diff --git a/scripts/base/frameworks/notice/actions/email_admin.zeek b/scripts/base/frameworks/notice/actions/email_admin.zeek index 34d8d3cfe1..6ba5937bb7 100644 --- a/scripts/base/frameworks/notice/actions/email_admin.zeek +++ b/scripts/base/frameworks/notice/actions/email_admin.zeek @@ -25,16 +25,8 @@ hook notice(n: Notice::Info) { local email = ""; if ( n?$src && |Site::get_emails(n$src)| > 0 ) - email = Site::get_emails(n$src); + add n$email_dest[Site::get_emails(n$src)]; if ( n?$dst && |Site::get_emails(n$dst)| > 0 ) - { - if ( email != "" ) - email = fmt("%s, %s", email, Site::get_emails(n$dst)); - else - email = Site::get_emails(n$dst); - } - - if ( email != "" ) - add n$email_dest[email]; + add n$email_dest[Site::get_emails(n$dst)]; } } diff --git a/testing/btest/Baseline/scripts.base.frameworks.notice.action-email-admin/notice.log b/testing/btest/Baseline/scripts.base.frameworks.notice.action-email-admin/notice.log new file mode 100644 index 0000000000..6b3fcb8a63 --- /dev/null +++ b/testing/btest/Baseline/scripts.base.frameworks.notice.action-email-admin/notice.log @@ -0,0 +1,11 @@ +### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. +#separator \x09 +#set_separator , +#empty_field (empty) +#unset_field - +#path notice +#open XXXX-XX-XX-XX-XX-XX +#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p fuid file_mime_type file_desc proto note msg sub src dst p n peer_descr actions email_dest suppress_for remote_location.country_code remote_location.region remote_location.city remote_location.latitude remote_location.longitude +#types time string addr port addr port string string string enum enum string string addr addr port count string set[enum] set[string] interval string string string double double +XXXXXXXXXX.XXXXXX - - - - - - - - - Test_Notice test - 1.1.1.1 2.2.2.2 - - - Notice::ACTION_EMAIL_ADMIN,Notice::ACTION_LOG postmaster@the.cloud\x2c cloudflare@example.net,2_dot@example.net 3600.000000 - - - - - +#close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/scripts.base.frameworks.notice.action-email-admin/sendmail.out b/testing/btest/Baseline/scripts.base.frameworks.notice.action-email-admin/sendmail.out index 95b718e67c..add5eaa99c 100644 --- a/testing/btest/Baseline/scripts.base.frameworks.notice.action-email-admin/sendmail.out +++ b/testing/btest/Baseline/scripts.base.frameworks.notice.action-email-admin/sendmail.out @@ -18,3 +18,22 @@ Email Extensions -- [Automatically generated] +------- cmdline args ----------- +-t -oi +----------- stdin -------------- +From: Zeek +Subject: [Zeek] Test_Notice +To: 2_dot@example.net +User-Agent: Zeek/$zeek_version() + +Message: test + +Address: 1.1.1.1 + +Email Extensions +---------------- + + +-- +[Automatically generated] + diff --git a/testing/btest/scripts/base/frameworks/notice/action-email-admin.zeek b/testing/btest/scripts/base/frameworks/notice/action-email-admin.zeek index 28cd849f48..7e47db0d17 100644 --- a/testing/btest/scripts/base/frameworks/notice/action-email-admin.zeek +++ b/testing/btest/scripts/base/frameworks/notice/action-email-admin.zeek @@ -1,5 +1,6 @@ # @TEST-EXEC: zeek -b %INPUT # @TEST-EXEC: btest-diff sendmail.out +# @TEST-EXEC: btest-diff notice.log @load base/frameworks/notice @load base/utils/site @@ -7,7 +8,10 @@ redef Notice::mail_dest = "user@example.net"; redef Notice::sendmail = "fake-sendmail"; -redef Site::local_admins += { [1.0.0.0/8] = set("cloudflare@example.net", "postmaster@the.cloud") }; +redef Site::local_admins += { + [1.0.0.0/8] = set("cloudflare@example.net", "postmaster@the.cloud"), + [2.0.0.0/8] = set("2_dot@example.net"), + }; redef enum Notice::Type += { Test_Notice, @@ -15,7 +19,7 @@ redef enum Notice::Type += { event zeek_init() { - NOTICE([$note=Test_Notice, $msg="test", $identifier="static", $src=1.1.1.1, $dst=[::1]]); + NOTICE([$note=Test_Notice, $msg="test", $identifier="static", $src=1.1.1.1, $dst=2.2.2.2]); } hook Notice::policy(n: Notice::Info) &priority=1