mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 06:38:20 +00:00
74af1ebe16
* alphabet * another * associated * avoiding * base * because * constructors * defining * deterministic * directly * endlessly * entity * function * indefinitely * initial * interpreter * into * modifying * negotiate * nonexistent * observations * occasional * omission * orphaned * overridden * passing * primitive * produces * reassembly * repository * restore * shouldn't * something * statement * the * therefore * transferred * uninitialized * unsuccessful Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>
8 lines
478 B
Text
8 lines
478 B
Text
# @TEST-EXEC: zeek -C -r $TRACES/http/multipart-form-data.pcap %INPUT
|
|
# @TEST-EXEC: btest-diff http.log
|
|
|
|
# This test is mainly checking the request_body_len field for correctness.
|
|
# Historical versions of Zeek would mistakenly count the body-lengths of the
|
|
# multipart sub-entities twice: once upon the end of the sub-entity and then
|
|
# again upon the end of the top-level entity that contains all sub-entities.
|
|
# The size of just the top-level entity is the correct one to use.
|