Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

testing/http: Add pcap extracted from m5-long external test-suite

Browse source 
This tests that the HTTP version is now updated if it changes in the
course of a connection.
This commit is contained in:
Arne Welzel 2022-11-30 15:59:45 +01:00
parent dab551aaa3
commit 0b26866ecf
4 changed files with 30 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

12
testing/btest/Baseline/scripts.base.protocols.http.version-mismatch/http.log Normal file
View file

@ -0,0 +1,12 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path http
#open XXXX-XX-XX-XX-XX-XX
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer version user_agent origin request_body_len response_body_len status_code status_msg info_code info_msg tags username password proxied orig_fuids orig_filenames orig_mime_types resp_fuids resp_filenames resp_mime_types
#types time string addr port addr port count string string string string string string string count count count string count string set[enum] string string set[string] vector[string] vector[string] vector[string] vector[string] vector[string] vector[string]
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.1.102 1482 74.201.118.102 80 1 GET ad.afy11.net /srad.js?azId=1000000326207 http://d3.zedo.com/jsc/d3/ff2.html?n=1073;c=1;s=1;d=7;w=160;h=600 1.1 Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 - 0 12122 200 OK - - (empty) - - - - - - FdVLuk3tKSr7YHlidh - text/plain
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.1.102 1482 74.201.118.102 80 2 GET ad.afy11.net /ad?asId=1000000326207&sd=2x160x600&ct=7&enc=1&sf=0&sfd=0&ynw=0&anw=1&rand=71014409&rk1=46812516&rk2=XXXXXXXXXX.XXXXXX&pt=0 http://d3.zedo.com/jsc/d3/ff2.html?n=1073;c=1;s=1;d=7;w=160;h=600 1.0 Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 - 0 1254 200 OK - - (empty) - - - - - - F5aMef27icyTRBKeQa - application/javascript
#close XXXX-XX-XX-XX-XX-XX

11
testing/btest/Baseline/scripts.base.protocols.http.version-mismatch/weird.log Normal file
View file

@ -0,0 +1,11 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path weird
#open XXXX-XX-XX-XX-XX-XX
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer source
#types time string addr port addr port string string bool string string
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.1.102 1482 74.201.118.102 80 HTTP_version_mismatch - F zeek HTTP
#close XXXX-XX-XX-XX-XX-XX

BIN
testing/btest/Traces/http/version-mismatch.pcap Normal file
View file

Binary file not shown.

7
testing/btest/scripts/base/protocols/http/version-mismatch.zeek Normal file
View file

@ -0,0 +1,7 @@
# @TEST-DOC: Pcap extracted from 2009-M57-day11-18.trace: The server replies with HTTP/1.1, then HTTP/1.0 (also different Server headers).
# @TEST-EXEC: zeek -b -Cr $TRACES/http/version-mismatch.pcap %INPUT
# @TEST-EXEC: btest-diff http.log
# @TEST-EXEC: btest-diff weird.log
@load base/protocols/http
@load base/frameworks/notice/weird