mirror of
https://github.com/zeek/zeek.git
synced 2025-10-10 10:38:20 +00:00
Expand the tests, and have email_admin email src contacts in one e-mail, and dst contacts in another.
This commit is contained in:
parent
9d0bd96e1f
commit
9d1e9a20e4
4 changed files with 38 additions and 12 deletions
|
@ -25,16 +25,8 @@ hook notice(n: Notice::Info)
|
||||||
{
|
{
|
||||||
local email = "";
|
local email = "";
|
||||||
if ( n?$src && |Site::get_emails(n$src)| > 0 )
|
if ( n?$src && |Site::get_emails(n$src)| > 0 )
|
||||||
email = Site::get_emails(n$src);
|
add n$email_dest[Site::get_emails(n$src)];
|
||||||
if ( n?$dst && |Site::get_emails(n$dst)| > 0 )
|
if ( n?$dst && |Site::get_emails(n$dst)| > 0 )
|
||||||
{
|
add n$email_dest[Site::get_emails(n$dst)];
|
||||||
if ( email != "" )
|
|
||||||
email = fmt("%s, %s", email, Site::get_emails(n$dst));
|
|
||||||
else
|
|
||||||
email = Site::get_emails(n$dst);
|
|
||||||
}
|
|
||||||
|
|
||||||
if ( email != "" )
|
|
||||||
add n$email_dest[email];
|
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
|
@ -0,0 +1,11 @@
|
||||||
|
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
|
||||||
|
#separator \x09
|
||||||
|
#set_separator ,
|
||||||
|
#empty_field (empty)
|
||||||
|
#unset_field -
|
||||||
|
#path notice
|
||||||
|
#open XXXX-XX-XX-XX-XX-XX
|
||||||
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p fuid file_mime_type file_desc proto note msg sub src dst p n peer_descr actions email_dest suppress_for remote_location.country_code remote_location.region remote_location.city remote_location.latitude remote_location.longitude
|
||||||
|
#types time string addr port addr port string string string enum enum string string addr addr port count string set[enum] set[string] interval string string string double double
|
||||||
|
XXXXXXXXXX.XXXXXX - - - - - - - - - Test_Notice test - 1.1.1.1 2.2.2.2 - - - Notice::ACTION_EMAIL_ADMIN,Notice::ACTION_LOG postmaster@the.cloud\x2c cloudflare@example.net,2_dot@example.net 3600.000000 - - - - -
|
||||||
|
#close XXXX-XX-XX-XX-XX-XX
|
|
@ -18,3 +18,22 @@ Email Extensions
|
||||||
--
|
--
|
||||||
[Automatically generated]
|
[Automatically generated]
|
||||||
|
|
||||||
|
------- cmdline args -----------
|
||||||
|
-t -oi
|
||||||
|
----------- stdin --------------
|
||||||
|
From: Zeek <zeek@localhost>
|
||||||
|
Subject: [Zeek] Test_Notice
|
||||||
|
To: 2_dot@example.net
|
||||||
|
User-Agent: Zeek/$zeek_version()
|
||||||
|
|
||||||
|
Message: test
|
||||||
|
|
||||||
|
Address: 1.1.1.1
|
||||||
|
|
||||||
|
Email Extensions
|
||||||
|
----------------
|
||||||
|
|
||||||
|
|
||||||
|
--
|
||||||
|
[Automatically generated]
|
||||||
|
|
||||||
|
|
|
@ -1,5 +1,6 @@
|
||||||
# @TEST-EXEC: zeek -b %INPUT
|
# @TEST-EXEC: zeek -b %INPUT
|
||||||
# @TEST-EXEC: btest-diff sendmail.out
|
# @TEST-EXEC: btest-diff sendmail.out
|
||||||
|
# @TEST-EXEC: btest-diff notice.log
|
||||||
|
|
||||||
@load base/frameworks/notice
|
@load base/frameworks/notice
|
||||||
@load base/utils/site
|
@load base/utils/site
|
||||||
|
@ -7,7 +8,10 @@
|
||||||
redef Notice::mail_dest = "user@example.net";
|
redef Notice::mail_dest = "user@example.net";
|
||||||
redef Notice::sendmail = "fake-sendmail";
|
redef Notice::sendmail = "fake-sendmail";
|
||||||
|
|
||||||
redef Site::local_admins += { [1.0.0.0/8] = set("cloudflare@example.net", "postmaster@the.cloud") };
|
redef Site::local_admins += {
|
||||||
|
[1.0.0.0/8] = set("cloudflare@example.net", "postmaster@the.cloud"),
|
||||||
|
[2.0.0.0/8] = set("2_dot@example.net"),
|
||||||
|
};
|
||||||
|
|
||||||
redef enum Notice::Type += {
|
redef enum Notice::Type += {
|
||||||
Test_Notice,
|
Test_Notice,
|
||||||
|
@ -15,7 +19,7 @@ redef enum Notice::Type += {
|
||||||
|
|
||||||
event zeek_init()
|
event zeek_init()
|
||||||
{
|
{
|
||||||
NOTICE([$note=Test_Notice, $msg="test", $identifier="static", $src=1.1.1.1, $dst=[::1]]);
|
NOTICE([$note=Test_Notice, $msg="test", $identifier="static", $src=1.1.1.1, $dst=2.2.2.2]);
|
||||||
}
|
}
|
||||||
|
|
||||||
hook Notice::policy(n: Notice::Info) &priority=1
|
hook Notice::policy(n: Notice::Info) &priority=1
|
||||||
|
|
Loading…
Add table
Add a link
Reference in a new issue