diff --git a/testing/btest/Baseline/language.cross-product-init/output b/testing/btest/Baseline/language.cross-product-init/output new file mode 100644 index 0000000000..95794f9179 --- /dev/null +++ b/testing/btest/Baseline/language.cross-product-init/output @@ -0,0 +1,6 @@ +{ +[bar, 1.2.0.0/19] , +[foo, 5.6.0.0/21] , +[bar, 5.6.0.0/21] , +[foo, 1.2.0.0/19] +} diff --git a/testing/btest/Baseline/language.enum-scope/output b/testing/btest/Baseline/language.enum-scope/output new file mode 100644 index 0000000000..f2ad6c76f0 --- /dev/null +++ b/testing/btest/Baseline/language.enum-scope/output @@ -0,0 +1 @@ +c diff --git a/testing/btest/Baseline/language.match-test/output b/testing/btest/Baseline/language.match-test/output new file mode 100644 index 0000000000..5ee7ba029d --- /dev/null +++ b/testing/btest/Baseline/language.match-test/output @@ -0,0 +1,3 @@ +default +it's big +it's really big diff --git a/testing/btest/Baseline/language.match-test2/output b/testing/btest/Baseline/language.match-test2/output new file mode 100644 index 0000000000..0cfbf08886 --- /dev/null +++ b/testing/btest/Baseline/language.match-test2/output @@ -0,0 +1 @@ +2 diff --git a/testing/btest/Baseline/language.next-test/output b/testing/btest/Baseline/language.next-test/output new file mode 100644 index 0000000000..db9ce4efa4 --- /dev/null +++ b/testing/btest/Baseline/language.next-test/output @@ -0,0 +1,8 @@ +0 +1 +1 +MIDDLE +0 +0 +1 +THE END diff --git a/testing/btest/Baseline/language.rare-events/output b/testing/btest/Baseline/language.rare-events/output new file mode 100644 index 0000000000..1de3641284 --- /dev/null +++ b/testing/btest/Baseline/language.rare-events/output @@ -0,0 +1 @@ +1106953531.452525 DroppedPackets 2 packets dropped after filtering, 1109 received, 10000 on link diff --git a/testing/btest/Baseline/language.rec-of-tbl/output b/testing/btest/Baseline/language.rec-of-tbl/output new file mode 100644 index 0000000000..f7c06f0b63 --- /dev/null +++ b/testing/btest/Baseline/language.rec-of-tbl/output @@ -0,0 +1,3 @@ +[a={ +[5] = 3 +}] diff --git a/testing/btest/Baseline/language.sizeof/output b/testing/btest/Baseline/language.sizeof/output new file mode 100644 index 0000000000..0c1f3448c6 --- /dev/null +++ b/testing/btest/Baseline/language.sizeof/output @@ -0,0 +1,17 @@ +Address 1.2.3.4: 16909060 +Boolean T: 1 +Count 10: 10 +Double -1.23: 1.230000 +Enum ENUM3: 2 +File 21.000000 +Function add_interface: 2 +Integer -10: 10 +Interval -5.0 secs: 5.000000 +Net 192.168.0: 65536.000000 +Port 80/tcp: 65616 +Record [i=10, j=, k=]: 3 +Set: 3 +String 'Hello': 5 +Subnet 192.168.0.0/24: 256.000000 +Table 2 +Vector [Hello, , , , World]: 5 diff --git a/testing/btest/Baseline/language.smith-waterman-test/output b/testing/btest/Baseline/language.smith-waterman-test/output new file mode 100644 index 0000000000..b0d0d33526 --- /dev/null +++ b/testing/btest/Baseline/language.smith-waterman-test/output @@ -0,0 +1,32 @@ +abcdefgh - ijklmnop: +AAAabcefghij - lmnopAAAqrst: +tok 1: AAA (0/5, T) +abcAAAefghij - lmnopAAAqrst: +tok 1: AAA (3/5, T) +abcefghijAAA - lmnopAAAqrst: +tok 1: AAA (9/5, T) +xxxAAAyyy - AAAaAAAbAAA: +tok 1: AAA (3/0, T) +tok 2: AAA (3/4, T) +tok 3: AAA (3/8, T) +AAAaAAAbAAA - xxxAAAyyy: +tok 1: AAA (0/3, T) +tok 2: AAA (4/3, T) +tok 3: AAA (8/3, T) +xxCDyABzCDyABzz - ABCD: +tok 1: CD (2/2, T) +tok 2: AB (5/0, T) +tok 3: CD (8/2, F) +tok 4: AB (11/0, T) +ABCD - xxCDyABzCDyABzz: +tok 1: CD (2/2, T) +tok 2: AB (0/5, T) +tok 3: CD (2/8, F) +tok 4: AB (0/11, T) +Cache-control: no-cache^M^JAccept: - Accept-: deflate^M^JAccept-: Accept-: +tok 1: Accept (27/0, T) +tok 2: e^M^JAccept (22/15, T) +tok 3: Accept (27/29, T) +xxAAxxAAxx - yyyyyAAyyyyy: +tok 1: AA (2/5, T) +tok 2: AA (6/5, T) diff --git a/testing/btest/Baseline/language.strings/output b/testing/btest/Baseline/language.strings/output new file mode 100644 index 0000000000..525ce64916 --- /dev/null +++ b/testing/btest/Baseline/language.strings/output @@ -0,0 +1,25 @@ +Input string: broisaveryneatids + +String splitting +---------------- +Splitting 'broisaveryneatids' at 6 points... +bro +is +a +very +neat +ids + +Substrings +---------- +3@0: bro +5@2: roisa +7@4: isavery +10@10: yneatids + +Finding strings +--------------- +isa: 4 +very: 7 +ids: 15 +nono: 0 diff --git a/testing/btest/Baseline/language.wrong-delete-field/output b/testing/btest/Baseline/language.wrong-delete-field/output index c51fb6a37e..8d965362f1 100644 --- a/testing/btest/Baseline/language.wrong-delete-field/output +++ b/testing/btest/Baseline/language.wrong-delete-field/output @@ -1 +1 @@ -/da/home/robin/bro/master/testing/btest/.tmp/language.wrong-delete-field/wrong-delete-field.bro, line 11 (delete x$a): error, illegal delete statement +/da/home/robin/bro/master/testing/btest/.tmp/language.wrong-delete-field/wrong-delete-field.bro, line 10 (delete x$a): error, illegal delete statement diff --git a/testing/btest/language/cross-product-init.bro b/testing/btest/language/cross-product-init.bro new file mode 100644 index 0000000000..c12f9eb0bd --- /dev/null +++ b/testing/btest/language/cross-product-init.bro @@ -0,0 +1,10 @@ +# @TEST-EXEC: bro %INPUT >output 2>&1 +# @TEST-EXEC: btest-diff output + +global my_subs = { 1.2.3.4/19, 5.6.7.8/21 }; + +global x: set[string, subnet] &redef; + +redef x += { [["foo", "bar"], my_subs] }; + +print x; diff --git a/testing/btest/language/delete-field-set.bro b/testing/btest/language/delete-field-set.bro index 9469dbb2f0..ad7cf6e9fb 100644 --- a/testing/btest/language/delete-field-set.bro +++ b/testing/btest/language/delete-field-set.bro @@ -1,4 +1,3 @@ - # @TEST-EXEC: bro %INPUT >output 2>&1 # @TEST-EXEC: btest-diff output diff --git a/testing/btest/language/delete-field.bro b/testing/btest/language/delete-field.bro index 0aad10d55f..477466b76a 100644 --- a/testing/btest/language/delete-field.bro +++ b/testing/btest/language/delete-field.bro @@ -1,4 +1,3 @@ - # @TEST-EXEC: bro %INPUT >output 2>&1 # @TEST-EXEC: btest-diff output diff --git a/testing/btest/language/enum-scope.bro b/testing/btest/language/enum-scope.bro new file mode 100644 index 0000000000..c8667bfada --- /dev/null +++ b/testing/btest/language/enum-scope.bro @@ -0,0 +1,10 @@ +# @TEST-EXEC: bro %INPUT >output 2>&1 +# @TEST-EXEC: btest-diff output + +type foo: enum { a, b } &redef; + +module test; + +redef enum foo += { c }; + +print c; diff --git a/testing/btest/language/match-test.bro b/testing/btest/language/match-test.bro new file mode 100644 index 0000000000..9352d0f39f --- /dev/null +++ b/testing/btest/language/match-test.bro @@ -0,0 +1,20 @@ +# @TEST-EXEC: bro %INPUT >output 2>&1 +# @TEST-EXEC: btest-diff output + +global match_stuff = { + [$pred(a: count) = { return a > 5; }, + $result = "it's big", + $priority = 2], + + [$pred(a: count) = { return a > 15; }, + $result = "it's really big", + $priority = 3], + + [$pred(a: count) = { return T; }, + $result = "default", + $priority = 0], +}; + +print match 0 using match_stuff; +print match 10 using match_stuff; +print match 20 using match_stuff; diff --git a/testing/btest/language/match-test2.bro b/testing/btest/language/match-test2.bro new file mode 100644 index 0000000000..f1c120adf2 --- /dev/null +++ b/testing/btest/language/match-test2.bro @@ -0,0 +1,51 @@ +# @TEST-EXEC: bro %INPUT >output 2>&1 +# @TEST-EXEC: btest-diff output + +type