Commit graph

84 commits

Author SHA1 Message Date
Jon Siwek
1531980f3d Exec module and raw input reader fixes.
- Do stream mode for commands done by exec module, it seems important
  in some cases (e.g. ensure requested stdin is fully written).

- For cases where the raw input reader knows the child process has been
  reaped, set the childpid member to a sentinel value to indicate such
  so we don't later think we should kill it or wait on it anymore.

- More error checking on dup2/close calls.  Set sentinel values when
  closing ends of pipes to prevent double closing a fd.

- Signal flag not set when raw input reader's child exits as a result
  of a signal.  Left out a test for this -- might be portability issues
  (e.g. Ubuntu seems to do things different regarding the exit code and
  also is printing "Killed" to stderr where other platforms don't).
2013-08-02 17:27:10 -05:00
Bernhard Amann
f1745ff488 fix stderr test. ls behaves differently on errors on linux... 2013-05-27 23:07:37 -07:00
Bernhard Amann
08656c976b small fixes. 2013-05-27 22:59:27 -07:00
Bernhard Amann
3719524a6a Merge remote branch 'origin/master' into topic/bernhard/input-update 2013-05-27 20:32:50 -07:00
Bernhard Amann
2b009939f5 and there is no has-reader. 2013-05-14 22:12:23 -07:00
Bernhard Amann
2ad67643c0 make sqlite3 executable required and add test-cases for errors
logging: table does not contain all required columns (when extending
data structures)

input: table does not contain all required columns (when extending
data structure), wrong sql statement
2013-05-14 22:09:46 -07:00
Bernhard Amann
8f7619971f fix bug in input-manager regarding enums that a writer reads without
0-terminating the string
2013-05-13 20:26:41 -07:00
Bernhard Amann
6c99df508c actually make sqlite work again (tests passed because the writer
was not actually defined because of the define.)
2013-05-13 19:27:11 -07:00
Bernhard Amann
8875953751 A bunch of more changes for the raw reader
* send end_of_data event for all kind of streams
* send process_finished event containing exit code of child process for executed programs
* move raw-tests to separate directory
* expose name of input stream to readers
* better handling of some error cases in raw reader
* new force_kill option for raw reader which SIGKILLs progesses on exit

The ordering of events how they arrive in the main loop is a bit peculiar at the moment.
The process_finished event arrives in scriptland before all of the other events, even though
it should be sent last. I have not yet fully figured that out.
2013-03-18 21:49:16 -07:00
Bernhard Amann
6fef99ee03 make reading from stdout and stderr simultaneously work.
Needs a few test-cases - but seems ok...
2013-03-16 09:54:48 -07:00
Bernhard Amann
3aeec7ec14 allow sending data to stdin of child process 2013-03-15 15:47:20 -07:00
Bernhard Amann
fc42c71dfa Streaming reads from external commands work without blocking anything. 2013-03-15 13:58:41 -07:00
Bernhard Amann
fdc8de7596 add sqlite tests and fix small vector/set escaping bugs 2013-03-11 14:22:35 -07:00
Bernhard Amann
8cb91de93a Merge remote-tracking branch 'origin/master' into topic/bernhard/sqlite
Conflicts:
	src/threading/AsciiFormatter.cc
2013-03-11 11:47:10 -07:00
Bernhard Amann
1fb05da9cd Fix race-condition in table-event test.
Event depended on the input manager receiving all lines from the reader
before the first input event was processed by the scripting layer.
2013-03-07 20:28:18 -08:00
Bernhard Amann
dd24d7af83 update input tests to use exit_only_after_terminate 2013-02-01 15:45:21 -08:00
Jon Siwek
acafcfafd2 Revert "Trick for parallelizing input framework unit tests."
This reverts commit 43ed437daa.

