Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

logging: Fix HookLogInit() and HookLogWrite() info usage

Browse source 
There's two instances of WriterBackend::WriterInfo for a given
writer. One in Manager::WriterInfo that's accessible via
stream.writers and a copy within WriterFrontend.

Commit 78999d147d switched to use the
address of the frontend's info instance for HookLogWrite() invocations,
breaking users using the address for identification purposes.
This commit is contained in:
Arne Welzel 2025-01-14 10:30:44 +01:00
parent 300b3788e2
commit 927a06b9ab
3 changed files with 32 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

21
src/logging/Manager.cc
View file

@ -1115,19 +1115,21 @@ bool Manager::WriteToFilters(const Manager::Stream* stream, zeek::RecordValPtr c
path = filter->path = filter->path_val->AsString()->CheckString();
}
WriterBackend::WriterInfo* info = nullptr;
WriterFrontend* writer = nullptr;
if ( w != stream->writers.end() ) {
// We know this writer already.
writer = w->second->writer;
auto* wi = w->second;
writer = wi->writer;
info = wi->info;
if ( ! w->second->hook_initialized ) {
auto wi = w->second;
if ( ! wi->hook_initialized ) {
wi->hook_initialized = true;
PLUGIN_HOOK_VOID(HOOK_LOG_INIT, HookLogInit(filter->writer->GetType()->AsEnumType()->Lookup(
filter->writer->InternalInt()),
wi->instantiating_filter, filter->local, filter->remote,
*wi->info, filter->num_fields, filter->fields));
*info, filter->num_fields, filter->fields));
}
}
@ -1141,9 +1143,12 @@ bool Manager::WriteToFilters(const Manager::Stream* stream, zeek::RecordValPtr c
// Find the newly inserted WriterInfo record.
w = stream->writers.find(wpp);
assert(w != stream->writers.end());
info = w->second->info;
}
assert(writer);
assert(info);
// Alright, can do the write now.
auto rec = RecordToLogRecord(stream, filter, columns.get());
@ -1156,10 +1161,10 @@ bool Manager::WriteToFilters(const Manager::Stream* stream, zeek::RecordValPtr c
for ( auto& v : rec )
vals.emplace_back(&v);
bool res = zeek::plugin_mgr->HookLogWrite(filter->writer->GetType()->AsEnumType()->Lookup(
filter->writer->InternalInt()),
filter->name, *writer->info, filter->num_fields, filter->fields,
&vals[0]);
bool res =
zeek::plugin_mgr->HookLogWrite(filter->writer->GetType()->AsEnumType()->Lookup(
filter->writer->InternalInt()),
filter->name, *info, filter->num_fields, filter->fields, &vals[0]);
if ( ! res ) {
DBG_LOG(DBG_LOGGING, "Hook prevented writing to filter '%s' on stream '%s'", filter->name.c_str(),
stream->name.c_str());

14
testing/btest/plugins/logging-hooks-plugin/src/Plugin.cc
View file

@ -49,6 +49,8 @@ void Plugin::HookLogInit(const std::string& writer, const std::string& instantia
fprintf(stderr, "%.6f %-15s %s %d/%d %s\n", zeek::run_state::network_time, "| HookLogInit", info.path, local,
remote, d.Description());
info_addr_init = &info;
}
bool Plugin::HookLogWrite(const std::string& writer, const std::string& filter,
@ -62,5 +64,17 @@ bool Plugin::HookLogWrite(const std::string& writer, const std::string& filter,
else if ( round == 3 )
vals[1]->present = false;
if ( ! info_addr_write )
info_addr_write = &info;
else if ( info_addr_write != &info )
fprintf(stderr, "FAIL: subsequent info addr %p differs from %p\n", &info, info_addr_write);
return true;
}
void Plugin::Done() {
if ( ! info_addr_init || ! info_addr_write || info_addr_init != info_addr_write ) {
fprintf(stderr, "FAIL: info_addr_init=%p info_addr_write=%p\n", info_addr_init, info_addr_write);
exit(1);
}
}

5
testing/btest/plugins/logging-hooks-plugin/src/Plugin.h
View file

@ -17,8 +17,13 @@ protected:
// Overridden from plugin::Plugin.
zeek::plugin::Configuration Configure() override;
// Overridden from plugin::Plugin.
void Done() override;
private:
int round;
const zeek::logging::WriterBackend::WriterInfo* info_addr_init = nullptr;
const zeek::logging::WriterBackend::WriterInfo* info_addr_write = nullptr;
};
extern Plugin plugin;