Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-13 03:58:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

BIT-844: fix UDP payload signatures to match packet-wise

Browse source
This commit is contained in:
Jon Siwek 2015-04-06 15:22:26 -05:00
parent 1a42296389
commit 56a7bf7936
6 changed files with 72 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

6
testing/btest/Baseline/signatures.udp-packetwise-match/out Normal file
View file

@ -0,0 +1,6 @@
signature match, Found XXXX, XXXX
signature match, Found ^XXXX, XXXX
signature match, Found .*XXXX, XXXX
signature match, Found YYYY, YYYY
signature match, Found ^YYYY, YYYY
signature match, Found .*YYYY, YYYY

BIN
testing/btest/Traces/udp-signature-test.pcap Normal file
View file

Binary file not shown.

53
testing/btest/signatures/udp-packetwise-match.bro Normal file
View file

@ -0,0 +1,53 @@
# @TEST-EXEC: bro -r $TRACES/udp-signature-test.pcap %INPUT >out
# @TEST-EXEC: btest-diff out
@load-sigs test.sig
@TEST-START-FILE test.sig
signature xxxx {
ip-proto = udp
payload /XXXX/
event "Found XXXX"
}
signature axxxx {
ip-proto = udp
payload /^XXXX/
event "Found ^XXXX"
}
signature sxxxx {
ip-proto = udp
payload /.*XXXX/
event "Found .*XXXX"
}
signature yyyy {
ip-proto = udp
payload /YYYY/
event "Found YYYY"
}
signature ayyyy {
ip-proto = udp
payload /^YYYY/
event "Found ^YYYY"
}
signature syyyy {
ip-proto = udp
payload /.*YYYY/
event "Found .*YYYY"
}
signature nope {
ip-proto = udp
payload /.*nope/
event "Found .*nope"
}
@TEST-END-FILE
event signature_match(state: signature_state, msg: string, data: string)
{
print "signature match", msg, data;
}