mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 06:38:20 +00:00
Merge remote-tracking branch 'origin/topic/vlad/analyzer_coverage'
* origin/topic/vlad/analyzer_coverage: Add btests for DNS WKS and BINDS Add btest for DNS WKS RR. Add btest for DNS NSEC3PARAM RR.
This commit is contained in:
commit
0746ef7ecc
14 changed files with 94 additions and 1 deletions
8
CHANGES
8
CHANGES
|
@ -1,3 +1,11 @@
|
||||||
|
4.2.0-dev.112 | 2021-09-03 18:12:12 +0000
|
||||||
|
|
||||||
|
* Add btests for DNS WKS and BINDS (Vlad Grigorescu)
|
||||||
|
|
||||||
|
* Add btest for DNS WKS RR. (Vlad Grigorescu)
|
||||||
|
|
||||||
|
* Add btest for DNS NSEC3PARAM RR. (Vlad Grigorescu)
|
||||||
|
|
||||||
4.2.0-dev.106 | 2021-09-03 18:10:31 +0000
|
4.2.0-dev.106 | 2021-09-03 18:10:31 +0000
|
||||||
|
|
||||||
* Code modernization: use ranged-based for loop where possible (Vlad Grigorescu)
|
* Code modernization: use ranged-based for loop where possible (Vlad Grigorescu)
|
||||||
|
|
2
VERSION
2
VERSION
|
@ -1 +1 @@
|
||||||
4.2.0-dev.106
|
4.2.0-dev.112
|
||||||
|
|
|
@ -0,0 +1,11 @@
|
||||||
|
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
|
||||||
|
#separator \x09
|
||||||
|
#set_separator ,
|
||||||
|
#empty_field (empty)
|
||||||
|
#unset_field -
|
||||||
|
#path dns
|
||||||
|
#open XXXX-XX-XX-XX-XX-XX
|
||||||
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto trans_id rtt query qclass qclass_name qtype qtype_name rcode rcode_name AA TC RD RA Z answers TTLs rejected auth addl
|
||||||
|
#types time string addr port addr port enum count interval string count string count string count string bool bool bool bool count vector[string] vector[interval] bool set[string] set[string]
|
||||||
|
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 10.87.3.74 51871 10.87.1.10 53 udp 27571 0.002004 example.net 1 C_INTERNET 65534 query-65534 0 NOERROR T F T T 2 BIND9 signing signal,BIND9 signing signal,BIND9 signing signal,BIND9 signing signal,BIND9 signing signal,BIND9 signing signal,BIND9 signing signal,BIND9 signing signal,BIND9 signing signal,BIND9 signing signal,BIND9 signing signal,BIND9 signing signal,BIND9 signing signal,BIND9 signing signal,BIND9 signing signal,BIND9 signing signal 0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000 F - -
|
||||||
|
#close XXXX-XX-XX-XX-XX-XX
|
|
@ -0,0 +1,17 @@
|
||||||
|
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
|
||||||
|
BINDS, [query=example.net, answer_type=1, algorithm=7, key_id=32018, removal_flag=0, complte_flag=\x01, is_query=0]
|
||||||
|
BINDS, [query=example.net, answer_type=1, algorithm=5, key_id=2196, removal_flag=0, complte_flag=\x01, is_query=0]
|
||||||
|
BINDS, [query=example.net, answer_type=1, algorithm=15, key_id=12994, removal_flag=0, complte_flag=\x01, is_query=0]
|
||||||
|
BINDS, [query=example.net, answer_type=1, algorithm=16, key_id=23868, removal_flag=0, complte_flag=\x01, is_query=0]
|
||||||
|
BINDS, [query=example.net, answer_type=1, algorithm=7, key_id=37611, removal_flag=0, complte_flag=\x01, is_query=0]
|
||||||
|
BINDS, [query=example.net, answer_type=1, algorithm=8, key_id=9551, removal_flag=0, complte_flag=\x01, is_query=0]
|
||||||
|
BINDS, [query=example.net, answer_type=1, algorithm=5, key_id=48254, removal_flag=0, complte_flag=\x01, is_query=0]
|
||||||
|
BINDS, [query=example.net, answer_type=1, algorithm=8, key_id=33130, removal_flag=0, complte_flag=\x01, is_query=0]
|
||||||
|
BINDS, [query=example.net, answer_type=1, algorithm=14, key_id=15141, removal_flag=0, complte_flag=\x01, is_query=0]
|
||||||
|
BINDS, [query=example.net, answer_type=1, algorithm=10, key_id=41675, removal_flag=0, complte_flag=\x01, is_query=0]
|
||||||
|
BINDS, [query=example.net, answer_type=1, algorithm=10, key_id=63711, removal_flag=0, complte_flag=\x01, is_query=0]
|
||||||
|
BINDS, [query=example.net, answer_type=1, algorithm=13, key_id=65395, removal_flag=0, complte_flag=\x01, is_query=0]
|
||||||
|
BINDS, [query=example.net, answer_type=1, algorithm=13, key_id=31400, removal_flag=0, complte_flag=\x01, is_query=0]
|
||||||
|
BINDS, [query=example.net, answer_type=1, algorithm=14, key_id=60289, removal_flag=0, complte_flag=\x01, is_query=0]
|
||||||
|
BINDS, [query=example.net, answer_type=1, algorithm=15, key_id=31000, removal_flag=0, complte_flag=\x01, is_query=0]
|
||||||
|
BINDS, [query=example.net, answer_type=1, algorithm=16, key_id=40187, removal_flag=0, complte_flag=\x01, is_query=0]