fakealert : record { + alert: string; +}; + + +type match_rec : record { + result : count; + pred : function(rec : fakealert) : bool; + priority: count; +}; + + +#global test_set : set[int] = +#{ +#1, 2, 3 +#}; + +global match_set : set[match_rec] = +{ + [$result = 1, $pred(a: fakealert) = { return T; }, $priority = 8 ], + [$result = 2, $pred(a: fakealert) = { return T; }, $priority = 9 ] +}; + +global al : fakealert; + +#global testset : set[fakealert] = +#{ +# [$alert="hithere"] +#}; + + +type nonalert: record { + alert : string; + pred : function(a : int) : int; +}; + +#global na : nonalert; +#na$alert = "5"; + +#al$alert = "hithere2"; +#if (al in testset) +# print 1; +#else +# print 0; + + +al$alert = "hi"; +print (match al using match_set); diff --git a/testing/btest/language/next-test.bro b/testing/btest/language/next-test.bro new file mode 100644 index 0000000000..7e9626a62c --- /dev/null +++ b/testing/btest/language/next-test.bro @@ -0,0 +1,36 @@ +# @TEST-EXEC: bro %INPUT >output 2>&1 +# @TEST-EXEC: btest-diff output + +# This script tests "next" being called during the last iteration of a +# for loop + +event bro_done() + { + + local number_set: set[count]; + local i: count; + + add number_set[0]; + add number_set[1]; + + + for ( i in number_set ) + { + print fmt ("%d", i); + if ( i == 0 ) + next; + print fmt ("%d", i); + } + print fmt ("MIDDLE"); + + + for ( i in number_set ) + { + print fmt ("%d", i); + if ( i == 1 ) + next; + print fmt ("%d", i); + } + print fmt ("THE END"); + + } diff --git a/testing/btest/language/rare-events.bro b/testing/btest/language/rare-events.bro new file mode 100644 index 0000000000..ae7674d406 --- /dev/null +++ b/testing/btest/language/rare-events.bro @@ -0,0 +1,37 @@ +# @TEST-EXEC: bro %INPUT >output 2>&1 +# @TEST-EXEC: btest-diff output + +# This is a test script whose job is to generate rarely-seen events +# (i.e., events that test traces might not include) to ensure that they're +# handled properly. + +# This is needed or else the output fails on the warning that +# Drop::restore_dropped_address is never defined. +redef check_for_unused_event_handlers = F; + +@load netstats + +function test_net_stats_update() + { + local t = current_time(); + + local s: net_stats; + s$pkts_recvd = 1234; + s$pkts_dropped = 123; + s$pkts_link = 9999; + + event net_stats_update(t, s); + + local s2: net_stats; + s2$pkts_recvd = 2341; + s2$pkts_dropped = 125; + s2$pkts_link = 19999; + + event net_stats_update(t + 33 sec, s2); + } + +event bro_init() + { + test_net_stats_update(); + } + diff --git a/testing/btest/language/rec-nested-opt.bro b/testing/btest/language/rec-nested-opt.bro index eb7375541b..ab1a64dffd 100644 --- a/testing/btest/language/rec-nested-opt.bro +++ b/testing/btest/language/rec-nested-opt.bro @@ -1,4 +1,3 @@ - # @TEST-EXEC: bro %INPUT >output 2>&1 # @TEST-EXEC: btest-diff output diff --git a/testing/btest/language/rec-of-tbl.bro b/testing/btest/language/rec-of-tbl.bro new file mode 100644 index 0000000000..59d770bb30 --- /dev/null +++ b/testing/btest/language/rec-of-tbl.bro @@ -0,0 +1,16 @@ +# @TEST-EXEC: bro %INPUT >output 2>&1 +# @TEST-EXEC: btest-diff output + +type x: record { + a: table[int] of count; +}; + +global y: x; + +global yy: table[int] of count; + +y$a = yy; + +y$a[+5] = 3; + +print y; diff --git a/testing/btest/language/rec-table-default.bro b/testing/btest/language/rec-table-default.bro index 1473933e6a..ee4a0e25ee 100644 --- a/testing/btest/language/rec-table-default.bro +++ b/testing/btest/language/rec-table-default.bro @@ -1,4 +1,3 @@ - # @TEST-EXEC: bro %INPUT >output 2>&1 # @TEST-EXEC: btest-diff output diff --git a/testing/btest/language/sizeof.bro