Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-17 05:58:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge topic/actor-system throug a squashed commit.

Browse source
This commit is contained in:
Robin Sommer 2018-05-16 23:48:07 +00:00
parent 7a6f5020f6
commit fe7e1ee7f0
466 changed files with 12559 additions and 9655 deletions
Download patch file Download diff file Expand all files Collapse all files

44
testing/btest/scripts/base/frameworks/logging/field-extension-cluster-error.bro
View file

@ -4,20 +4,25 @@
# @TEST-EXEC: sleep 1
# @TEST-EXEC: btest-bg-run worker-1 "cp ../cluster-layout.bro . && CLUSTER_NODE=worker-1 bro --pseudo-realtime -C -r $TRACES/wikipedia.trace %INPUT"
# @TEST-EXEC: btest-bg-wait 20
# @TEST-EXEC: btest-diff manager-1/reporter.log
# @TEST-EXEC: cat manager-1/reporter.log | grep -v "reporter/" > manager-reporter.log
# @TEST-EXEC: btest-diff manager-reporter.log
@TEST-START-FILE cluster-layout.bro
redef Cluster::nodes = {
["manager-1"] = [$node_type=Cluster::MANAGER, $ip=127.0.0.1, $p=37757/tcp, $workers=set("worker-1")],
["manager-1"] = [$node_type=Cluster::MANAGER, $ip=127.0.0.1, $p=37757/tcp],
["worker-1"] = [$node_type=Cluster::WORKER, $ip=127.0.0.1, $p=37760/tcp, $manager="manager-1", $interface="eth0"],
};
@TEST-END-FILE
redef Log::default_rotation_interval = 0secs;
@load base/protocols/conn
@if ( Cluster::node == "worker-1" )
redef exit_only_after_terminate = T;
@endif
redef Log::default_rotation_interval = 0secs;
redef Log::default_scope_sep="_";
type Extension: record {
@ -39,11 +44,32 @@ redef Log::default_ext_func = add_extension;
@endif
event terminate_me() {
event die()
{
terminate();
}
}
event remote_connection_closed(p: event_peer) {
schedule 1sec { terminate_me() };
}
event slow_death()
{
Broker::flush_logs();
schedule 2sec { die() };
}
event kill_worker()
{
Broker::publish("death", slow_death);
}
event bro_init()
{
if ( Cluster::node == "worker-1" )
Broker::subscribe("death");
if ( Cluster::node == "manager-1" )
schedule 13sec { kill_worker() };
}
event Broker::peer_lost(endpoint: Broker::EndpointInfo, msg: string)
{
schedule 2sec { die() };
}

41
testing/btest/scripts/base/frameworks/logging/field-extension-cluster.bro
View file

@ -9,15 +9,19 @@
@TEST-START-FILE cluster-layout.bro
redef Cluster::nodes = {
["manager-1"] = [$node_type=Cluster::MANAGER, $ip=127.0.0.1, $p=37757/tcp, $workers=set("worker-1")],
["manager-1"] = [$node_type=Cluster::MANAGER, $ip=127.0.0.1, $p=37757/tcp],
["worker-1"] = [$node_type=Cluster::WORKER, $ip=127.0.0.1, $p=37760/tcp, $manager="manager-1", $interface="eth0"],
};
@TEST-END-FILE
redef Log::default_rotation_interval = 0secs;
@load base/protocols/conn
@if ( Cluster::node == "worker-1" )
redef exit_only_after_terminate = T;
@endif
redef Log::default_rotation_interval = 0secs;
redef Log::default_scope_sep="_";
type Extension: record {
@ -35,11 +39,32 @@ function add_extension(path: string): Extension
redef Log::default_ext_func = add_extension;
event terminate_me() {
event die()
{
terminate();
}
}
event remote_connection_closed(p: event_peer) {
schedule 1sec { terminate_me() };
}
event slow_death()
{
Broker::flush_logs();
schedule 2sec { die() };
}
event kill_worker()
{
Broker::publish("death", slow_death);
}
event bro_init()
{
if ( Cluster::node == "worker-1" )
Broker::subscribe("death");
if ( Cluster::node == "manager-1" )
schedule 13sec { kill_worker() };
}
event Broker::peer_lost(endpoint: Broker::EndpointInfo, msg: string)
{
schedule 2sec { die() };
}

