mirror of
https://github.com/zeek/zeek.git
synced 2025-10-16 05:28:20 +00:00
0d3296590d
This avoids the earlier problem of not tracking ports correctly in scriptland, while still supporting `port` in EVT files and `%port` in Spicy files. As it turns out we are already following the same approach for file analyzers' MIME types, so I'm applying the same pattern: it's one event per port, without further customization points. That leaves the patch pretty small after all while fixing the original issue.
22 lines
461 B
Text
22 lines
461 B
Text
# @TEST-REQUIRES: have-spicy
|
|
#
|
|
# @TEST-EXEC-FAIL: spicyz %INPUT -d -o x.hlto >output 2>&1
|
|
# @TEST-EXEC: TEST_DIFF_CANONIFIER=diff-canonifier-spicy btest-diff output
|
|
|
|
protocol analyzer spicy::SSH over TCP:
|
|
port 123456/udp;
|
|
|
|
@TEST-START-NEXT
|
|
|
|
protocol analyzer spicy::SSH over TCP:
|
|
port -1/udp;
|
|
|
|
@TEST-START-NEXT
|
|
|
|
protocol analyzer spicy::SSH over TCP:
|
|
port 1/udp-2/tcp;
|
|
|
|
@TEST-START-NEXT
|
|
|
|
protocol analyzer spicy::SSH over TCP:
|
|
port 2/udp-1/udp;
|