Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-07 00:58:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Merge remote-tracking branch 'origin/topic/johanna/in-binary'

Browse source 
BIT-1845 #merged

* origin/topic/johanna/in-binary:
  Make "in" keyword work with binary data.
This commit is contained in:
Robin Sommer 2017-09-21 10:00:32 -07:00
commit ad6162ce44
4 changed files with 25 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

5
src/Expr.cc
View file

@ -4351,9 +4351,8 @@ Val* InExpr::Fold(Val* v1, Val* v2) const
const BroString* s1 = v1->AsString(); const BroString* s1 = v1->AsString();
const BroString* s2 = v2->AsString(); const BroString* s2 = v2->AsString();
// Could do better here - either roll our own, to deal with // Could do better here e.g. Boyer-Moore if done repeatedly.
// NULs, and/or Boyer-Moore if done repeatedly. return new Val(strstr_n(s2->Len(), s2->Bytes(), s1->Len(), reinterpret_cast<const unsigned char*>(s1->CheckString())) != -1, TYPE_BOOL);
return new Val(strstr(s2->CheckString(), s1->CheckString()) != 0, TYPE_BOOL);
} }
if ( v1->Type()->Tag() == TYPE_ADDR && if ( v1->Type()->Tag() == TYPE_ADDR &&

0
testing/btest/Baseline/scripts.base.files.data_event.basic/.stderr Normal file
View file

3
testing/btest/Baseline/scripts.base.files.data_event.basic/.stdout Normal file
View file

@ -0,0 +1,3 @@
Found
Found
Found

20
testing/btest/scripts/base/files/data_event/basic.bro Normal file
View file

@ -0,0 +1,20 @@
# Just a very basic test to check if ANALYZER_DATA_EVENT works.
# Also check if "in" works with binary data.
# @TEST-EXEC: bro -r $TRACES/pe/pe.trace %INPUT
# @TEST-EXEC: btest-diff .stdout
# @TEST-EXEC: btest-diff .stderr
event stream_data(f: fa_file, data: string)
{
if ( "Windows" in data )
{
print "Found";
}
}
event file_new (f: fa_file)
{
Files::add_analyzer(f, Files::ANALYZER_DATA_EVENT,
[$stream_event=stream_data]);
}