Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Merge remote-tracking branch 'origin/topic/robin/spicy-export-extensions'

Browse source 
* origin/topic/robin/spicy-export-extensions:
  [Spicy] Clean up representation of EVT record fields.
  [Spicy] Extend functionality of `export` in EVT files.
  [Spicy] Refactor parsing of `export` in EVT files.
This commit is contained in:
Robin Sommer 2023-08-22 14:59:28 +02:00
commit e8292be0ce
No known key found for this signature in database
GPG key ID: 6BEDA4DA6B8B23E3
15 changed files with 386 additions and 38 deletions
Download patch file Download diff file Expand all files Collapse all files

3
testing/btest/Baseline/spicy.export-type-ambigious-fail/output Normal file
View file

@ -0,0 +1,3 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
[error] <...>/foo.evt:3: export of 'Test::A' already defined
[error] error loading EVT file "<...>/foo.evt"

2
testing/btest/Baseline/spicy.export-type-fail/output
View file

@ -1,6 +1,6 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
[error] unknown type 'Test::DOES_NOT_EXIST' exported
[error] unknown type 'NOT_SCOPED' exported
[error] unknown type 'Test::DOES_NOT_EXIST' exported
[error] <...>/foo.spicy:1:13-5:3: cannot export Spicy type 'Test::X': type is self-recursive
[error] <...>/foo.spicy:9:3-13:3: cannot export Spicy type 'Test::Z': can only convert tuple types with all-named fields to Zeek
[error] <Spicy Plugin for Zeek>: aborting after errors

4
testing/btest/Baseline/spicy.export-type-with-fields-fail/output Normal file
View file

@ -0,0 +1,4 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
[error] <...>/foo.spicy:1:13-5:3: type 'Test::A' does not have field 'does_not_exist'
[error] <...>/foo.spicy:1:13-5:3: type 'Test::A' does not have field 'does_not_exist'
[error] <Spicy Plugin for Zeek>: aborting after errors

16
testing/btest/Baseline/spicy.export-type-with-fields/output Normal file
View file

@ -0,0 +1,16 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
=== X
name=x log=F
=== X1
name=x log=F
name=z log=F
name=y log=F
=== X2
name=x log=T
name=z log=T
name=y log=T
=== X3
name=x log=F
name=z log=T
=== X4
name=z log=F

25
testing/btest/spicy/export-type-ambigious-fail.spicy Normal file
View file

@ -0,0 +1,25 @@
# @TEST-REQUIRES: have-spicy
#
# @TEST-DOC: Fail attempt to export a type multiple times
#
# @TEST-EXEC-FAIL: spicyz -d foo.spicy foo.evt -o foo.hlto >output 2>&1
# @TEST-EXEC: TEST_DIFF_CANONIFIER=diff-canonifier-spicy btest-diff output
# @TEST-START-FILE foo.spicy
module Test;
type A = unit {
x: uint8;
};
# @TEST-END-FILE
# @TEST-START-FILE foo.evt
export Test::A with { x };
export Test::A without { x };
# @TEST-END-FILE
# @TEST-START-FILE foo.zeek
# @TEST-END-FILE

25
testing/btest/spicy/export-type-with-fields-fail.spicy Normal file
View file

@ -0,0 +1,25 @@
# @TEST-REQUIRES: have-spicy
#
# @TEST-DOC: Failure cases for `export` with field specifcations.
#
# @TEST-EXEC-FAIL: spicyz -d foo.spicy foo.evt -o foo.hlto >output 2>&1
# @TEST-EXEC: TEST_DIFF_CANONIFIER=diff-canonifier-spicy btest-diff output
# @TEST-START-FILE foo.spicy
module Test;
type A = unit {
x: uint8;
};
# @TEST-END-FILE
# @TEST-START-FILE foo.evt
export Test::A as Test::A1 with { does_not_exist };
export Test::A as Test::A2 without { does_not_exist };
# @TEST-END-FILE
# @TEST-START-FILE foo.zeek
# @TEST-END-FILE

48
testing/btest/spicy/export-type-with-fields.zeek Normal file
View file

@ -0,0 +1,48 @@
# @TEST-REQUIRES: have-spicy
#
# @TEST-EXEC: spicyz -do export.hlto export.spicy export.evt
# @TEST-EXEC: zeek export.hlto %INPUT >>output
# @TEST-EXEC: btest-diff output
#
# @TEST-DOC: Test type export with specified fields.
# @TEST-START-FILE export.spicy
module foo;
public type X = unit {
x: uint8;
y: uint8;
z: uint8;
};
# @TEST-END-FILE
# @TEST-START-FILE export.evt
import foo;
protocol analyzer FOO over TCP:
parse with foo::X,
port 80/tcp;
export foo::X with { x };
export foo::X as foo::X1;
export foo::X as foo::X2 &log;
export foo::X as foo::X3 with { x, z &log };
export foo::X as foo::X4 without { x, y };
# @TEST-END-FILE
function printFields(name: string, t: any) {
print fmt("=== %s", name);
local fields = record_fields(t);
for ( f in fields )
print fmt("name=%s log=%s", f, fields[f]$log);
}
event zeek_init() {
printFields("X ", foo::X);
printFields("X1", foo::X1);
printFields("X2", foo::X2);
printFields("X3", foo::X3);
printFields("X4", foo::X4);
}