The old way of doing the tests seems more reliable for now.
2013-01-18 13:15:34 -06:00
Bernhard Amann
0fcc3db9a0 start adding a different text for empty records for the sqlite writer.
Sadly there also seems to be another deadlock issue which I am currently
not really able to figure out - on shutdown sometimes (too often) the main
thread + all sqlite threads wait for semaphores or mutexes.
2013-01-16 18:13:39 -08:00
Bernhard Amann
3415b5fcbe make sqlite support more or less work for logging and input
* add support for &type_column for reading
* add basic tests for logging & input
* clean up a bit
* add support for tables for reading (untested)
2013-01-15 16:01:30 -08:00
Jon Siwek
43ed437daa Trick for parallelizing input framework unit tests.
Instead of loading listen.bro to block until files are read, just read
a pcap file in pseudo-realtime.  Seems to work well.
2012-12-11 17:06:54 -06:00
Bernhard Amann
d367e227c1 ok, this one is a bit... embarrassing.
Delete the correct entry in case of error. Fixes a segfault when the faulty
data is of type string and not the last field of the input...
2012-12-05 12:40:00 -08:00
Bernhard Amann
a6d87fcab7 rename the update_finished event to end_of_data and make it fire in
more cases.

It will now not only fire after table-reads have been completed,
but also after the last event of a whole-file-read (or whole-db-read, etc.).

The interface also has been extended a bit to allow readers to
directly fire the event should they so choose. This allows the
event to be fired in direct table-setting/event-sending modes,
which was previously not possible.
2012-10-10 11:51:20 -07:00
Bernhard Amann
4cbf4e3caf Small but important fix for the input framework. BroStrings were constructed
without a final \0 - which means that strings read by the input framework are
unusable by basically all internal functions (like to_count).

the basic test now also checks this.

Thanks at Sheharbano for noticing this.
2012-10-01 13:04:40 -07:00
Robin Sommer
20c71cac51 Merge remote-tracking branch 'remotes/origin/topic/bernhard/input-warn-on-invalid-numbers'
* remotes/origin/topic/bernhard/input-warn-on-invalid-numbers:
  ...and another small change to error handling -> now errors in single lines do not kill processing, but simply ignore the line, log it, and continue.
  Ok, this one was a little bit sneaky.
  ok, this one might really be a bit too big for 2.1
2012-08-27 12:43:36 -07:00
Robin Sommer
48c6bdf467 Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  fix handline of sets only containing a zero-length string.

Conflicts:
	src/input/readers/Ascii.cc
2012-08-27 12:27:24 -07:00
Bernhard Amann
56fa56ffa9 ...and another small change to error handling -> now errors in single lines
do not kill processing, but simply ignore the line, log it, and continue.
2012-08-27 11:38:20 -07:00
Bernhard Amann
a4ca5b0d82 fix handline of sets only containing a zero-length string.
Thank you Robin...
2012-08-27 09:50:51 -07:00
Robin Sommer
352d4bd5e2 Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  Ok, this one is not really necessary for 2.1 and more of a nice-to-have
  another small bug found while searching for something else...
  Fix two little bugs:
  sorry. the patch for the set_separator.
  make set_separators different from , work for input framework.
  Bug found bei Keith & Seth: input framework was not handling counts and ints out of 32-bit-range correctly.
2012-08-27 09:31:17 -07:00
Bernhard Amann
f133e8808a ok, this one might really be a bit too big for 2.1
Give all kinds of errors when encountering invalid numbers (like out-of-range-warnings, etc).
2012-08-26 22:00:37 -07:00
Bernhard Amann
7e46936728 Ok, this one is not really necessary for 2.1 and more of a nice-to-have
Before this patch, empty values were not hashed at all. Which had the unfortunate side-effect
that e.g. the lines

TEST	-
and
-	TEST

have the same hash values. On re-reads that means that the change will
be ignored.

This is probably pretty academic, but this patch changes it and adds a testcase.

Output of the reread test changes due to re-ordering of the output (probably
due to the fact that the internal hash values are changed and thus transferred
in a different order)
2012-08-26 20:49:21 -07:00
Bernhard Amann
a9e6d9ae81 Fix two little bugs:
Escaped ,'s in sets and vectors were unescaped before tokenization

Handling of zero-length-strings as last element in a set was broken (sets ending with a ,).

