Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

btest/pop3: Add somewhat more elaborate testing

Browse source 
PCAP taken from here: https://tranalyzer.com/tutorial/pop and reference
added to Traces/README.
This commit is contained in:
Arne Welzel 2024-09-18 14:05:43 +02:00
parent 5a26a39d06
commit b4fdce8d5b
5 changed files with 92 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

20
testing/btest/scripts/base/protocols/pop3/basic.zeek Normal file
View file

@ -0,0 +1,20 @@
# @TEST-DOC: Ensure basic POP3 functionality.
# @TEST-EXEC: zeek -C -b -r $TRACES/pop3/pop3.pcap %INPUT >out
# @TEST-EXEC: btest-diff conn.log
# @TEST-EXEC: btest-diff out
# @TEST-EXEC: test ! -f weird.log
# @TEST-EXEC: test ! -f analyzer.log
@load base/frameworks/notice/weird
@load base/protocols/conn
@load base/protocols/pop3
event pop3_request(c: connection, is_orig: bool, cmd: string, arg: string)
{
print c$uid, "pop3_request", is_orig, cmd, arg;
}
event pop3_reply(c: connection, is_orig: bool, cmd: string, arg: string)
{
print c$uid, "pop3_reply", is_orig, cmd, arg;
}