diff --git a/testing/btest/Baseline/scripts.base.protocols.http.version-mismatch/http.log b/testing/btest/Baseline/scripts.base.protocols.http.version-mismatch/http.log new file mode 100644 index 0000000000..23b43c9607 --- /dev/null +++ b/testing/btest/Baseline/scripts.base.protocols.http.version-mismatch/http.log @@ -0,0 +1,12 @@ +### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. +#separator \x09 +#set_separator , +#empty_field (empty) +#unset_field - +#path http +#open XXXX-XX-XX-XX-XX-XX +#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer version user_agent origin request_body_len response_body_len status_code status_msg info_code info_msg tags username password proxied orig_fuids orig_filenames orig_mime_types resp_fuids resp_filenames resp_mime_types +#types time string addr port addr port count string string string string string string string count count count string count string set[enum] string string set[string] vector[string] vector[string] vector[string] vector[string] vector[string] vector[string] +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.1.102 1482 74.201.118.102 80 1 GET ad.afy11.net /srad.js?azId=1000000326207 http://d3.zedo.com/jsc/d3/ff2.html?n=1073;c=1;s=1;d=7;w=160;h=600 1.1 Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 - 0 12122 200 OK - - (empty) - - - - - - FdVLuk3tKSr7YHlidh - text/plain +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.1.102 1482 74.201.118.102 80 2 GET ad.afy11.net /ad?asId=1000000326207&sd=2x160x600&ct=7&enc=1&sf=0&sfd=0&ynw=0&anw=1&rand=71014409&rk1=46812516&rk2=XXXXXXXXXX.XXXXXX&pt=0 http://d3.zedo.com/jsc/d3/ff2.html?n=1073;c=1;s=1;d=7;w=160;h=600 1.0 Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 - 0 1254 200 OK - - (empty) - - - - - - F5aMef27icyTRBKeQa - application/javascript +#close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/scripts.base.protocols.http.version-mismatch/weird.log b/testing/btest/Baseline/scripts.base.protocols.http.version-mismatch/weird.log new file mode 100644 index 0000000000..7fa1fc9d70 --- /dev/null +++ b/testing/btest/Baseline/scripts.base.protocols.http.version-mismatch/weird.log @@ -0,0 +1,11 @@ +### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. +#separator \x09 +#set_separator , +#empty_field (empty) +#unset_field - +#path weird +#open XXXX-XX-XX-XX-XX-XX +#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer source +#types time string addr port addr port string string bool string string +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.1.102 1482 74.201.118.102 80 HTTP_version_mismatch - F zeek HTTP +#close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Traces/http/version-mismatch.pcap b/testing/btest/Traces/http/version-mismatch.pcap new file mode 100644 index 0000000000..179e44f984 Binary files /dev/null and b/testing/btest/Traces/http/version-mismatch.pcap differ diff --git a/testing/btest/scripts/base/protocols/http/version-mismatch.zeek b/testing/btest/scripts/base/protocols/http/version-mismatch.zeek new file mode 100644 index 0000000000..9929122053 --- /dev/null +++ b/testing/btest/scripts/base/protocols/http/version-mismatch.zeek @@ -0,0 +1,7 @@ +# @TEST-DOC: Pcap extracted from 2009-M57-day11-18.trace: The server replies with HTTP/1.1, then HTTP/1.0 (also different Server headers). +# @TEST-EXEC: zeek -b -Cr $TRACES/http/version-mismatch.pcap %INPUT +# @TEST-EXEC: btest-diff http.log +# @TEST-EXEC: btest-diff weird.log + +@load base/protocols/http +@load base/frameworks/notice/weird