Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-13 12:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Additional test specifically for the HTTP filename handling.

Browse source
This commit is contained in:
Seth Hall 2016-06-15 01:56:07 -04:00
parent 7c2307e079
commit 90399db32d
3 changed files with 18 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

10
testing/btest/Baseline/scripts.base.protocols.http.http-filename/http.log Normal file
View file

@ -0,0 +1,10 @@
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path http
#open 2016-06-15-05-55-29
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer version user_agent request_body_len response_body_len status_code status_msg info_code info_msg tags username password proxied orig_fuids orig_filenames orig_mime_types resp_fuids resp_filenames resp_mime_types
#types time string addr port addr port count string string string string string string count count count string count string set[enum] string string set[string] vector[string] vector[string] vector[string] vector[string] vector[string] vector[string]
1445000735.104954 CXWv6p3arKYeMETxOg 10.1.9.63 63526 54.175.222.246 80 1 GET httpbin.org /response-headers?Content-Type=application/octet-stream; charset=UTF-8&Content-Disposition=attachment; filename="test.json" - 1.1 curl/7.45.0 0 191 200 OK - - (empty) - - - - - - FygKthZCYFLgVzwY8 test.json text/json
#close 2016-06-15-05-55-29

BIN
testing/btest/Traces/http/http-filename.pcap Normal file
View file

Binary file not shown.

8
testing/btest/scripts/base/protocols/http/http-filename.bro Normal file
View file

@ -0,0 +1,8 @@
# This tests that the HTTP analyzer handles filenames over HTTP correctly.
#
# @TEST-EXEC: bro -r $TRACES/http/http-filename.pcap %INPUT
# @TEST-EXEC: btest-diff http.log
# The base analysis scripts are loaded by default.
#@load base/protocols/http