Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-09 10:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

make test more robust.

Browse source
This commit is contained in:
Bernhard Amann 2011-12-06 10:50:36 -08:00
parent 4a690484ec
commit 9f32f68a13
2 changed files with 9 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

9
testing/btest/Baseline/scripts.base.frameworks.input.port/out
View file

@ -1,6 +1,3 @@
Trying to find field: t
{
[1.2.3.4] = [p=80/tcp],
[1.2.4.6] = [p=30/unknown],
[1.2.3.5] = [p=52/udp]
}
[p=80/tcp]
[p=52/udp]
[p=30/unknown]

10
testing/btest/scripts/base/frameworks/input/port.bro
View file

@ -6,7 +6,7 @@
#fields i p t
1.2.3.4 80 tcp
1.2.3.5 52 udp
1.2.4.6 30 unknown
1.2.3.6 30 unknown
@TEST-END-FILE
redef InputAscii::empty_field = "EMPTY";
@ -31,9 +31,11 @@ event bro_init()
{
# first read in the old stuff into the table...
Input::create_stream(A::INPUT, [$source="input.log"]);
Input::add_tablefilter(A::INPUT, [$name="ssh", $idx=Idx, $val=Val, $destination=servers]);
Input::add_tablefilter(A::INPUT, [$name="input", $idx=Idx, $val=Val, $destination=servers]);
Input::force_update(A::INPUT);
print servers;
Input::remove_tablefilter(A::INPUT, "ssh");
print servers[1.2.3.4];
print servers[1.2.3.5];
print servers[1.2.3.6];
Input::remove_tablefilter(A::INPUT, "input");
Input::remove_stream(A::INPUT);
}