mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
04872d4e78
This change tracks the current offset (number of bytes fed into matchers) on the top-level RuleEndpointState such that we can compute the relative ending for matched texts individually. Additionally, it adds the data_end_offset as a new optional parameter to signature_match().
69 lines
2.1 KiB
Text
69 lines
2.1 KiB
Text
# @TEST-DOC: Check optional end_of_match parameter for signature_match() and custom events.
|
|
# @TEST-EXEC: zeek -b %INPUT -r $TRACES/http/get.trace
|
|
# @TEST-EXEC: btest-diff .stdout
|
|
# @TEST-EXEC: btest-diff .stderr
|
|
|
|
# Default is 1024, so we don't even peek into the second packet.
|
|
redef dpd_buffer_size = 1024 * 1024;
|
|
|
|
module DataEndOffset;
|
|
|
|
export {
|
|
global portability_match: event(state: signature_state, data: string, end_of_match: count);
|
|
global portability_match: event(state: signature_state, data: string);
|
|
|
|
global portability_match_with_msg: event(state: signature_state, msg: string, data: string, end_of_match: count);
|
|
global portability_match_with_msg: event(state: signature_state, msg: string, data: string);
|
|
}
|
|
|
|
@load-sigs ./test.sig
|
|
|
|
event signature_match(state: signature_state, msg: string, data: string)
|
|
{
|
|
print "signature_match", msg, |data|;
|
|
}
|
|
|
|
event signature_match(state: signature_state, msg: string, data: string, end_of_match: count)
|
|
{
|
|
print "signature_match with end_of_match", msg, |data|, data[:end_of_match];
|
|
}
|
|
|
|
event portability_match(state: signature_state, data: string, end_of_match: count)
|
|
{
|
|
print "portability_match with end_of_match", |data|, data[:end_of_match];
|
|
}
|
|
|
|
event portability_match(state: signature_state, data: string)
|
|
{
|
|
print "portability_match", |data|;
|
|
}
|
|
|
|
event portability_match_with_msg(state: signature_state, msg: string, data: string, end_of_match: count)
|
|
{
|
|
print "portability_match_with_msg with end_of_match", msg, |data|, end_of_match, data[:end_of_match];
|
|
}
|
|
|
|
event portability_match_with_msg(state: signature_state, msg: string, data: string)
|
|
{
|
|
print "portability_match_with_msg", msg, |data|;
|
|
}
|
|
|
|
@TEST-START-FILE test.sig
|
|
signature with-msg {
|
|
ip-proto == tcp
|
|
payload /.*portability.*/ # this is in the second packet.
|
|
event "message"
|
|
}
|
|
|
|
signature my-custom-event {
|
|
ip-proto == tcp
|
|
payload /.*portability.*/ # this is in the second packet.
|
|
event DataEndOffset::portability_match
|
|
}
|
|
|
|
signature my-custom-event2 {
|
|
ip-proto == tcp
|
|
payload /.*portability.*/ # this is in the second packet.
|
|
event DataEndOffset::portability_match_with_msg "custom message"
|
|
}
|
|
@TEST-END-FILE
|