Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-11 11:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Merge remote-tracking branch 'origin/topic/awelzel/3278-spicy-fix-port-range-off-by-one'

Browse source 
* origin/topic/awelzel/3278-spicy-fix-port-range-off-by-one:
  spicy: Do not register port N+1 for port N in .evt file

(cherry picked from commit 6e6a2bee8a)
This commit is contained in:
Arne Welzel 2023-09-07 13:28:42 +02:00 • committed by Tim Wojtulewicz
parent 846d764886
commit c413c6d71a
4 changed files with 32 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

2
testing/btest/Baseline/spicy.port-range-one-port/out.filtered Normal file
View file

@ -0,0 +1,2 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
[zeek] Scheduling analyzer for port 31336/udp

24
testing/btest/spicy/port-range-one-port.zeek Normal file
View file

@ -0,0 +1,24 @@
# @TEST-REQUIRES: have-spicy
#
# @TEST-EXEC: spicyz -o test.hlto udp-test.spicy ./udp-test.evt
# @TEST-EXEC: HILTI_DEBUG=zeek zeek -Cr ${TRACES}/udp-packet.pcap test.hlto %INPUT >out 2>&1
# @TEST-EXEC: grep -e 'Scheduling analyzer' -e 'error during parsing' < out > out.filtered
# @TEST-EXEC: btest-diff out.filtered
# @TEST-DOC: Expect a single 'Scheduling analyzer ...' message in the debug output and no parsing errors. There was a bug that 'port 31336/udp' would be wrongly interpreted as a 31336/udp-31337/udp port range. Regression test for #3278.
# @TEST-START-FILE udp-test.spicy
module UDPTest;
public type Message = unit {
data: bytes &eod {
assert False: "not reached";
}
};
# @TEST-END-FILE
# @TEST-START-FILE udp-test.evt
protocol analyzer spicy::UDP_TEST over UDP:
parse with UDPTest::Message,
port 31336/udp;
# @TEST-END-FILE