Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-12 11:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Remove deprecated signature definition format

Browse source
This commit is contained in:
Tim Wojtulewicz 2024-08-05 11:21:28 -07:00
parent 2d68b1d834
commit 9142a48725
6 changed files with 5 additions and 34 deletions
Download patch file Download diff file Expand all files Collapse all files

14
src/rule-parse.y
View file

@ -199,21 +199,11 @@ rule_attr:
{
const char *msg = id_to_str($2);
if ( ! zeek::util::streq(msg, "<error>") )
zeek::reporter->Deprecation(zeek::util::fmt("Remove in v7.1: Using an identifier for msg is deprecated (%s:%d)",
current_rule_file, rules_line_number+1));
current_rule->AddAction(new zeek::detail::RuleActionEvent(msg));
zeek::reporter->Error("Identifier %s is not an event (%s:%d)", id_to_str($2),
current_rule_file, rules_line_number+1);
}
}
| TOK_EVENT TOK_IDENT TOK_IDENT
{
// Maybe remove in v7.1: Once we do not support msg as identifier,
// this extra messaging isn't all that useful anymore, but it
// beats a syntax error.
rules_error("custom event and identifier for msg unsupported");
zeek::detail::rule_matcher->SetParseError();
}
| TOK_EVENT TOK_IDENT TOK_STRING
{ current_rule->AddAction(new zeek::detail::RuleActionEvent($3, $2)); }

7
testing/btest/Baseline/signatures.custom-event-errors/.stderr
View file

@ -1,9 +1,8 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
warning in <...>/custom-event-errors.zeek, line 9: Wrong number of arguments for function. Expected 3, got 2. (event(state:signature_state, data:string))
warning in <...>/custom-event-errors.zeek, line 7: Wrong number of arguments for function. Expected 3, got 2. (event(state:signature_state, data:string))
error: wrong event parameters for 'wrong_signature2'
warning in <...>/custom-event-errors.zeek, line 11: Wrong number of arguments for function. Expected 2, got 3. (event(state:signature_state, msg:string, data:string))
warning in <...>/custom-event-errors.zeek, line 9: Wrong number of arguments for function. Expected 2, got 3. (event(state:signature_state, msg:string, data:string))
error: wrong event parameters for 'wrong_signature3'
warning in <...>/custom-event-errors.zeek, line 13: Type mismatch in function argument #1. Expected string, got count. (event(state:signature_state, msg:count, data:string))
warning in <...>/custom-event-errors.zeek, line 11: Type mismatch in function argument #1. Expected string, got count. (event(state:signature_state, msg:count, data:string))
error: wrong event parameters for 'wrong_signature4'
error: Error in signature (./id.sig:19): unknown script-level identifier (non_existing_event)
error: Error in signature (./id2.sig:4): custom event and identifier for msg unsupported

1
testing/btest/Baseline/signatures.custom-event/.stderr
View file

@ -1,2 +1 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
warning: Remove in v7.1: Using an identifier for msg is deprecated (./id.sig:9)

1
testing/btest/Baseline/signatures.custom-event/out
View file

@ -1,4 +1,3 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
signature_match2 [orig_h=127.0.0.1, orig_p=30000/udp, resp_h=127.0.0.1, resp_p=13000/udp]
signature_match [orig_h=127.0.0.1, orig_p=30000/udp, resp_h=127.0.0.1, resp_p=13000/udp] - message from identifier (cannot be changed)
signature_match3 [orig_h=127.0.0.1, orig_p=30000/udp, resp_h=127.0.0.1, resp_p=13000/udp] - message

9
testing/btest/signatures/custom-event-errors.zeek
View file

@ -1,7 +1,6 @@
# @TEST-DOC: Using the wrong paramters for custom signature events.
#
# @TEST-EXEC-FAIL: zeek -b -s id -r $TRACES/chksums/ip4-udp-good-chksum.pcap %INPUT >id.out
# @TEST-EXEC-FAIL: zeek -b -s id2 -r $TRACES/chksums/ip4-udp-good-chksum.pcap %INPUT >id.out
# @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-remove-abspath btest-diff .stderr
@TEST-START-FILE id.sig
@ -26,14 +25,6 @@ signature udp-proto4 {
}
@TEST-END-FILE
@TEST-START-FILE id2.sig
# Using two identifiers is not supported.
signature udp-proto-msg-id {
ip-proto == 17
event signature_match message_as_id
}
@TEST-END-FILE
event wrong_signature2(state: signature_state, data: string) { }
event wrong_signature3(state: signature_state, msg: string, data: string) { }

7
testing/btest/signatures/custom-event.zeek
View file

@ -10,11 +10,6 @@ signature udp-proto {
event my_signature_match3 "message"
}
signature udp-proto-msg-id2 {
ip-proto == 17
event message_as_id
}
signature udp-stuff {
dst-ip == mynets
event my_signature_match2
@ -22,8 +17,6 @@ signature udp-stuff {
@TEST-END-FILE
const message_as_id = "message from identifier (cannot be changed)";
const mynets: set[subnet] = {
192.168.1.0/24,
10.0.0.0/8,