Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-09 18:18:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Merge remote-tracking branch 'origin/topic/timw/2338-signature-eval-unused'

Browse source 
* origin/topic/timw/2338-signature-eval-unused:
  Add is_used attribute to an ID if used in a signature eval statement
This commit is contained in:
Tim Wojtulewicz 2022-09-06 07:44:18 -07:00
commit 7cc876d84a
6 changed files with 42 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

1
testing/btest/Baseline/signatures.signature-cond-used/.stderr Normal file
View file

@ -0,0 +1 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.

3
testing/btest/Baseline/signatures.signature-cond-used/.stdout Normal file
View file

@ -0,0 +1,3 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
signature_cond, GET /download/CHANGES.bro-aux.txt HTTP/1.1\x0d\x0aUser-Agent: Wget/1.14 (darwin12.2.0)\x0d\x0aAccept: */*\x0d\x0aHost: bro.org\x0d\x0aConnection: Keep-Alive\x0d\x0a\x0d\x0a
signature_match, GET, GET /download/CHANGES.bro-aux.txt HTTP/1.1\x0d\x0aUser-Agent: Wget/1.14 (darwin12.2.0)\x0d\x0aAccept: */*\x0d\x0aHost: bro.org\x0d\x0aConnection: Keep-Alive\x0d\x0a\x0d\x0a

29
testing/btest/signatures/signature-cond-used.zeek Normal file
View file

@ -0,0 +1,29 @@
# @TEST-DOC: The function signature_cond used for eval in test.sig should not be reported as unused
# @TEST-EXEC: zeek -b %INPUT -r $TRACES/http/get.trace
# @TEST-EXEC: btest-diff .stderr
# @TEST-EXEC: btest-diff .stdout
module SignatureEvalTest;
@load-sigs ./test.sig
event signature_match(state: signature_state, msg: string, data: string)
{
print "signature_match", msg, data;
}
function signature_cond(state: signature_state, data: string): bool
{
print "signature_cond", data;
return T;
}
@TEST-START-FILE test.sig
signature my-first-sig {
ip-proto == tcp
dst-port == 80
payload /GET/
event "GET"
eval SignatureEvalTest::signature_cond
}
@TEST-END-FILE