94
testing/btest/scripts/base/frameworks/logging/remote-config.bro
View file

@ -1,94 +0,0 @@
# @TEST-SERIALIZE: comm
#
# @TEST-EXEC: btest-bg-run sender bro -b --pseudo-realtime %INPUT ../sender.bro
# @TEST-EXEC: sleep 1
# @TEST-EXEC: btest-bg-run receiver bro -b --pseudo-realtime %INPUT ../receiver.bro
# @TEST-EXEC: sleep 1
# @TEST-EXEC: btest-bg-wait 15
# @TEST-EXEC: btest-diff sender/test.log
# @TEST-EXEC: btest-diff sender/test.failure.log
# @TEST-EXEC: btest-diff sender/test.success.log
# @TEST-EXEC: ( cd sender && for i in *.log; do cat $i | $SCRIPTS/diff-remove-timestamps >c.$i; done )
# @TEST-EXEC: ( cd receiver && for i in *.log; do cat $i | $SCRIPTS/diff-remove-timestamps >c.$i; done )
# @TEST-EXEC: cmp receiver/c.test.log sender/c.test.log
# @TEST-EXEC: cmp receiver/c.test.failure.log sender/c.test.failure.log
# @TEST-EXEC: cmp receiver/c.test.success.log sender/c.test.success.log
# This is the common part loaded by both sender and receiver.
module Test;
export {
# Create a new ID for our log stream
redef enum Log::ID += { LOG };
# Define a record with all the columns the log file can have.
# (I'm using a subset of fields from ssh-ext for demonstration.)
type Log: record {
t: time;
id: conn_id; # Will be rolled out into individual columns.
status: string &optional;
country: string &default="unknown";
} &log;
}
event bro_init()
{
Log::create_stream(Test::LOG, [$columns=Log]);
Log::add_filter(Test::LOG, [$name="f1", $path="test.success", $pred=function(rec: Log): bool { return rec$status == "success"; }]);
}
#####
@TEST-START-FILE sender.bro
@load frameworks/communication/listen
module Test;
function fail(rec: Log): bool
{
return rec$status != "success";
}
event remote_connection_handshake_done(p: event_peer)
{
local config: table[string] of string;
config["tsv"] = "T";
Log::add_filter(Test::LOG, [$name="f2", $path="test.failure", $pred=fail, $config=config]);
local cid = [$orig_h=1.2.3.4, $orig_p=1234/tcp, $resp_h=2.3.4.5, $resp_p=80/tcp];
local r: Log = [$t=network_time(), $id=cid, $status="success"];
# Log something.
Log::write(Test::LOG, r);
Log::write(Test::LOG, [$t=network_time(), $id=cid, $status="failure", $country="US"]);
Log::write(Test::LOG, [$t=network_time(), $id=cid, $status="failure", $country="UK"]);
Log::write(Test::LOG, [$t=network_time(), $id=cid, $status="success", $country="BR"]);
Log::write(Test::LOG, [$t=network_time(), $id=cid, $status="failure", $country="MX"]);
disconnect(p);
}
event remote_connection_closed(p: event_peer)
{
terminate();
}
@TEST-END-FILE
@TEST-START-FILE receiver.bro
#####
@load base/frameworks/communication
redef Communication::nodes += {
["foo"] = [$host = 127.0.0.1, $connect=T, $request_logs=T]
};
event remote_connection_closed(p: event_peer)
{
terminate();
}
@TEST-END-FILE

91
testing/btest/scripts/base/frameworks/logging/remote-types.bro
View file

@ -1,91 +0,0 @@
# @TEST-SERIALIZE: comm
#
# @TEST-EXEC: btest-bg-run sender bro -B threading,logging --pseudo-realtime %INPUT ../sender.bro
# @TEST-EXEC: btest-bg-run receiver bro -B threading,logging --pseudo-realtime %INPUT ../receiver.bro
# @TEST-EXEC: btest-bg-wait -k 10
# @TEST-EXEC: btest-diff receiver/test.log
# @TEST-EXEC: cat receiver/test.log | egrep -v '#open|#close' >r.log
# @TEST-EXEC: cat sender/test.log | egrep -v '#open|#close' >s.log
# @TEST-EXEC: cmp r.log s.log
# Remote version testing all types.
# This is the common part loaded by both sender and receiver.
redef LogAscii::empty_field = "EMPTY";
module Test;
export {
# Create a new ID for our log stream
redef enum Log::ID += { LOG };
type Log: record {
b: bool;
i: int;
e: Log::ID;
c: count;
p: port;
sn: subnet;
a: addr;
d: double;
t: time;
iv: interval;
s: string;
sc: set[count];
ss: set[string];
se: set[string];
vc: vector of count;
ve: vector of string;
} &log;
}
event bro_init()
{
Log::create_stream(Test::LOG, [$columns=Log]);
}
#####
@TEST-START-FILE sender.bro
module Test;
@load frameworks/communication/listen
event remote_connection_handshake_done(p: event_peer)
{
local empty_set: set[string];
local empty_vector: vector of string;
Log::write(Test::LOG, [
$b=T,
$i=-42,
$e=Test::LOG,
$c=21,
$p=123/tcp,
$sn=10.0.0.1/24,
$a=1.2.3.4,
$d=3.14,
$t=network_time(),
$iv=100secs,
$s="hurz",
$sc=set(1,2,3,4),
$ss=set("AA", "BB", "CC"),
$se=empty_set,
$vc=vector(10, 20, 30),
$ve=empty_vector
]);
disconnect(p);
}
@TEST-END-FILE
@TEST-START-FILE receiver.bro
#####
redef Communication::nodes += {
["foo"] = [$host = 127.0.0.1, $connect=T, $request_logs=T]
};
@TEST-END-FILE

