mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
789cb376fd
This also installs symlinks from "zeek" and "bro-config" to a wrapper script that prints a deprecation warning. The btests pass, but this is still WIP. broctl renaming is still missing. #239
24 lines
578 B
Text
24 lines
578 B
Text
# @TEST-EXEC: zeek -r $TRACES/http/entity_gap2.trace %INPUT
|
|
# @TEST-EXEC: btest-diff entity_data
|
|
# @TEST-EXEC: btest-diff extract_files/file0
|
|
|
|
global f = open("entity_data");
|
|
global fn = 0;
|
|
|
|
event http_entity_data(c: connection, is_orig: bool, length: count,
|
|
data: string)
|
|
{
|
|
print f, data;
|
|
}
|
|
|
|
event content_gap(c: connection, is_orig: bool, seq: count, length: count)
|
|
{
|
|
print f, fmt("<%d byte gap>", length);
|
|
}
|
|
|
|
event file_new(f: fa_file)
|
|
{
|
|
Files::add_analyzer(f, Files::ANALYZER_EXTRACT,
|
|
[$extract_filename=fmt("file%d", fn)]);
|
|
++fn;
|
|
}
|