Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-08 17:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

mainly add a small test to the pacf framework that uses the debug

Browse source 
plugin for shunt / drop rule additions...
This commit is contained in:
Johanna Amann 2015-04-13 16:45:31 -07:00
parent 00204ab8a6
commit fd07b0bee9
3 changed files with 40 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

18
testing/btest/scripts/base/frameworks/pacf/basic.bro Normal file
View file

@ -0,0 +1,18 @@
# @TEST-EXEC: bro -r $TRACES/smtp.trace %INPUT
# @TEST-EXEC: btest-diff pacf.log
# @TEST-EXEC: btest-diff .stdout
@load base/frameworks/pacf
event bro_init()
{
local pacf_debug = Pacf::create_debug(T);
Pacf::activate(pacf_debug, 0);
}
event connection_established(c: connection)
{
local id = c$id;
Pacf::shunt_flow([$src_h=id$orig_h, $src_p=id$orig_p, $dst_h=id$resp_h, $dst_p=id$resp_p], 30sec);
Pacf::drop_address(id$orig_h, 15sec);
}