diff --git a/testing/btest/Baseline/frameworks.intel.insert-and-matcher/out b/testing/btest/Baseline/policy.frameworks.intel.insert-and-matcher/out similarity index 100% rename from testing/btest/Baseline/frameworks.intel.insert-and-matcher/out rename to testing/btest/Baseline/policy.frameworks.intel.insert-and-matcher/out diff --git a/testing/btest/Baseline/logging.adapt-filter/ssh-new-default.log b/testing/btest/Baseline/policy.frameworks.logging.adapt-filter/ssh-new-default.log similarity index 100% rename from testing/btest/Baseline/logging.adapt-filter/ssh-new-default.log rename to testing/btest/Baseline/policy.frameworks.logging.adapt-filter/ssh-new-default.log diff --git a/testing/btest/Baseline/logging.ascii-binary/ssh.log b/testing/btest/Baseline/policy.frameworks.logging.ascii-binary/ssh.log similarity index 100% rename from testing/btest/Baseline/logging.ascii-binary/ssh.log rename to testing/btest/Baseline/policy.frameworks.logging.ascii-binary/ssh.log diff --git a/testing/btest/Baseline/logging.ascii-empty/ssh.log b/testing/btest/Baseline/policy.frameworks.logging.ascii-empty/ssh.log similarity index 100% rename from testing/btest/Baseline/logging.ascii-empty/ssh.log rename to testing/btest/Baseline/policy.frameworks.logging.ascii-empty/ssh.log diff --git a/testing/btest/Baseline/logging.ascii-escape/ssh.log b/testing/btest/Baseline/policy.frameworks.logging.ascii-escape/ssh.log similarity index 100% rename from testing/btest/Baseline/logging.ascii-escape/ssh.log rename to testing/btest/Baseline/policy.frameworks.logging.ascii-escape/ssh.log diff --git a/testing/btest/Baseline/logging.ascii-options/ssh.log b/testing/btest/Baseline/policy.frameworks.logging.ascii-options/ssh.log similarity index 100% rename from testing/btest/Baseline/logging.ascii-options/ssh.log rename to testing/btest/Baseline/policy.frameworks.logging.ascii-options/ssh.log diff --git a/testing/btest/Baseline/logging.attr-extend/ssh.log b/testing/btest/Baseline/policy.frameworks.logging.attr-extend/ssh.log similarity index 100% rename from testing/btest/Baseline/logging.attr-extend/ssh.log rename to testing/btest/Baseline/policy.frameworks.logging.attr-extend/ssh.log diff --git a/testing/btest/Baseline/logging.attr/ssh.log b/testing/btest/Baseline/policy.frameworks.logging.attr/ssh.log similarity index 100% rename from testing/btest/Baseline/logging.attr/ssh.log rename to testing/btest/Baseline/policy.frameworks.logging.attr/ssh.log diff --git a/testing/btest/Baseline/logging.empty-event/ssh.log b/testing/btest/Baseline/policy.frameworks.logging.empty-event/ssh.log similarity index 100% rename from testing/btest/Baseline/logging.empty-event/ssh.log rename to testing/btest/Baseline/policy.frameworks.logging.empty-event/ssh.log diff --git a/testing/btest/Baseline/logging.events/output b/testing/btest/Baseline/policy.frameworks.logging.events/output similarity index 100% rename from testing/btest/Baseline/logging.events/output rename to testing/btest/Baseline/policy.frameworks.logging.events/output diff --git a/testing/btest/Baseline/logging.exclude/ssh.log b/testing/btest/Baseline/policy.frameworks.logging.exclude/ssh.log similarity index 100% rename from testing/btest/Baseline/logging.exclude/ssh.log rename to testing/btest/Baseline/policy.frameworks.logging.exclude/ssh.log diff --git a/testing/btest/Baseline/logging.file/ssh.log b/testing/btest/Baseline/policy.frameworks.logging.file/ssh.log similarity index 100% rename from testing/btest/Baseline/logging.file/ssh.log rename to testing/btest/Baseline/policy.frameworks.logging.file/ssh.log diff --git a/testing/btest/Baseline/logging.include/ssh.log b/testing/btest/Baseline/policy.frameworks.logging.include/ssh.log similarity index 100% rename from testing/btest/Baseline/logging.include/ssh.log rename to testing/btest/Baseline/policy.frameworks.logging.include/ssh.log diff --git a/testing/btest/Baseline/logging.path-func/output b/testing/btest/Baseline/policy.frameworks.logging.path-func/output similarity index 100% rename from