mirror of
https://github.com/zeek/zeek.git
synced 2025-10-04 23:58:20 +00:00
789cb376fd
This also installs symlinks from "zeek" and "bro-config" to a wrapper script that prints a deprecation warning. The btests pass, but this is still WIP. broctl renaming is still missing. #239
44 lines
1.7 KiB
Text
44 lines
1.7 KiB
Text
# These tests all check that ICMP6 events get raised with correct arguments.
|
|
|
|
# @TEST-EXEC: zeek -b -r $TRACES/icmp/icmp-destunreach-udp.pcap %INPUT >>output 2>&1
|
|
# @TEST-EXEC: zeek -b -r $TRACES/icmp/icmp-timeexceeded.pcap %INPUT >>output 2>&1
|
|
# @TEST-EXEC: zeek -b -r $TRACES/icmp/icmp-ping.pcap %INPUT >>output 2>&1
|
|
|
|
# @TEST-EXEC: btest-diff output
|
|
|
|
event icmp_sent(c: connection, icmp: icmp_conn)
|
|
{
|
|
print "icmp_sent";
|
|
print " conn_id: " + fmt("%s", c$id);
|
|
print " icmp_conn: " + fmt("%s", icmp);
|
|
}
|
|
|
|
event icmp_echo_request(c: connection, icmp: icmp_conn, id: count, seq: count, payload: string)
|
|
{
|
|
print "icmp_echo_request (id=" + fmt("%d", id) + ", seq=" + fmt("%d", seq) + ", payload=" + payload + ")";
|
|
print " conn_id: " + fmt("%s", c$id);
|
|
print " icmp_conn: " + fmt("%s", icmp);
|
|
}
|
|
|
|
event icmp_echo_reply(c: connection, icmp: icmp_conn, id: count, seq: count, payload: string)
|
|
{
|
|
print "icmp_echo_reply (id=" + fmt("%d", id) + ", seq=" + fmt("%d", seq) + ", payload=" + payload + ")";
|
|
print " conn_id: " + fmt("%s", c$id);
|
|
print " icmp_conn: " + fmt("%s", icmp);
|
|
}
|
|
|
|
event icmp_unreachable(c: connection, icmp: icmp_conn, code: count, context: icmp_context)
|
|
{
|
|
print "icmp_unreachable (code=" + fmt("%d", code) + ")";
|
|
print " conn_id: " + fmt("%s", c$id);
|
|
print " icmp_conn: " + fmt("%s", icmp);
|
|
print " icmp_context: " + fmt("%s", context);
|
|
}
|
|
|
|
event icmp_time_exceeded(c: connection, icmp: icmp_conn, code: count, context: icmp_context)
|
|
{
|
|
print "icmp_time_exceeded (code=" + fmt("%d", code) + ")";
|
|
print " conn_id: " + fmt("%s", c$id);
|
|
print " icmp_conn: " + fmt("%s", icmp);
|
|
print " icmp_context: " + fmt("%s", context);
|
|
}
|