mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 06:38:20 +00:00
1a74516db1
For backward compatibility when reading values, we first check the ZEEK-prefixed value, and if not set, then check the corresponding BRO-prefixed value.
41 lines
675 B
Text
41 lines
675 B
Text
# @TEST-EXEC: ZEEK_DNS_FAKE=1 zeek -b %INPUT >out
|
|
# @TEST-EXEC: btest-diff out
|
|
|
|
redef exit_only_after_terminate = T;
|
|
|
|
global addrs: set[addr] = {
|
|
google.com,
|
|
bing.com,
|
|
yahoo.com
|
|
};
|
|
|
|
global c: count = 0;
|
|
|
|
function check_terminate()
|
|
{
|
|
++c;
|
|
|
|
if ( c > 2 )
|
|
terminate();
|
|
}
|
|
|
|
event zeek_init()
|
|
{
|
|
print addrs;
|
|
|
|
when ( local result = lookup_hostname_txt("bro.wp.dg.cx") )
|
|
{
|
|
print "lookup_hostname_txt", result;
|
|
check_terminate();
|
|
}
|
|
when ( local result2 = lookup_hostname("example.com") )
|
|
{
|
|
print "lookup_hostname", result2;
|
|
check_terminate();
|
|
}
|
|
when ( local result3 = lookup_addr(1.2.3.4) )
|
|
{
|
|
print "lookup_addr", result3;
|
|
check_terminate();
|
|
}
|
|
}
|