92
testing/btest/scripts/base/frameworks/logging/remote.bro
View file

@ -1,92 +0,0 @@
# @TEST-SERIALIZE: comm
#
# @TEST-EXEC: btest-bg-run sender bro -b --pseudo-realtime %INPUT ../sender.bro
# @TEST-EXEC: sleep 1
# @TEST-EXEC: btest-bg-run receiver bro -b --pseudo-realtime %INPUT ../receiver.bro
# @TEST-EXEC: sleep 1
# @TEST-EXEC: btest-bg-wait 15
# @TEST-EXEC: btest-diff sender/test.log
# @TEST-EXEC: btest-diff sender/test.failure.log
# @TEST-EXEC: btest-diff sender/test.success.log
# @TEST-EXEC: ( cd sender && for i in *.log; do cat $i | $SCRIPTS/diff-remove-timestamps >c.$i; done )
# @TEST-EXEC: ( cd receiver && for i in *.log; do cat $i | $SCRIPTS/diff-remove-timestamps >c.$i; done )
# @TEST-EXEC: cmp receiver/c.test.log sender/c.test.log
# @TEST-EXEC: cmp receiver/c.test.failure.log sender/c.test.failure.log
# @TEST-EXEC: cmp receiver/c.test.success.log sender/c.test.success.log
# This is the common part loaded by both sender and receiver.
module Test;
export {
# Create a new ID for our log stream
redef enum Log::ID += { LOG };
# Define a record with all the columns the log file can have.
# (I'm using a subset of fields from ssh-ext for demonstration.)
type Log: record {
t: time;
id: conn_id; # Will be rolled out into individual columns.
status: string &optional;
country: string &default="unknown";
} &log;
}
event bro_init()
{
Log::create_stream(Test::LOG, [$columns=Log]);
Log::add_filter(Test::LOG, [$name="f1", $path="test.success", $pred=function(rec: Log): bool { return rec$status == "success"; }]);
}
#####
@TEST-START-FILE sender.bro
@load frameworks/communication/listen
module Test;
function fail(rec: Log): bool
{
return rec$status != "success";
}
event remote_connection_handshake_done(p: event_peer)
{
Log::add_filter(Test::LOG, [$name="f2", $path="test.failure", $pred=fail]);
local cid = [$orig_h=1.2.3.4, $orig_p=1234/tcp, $resp_h=2.3.4.5, $resp_p=80/tcp];
local r: Log = [$t=network_time(), $id=cid, $status="success"];
# Log something.
Log::write(Test::LOG, r);
Log::write(Test::LOG, [$t=network_time(), $id=cid, $status="failure", $country="US"]);
Log::write(Test::LOG, [$t=network_time(), $id=cid, $status="failure", $country="UK"]);
Log::write(Test::LOG, [$t=network_time(), $id=cid, $status="success", $country="BR"]);
Log::write(Test::LOG, [$t=network_time(), $id=cid, $status="failure", $country="MX"]);
disconnect(p);
}
event remote_connection_closed(p: event_peer)
{
terminate();
}
@TEST-END-FILE
@TEST-START-FILE receiver.bro
#####
@load base/frameworks/communication
redef Communication::nodes += {
["foo"] = [$host = 127.0.0.1, $connect=T, $request_logs=T]
};
event remote_connection_closed(p: event_peer)
{
terminate();
}
@TEST-END-FILE