Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-16 21:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

rule-parse: Remove [event_name] syntax, deprecate msg as identifier

Browse source 
As suggested by Robin. Thanks.
This commit is contained in:
Arne Welzel 2023-12-13 20:50:56 +01:00
parent 0b5126f650
commit f3470843d6
12 changed files with 68 additions and 39 deletions
Download patch file Download diff file Expand all files Collapse all files

36
src/rule-parse.y
View file

@ -191,13 +191,33 @@ rule_attr:
(zeek::detail::RuleHdrTest::Comp) $2, $3));
}
| TOK_EVENT '[' TOK_IDENT ']'
{ current_rule->AddAction(new zeek::detail::RuleActionEvent(nullptr, $3)); }
| TOK_EVENT TOK_IDENT
{
if ( is_event($2) )
current_rule->AddAction(new zeek::detail::RuleActionEvent(nullptr, $2));
else
{
const char *msg = id_to_str($2);
if ( ! zeek::util::streq(msg, "<error>") )
zeek::reporter->Deprecation(zeek::util::fmt("Remove in v7.1: Using an identifier for msg is deprecated (%s:%d)",
current_rule_file, rules_line_number+1));
current_rule->AddAction(new zeek::detail::RuleActionEvent(msg));
}
}
| TOK_EVENT '[' TOK_IDENT ']' string
{ current_rule->AddAction(new zeek::detail::RuleActionEvent($5, $3)); }
| TOK_EVENT TOK_IDENT TOK_IDENT
{
// Maybe remove in v7.1: Once we do not support msg as identifier,
// this extra messaging isn't all that useful anymore, but it
// beats a syntax error.
rules_error("custom event and identifier for msg unsupported");
zeek::detail::rule_matcher->SetParseError();
}
| TOK_EVENT string
| TOK_EVENT TOK_IDENT TOK_STRING
{ current_rule->AddAction(new zeek::detail::RuleActionEvent($3, $2)); }
| TOK_EVENT TOK_STRING
{ current_rule->AddAction(new zeek::detail::RuleActionEvent($2)); }
| TOK_MIME string opt_strength
@ -444,14 +464,14 @@ pattern:
void rules_error(const char* msg)
{
zeek::reporter->Error("Error in signature (%s:%d): %s\n",
zeek::reporter->Error("Error in signature (%s:%d): %s",
current_rule_file, rules_line_number+1, msg);
zeek::detail::rule_matcher->SetParseError();
}
void rules_error(const char* msg, const char* addl)
{
zeek::reporter->Error("Error in signature (%s:%d): %s (%s)\n",
zeek::reporter->Error("Error in signature (%s:%d): %s (%s)",
current_rule_file, rules_line_number+1, msg, addl);
zeek::detail::rule_matcher->SetParseError();
}
@ -459,7 +479,7 @@ void rules_error(const char* msg, const char* addl)
void rules_error(zeek::detail::Rule* r, const char* msg)
{
const zeek::detail::Location& l = r->GetLocation();
zeek::reporter->Error("Error in signature %s (%s:%d): %s\n",
zeek::reporter->Error("Error in signature %s (%s:%d): %s",
r->ID(), l.filename, l.first_line, msg);
zeek::detail::rule_matcher->SetParseError();
}