Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Small, mostly cosmetic updates and fixing a test.

Browse source 
- The test needed to append the second notice the event queue so that
  the notice would be suppressed correctly.

- Setting $suppress_for manually in apply_policy since it doesn't pick
  up the &default when directly creating the record inside the NOTICE call.
This commit is contained in:
Seth Hall 2011-09-12 15:08:25 -04:00
parent a267c30fcd
commit e0af4f6e8d
3 changed files with 25 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

9
scripts/base/frameworks/notice/main.bro
View file

@ -358,10 +358,10 @@ event notice(n: Notice::Info) &priority=-5
Log::write(Notice::LOG, n); Log::write(Notice::LOG, n);
if ( ACTION_ALARM in n$actions ) if ( ACTION_ALARM in n$actions )
Log::write(Notice::ALARM_LOG, n); Log::write(Notice::ALARM_LOG, n);
# Normally suppress further notices like this one unless directed not to # Normally suppress further notices like this one unless directed not to.
# .
# n$identifier *must* be specified for suppression to function at all. # n$identifier *must* be specified for suppression to function at all.
if ( n?$identifier && ACTION_NO_SUPPRESS !in n$actions && if ( n?$identifier &&
ACTION_NO_SUPPRESS !in n$actions &&
[n$note, n$identifier] !in suppressing && [n$note, n$identifier] !in suppressing &&
n$suppress_for != 0secs ) n$suppress_for != 0secs )
{ {
@ -446,6 +446,9 @@ function apply_policy(n: Notice::Info)
if ( ! n?$policy_items ) if ( ! n?$policy_items )
n$policy_items = set(); n$policy_items = set();
if ( ! n?$suppress_for )
n$suppress_for = default_suppression_interval;
for ( i in ordered_policy ) for ( i in ordered_policy )
{ {
if ( ordered_policy[i]$pred(n) ) if ( ordered_policy[i]$pred(n) )

5
testing/btest/Baseline/scripts.base.frameworks.notice.suppression/notice.log Normal file
View file

@ -0,0 +1,5 @@
#separator \x09
#path notice
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p note msg sub src dst p n peer_descr actions policy_items suppress_for dropped remote_location.country_code remote_location.region remote_location.city remote_location.latitude remote_location.longitude
#types time string addr port addr port enum string string addr addr port count string table table interval bool string string string double double
1315853847.758176 - - - - - Test_Notice test - - - - - bro Notice::ACTION_LOG 5 3600.000000 - - - - - -

11
testing/btest/scripts/base/frameworks/notice/suppression.bro
View file

@ -7,8 +7,17 @@ redef enum Notice::Type += {
Test_Notice, Test_Notice,
}; };
# The second notice needs to be scheduled due to how the notice framework
# uses the event queue.
event second_notice()
{
NOTICE([$note=Test_Notice, $msg="another test", $identifier="static"]);
}
event bro_init() event bro_init()
{ {
NOTICE([$note=Test_Notice, $msg="test", $identifier="static"]); NOTICE([$note=Test_Notice, $msg="test", $identifier="static"]);
NOTICE([$note=Test_Notice, $msg="another test", $identifier="static"]); schedule 1msec { second_notice() };
} }