diff --git a/CHANGES b/CHANGES index 04b025c23b3..7013e2a9312 100644 --- a/CHANGES +++ b/CHANGES @@ -1,4 +1,9 @@ +2.5-840 | 2018-08-13 17:40:06 -0500 + + * Fix SumStats::observe key normalization logic + (reported by Jim Mellander and fixed by Jon Siwek, Corelight) + 2.5-839 | 2018-08-13 10:51:43 -0500 * Make options redef-able by default. (Johanna Amann, Corelight) diff --git a/VERSION b/VERSION index 7960a61cb9e..446a694de2f 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -2.5-839 +2.5-840 diff --git a/scripts/base/frameworks/sumstats/main.bro b/scripts/base/frameworks/sumstats/main.bro index f704dbcdd27..69a853fd5aa 100644 --- a/scripts/base/frameworks/sumstats/main.bro +++ b/scripts/base/frameworks/sumstats/main.bro @@ -399,7 +399,7 @@ function create(ss: SumStat) schedule ss$epoch { SumStats::finish_epoch(ss) }; } -function observe(id: string, key: Key, obs: Observation) +function observe(id: string, orig_key: Key, obs: Observation) { if ( id !in reducer_store ) return; @@ -407,8 +407,7 @@ function observe(id: string, key: Key, obs: Observation) # Try to add the data to all of the defined reducers. for ( r in reducer_store[id] ) { - if ( r?$normalize_key ) - key = r$normalize_key(copy(key)); + local key = r?$normalize_key ? r$normalize_key(copy(orig_key)) : orig_key; # If this reducer has a predicate, run the predicate # and skip this key if the predicate return false.