Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-17 05:58:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Merge remote-tracking branch 'origin/topic/christian/fix-extfunc-includes'

Browse source 
* origin/topic/christian/fix-extfunc-includes:
  Fix type clash fatal error with log filters that use $ext_func and $include/$exclude
This commit is contained in:
Robin Sommer 2020-11-12 10:33:48 +00:00
commit 78fc5615a5
4 changed files with 123 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

31
testing/btest/scripts/base/frameworks/logging/field-extension-include-exclude.zeek Normal file
View file

@ -0,0 +1,31 @@
# This tests the intersection of log filters with a custom extension
# function that also use $include/$exclude: the extension function
# overrides those restrictions.
#
# @TEST-EXEC: zeek -b -r $TRACES/wikipedia.trace %INPUT
# @TEST-EXEC: btest-diff conn-inc.log
# @TEST-EXEC: btest-diff conn-exc.log
@load base/protocols/conn
type Extension: record {
write_ts: time &log;
stream: string &log;
system_name: string &log;
};
function add_extension(path: string): Extension
{
return Extension($write_ts = network_time(),
$stream = path,
$system_name = peer_description);
}
redef Log::default_ext_func = add_extension;
event zeek_init()
{
Log::remove_default_filter(Conn::LOG);
Log::add_filter(Conn::LOG, [$name="default-inc", $path="conn-inc", $include=set("ts", "uid", "id.orig_h", "id.resp_h")]);
Log::add_filter(Conn::LOG, [$name="default-exc", $path="conn-exc", $exclude=set("_write_ts")]);
}