mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 06:38:20 +00:00
51 lines
1.4 KiB
Text
51 lines
1.4 KiB
Text
# @TEST-REQUIRES: have-spicy
|
|
#
|
|
# @TEST-EXEC: spicyz -d -o foo.hlto foo.spicy foo.evt
|
|
# @TEST-EXEC: zeek -r ${TRACES}/ssh/single-conn.trace foo.hlto %INPUT Spicy::enable_print=T >output
|
|
# @TEST-EXEC: btest-diff output
|
|
|
|
event zeek_init() {
|
|
Analyzer::register_for_port(Analyzer::ANALYZER_SPICY_X, 22/tcp);
|
|
}
|
|
|
|
# @TEST-START-FILE foo.spicy
|
|
module foo;
|
|
import zeek;
|
|
|
|
public type X = unit {
|
|
xs: bytes &eod {
|
|
local y = zeek::protocol_handle_get_or_create("spicy_Y");
|
|
local z = zeek::protocol_handle_get_or_create("spicy_Z");
|
|
|
|
zeek::protocol_data_in(zeek::is_orig(), b"only Y", y);
|
|
zeek::protocol_data_in(zeek::is_orig(), b"both Y and Z");
|
|
|
|
zeek::protocol_handle_close(z);
|
|
zeek::protocol_data_in(zeek::is_orig(), b"only Y after removal of Z");
|
|
|
|
zeek::protocol_handle_close(y);
|
|
zeek::protocol_data_in(zeek::is_orig(), b"goes nowhere");
|
|
}
|
|
};
|
|
|
|
public type Y = unit {
|
|
ys: bytes &eod &chunked { print "ys=%s" % $$; }
|
|
};
|
|
|
|
public type Z = unit {
|
|
zs: bytes &eod &chunked { print "zs=%s" % $$; }
|
|
};
|
|
# @TEST-END-FILE
|
|
|
|
# @TEST-START-FILE foo.evt
|
|
# Analyzer instantiated from Zeek based on the traffic.
|
|
protocol analyzer spicy::X over TCP:
|
|
parse originator with foo::X,
|
|
replaces SSH;
|
|
|
|
# Analyzers which will only be instantiated explicitly by us.
|
|
protocol analyzer spicy::Y over TCP:
|
|
parse originator with foo::Y;
|
|
protocol analyzer spicy::Z over TCP:
|
|
parse originator with foo::Z;
|
|
# @TEST-END-FILE
|