From e0af4f6e8d6ea5b02e650088daef88ecbd5eefea Mon Sep 17 00:00:00 2001
From: Seth Hall <seth@icir.org>
Date: Mon, 12 Sep 2011 15:08:25 -0400
Subject: [PATCH] Small, mostly cosmetic updates and fixing a test.

- The test needed to append the second notice the event queue so that
  the notice would be suppressed correctly.

- Setting $suppress_for manually in apply_policy since it doesn't pick
  up the &default when directly creating the record inside the NOTICE call.
---
 scripts/base/frameworks/notice/main.bro           | 15 +++++++++------
 .../notice.log                                    |  5 +++++
 .../base/frameworks/notice/suppression.bro        | 13 +++++++++++--
 3 files changed, 25 insertions(+), 8 deletions(-)
 create mode 100644 testing/btest/Baseline/scripts.base.frameworks.notice.suppression/notice.log

diff --git a/scripts/base/frameworks/notice/main.bro b/scripts/base/frameworks/notice/main.bro
index 6117755aaa..55dd47931b 100644
--- a/scripts/base/frameworks/notice/main.bro
+++ b/scripts/base/frameworks/notice/main.bro
@@ -358,12 +358,12 @@ event notice(n: Notice::Info) &priority=-5
 		Log::write(Notice::LOG, n);
 	if ( ACTION_ALARM in n$actions )
 		Log::write(Notice::ALARM_LOG, n);
-	# Normally suppress further notices like this one unless directed not to
-	# .
-	# n$identifier *must* be specified for suppression to function at all.
-	if ( n?$identifier && ACTION_NO_SUPPRESS !in n$actions &&
-		 [n$note, n$identifier] !in suppressing &&
-		 n$suppress_for != 0secs )
+	# Normally suppress further notices like this one unless directed not to.
+	#  n$identifier *must* be specified for suppression to function at all.
+	if ( n?$identifier && 
+	     ACTION_NO_SUPPRESS !in n$actions &&
+	     [n$note, n$identifier] !in suppressing &&
+	     n$suppress_for != 0secs )
 		{
 		suppressing[n$note, n$identifier] = n;
 		event Notice::begin_suppression(n);
@@ -446,6 +446,9 @@ function apply_policy(n: Notice::Info)
 	if ( ! n?$policy_items )
 		n$policy_items = set();
 	
+	if ( ! n?$suppress_for )
+		n$suppress_for = default_suppression_interval;
+	
 	for ( i in ordered_policy )
 		{
 		if ( ordered_policy[i]$pred(n) )
diff --git a/testing/btest/Baseline/scripts.base.frameworks.notice.suppression/notice.log b/testing/btest/Baseline/scripts.base.frameworks.notice.suppression/notice.log
new file mode 100644
index 0000000000..9fa064657d
--- /dev/null
+++ b/testing/btest/Baseline/scripts.base.frameworks.notice.suppression/notice.log
@@ -0,0 +1,5 @@
+#separator \x09
+#path	notice
+#fields	ts	uid	id.orig_h	id.orig_p	id.resp_h	id.resp_p	note	msg	sub	src	dst	p	n	peer_descr	actions	policy_items	suppress_for	dropped	remote_location.country_code	remote_location.region	remote_location.city	remote_location.latitude	remote_location.longitude
+#types	time	string	addr	port	addr	port	enum	string	string	addr	addr	port	count	string	table	table	interval	bool	string	string	string	double	double
+1315853847.758176	-	-	-	-	-	Test_Notice	test	-	-	-	-	-	bro	Notice::ACTION_LOG	5	3600.000000	-	-	-	-	-	-
diff --git a/testing/btest/scripts/base/frameworks/notice/suppression.bro b/testing/btest/scripts/base/frameworks/notice/suppression.bro
index 6894dd718c..773ca00ece 100644
--- a/testing/btest/scripts/base/frameworks/notice/suppression.bro
+++ b/testing/btest/scripts/base/frameworks/notice/suppression.bro
@@ -7,8 +7,17 @@ redef enum Notice::Type += {
 	Test_Notice,
 };
 
+# The second notice needs to be scheduled due to how the notice framework 
+# uses the event queue.
+
+event second_notice()
+	{
+	NOTICE([$note=Test_Notice, $msg="another test", $identifier="static"]);
+	}
+
 event bro_init()
 	{
 	NOTICE([$note=Test_Notice, $msg="test", $identifier="static"]);
-	NOTICE([$note=Test_Notice, $msg="another test", $identifier="static"]);
-	}
\ No newline at end of file
+	schedule 1msec { second_notice() };
+	}
+