Fixing ASCII logger to escape the unset-field place-holder if written

out literally.
This commit is contained in:
Robin Sommer 2011-11-29 16:55:31 -08:00
parent 5fae0482a9
commit ebd15cf12e
5 changed files with 60 additions and 4 deletions

View file

@ -1,4 +1,9 @@
2.0-beta-69 | 2011-11-29 16:55:31 -0800
* Fixing ASCII logger to escape the unset-field place holder if
written out literally. (Robin Sommer)
2.0-beta-68 | 2011-11-29 15:23:12 -0800
* Lots of documentation polishing. (Jon Siwek)

View file

@ -1 +1 @@
2.0-beta-68
2.0-beta-69

View file

@ -200,10 +200,33 @@ bool LogWriterAscii::DoWriteOne(ODesc* desc, LogVal* val, const LogField* field)
case TYPE_FUNC:
{
int size = val->val.string_val->size();
if ( size )
desc->AddN(val->val.string_val->data(), val->val.string_val->size());
else
const char* data = val->val.string_val->data();
if ( ! size )
{
desc->AddN(empty_field, empty_field_len);
break;
}
if ( size == unset_field_len && memcmp(data, unset_field, size) == 0 )
{
// The value we'd write out would match exactly the
// place-holder we use for unset optional fields. We
// escape the first character so that the output
// won't be ambigious.
static const char hex_chars[] = "0123456789abcdef";
char hex[6] = "\\x00";
hex[2] = hex_chars[((*data) & 0xf0) >> 4];
hex[3] = hex_chars[(*data) & 0x0f];
desc->AddRaw(hex, 4);
++data;
--size;
}
if ( size )
desc->AddN(data, size);
break;
}

View file

@ -0,0 +1,5 @@
#separator \x09
#path test
#fields x y z
#types string string string
\x2d - -

View file

@ -0,0 +1,23 @@
#
# @TEST-EXEC: bro -b %INPUT
# @TEST-EXEC: btest-diff test.log
module Test;
export {
redef enum Log::ID += { LOG };
type Log: record {
x: string &optional;
y: string &optional;
z: string &optional;
} &log;
}
event bro_init()
{
Log::create_stream(Test::LOG, [$columns=Log]);
Log::write(Test::LOG, [$x=LogAscii::unset_field, $z=""]);
}