diff --git a/CHANGES b/CHANGES index 4040418b94..a9ab2b497b 100644 --- a/CHANGES +++ b/CHANGES @@ -1,3 +1,15 @@ +8.0.0-dev.136 | 2025-05-19 20:01:30 +0200 + + * btest/core: Add event-trace test (Arne Welzel, Corelight) + + * zeek-setup: Free event_trace_mgr after generating trace (Arne Welzel, Corelight) + + * EventTraceMgr: Rename etm to event_trace_mgr (Arne Welzel, Corelight) + + * EventTraceMgr: Move fclose() to destructor (Arne Welzel, Corelight) + + * Update cmake submodule (Tim Wojtulewicz, Corelight) + 8.0.0-dev.130 | 2025-05-19 10:25:34 -0700 * Remove unnecessary #includes across the repo (Tim Wojtulewicz, Corelight) diff --git a/VERSION b/VERSION index 17dbb24a27..42d5b5679d 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -8.0.0-dev.130 +8.0.0-dev.136 diff --git a/src/EventTrace.cc b/src/EventTrace.cc index 09eda0cb5e..6bdd083654 100644 --- a/src/EventTrace.cc +++ b/src/EventTrace.cc @@ -13,7 +13,7 @@ namespace zeek::detail { -std::unique_ptr etm; +std::unique_ptr event_trace_mgr; // Helper function for generating a correct script-level representation // of a string constant. @@ -955,7 +955,17 @@ bool ValTraceMgr::IsUnsupported(const Val* v) const { EventTraceMgr::EventTraceMgr(const std::string& trace_file) { f = fopen(trace_file.c_str(), "w"); if ( ! f ) - reporter->FatalError("can't open event trace file %s", trace_file.c_str()); + reporter->FatalError("can't open event trace file %s: %s", trace_file.c_str(), strerror(errno)); +} + +EventTraceMgr::~EventTraceMgr() { + if ( f ) { + if ( fclose(f) ) + // Not fatal, won't do anything with it anymore anyhow. + reporter->Error("failed to close event trace file: %s", strerror(errno)); + + f = nullptr; + } } void EventTraceMgr::Generate() { @@ -999,8 +1009,6 @@ void EventTraceMgr::Generate() { for ( auto& c : c_t ) fprintf(f, "#\t%s\n", c.c_str()); } - - fclose(f); } void EventTraceMgr::StartEvent(const ScriptFunc* ev, const zeek::Args* args) { diff --git a/src/EventTrace.h b/src/EventTrace.h index 710f2680b7..2c86efb7b2 100644 --- a/src/EventTrace.h +++ b/src/EventTrace.h @@ -441,6 +441,8 @@ class EventTraceMgr { public: EventTraceMgr(const std::string& trace_file); + ~EventTraceMgr(); + // Generates the trace upon exit. void Generate(); @@ -465,6 +467,6 @@ private: }; // If non-nil then we're doing event tracing. -extern std::unique_ptr etm; +extern std::unique_ptr event_trace_mgr; } // namespace zeek::detail diff --git a/src/Expr.cc b/src/Expr.cc index 2199339bff..53405ba198 100644 --- a/src/Expr.cc +++ b/src/Expr.cc @@ -3865,8 +3865,8 @@ ValPtr ScheduleExpr::Eval(Frame* f) const { if ( args ) { auto handler = event->Handler(); - if ( etm ) - etm->ScriptEventQueued(handler); + if ( event_trace_mgr ) + event_trace_mgr->ScriptEventQueued(handler); timer_mgr->Add(new ScheduleTimer(handler, std::move(*args), dt)); } @@ -4471,8 +4471,8 @@ ValPtr EventExpr::Eval(Frame* f) const { auto v = eval_list(f, args.get()); if ( handler ) { - if ( etm ) - etm->ScriptEventQueued(handler); + if ( event_trace_mgr ) + event_trace_mgr->ScriptEventQueued(handler); event_mgr.Enqueue(handler, std::move(*v)); } diff --git a/src/Func.cc b/src/Func.cc index eabe9da805..b484d1ca55 100644 --- a/src/Func.cc +++ b/src/Func.cc @@ -355,8 +355,8 @@ ValPtr ScriptFunc::Invoke(zeek::Args* args, Frame* parent) const { return nullptr; } - if ( etm && Flavor() == FUNC_FLAVOR_EVENT ) - etm->StartEvent(this, args); + if ( event_trace_mgr && Flavor() == FUNC_FLAVOR_EVENT ) + event_trace_mgr->StartEvent(this, args); if ( g_trace_state.DoTrace() ) { ODesc d; @@ -433,8 +433,8 @@ ValPtr ScriptFunc::Invoke(zeek::Args* args, Frame* parent) const { result = val_mgr->True(); } - else if ( etm && Flavor() == FUNC_FLAVOR_EVENT ) - etm->EndEvent(this, args); + else if ( event_trace_mgr && Flavor() == FUNC_FLAVOR_EVENT ) + event_trace_mgr->EndEvent(this, args); // Warn if the function returns something, but we returned from // the function without an explicit return, or without a value. diff --git a/src/Stmt.cc b/src/Stmt.cc index 1a1a9103bd..9d93992b97 100644 --- a/src/Stmt.cc +++ b/src/Stmt.cc @@ -902,8 +902,8 @@ ValPtr EventStmt::Exec(Frame* f, StmtFlowType& flow) { auto h = event_expr->Handler(); if ( args && h ) { - if ( etm ) - etm->ScriptEventQueued(h); + if ( event_trace_mgr ) + event_trace_mgr->ScriptEventQueued(h); event_mgr.Enqueue(h, std::move(*args)); } diff --git a/src/zeek-setup.cc b/src/zeek-setup.cc index f00d0478e3..45582170c8 100644 --- a/src/zeek-setup.cc +++ b/src/zeek-setup.cc @@ -401,8 +401,10 @@ static void terminate_zeek() { script_coverage_mgr.WriteStats(); - if ( etm ) - etm->Generate(); + if ( event_trace_mgr ) { + event_trace_mgr->Generate(); + event_trace_mgr.reset(); + } delete zeekygen_mgr; delete packet_mgr; @@ -775,7 +777,7 @@ SetupResult setup(int argc, char** argv, Options* zopts) { auto ipbb = make_intrusive(init_bifs, ipbid->Name(), false); if ( options.event_trace_file ) - etm = std::make_unique(*options.event_trace_file); + event_trace_mgr = std::make_unique(*options.event_trace_file); // Parsing involves reading input files, including any input // interactively provided by the user at the console. Temporarily diff --git a/testing/btest/Baseline/core.event-trace/.stderr b/testing/btest/Baseline/core.event-trace/.stderr new file mode 100644 index 0000000000..49d861c74c --- /dev/null +++ b/testing/btest/Baseline/core.event-trace/.stderr @@ -0,0 +1 @@ +### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. diff --git a/testing/btest/core/event-trace.zeek b/testing/btest/core/event-trace.zeek new file mode 100644 index 0000000000..eeeeef61b7 --- /dev/null +++ b/testing/btest/core/event-trace.zeek @@ -0,0 +1,21 @@ +# @TEST-DOC: Verify the --event-trace feature works and produces the same logs as when reading from a pcap. +# +# Trace files produced with ZAM don't work - issue #4478 +# +# @TEST-REQUIRES: test "${ZEEK_ZAM}" != "1" +# +# @TEST-EXEC: zeek --event-trace trace.zeek -b -r $TRACES/http/get.trace %INPUT +# @TEST-EXEC: mkdir pcap-logs +# @TEST-EXEC: zeek-cut -m < http.log > pcap-logs/http.log +# @TEST-EXEC: rm -v *.log +# +# @TEST-EXEC: zeek -b --parse-only %INPUT trace.zeek +# @TEST-EXEC: zeek -b %INPUT trace.zeek +# @TEST-EXEC: mkdir trace-logs +# @TEST-EXEC: zeek-cut -m < http.log > trace-logs/http.log +# @TEST-EXEC: rm -v *.log +# +# @TEST-EXEC: diff pcap-logs/http.log trace-logs/http.log +# @TEST-EXEC: btest-diff .stderr + +@load base/protocols/http