mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
560f8a4a84
The ssl_history field may grow unbounded (e.g., ssl_alert event). Prevent this by capping using a configurable limit (default 100) and raise a weird once reached.
12 lines
650 B
Text
12 lines
650 B
Text
# Test max history length functionality
|
|
|
|
# @TEST-EXEC: zeek -r $TRACES/tls/tls-conn-with-extensions.trace
|
|
# @TEST-EXEC: zeek-cut uid ssl_history < ssl.log > ssl-max-history-length-default.log
|
|
# @TEST-EXEC: btest-diff ssl-max-history-length-default.log
|
|
# @TEST-EXEC: ! test -f weird.log
|
|
#
|
|
# @TEST-EXEC: zeek -r $TRACES/tls/tls-conn-with-extensions.trace SSL::max_ssl_history_length=3
|
|
# @TEST-EXEC: zeek-cut uid ssl_history < ssl.log > ssl-max-history-length-3.log
|
|
# @TEST-EXEC: zeek-cut uid name < weird.log > weird-max-history-length-3.log
|
|
# @TEST-EXEC: btest-diff ssl-max-history-length-3.log
|
|
# @TEST-EXEC: btest-diff weird-max-history-length-3.log
|