b/testing/btest/language/sizeof.bro new file mode 100644 index 0000000000..7db78212ad --- /dev/null +++ b/testing/btest/language/sizeof.bro @@ -0,0 +1,119 @@ +# @TEST-EXEC: bro %INPUT >output 2>&1 +# @TEST-EXEC: btest-diff output + +# Demo policy for the sizeof operator "|x|". +# ------------------------------------------ +# +# This script creates various types and values and shows the result of the +# sizeof operator on these values. +# +# For any types not covered in this script, the sizeof operator's semantics +# are not defined and its application returns a count of 0. At the moment +# the only type where this should happen is string patterns. + +type example_enum: enum { ENUM1, ENUM2, ENUM3 }; + +type example_record: record { + i: int &optional; + j: int &optional; + k: int &optional; +}; + +global a: addr = 1.2.3.4; +global b: bool = T; +global c: count = 10; +global d: double = -1.23; +global f: file = open_log_file("sizeof_demo"); +global i: int = -10; +global iv: interval = -5sec; +global n: net = 192.168.; +global p: port = 80/tcp; +global r: example_record [ $i = 10 ]; +global si: set[int]; +global s: string = "Hello"; +global sn: subnet = 192.168.0.0/24; +global t: table[string] of string; +global ti: time = current_time(); +global v: vector of string; + +# Additional initialization +# +print f, "12345678901234567890"; + +add si[1]; +add si[10]; +add si[100]; + +t["foo"] = "Hello"; +t["bar"] = "World"; + +v[0] = "Hello"; +v[4] = "World"; + +# Print out the sizes of the various vals: +#----------------------------------------- + +# Size of addr: returns integer representation for IPv4, 0 for IPv6. +print fmt("Address %s: %d", a, |a|); + +# Size of boolean: returns 1 or 0. +print fmt("Boolean %s: %d", b, |b|); + +# Size of count: identity. +print fmt("Count %s: %d", c, |c|); + +# Size of double: returns absolute value. +print fmt("Double %s: %f", d, |d|); + +# Size of enum: returns numeric value of enum constant. +print fmt("Enum %s: %d", ENUM3, |ENUM3|); + +# Size of file: returns current file size. +# Note that this is a double so that file sizes >> 4GB +# can be expressed. +print fmt("File %f", |f|); + +# Size of function: returns number of arguments. +print fmt("Function add_interface: %d", |add_interface|); + +# Size of integer: returns absolute value. +print fmt("Integer %s: %d", i, |i|); + +# Size of interval: returns double representation of the interval +print fmt("Interval %s: %f", iv, |iv|); + +# Size of net: returns size of class N network as a double +# (so that 2^32 can be expressed too). +print fmt("Net %s: %f", n, |n|); + +# Size of port: returns port number as a count. +print fmt("Port %s: %d", p, |p|); + +# Size of record: returns number of fields (assigned + unassigned) +print fmt("Record %s: %d", r, |r|); + +# Size of set: returns number of elements in set. +# Don't print the set, as its order depends on the seeding of the hash +# fnction, and it's not worth the trouble to normalize it. +print fmt("Set: %d", |si|); + +# Size of string: returns string length. +print fmt("String '%s': %d", s, |s|); + +# Size of subnet: returns size of net as a double +# (so that 2^32 can be expressed too). +print fmt("Subnet %s: %f", sn, |sn|); + +# Size of table: returns number of elements in table +print fmt("Table %d", |t|); + +# Size of time: returns double representation of the time +# print fmt("Time %s: %f", ti, |ti|); + +# Size of vector: returns largest assigned index. +# Note that this is not the number of assigned values. +# The following prints "5": +# +print fmt("Vector %s: %d", v, |v|); + +close(f); diff --git a/testing/btest/language/smith-waterman-test.bro