Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-06 16:48:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Merge remote-tracking branch 'origin/topic/johanna/in-binary'

Browse source 
BIT-1845 #merged

* origin/topic/johanna/in-binary:
  Make "in" keyword work with binary data.
This commit is contained in:
Robin Sommer 2017-09-21 10:00:32 -07:00
commit ad6162ce44
4 changed files with 25 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

20
testing/btest/scripts/base/files/data_event/basic.bro Normal file
View file

@ -0,0 +1,20 @@
# Just a very basic test to check if ANALYZER_DATA_EVENT works.
# Also check if "in" works with binary data.
# @TEST-EXEC: bro -r $TRACES/pe/pe.trace %INPUT
# @TEST-EXEC: btest-diff .stdout
# @TEST-EXEC: btest-diff .stderr
event stream_data(f: fa_file, data: string)
{
if ( "Windows" in data )
{
print "Found";
}
}
event file_new (f: fa_file)
{
Files::add_analyzer(f, Files::ANALYZER_DATA_EVENT,
[$stream_event=stream_data]);
}