Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-16 05:28:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

FileAnalysis: refactor unit tests to use a common script.

Browse source
This commit is contained in:
Jon Siwek 2013-03-22 17:27:16 -05:00
parent 71f0e2d276
commit 00a1de3593
15 changed files with 209 additions and 931 deletions
Download patch file Download diff file Expand all files Collapse all files

82
testing/btest/scripts/base/frameworks/file-analysis/input/basic.bro
View file

@ -1,10 +1,15 @@
# @TEST-EXEC: btest-bg-run bro bro -b %INPUT
# @TEST-EXEC: btest-bg-run bro bro -b $SCRIPTS/file-analysis-test.bro %INPUT
# @TEST-EXEC: btest-bg-wait 8
# @TEST-EXEC: btest-diff bro/.stdout
# @TEST-EXEC: diff -q bro/nYgPNGLrZf9-file input.log
redef exit_only_after_terminate = T;
redef test_get_file_name = function(info: FileAnalysis::Info): string
{
return fmt("%s-file", info$file_id);
};
@TEST-START-FILE input.log
#separator \x09
#path ssh
@ -37,79 +42,10 @@ event bro_init()
Input::remove("input");
}
global actions: set[FileAnalysis::ActionArgs];
hook FileAnalysis::policy(trig: FileAnalysis::Trigger, info: FileAnalysis::Info)
&priority=-10
{
local filename: string;
print trig;
switch ( trig ) {
case FileAnalysis::TRIGGER_NEW:
print info$file_id, info$seen_bytes, info$missing_bytes;
for ( act in actions )
FileAnalysis::add_action(info$file_id, act);
filename = fmt("%s-file", info$file_id);
FileAnalysis::add_action(info$file_id,
[$act=FileAnalysis::ACTION_EXTRACT,
$extract_filename=filename]);
break;
case FileAnalysis::TRIGGER_BOF_BUFFER:
if ( info?$bof_buffer )
print info$bof_buffer[0:10];
break;
case FileAnalysis::TRIGGER_TYPE:
for ( act in actions )
FileAnalysis::remove_action(info$file_id, act);
filename = fmt("%s-file", info$file_id);
FileAnalysis::remove_action(info$file_id,
[$act=FileAnalysis::ACTION_EXTRACT,
$extract_filename=filename]);
# not actually printing the values due to libmagic variances
if ( info?$file_type )
print "file type is set";
if ( info?$mime_type )
print "mime type is set";
break;
case FileAnalysis::TRIGGER_EOF:
fallthrough;
case FileAnalysis::TRIGGER_DONE:
print info$file_id, info$seen_bytes, info$missing_bytes;
if ( info?$total_bytes )
print "total bytes: " + fmt("%s", info$total_bytes);
if ( info?$source )
print "source: " + info$source;
for ( act in info$actions )
switch ( act$act ) {
case FileAnalysis::ACTION_MD5:
if ( info$actions[act]?$md5 )
print fmt("MD5: %s", info$actions[act]$md5);
break;
case FileAnalysis::ACTION_SHA1:
if ( info$actions[act]?$sha1 )
print fmt("SHA1: %s", info$actions[act]$sha1);
break;
case FileAnalysis::ACTION_SHA256:
if ( info$actions[act]?$sha256 )
print fmt("SHA256: %s", info$actions[act]$sha256);
break;
}
terminate();
break;
}
if ( trig != FileAnalysis::TRIGGER_EOF ) return;
terminate();
}
event bro_init()
{
add actions[[$act=FileAnalysis::ACTION_MD5]];
add actions[[$act=FileAnalysis::ACTION_SHA1]];
add actions[[$act=FileAnalysis::ACTION_SHA256]];
}