mirror of
https://github.com/zeek/zeek.git
synced 2025-10-03 07:08:19 +00:00
789cb376fd
This also installs symlinks from "zeek" and "bro-config" to a wrapper script that prints a deprecation warning. The btests pass, but this is still WIP. broctl renaming is still missing. #239
18 lines
319 B
Text
18 lines
319 B
Text
#
|
|
# @TEST-EXEC: zeek -b -s mysig %INPUT
|
|
|
|
@TEST-START-FILE mysig.sig
|
|
signature my_ftp_client {
|
|
ip-proto == tcp
|
|
payload /(|.*[\n\r]) *[uU][sS][eE][rR] /
|
|
tcp-state originator
|
|
event "matched my_ftp_client"
|
|
}
|
|
@TEST-END-FILE
|
|
|
|
event zeek_init()
|
|
{
|
|
local a = get_matcher_stats();
|
|
if ( a$matchers == 0 )
|
|
exit(1);
|
|
}
|