diff --git a/scripts/base/frameworks/packet-filter/main.zeek b/scripts/base/frameworks/packet-filter/main.zeek index 6b97960663..ccf7318469 100644 --- a/scripts/base/frameworks/packet-filter/main.zeek +++ b/scripts/base/frameworks/packet-filter/main.zeek @@ -281,10 +281,17 @@ function install(): bool NOTICE([$note=Compile_Failure, $msg=fmt("Compiling packet filter failed"), $sub=tmp_filter]); + + local error_string = fmt("Bad pcap filter '%s'", tmp_filter); + + local pkt_src_error : string = Pcap::error(); + if ( pkt_src_error != "no error" ) + error_string = pkt_src_error; + if ( network_time() == 0.0 ) - Reporter::fatal(fmt("Bad pcap filter '%s'", tmp_filter)); + Reporter::fatal(error_string); else - Reporter::warning(fmt("Bad pcap filter '%s'", tmp_filter)); + Reporter::warning(error_string); } local diff = current_time()-ts; if ( diff > max_filter_compile_time ) diff --git a/testing/btest/Baseline.cpp/core.pcap.filter-error/output b/testing/btest/Baseline.cpp/core.pcap.filter-error/output deleted file mode 100644 index 42ccac41ce..0000000000 --- a/testing/btest/Baseline.cpp/core.pcap.filter-error/output +++ /dev/null @@ -1,4 +0,0 @@ -### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. -fatal error: Bad pcap filter 'kaputt' ----- -error, cannot compile BPF filter "kaputt, too" diff --git a/testing/btest/Baseline/core.pcap.filter-error/output b/testing/btest/Baseline/core.pcap.filter-error/output deleted file mode 100644 index c956191ac6..0000000000 --- a/testing/btest/Baseline/core.pcap.filter-error/output +++ /dev/null @@ -1,4 +0,0 @@ -### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. -fatal error in <...>/main.zeek, line 285: Bad pcap filter 'kaputt' ----- -error, cannot compile BPF filter "kaputt, too" diff --git a/testing/btest/core/pcap/filter-error.zeek b/testing/btest/core/pcap/filter-error.zeek index 81f4c24cf9..ae9a40d70f 100644 --- a/testing/btest/core/pcap/filter-error.zeek +++ b/testing/btest/core/pcap/filter-error.zeek @@ -1,9 +1,14 @@ -# @TEST-EXEC-FAIL: zeek -r $TRACES/workshop_2011_browse.trace -f "kaputt" >>output 2>&1 +# Due to the instability of the output from libpcap when it comes to errors when compiling +# filters, we can't rely on a fixed baseline here to diff against. Instead, just do some +# greps to validate that we got a syntax error in the output with the string that we passed +# as a filter. + +# @TEST-EXEC-FAIL: zeek -r $TRACES/workshop_2011_browse.trace -f "kaputt" >output 2>&1 # @TEST-EXEC-FAIL: test -e conn.log -# @TEST-EXEC: echo ---- >>output -# @TEST-EXEC: zeek -r $TRACES/workshop_2011_browse.trace %INPUT >>output 2>&1 +# @TEST-EXEC: grep "kaputt" output | grep -q "syntax error" +# @TEST-EXEC: zeek -r $TRACES/workshop_2011_browse.trace %INPUT >output 2>&1 # @TEST-EXEC: test -e conn.log -# @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-remove-abspath btest-diff output +# @TEST-EXEC: grep "kaputt, too" output | grep -q "syntax error" redef enum PcapFilterID += { A }; @@ -12,5 +17,3 @@ event zeek_init() if ( ! Pcap::precompile_pcap_filter(A, "kaputt, too") ) print "error", Pcap::error(); } - -