mirror of
https://github.com/zeek/zeek.git
synced 2025-10-03 15:18:20 +00:00
c38e962030
The problem is that with certain compilers, the order of the file hash events is reversed (for at this moment unknown reasons). This fix simply removes all MD5 events from the dump-events test, only leaving the SHA1 events. This removes this condition during the test.
18 lines
802 B
Text
18 lines
802 B
Text
# @TEST-EXEC: bro -r $TRACES/smtp.trace policy/misc/dump-events.bro %INPUT >all-events.log
|
|
# @TEST-EXEC: bro -r $TRACES/smtp.trace policy/misc/dump-events.bro %INPUT DumpEvents::include_args=F >all-events-no-args.log
|
|
# @TEST-EXEC: bro -r $TRACES/smtp.trace policy/misc/dump-events.bro %INPUT DumpEvents::include=/smtp_/ >smtp-events.log
|
|
#
|
|
# @TEST-EXEC: btest-diff all-events.log
|
|
# @TEST-EXEC: btest-diff all-events-no-args.log
|
|
# @TEST-EXEC: btest-diff smtp-events.log
|
|
|
|
# There is some kind of race condition between the MD5 and SHA1 events, which are added
|
|
# by the SSL parser. Just remove MD5, this is not important for this test.
|
|
|
|
event file_over_new_connection(f: fa_file, c: connection, is_orig: bool) &priority=-5
|
|
{
|
|
if ( ! c?$ssl )
|
|
return;
|
|
|
|
Files::remove_analyzer(f, Files::ANALYZER_MD5);
|
|
}
|