Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Merge remote-tracking branch 'origin/topic/etyp/enshrine-event-order'

Browse source
This commit is contained in:
Benjamin Bannier 2024-10-15 09:56:19 +02:00
commit 391fb4de07
4 changed files with 22 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

7
CHANGES
View file

@ -1,3 +1,10 @@
7.1.0-dev.393 | 2024-10-15 09:56:19 +0200
* Test `.evt` file `&priority` (Evan Typanski, Corelight)
This was not documented nor tested, so this tests the behavior.
Documentation should be added later.
7.1.0-dev.390 | 2024-10-09 15:36:41 -0700 7.1.0-dev.390 | 2024-10-09 15:36:41 -0700
* removed specialized ZAM instructions for GTPv1 and Teredo cleanup BiFs (Vern Paxson, Corelight) * removed specialized ZAM instructions for GTPv1 and Teredo cleanup BiFs (Vern Paxson, Corelight)

2
VERSION
View file

@ -1 +1 @@
7.1.0-dev.390 7.1.0-dev.393

2
testing/btest/Baseline/spicy.hook-priority/output
View file

@ -2,4 +2,6 @@
Spicy: highest prio Spicy: highest prio
Spicy: default prio Spicy: default prio
Spicy: lowest prio Spicy: lowest prio
Zeek: highest prio, [x=default]
Zeek: default prio, [x=default] Zeek: default prio, [x=default]
Zeek: lowest prio, [x=default]

14
testing/btest/spicy/hook-priority.zeek
View file

@ -12,11 +12,21 @@ event zeek_init()
Analyzer::register_for_port(Analyzer::ANALYZER_FOO, 80/tcp); Analyzer::register_for_port(Analyzer::ANALYZER_FOO, 80/tcp);
} }
event foo_last(x: foo::X)
{
print "Zeek: lowest prio", x;
}
event foo(x: foo::X) event foo(x: foo::X)
{ {
print "Zeek: default prio", x; print "Zeek: default prio", x;
} }
event foo_first(x: foo::X)
{
print "Zeek: highest prio", x;
}
# @TEST-START-FILE foo.spicy # @TEST-START-FILE foo.spicy
module foo; module foo;
@ -54,8 +64,8 @@ protocol analyzer Foo over TCP:
# by examining the data though which above Spicy hooks mutate; we expect to see # by examining the data though which above Spicy hooks mutate; we expect to see
# data from the default priority handler since we should run right after it. # data from the default priority handler since we should run right after it.
on foo::X -> event foo(self); on foo::X -> event foo(self);
on foo::X -> event foo_first(self) &priority=-500;
on foo::X -> event foo_last(self) &priority=-1500;
export foo::X; export foo::X;
# TODO(bbannier): test that EVT hook priority can correctly be overriden.
# @TEST-END-FILE # @TEST-END-FILE