mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 22:58:20 +00:00
7344052b50
With this patch the model is:
- "print" cleans the data so that non-printable characters get
escaped. This is not necessarily reversible.
- to print in a reversible way, one can go through
escape_string(); this escapes backslashes as well to make the
decoding non-ambigious.
- Logging always escapes similar to escape_string(), making it
reversible.
Compared to master, we also change the escaping as follows:
- We now only escape with "\xXX", no more "^X" or "\0". Exception:
backslashes.
- We escape backlashes as "\\".
- There's no "alternative" output style anymore, i.e., fmt() '%A'
qualifier is gone.
Baselines in testing/btest are updated, external tests not yet.
Addresses BIT-1333.
26 lines
817 B
Text
26 lines
817 B
Text
FILE_NEW
|
|
file #0, 0, 0
|
|
FILE_OVER_NEW_CONNECTION
|
|
FILE_NEW
|
|
file #1, 0, 0
|
|
FILE_OVER_NEW_CONNECTION
|
|
FILE_STATE_REMOVE
|
|
file #1, 124, 0
|
|
[orig_h=192.168.1.77, orig_p=57655/tcp, resp_h=209.197.168.151, resp_p=1024/tcp]
|
|
FILE_BOF_BUFFER
|
|
\x00\x00\x05x\x00\x00\x0a\xf0\x00\x00\x10
|
|
source: IRC_DATA
|
|
MD5: 35288fd50a74c7d675909ff83424d7a1
|
|
SHA1: 8a98f177cb47e6bf771bf57c2f7e94c4b5e79ffa
|
|
SHA256: b24dde52b933a0d76e885ab418cb6d697b14a4e2fef45fce66e12ecc5a6a81aa
|
|
FILE_STATE_REMOVE
|
|
file #0, 42208, 0
|
|
[orig_h=192.168.1.77, orig_p=57655/tcp, resp_h=209.197.168.151, resp_p=1024/tcp]
|
|
FILE_BOF_BUFFER
|
|
PK\x03\x04\x14\x00\x00\x00\x08\x00\xae
|
|
MIME_TYPE
|
|
application/zip
|
|
source: IRC_DATA
|
|
MD5: 8c0803242f549c2780cb88b9a9215c65
|
|
SHA1: 8abe0239263fd7326eb803d4465cf494f8bea218
|
|
SHA256: e4f0b0b9d7580e7a22dc1093c8db4df7d0115a4f3b03cc2875cc69705f0d0204
|