mirror of
https://github.com/zeek/zeek.git
synced 2025-10-15 04:58:21 +00:00
7344052b50
With this patch the model is:
- "print" cleans the data so that non-printable characters get
escaped. This is not necessarily reversible.
- to print in a reversible way, one can go through
escape_string(); this escapes backslashes as well to make the
decoding non-ambigious.
- Logging always escapes similar to escape_string(), making it
reversible.
Compared to master, we also change the escaping as follows:
- We now only escape with "\xXX", no more "^X" or "\0". Exception:
backslashes.
- We escape backlashes as "\\".
- There's no "alternative" output style anymore, i.e., fmt() '%A'
qualifier is gone.
Baselines in testing/btest are updated, external tests not yet.
Addresses BIT-1333.
28 lines
727 B
Text
28 lines
727 B
Text
FILE_NEW
|
|
file #0, 0, 0
|
|
FILE_OVER_NEW_CONNECTION
|
|
FILE_STATE_REMOVE
|
|
file #0, 1022920, 0
|
|
[orig_h=192.168.72.14, orig_p=3254/tcp, resp_h=65.54.95.206, resp_p=80/tcp]
|
|
FILE_BOF_BUFFER
|
|
MZ\x90\x00\x03\x00\x00\x00\x04\x00\x00
|
|
MIME_TYPE
|
|
application/x-dosexec
|
|
total bytes: 1022920
|
|
source: HTTP
|
|
MD5: fc13fee1d44ef737a3133f1298b21d28
|
|
SHA1: 7d99803eaf3b6e8dfa3581348bc694089579d25a
|
|
SHA256: dcb87a62a2b5d449abc138776000fd1b14edc690e9da6ea325b8f352ab033202
|
|
FILE_NEW
|
|
file #1, 0, 0
|
|
FILE_OVER_NEW_CONNECTION
|
|
FILE_TIMEOUT
|
|
FILE_TIMEOUT
|
|
FILE_GAP
|
|
FILE_STATE_REMOVE
|
|
file #1, 206024, 816896
|
|
[orig_h=192.168.72.14, orig_p=3257/tcp, resp_h=65.54.95.14, resp_p=80/tcp]
|
|
FILE_BOF_BUFFER
|
|
\x1b\xb8=\xb1\xff\x10U\x10\xce\xc3^
|
|
total bytes: 1022920
|
|
source: HTTP
|