mirror of
https://github.com/zeek/zeek.git
synced 2025-10-06 16:48:19 +00:00
3c59aa9459
- First: Due to architectural constraints, it is very hard for the input framework to handle optional records. For an optional record, either the whole record has to be missing, or all non-optional elements of the record have to be defined. This information is not available to input readers after the records have been unrolled into the threading types. Behavior so far was to treat optional records like they are non-optional, without warning. The patch changes this behavior to emit an error on stream- creation (during type-checking) and refusing to open the file. I think this is a better idea - the behavior so far was undocumented and unintuitive. - Second: For table and event streams, reader backend creation was done very early, before actually checking if all arguments are valid. Initialization is moved after the checks now - this makes a number of delete statements unnecessary. Also - I suspect threads of failed input reader instances were not deleted until shutdown - Third: Add a couple more consistency checks, e.g. checking if the destination value of a table has the same type as we need. We did not check everything in all instances, instead we just assigned the things without caring (which works, but is not really desirable). This change also exposed a few bugs in other testcases where table definitions were wrong (did not respect $want_record) - Fourth: Improve error messages and write testcases for all error messages (I think). |
||
|---|---|---|
| .. | ||
| analyzer | ||
| cluster | ||
| communication | ||
| control | ||
| file-analysis | ||
| input | ||
| intel | ||
| logging | ||
| notice | ||
| packet-filter | ||
| reporter | ||
| software | ||
| sumstats | ||