zeek/testing/btest/signatures/load-sigs.bro
Jon Siwek bef0ce1c98 Add type checking for signature 'eval' condition functions.
Otherwise functions could be called with a mismatching argument list
and cause a crash at run-time.  The incorrect function type is now
reported at parse-time.
2012-08-23 11:52:39 -05:00

21 lines
428 B
Text

# A test of signature loading using @load-sigs.
# @TEST-EXEC: bro -C -r $TRACES/wikipedia.trace %INPUT >output
# @TEST-EXEC: btest-diff output
@load-sigs ./subdir/mysigs.sig
event signature_match(state: signature_state, msg: string, data: string)
{
print state$conn$id;
print msg;
print data;
}
@TEST-START-FILE subdir/mysigs.sig
signature my-sig {
ip-proto == tcp
payload /GET \/images/
event "works"
}
@TEST-END-FILE