Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-15 13:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge remote-tracking branch 'origin/topic/jsiwek/gh-1076-fix-random'

Browse source 
* origin/topic/jsiwek/gh-1076-fix-random:
  Deprecate bro_srandom(), replace with zeek::seed_random().
  Add zeek::max_random() & fix misuse of RAND_MAX w/ zeek::random_number()
  Deprecate bro_random(), replace with zeek::random_number()
  Deprecate bro_prng(), replace with zeek::prng()
  GH-1076: Fix bro_srandom() to replace 0 seeds with 1
  GH-1076: Fix bro_prng() implementation
  GH-1076: Fix use of getrandom()
This commit is contained in:
Tim Wojtulewicz 2020-07-23 13:02:13 -07:00
commit ebc073ba92
15 changed files with 241 additions and 52 deletions
Download patch file Download diff file Expand all files Collapse all files

1
testing/btest/Baseline/bifs.rand/out.3 Normal file
View file

@ -0,0 +1 @@
F

6
testing/btest/Baseline/bifs.rand/out.4 Normal file
View file

@ -0,0 +1,6 @@
0
131
755
4
634
473

7
testing/btest/Baseline/scripts.base.frameworks.netcontrol.packetfilter/conn.log
View file

@ -3,13 +3,12 @@
#empty_field (empty)
#unset_field -
#path conn
#open 2019-07-31-22-25-32
#open 2020-07-22-05-02-04
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents
#types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string]
1254722767.492060 CHhAvVGS1DHFjwGM9 10.10.1.4 56166 10.10.1.1 53 udp dns 0.034025 34 100 SF - - 0 Dd 1 62 1 128 -
1254722776.690444 C4J4Th3PJpwUYZZ6gc 10.10.1.20 138 10.10.1.255 138 udp - - - - S0 - - 0 D 1 229 0 0 -
1254722767.529046 ClEkJM2Vm5giqnMf4h 10.10.1.4 1470 74.53.140.153 25 tcp - 0.346950 0 0 S1 - - 0 Sh 1 48 1 48 -
1437831776.764391 CtPZjS20MLrsMUOJi2 192.168.133.100 49285 66.196.121.26 5050 tcp - 0.343008 41 0 OTH - - 0 Da 1 93 1 52 -
1437831798.533765 CmES5u32sYpV7JYN 192.168.133.100 49336 74.125.71.189 443 tcp - - - - OTH - - 0 A 1 52 0 0 -
1437831787.856895 CUM0KZ3MLUfNB0cl11 192.168.133.100 49648 192.168.133.102 25 tcp - 0.048043 162 154 S1 - - 154 ShDgA 3 192 1 60 -
#close 2019-07-31-22-25-32
1437831787.856895 CUM0KZ3MLUfNB0cl11 192.168.133.100 49648 192.168.133.102 25 tcp - 0.004707 0 0 S1 - - 0 Sh 1 64 1 60 -
#close 2020-07-22-05-02-04

58
testing/btest/bifs/rand.zeek
View file

@ -1,13 +1,22 @@
#
# @TEST-EXEC: zeek -b %INPUT >out
# @TEST-EXEC: zeek -b %INPUT do_seed=F >out.2
# @TEST-EXEC: unset ZEEK_SEED_FILE && zeek -b %INPUT real_random=T >out.3
# @TEST-EXEC: for i in $(seq 21); do echo 0 >>random-zero.seed; done
# @TEST-EXEC: ZEEK_SEED_FILE=random-zero.seed zeek -b %INPUT >out.4
# @TEST-EXEC: btest-diff out
# @TEST-EXEC: btest-diff out.2
# @TEST-EXEC: btest-diff out.3
# @TEST-EXEC: btest-diff out.4
const do_seed = T &redef;
const real_random = F &redef;
event zeek_init()
{
if ( real_random )
return;
local a = rand(1000);
local b = rand(1000);
local c = rand(1000);
@ -26,4 +35,53 @@ event zeek_init()
print d;
print e;
print f;
local i = 0;
local max = 3;
while ( i < 100 )
{
local rn = rand(max);
if ( rn >= max )
print fmt("ERROR: rand returned value greater than %s: %s",
max, rn);
i += 1;
}
}
event zeek_init() &priority=-10
{
if ( ! real_random )
return;
local v1: vector of count = vector();
local v2: vector of count = vector();
local i = 0;
while ( i < 20 )
{
v1 += rand(65535);
i += 1;
}
i = 0;
while ( i < 20 )
{
v2 += rand(65535);
i += 1;
}
# Note: this is expected to be F with high probability, but
# technically could all be the same because, well, that's a
# valid "random" sequence, too
print all_set(v1 == v2);
if ( all_set(v1 == v2) )
{
print v1;
print v2;
}
}

4
testing/btest/plugins/reader-plugin/src/Foo.cc
View file

@ -45,10 +45,10 @@ std::string Foo::RandomString(const int len)
"abcdefghijklmnopqrstuvwxyz";
for (int i = 0; i < len; ++i)
// bro_random is not thread-safe; as we are only using one simultaneous thread
// zeek::random_number() is not thread-safe; as we are only using one simultaneous thread
// here, this should not matter in this case. If this test ever starts showing
// random errors, this might be the culprit.
s[i] = values[bro_random() / (RAND_MAX / sizeof(values))];
s[i] = values[zeek::random_number() / (zeek::max_random() / sizeof(values))];
return s;
}