Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Test .evt file &priority

Browse source 
This was not documented nor tested, so this tests the behavior.
Documentation should be added later.
This commit is contained in:
Evan Typanski 2024-10-14 08:50:02 -04:00
parent 1e24980901
commit 0c79849a0f
2 changed files with 14 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

2
testing/btest/Baseline/spicy.hook-priority/output
View file

@ -2,4 +2,6 @@
Spicy: highest prio
Spicy: default prio
Spicy: lowest prio
Zeek: highest prio, [x=default]
Zeek: default prio, [x=default]
Zeek: lowest prio, [x=default]

14
testing/btest/spicy/hook-priority.zeek
View file

@ -12,11 +12,21 @@ event zeek_init()
Analyzer::register_for_port(Analyzer::ANALYZER_FOO, 80/tcp);
}
event foo_last(x: foo::X)
{
print "Zeek: lowest prio", x;
}
event foo(x: foo::X)
{
print "Zeek: default prio", x;
}
event foo_first(x: foo::X)
{
print "Zeek: highest prio", x;
}
# @TEST-START-FILE foo.spicy
module foo;
@ -54,8 +64,8 @@ protocol analyzer Foo over TCP:
# by examining the data though which above Spicy hooks mutate; we expect to see
# data from the default priority handler since we should run right after it.
on foo::X -> event foo(self);
on foo::X -> event foo_first(self) &priority=-500;
on foo::X -> event foo_last(self) &priority=-1500;
export foo::X;
# TODO(bbannier): test that EVT hook priority can correctly be overriden.
# @TEST-END-FILE