mirror of
https://github.com/zeek/zeek.git
synced 2025-10-04 15:48:19 +00:00
04872d4e78
This change tracks the current offset (number of bytes fed into matchers) on the top-level RuleEndpointState such that we can compute the relative ending for matched texts individually. Additionally, it adds the data_end_offset as a new optional parameter to signature_match().
22 lines
658 B
Text
22 lines
658 B
Text
# @TEST-DOC: Check optional data_end_offset parameter for signature_match()
|
|
# @TEST-EXEC: zeek -b -r $TRACES/dns-caa.pcap %INPUT
|
|
# @TEST-EXEC: btest-diff .stdout
|
|
# @TEST-EXEC: btest-diff .stderr
|
|
|
|
@load-sigs ./test.sig
|
|
|
|
event signature_match(state: signature_state, msg: string, data: string, data_end_offset: count)
|
|
{
|
|
print fmt("signature_match %s - %s - offset=%s", state$conn$id, msg, data_end_offset);
|
|
local s = split_string(hexdump(data[:data_end_offset]), /\n/);
|
|
for ( i in s ) print s[i];
|
|
}
|
|
|
|
@TEST-START-FILE test.sig
|
|
signature my_sig_udp_orig {
|
|
ip-proto == udp
|
|
payload /.+google/
|
|
udp-state originator
|
|
event "my_sig_udp_orig"
|
|
}
|
|
@TEST-END-FILE
|