Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 22:58:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge remote-tracking branch 'origin/topic/robin/gh-3157-export-switch'

Browse source 
* origin/topic/robin/gh-3157-export-switch:
  [Spicy] Support `switch` fields when exporting Spicy types to Zeek.

(cherry picked from commit cd2c193cb2)
This commit is contained in:
Robin Sommer 2023-07-07 11:45:53 +02:00 • committed by Tim Wojtulewicz
parent 4ae02b7973
commit ddaa553418
3 changed files with 70 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

5
testing/btest/Baseline/spicy.export-switch/output Normal file
View file

@ -0,0 +1,5 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
[foo=12345\x0a]
[foo=ABCDE\x0a]
[foo=67890\x0a]
[foo=FGHIJ\x0a]

31
testing/btest/spicy/export-switch.zeek Normal file
View file

@ -0,0 +1,31 @@
# @TEST-REQUIRES: have-spicy
#
# @TEST-EXEC: spicyz -do test.hlto test.spicy test.evt
# @TEST-EXEC: zeek -Cr ${TRACES}/udp-packet.pcap test.hlto %INPUT >output 2>&1
# @TEST-EXEC: btest-diff output
#
# @TEST-DOC: Test exporting units with switches.
event TEST_ZEEK::MessageEvt(message: TEST::Message)
{ print message; }
# @TEST-START-FILE test.spicy
module TEST;
public type Message = unit {
switch (1) {
* -> foo: bytes &eod;
};
};
# @TEST-END-FILE
# @TEST-START-FILE test.evt
import TEST;
protocol analyzer spicy::Test over UDP:
port 0/udp - 42000/udp,
parse with TEST::Message;
export TEST::Message;
on TEST::Message -> event TEST_ZEEK::MessageEvt(self);
# @TEST-END-FILE