mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 22:58:20 +00:00
a4d25c8828
This switches in from using strstr to use strnstr (implementation from FreeBSD on systems which do not bring their own implementation). It is especially likely that users come accross this when using the DATA_EVENT analyzer with files that contain binary data - the test uses exactly this case.
20 lines
445 B
Text
20 lines
445 B
Text
# Just a very basic test to check if ANALYZER_DATA_EVENT works.
|
|
# Also check if "in" works with binary data.
|
|
# @TEST-EXEC: bro -r $TRACES/pe/pe.trace %INPUT
|
|
# @TEST-EXEC: btest-diff .stdout
|
|
# @TEST-EXEC: btest-diff .stderr
|
|
|
|
event stream_data(f: fa_file, data: string)
|
|
{
|
|
if ( "Windows" in data )
|
|
{
|
|
print "Found";
|
|
}
|
|
}
|
|
|
|
event file_new (f: fa_file)
|
|
{
|
|
Files::add_analyzer(f, Files::ANALYZER_DATA_EVENT,
|
|
[$stream_event=stream_data]);
|
|
}
|
|
|