# @TEST-REQUIRES: have-spicy # # @TEST-EXEC: spicyz test.spicy test.evt -d -o test.hlto # @TEST-EXEC: zeek -NN test.hlto | grep -q ANALYZER_SPICY_TEST # @TEST-EXEC: zeek -r ${TRACES}/http/post.trace test.hlto test.zeek "Spicy::enable_print = T;" >>output 2>&1 # @TEST-EXEC: btest-diff output # # @TEST-DOC: Smoke test for a custom ahead-of-time compiled Spicy analyzer hooked into Zeek. # @TEST-START-FILE test.spicy module test; import zeek; public type Dummy = unit { # Consume all data. We split data into lines and log the number of lines and the lines when done. data: bytes &eod &convert=$$.split(b"\r\n"); on %done { print |self.data|, self; } }; # @TEST-END-FILE # @TEST-START-FILE test.evt protocol analyzer spicy::Test over TCP: parse with test::Dummy; on test::Dummy -> event test::dummy(self.data); # @TEST-END-FILE # @TEST-START-FILE test.zeek module test; event test::dummy(data: vector of string) { print "Event:", data; } event zeek_init() { Analyzer::register_for_port(Analyzer::ANALYZER_SPICY_TEST, 80/tcp); } # @TEST-END-FILE