Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Merge remote-tracking branch 'origin/topic/timw/require-spicy-for-analyzer-id-test'

Browse source 
* origin/topic/timw/require-spicy-for-analyzer-id-test:
  Require spicy for spicy.analyzer-id btest
This commit is contained in:
Tim Wojtulewicz 2024-12-20 15:14:33 -07:00
commit 3a0bb55244
3 changed files with 17 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

11
CHANGES
View file

@ -1,3 +1,14 @@
7.2.0-dev.23 | 2024-12-20 15:14:33 -0700
* Require spicy for spicy.analyzer-id btest (Tim Wojtulewicz, Corelight)
* Document `get_tag` to ensure that `name` exists (Evan Typanski, Corelight)
This caused confusion and I don't think it's very intuitive. If called
with a name that does not exist, this returns without a value, not even
an error value. Changing that seems like it could be more deprecation
work.
7.2.0-dev.18 | 2024-12-18 15:44:40 -0700 7.2.0-dev.18 | 2024-12-18 15:44:40 -0700
* Add spicy runtime-support current_analyzer_id(), use it to set id in events (Tim Wojtulewicz, Corelight) * Add spicy runtime-support current_analyzer_id(), use it to set id in events (Tim Wojtulewicz, Corelight)

2
VERSION
View file

@ -1 +1 @@
7.2.0-dev.18 7.2.0-dev.23

8
testing/btest/spicy/analyzer-id.zeek
View file

@ -1,6 +1,8 @@
#@TEST-DOC: Test that analyzer ID set for spicy protocol analyzers # @TEST-DOC: Test that analyzer ID set for spicy protocol analyzers
#@TEST-EXEC: zeek -r $TRACES/postgresql/psql-aws-ssl-preferred.pcap %INPUT > out # @TEST-REQUIRES: have-spicy
#@TEST-EXEC: btest-diff out #
# @TEST-EXEC: zeek -r $TRACES/postgresql/psql-aws-ssl-preferred.pcap %INPUT > out
# @TEST-EXEC: btest-diff out
event PostgreSQL::ssl_request(c: connection) { event PostgreSQL::ssl_request(c: connection) {
print c$uid, "PostgreSQL::ssl_request", current_analyzer(); print c$uid, "PostgreSQL::ssl_request", current_analyzer();