Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-13 03:58:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Skip input framework entries with missing but non-optional fields

Browse source 
The framework so far populated data structures with missing fields
even when those fields are defined without the &optional
attribute. When using the attribute, such entries continue to get
populated.

Update tests to reflect focus on unset fields.
This commit is contained in:
Christian Kreibich 2021-06-16 16:55:28 -07:00
parent ef08605877
commit 937bdccab5
9 changed files with 122 additions and 59 deletions
Download patch file Download diff file Expand all files Collapse all files

13
testing/btest/scripts/base/frameworks/input/empty-values-hashing.zeek
View file

@ -11,15 +11,18 @@
#separator \x09
#fields i s ss
#types int sting string
1 - TEST
2 - -
1 - -
2 - TEST
3 TEST -
4 TEST TEST
@TEST-END-FILE
@TEST-START-FILE input2.log
#separator \x09
#fields i s ss
#types int sting string
1 TEST -
2 TEST TEST
1 TEST2 -
4 TEST2 TEST2
5 - TEST2
@TEST-END-FILE
redef exit_only_after_terminate = T;
@ -32,7 +35,7 @@ type Idx: record {
type Val: record {
s: string;
ss: string;
ss: string &optional;
};
type servers_type: table[int] of Val;

58
testing/btest/scripts/base/frameworks/input/emptyvals.zeek
View file

@ -1,14 +1,31 @@
# This test verifies the handling of unset fields in input files.
# For table indexes, columns wwith undefined fields cannot work
# and are skipped. For values, unset fields are safe for the user
# only when those fields are defined &optional, otherwise they
# too are skipped.
# @TEST-EXEC: btest-bg-run zeek zeek -b %INPUT
# @TEST-EXEC: btest-bg-wait 10
# @TEST-EXEC: btest-diff out
@TEST-START-FILE input.log
@TEST-START-FILE input1.log
#separator \x09
#path ssh
#fields b i
##types bool int
T 1
- 2
F -
@TEST-END-FILE
@TEST-START-FILE input2.log
#separator \x09
#path ssh
#fields b i j
##types bool int int
T 1 1
- 2 2
F - 3
@TEST-END-FILE
redef exit_only_after_terminate = T;
@ -19,27 +36,52 @@ redef InputAscii::empty_field = "EMPTY";
module A;
type Idx: record {
# We use two different index records just because the internal code
# paths differ slightly for these. And one used to crash. :)
type Idx1: record {
i: int;
};
type Val: record {
type Idx2: record {
i: int;
j: int;
};
type ValReq: record {
b: bool;
};
global servers: table[int] of Val = table();
type ValOpt: record {
b: bool &optional;
};
global servers1: table[int] of ValReq = table();
global servers2: table[int, int] of ValOpt = table();
# Counter to track when we're ready to report both table's contents in
# pre-defined order.
global reads_done = 0;
event zeek_init()
{
outfile = open("../out");
outfile = open("../out");
# first read in the old stuff into the table...
Input::add_table([$source="../input.log", $name="ssh", $idx=Idx, $val=Val, $destination=servers]);
Input::add_table([$source="../input1.log", $name="ssh1", $idx=Idx1, $val=ValReq, $destination=servers1]);
Input::add_table([$source="../input2.log", $name="ssh2", $idx=Idx2, $val=ValOpt, $destination=servers2]);
}
event Input::end_of_data(name: string, source:string)
{
print outfile, servers;
Input::remove("ssh");
reads_done += 1;
if ( reads_done < 2 )
return;
print outfile, servers1;
print outfile, servers2;
Input::remove("ssh1");
Input::remove("ssh2");
close(outfile);
terminate();
}