Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-09 18:18:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

btest: Add tests for full email extraction

Browse source
This commit is contained in:
cccs-jsjm 2025-07-14 21:38:47 +02:00 • committed by Arne Welzel
parent 4c60dfd6c5
commit 1b3b3892b5
11 changed files with 147 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

17
testing/btest/scripts/base/protocols/smtp/rfc822-msg-file-analysis-multi-session.test Normal file
View file

@ -0,0 +1,17 @@
# @TEST-DOC: Test case for analyzing RFC822 messages from multiple SMTP sessions.
#
# @TEST-EXEC: zeek -C -b -r $TRACES/smtp.trace %INPUT
# @TEST-EXEC: zeek-cut -m fuid uid mime_type seen_bytes parent_fuid sha1 < files.log > files.cut
# @TEST-EXEC: btest-diff files.cut
@load base/files/hash
@load base/files/extract
@load base/protocols/smtp
redef SMTP::enable_rfc822_msg_file_analysis = T;
event file_over_new_connection(f: fa_file, c: connection, is_orig: bool)
{
if ( f$id == c$smtp$rfc822_msg_fuid )
Files::add_analyzer(f, Files::ANALYZER_SHA1);
}