Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-04 15:48:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Fix type clash fatal error with log filters that use $ext_func and $include/$exclude

Browse source 
The logging manager's Manager::TraverseRecord(), called when adding a
log filter to a stream, skipped any fields intoduced by a filter's
$ext_func when such fields weren't mentioned in a $include restriction
or mentioned in an $exclude restriction. This was inconsistent with
Manager::RecordToFilterVals, used when actually writing log entries,
which does include those values.

The result was that the record indices descent in Manager::RecordToFilterVals
expects to find only record values, when in fact only the record
provided by ext_func is present. This leads to type mismatches and
hard Zeek exits like this one:

1300475173.475401 fatal error in zeek/share/zeek//base/init-bare.zeek, line 4810: Val::CONVERTER (string/record) (zeek)

The fix makes ext_func's field additions decisive, meaning the
filter's include/exclude lists don't apply to it. If a user really
wants to override this, they can reset the filter's ext_func back to
our no-op default.

The included btest produces the above error when the fix is not present.
This commit is contained in:
Christian Kreibich 2020-11-10 16:34:04 -08:00
parent ee31673154
commit f97a33e14d
4 changed files with 123 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

6
src/logging/Manager.cc
View file

@ -487,7 +487,8 @@ bool Manager::TraverseRecord(Stream* stream, Filter* filter, RecordType* rt,
}
// If include fields are specified, only include if explicitly listed.
if ( include )
// Exception: extension fields provided by the filter's ext_func remain.
if ( j >= num_ext_fields && include )
{
auto new_path_val = make_intrusive<StringVal>(new_path.c_str());
bool result = (bool)include->FindOrDefault(new_path_val);
@ -497,7 +498,8 @@ bool Manager::TraverseRecord(Stream* stream, Filter* filter, RecordType* rt,
}
// If exclude fields are specified, do not only include if listed.
if ( exclude )
// Here too, extension fields always remain.
if ( j >= num_ext_fields && exclude )
{
auto new_path_val = make_intrusive<StringVal>(new_path.c_str());
bool result = (bool)exclude->FindOrDefault(new_path_val);