zeek/testing/btest/signatures/eval-condition.bro
Jon Siwek bef0ce1c98 Add type checking for signature 'eval' condition functions.
Otherwise functions could be called with a mismatching argument list
and cause a crash at run-time.  The incorrect function type is now
reported at parse-time.
2012-08-23 11:52:39 -05:00

20 lines
346 B
Text

# @TEST-EXEC: bro -r $TRACES/ftp-ipv4.trace %INPUT
# @TEST-EXEC: btest-diff conn.log
@load-sigs blah.sig
@TEST-START-FILE blah.sig
signature blah
{
ip-proto == tcp
src-port == 21
payload /.*/
eval mark_conn
}
@TEST-END-FILE
function mark_conn(state: signature_state, data: string): bool
{
add state$conn$service["blah"];
return T;
}