b/testing/btest/language/smith-waterman-test.bro new file mode 100644 index 0000000000..50f5c1dae1 --- /dev/null +++ b/testing/btest/language/smith-waterman-test.bro @@ -0,0 +1,88 @@ +# @TEST-EXEC: bro %INPUT >output 2>&1 +# @TEST-EXEC: btest-diff output + +global params: sw_params = [ $min_strlen = 2, $sw_variant = 0 ]; + +global min: vector of count; +global mode: vector of count; +global c: count = 0; + +# Alignment pairs: +global s1: string_vec; +global s2: string_vec; + +# Single alignment, no matches: +s1[++c] = "abcdefgh"; +s2[c] = "ijklmnop"; +min[c] = 2;; +mode[c] = 0; + +# Simple single match, beginning: +s1[++c] = "AAAabcefghij"; +s2[c] = "lmnopAAAqrst"; +min[c] = 2;; +mode[c] = 0; + +# Simple single match, middle: +s1[++c] = "abcAAAefghij"; +s2[c] = "lmnopAAAqrst"; +min[c] = 2;; +mode[c] = 0; + +# Simple single match, end: +s1[++c] = "abcefghijAAA"; +s2[c] = "lmnopAAAqrst"; +min[c] = 2;; +mode[c] = 0; + +# Repeated alignment: +s1[++c] = "xxxAAAyyy"; +s2[c] = "AAAaAAAbAAA"; +min[c] = 2;; +mode[c] = 1; + +# Repeated alignment, swapped input: +s1[++c] = "AAAaAAAbAAA"; +s2[c] = "xxxAAAyyy"; +min[c] = 2;; +mode[c] = 1; + +# Repeated alignment, split: +s1[++c] = "xxCDyABzCDyABzz"; +s2[c] = "ABCD"; +min[c] = 2;; +mode[c] = 1; + +# Repeated alignment, split, swapped: +s1[++c] = "ABCD"; +s2[c] = "xxCDyABzCDyABzz"; +min[c] = 2;; +mode[c] = 1; + +# Used to cause problems +s1[++c] = "Cache-control: no-cache^M^JAccept:"; +s2[c] = "Accept-: deflate^M^JAccept-: Accept-"; +min[c] = 6; +mode[c] = 1; + +# Repeated occurrences in shorter string +s1[++c] = "xxAAxxAAxx"; +s2[c] = "yyyyyAAyyyyy"; +min[c] = 2; +mode[c] = 1; + +for ( i in s1 ) + { + local ss: sw_substring_vec; + + params$min_strlen = min[i]; + params$sw_variant = mode[i]; + ss = str_smith_waterman(s1[i], s2[i], params); + + print fmt("%s - %s:", s1[i], s2[i]); + + for ( j in ss ) + print fmt("tok %d: %s (%d/%d, %s)", + j, ss[j]$str, ss[j]$aligns[1]$index, + ss[j]$aligns[2]$index, ss[j]$new); + } diff --git a/testing/btest/language/strings.bro b/testing/btest/language/strings.bro new file mode 100644 index 0000000000..8e9eef43bf --- /dev/null +++ b/testing/btest/language/strings.bro @@ -0,0 +1,48 @@ +# @TEST-EXEC: bro %INPUT >output 2>&1 +# @TEST-EXEC: btest-diff output + +# Demo policy for string functions +# + +event bro_init() +{ + local s1: string = "broisaveryneatids"; + + print fmt("Input string: %s", s1); + print fmt(); + print fmt("String splitting"); + print fmt("----------------"); + + local idx1: index_vec; + + idx1[0] = 0; # We really need initializers for vectors ... + idx1[1] = 3; + idx1[2] = 5; + idx1[3] = 6; + idx1[4] = 10; + idx1[5] = 14; + + print fmt("Splitting '%s' at %d points...", s1, |idx1|); + local res_split: string_vec = str_split(s1, idx1); + + for ( i in res_split ) + print res_split[i]; + + print fmt(); + print fmt("Substrings"); + print fmt("----------"); + print fmt("3@0: %s", sub_bytes(s1, 0, 3)); + print fmt("5@2: %s", sub_bytes(s1, 2, 5)); + print fmt("7@4: %s", sub_bytes(s1, 4, 7)); + print fmt("10@10: %s", sub_bytes(s1, 10, 10)); + print fmt(); + + + print fmt("Finding strings"); + print fmt("---------------"); + print fmt("isa: %d", strstr(s1, "isa")); + print fmt("very: %d", strstr(s1, "very")); + print fmt("ids: %d", strstr(s1, "ids")); + print fmt("nono: %d", strstr(s1, "nono")); +} + diff --git a/testing/btest/language/wrong-delete-field.bro b/testing/btest/language/wrong-delete-field.bro index deffe379f4..0b58cc6fa0 100644 --- a/testing/btest/language/wrong-delete-field.bro +++ b/testing/btest/language/wrong-delete-field.bro @@ -1,4 +1,3 @@ - # @TEST-EXEC-FAIL: bro %INPUT >output 2>&1 # @TEST-EXEC: btest-diff output