|
|
@ -0,0 +1,11 @@
|
||||||
|
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
|
||||||
|
#separator \x09
|
||||||
|
#set_separator ,
|
||||||
|
#empty_field (empty)
|
||||||
|
#unset_field -
|
||||||
|
#path dns
|
||||||
|
#open XXXX-XX-XX-XX-XX-XX
|
||||||
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto trans_id rtt query qclass qclass_name qtype qtype_name rcode rcode_name AA TC RD RA Z answers TTLs rejected auth addl
|
||||||
|
#types time string addr port addr port enum count interval string count string count string count string bool bool bool bool count vector[string] vector[interval] bool set[string] set[string]
|
||||||
|
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 10.87.3.18 53540 10.87.1.54 53 udp 15626 0.522010 sshfp.net 1 C_INTERNET 51 NSEC3PARAM 0 NOERROR F F T T 2 NSEC3PARAM 0.000000 F - -
|
||||||
|
#close XXXX-XX-XX-XX-XX-XX
|
|
@ -0,0 +1,2 @@
|
||||||
|
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
|
||||||
|
NSEC3PARAM, [query=sshfp.net, answer_type=1, nsec_flags=0, nsec_hash_algo=1, nsec_iter=20, nsec_salt_len=16, nsec_salt={\x1a\x90\xa9\x16\x19~E\xd0w*\xbc\xb6D\x11V, is_query=0], 7b1a90a916197e45d0772abcb6441156
|
|
@ -0,0 +1,11 @@
|
||||||
|
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
|
||||||
|
#separator \x09
|
||||||
|
#set_separator ,
|
||||||
|
#empty_field (empty)
|
||||||
|
#unset_field -
|
||||||
|
#path dns
|
||||||
|
#open XXXX-XX-XX-XX-XX-XX
|
||||||
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto trans_id rtt query qclass qclass_name qtype qtype_name rcode rcode_name AA TC RD RA Z answers TTLs rejected auth addl
|
||||||
|
#types time string addr port addr port enum count interval string count string count string count string bool bool bool bool count vector[string] vector[interval] bool set[string] set[string]
|
||||||
|
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 10.87.3.18 60059 10.87.1.10 53 udp 63119 0.001993 zeek.example.net 1 C_INTERNET 11 WKS 0 NOERROR T F T T 2 - - F - -
|
||||||
|
#close XXXX-XX-XX-XX-XX-XX
|
|
@ -0,0 +1,2 @@
|
||||||
|
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
|
||||||
|
WKS, dns_msg, dns_answer
|
BIN
testing/btest/Traces/dns/dns-binds.pcap
Normal file
BIN
testing/btest/Traces/dns/dns-binds.pcap
Normal file
Binary file not shown.
BIN
testing/btest/Traces/dns/dns-wks.pcap
Normal file
BIN
testing/btest/Traces/dns/dns-wks.pcap
Normal file
Binary file not shown.
BIN
testing/btest/Traces/dnssec/nsec3param.pcap
Normal file
BIN
testing/btest/Traces/dnssec/nsec3param.pcap
Normal file
Binary file not shown.
10
testing/btest/scripts/base/protocols/dns/binds.zeek
Normal file
10
testing/btest/scripts/base/protocols/dns/binds.zeek
Normal file
|
@ -0,0 +1,10 @@
|
||||||
|
# @TEST-EXEC: zeek -b -C -r $TRACES/dns/dns-binds.pcap %INPUT > output
|
||||||
|
# @TEST-EXEC: btest-diff dns.log
|
||||||
|
# @TEST-EXEC: btest-diff output
|
||||||
|
|
||||||
|
@load policy/protocols/dns/auth-addl
|
||||||
|
|
||||||
|
event dns_BINDS(c: connection, msg: dns_msg, ans: dns_answer, binds: dns_binds_rr)
|
||||||
|
{
|
||||||
|
print "BINDS", binds;
|
||||||
|
}
|
11
testing/btest/scripts/base/protocols/dns/nsec3param.zeek
Normal file
11
testing/btest/scripts/base/protocols/dns/nsec3param.zeek
Normal file
|
@ -0,0 +1,11 @@
|
||||||
|
# @TEST-EXEC: zeek -b -C -r $TRACES/dnssec/nsec3param.pcap %INPUT > output
|
||||||
|
# @TEST-EXEC: btest-diff dns.log
|
||||||
|
# @TEST-EXEC: btest-diff output
|
||||||
|
|
||||||
|
@load policy/protocols/dns/auth-addl
|
||||||
|
|
||||||
|
event dns_NSEC3PARAM(c: connection, msg: dns_msg, ans: dns_answer, nsec3param: dns_nsec3param_rr)
|
||||||
|
{
|
||||||
|
print "NSEC3PARAM", nsec3param,
|
||||||
|
bytestring_to_hexstr(nsec3param$nsec_salt);
|
||||||
|
}
|
10
testing/btest/scripts/base/protocols/dns/wks.zeek
Normal file
10
testing/btest/scripts/base/protocols/dns/wks.zeek
Normal file
|
@ -0,0 +1,10 @@
|
||||||
|
# @TEST-EXEC: zeek -b -C -r $TRACES/dns/dns-wks.pcap %INPUT > output
|
||||||
|
# @TEST-EXEC: btest-diff dns.log
|
||||||
|
# @TEST-EXEC: btest-diff output
|
||||||
|
|
||||||
|
@load policy/protocols/dns/auth-addl
|
||||||
|
|
||||||
|
event dns_WKS_reply(c: connection, msg: dns_msg, ans: dns_answer)
|
||||||
|
{
|
||||||
|
print "WKS", dns_msg, dns_answer;
|
||||||
|
}
|
Loading…
Add table
Add a link
Reference in a new issue