Hashing of lines just containing zero-length-strings was broken (now a \0 is appended to each
string before it is hashed - giving us a hash of something for a line just consisting of \0s.
This also allows to differentiate between vectors with varying numbers of zero-length-strings).
2012-08-26 19:17:21 -07:00
Bernhard Amann
977c1d7c5a make set_separators different from , work for input framework.
1-line-patch + test.
2012-08-26 17:52:07 -07:00
Bernhard Amann
124c985d7a Bug found bei Keith & Seth: input framework was not handling counts and ints out of 32-bit-range correctly.
Note - another bugfix will be coming later (problem reading sets containing zero-length-strings & un-escaping-bug in sets)
2012-08-26 14:49:37 -07:00
Robin Sommer
42355bf6f1 Merge remote-tracking branch 'origin/topic/bernhard/input-allow_invalid_types'
* origin/topic/bernhard/input-allow_invalid_types:
  to be sure - add a small assertion
  add an option to the input framework that allows the user to chose to not die upon encountering files/functions.

That's the last feature for 2.1!
2012-08-22 16:11:28 -07:00
Bernhard Amann
b53be21750 add an option to the input framework that allows the user
to chose to not die upon encountering files/functions.

I am not entirely sure if I like the approach I took for
this, it is a bit... hacky.
2012-08-22 06:46:45 -07:00
Bernhard Amann
cd67603f49 add testcase for input of set.
Sets can be imported by not specifying $val in the add_table call.

This actually was already implemented, I just completely forgot about it.
2012-08-21 21:48:49 -07:00
Bernhard Amann
a2b5028b58 fix little sneaky bug in input framework with an edge case.
An assertion would trigger in the case when a predicate refuses
a new entry and another entry with the same index elements was
already in the table. (I thought that code block was unreachable
... did not think of this case).
2012-08-04 22:38:26 -07:00
Bernhard Amann
18550ab009 small bug in test script. Still worked, because the internal type checking let this through... 2012-08-04 22:24:44 -07:00
Robin Sommer
9f2abd0697 Fix input test for recent default change on fastpath. 2012-07-27 12:39:20 -07:00
Robin Sommer
767a792148 Tests updates for recent open/close log change. 2012-07-27 12:39:11 -07:00
Robin Sommer
c66c6d7c46 Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  Small (potential performance) improvement for logging framework.
  Script-level rotation postprocessor fix.
  update input framework documentation to reflect want_record change.
  Fix crash when encountering an InterpreterException in a predicate in logging or input Framework.
  make want_record=T the default for events
2012-07-27 12:26:18 -07:00
Bernhard Amann
76ea182387 make want_record=T the default for events 2012-07-26 21:13:49 -07:00
Robin Sommer
86ae7d8b7c Test for input framework failing to find a file.
The output isn't the nicest yet ...
2012-07-26 17:27:56 -07:00
Bernhard Amann
8633d91c40 and remove superflous print.
Yes, I know, look at the diff before committing...
2012-07-26 12:15:06 -07:00
Bernhard Amann
1a49363bbe add testcase for subrecords and events
add missing binary testcase (Baseline is in master, testcase is missing for some reason)
make error output for nonmatching event types much more verbose
2012-07-26 12:12:54 -07:00
Bernhard Amann
84399c5d7d add testcase for subrecords to input framework tests 2012-07-26 08:58:12 -07:00
Bernhard Amann
336990e234 make reading ascii logfiles work when the input separator is different from \t.
(Wrong escape character was used for reading header fields).
2012-07-23 11:27:08 -07:00
Jon Siwek
0e48fda6ff Updating input framework unit tests.
Generally tried to make them more reliable and execute quicker.
They all now load the listen script as a trick to make sure input
sources are fully read, but also terminate() at appropriate times
so that they don't take more time than needed.  They're also all
serialized with the 'comm' group so listening on a port doesn't
interfere with the communication tests.
2012-06-29 12:50:57 -05:00
Bernhard Amann
3e3ceda1a7 disable streaming reads from executed commands.
This lead to hanging bro's because pclose apparently can wait for eternity
if things go wrong. And there probably are a couple of other problems with this approach.
2012-06-07 14:36:03 -07:00
Bernhard Amann
f4864c69af fix another memory lead (when updating tables).
Adjust twotables testcase - now it is faster. Shorten the output
-- because of threading, the results did not always come out in
the same order (it depends on which thread manages to sneak in
the results into the queue earlier).
2012-05-29 09:21:16 -07:00