testing/btest/Baseline/logging.path-func/output rename to testing/btest/Baseline/policy.frameworks.logging.path-func/output diff --git a/testing/btest/Baseline/logging.pred/ssh.failure.log b/testing/btest/Baseline/policy.frameworks.logging.pred/ssh.failure.log similarity index 100% rename from testing/btest/Baseline/logging.pred/ssh.failure.log rename to testing/btest/Baseline/policy.frameworks.logging.pred/ssh.failure.log diff --git a/testing/btest/Baseline/logging.pred/ssh.success.log b/testing/btest/Baseline/policy.frameworks.logging.pred/ssh.success.log similarity index 100% rename from testing/btest/Baseline/logging.pred/ssh.success.log rename to testing/btest/Baseline/policy.frameworks.logging.pred/ssh.success.log diff --git a/testing/btest/Baseline/logging.remote-types/receiver.ssh.log b/testing/btest/Baseline/policy.frameworks.logging.remote-types/receiver.ssh.log similarity index 100% rename from testing/btest/Baseline/logging.remote-types/receiver.ssh.log rename to testing/btest/Baseline/policy.frameworks.logging.remote-types/receiver.ssh.log diff --git a/testing/btest/Baseline/logging.remote/sender.ssh.failure.log b/testing/btest/Baseline/policy.frameworks.logging.remote/sender.ssh.failure.log similarity index 100% rename from testing/btest/Baseline/logging.remote/sender.ssh.failure.log rename to testing/btest/Baseline/policy.frameworks.logging.remote/sender.ssh.failure.log diff --git a/testing/btest/Baseline/logging.remote/sender.ssh.log b/testing/btest/Baseline/policy.frameworks.logging.remote/sender.ssh.log similarity index 100% rename from testing/btest/Baseline/logging.remote/sender.ssh.log rename to testing/btest/Baseline/policy.frameworks.logging.remote/sender.ssh.log diff --git a/testing/btest/Baseline/logging.remote/sender.ssh.success.log b/testing/btest/Baseline/policy.frameworks.logging.remote/sender.ssh.success.log similarity index 100% rename from testing/btest/Baseline/logging.remote/sender.ssh.success.log rename to testing/btest/Baseline/policy.frameworks.logging.remote/sender.ssh.success.log diff --git a/testing/btest/Baseline/logging.remove/ssh.failure.log b/testing/btest/Baseline/policy.frameworks.logging.remove/ssh.failure.log similarity index 100% rename from testing/btest/Baseline/logging.remove/ssh.failure.log rename to testing/btest/Baseline/policy.frameworks.logging.remove/ssh.failure.log diff --git a/testing/btest/Baseline/logging.remove/ssh.log b/testing/btest/Baseline/policy.frameworks.logging.remove/ssh.log similarity index 100% rename from testing/btest/Baseline/logging.remove/ssh.log rename to testing/btest/Baseline/policy.frameworks.logging.remove/ssh.log diff --git a/testing/btest/Baseline/logging.rotate-custom/out b/testing/btest/Baseline/policy.frameworks.logging.rotate-custom/out similarity index 100% rename from testing/btest/Baseline/logging.rotate-custom/out rename to testing/btest/Baseline/policy.frameworks.logging.rotate-custom/out diff --git a/testing/btest/Baseline/logging.rotate/out b/testing/btest/Baseline/policy.frameworks.logging.rotate/out similarity index 100% rename from testing/btest/Baseline/logging.rotate/out rename to testing/btest/Baseline/policy.frameworks.logging.rotate/out diff --git a/testing/btest/Baseline/logging.stdout/output b/testing/btest/Baseline/policy.frameworks.logging.stdout/output similarity index 100% rename from testing/btest/Baseline/logging.stdout/output rename to testing/btest/Baseline/policy.frameworks.logging.stdout/output diff --git a/testing/btest/Baseline/logging.test-logging/ssh.log b/testing/btest/Baseline/policy.frameworks.logging.test-logging/ssh.log similarity index 100% rename from testing/btest/Baseline/logging.test-logging/ssh.log rename to testing/btest/Baseline/policy.frameworks.logging.test-logging/ssh.log diff --git a/testing/btest/Baseline/logging.types/ssh.log b/testing/btest/Baseline/policy.frameworks.logging.types/ssh.log similarity index 100% rename from testing/btest/Baseline/logging.types/ssh.log rename to testing/btest/Baseline/policy.frameworks.logging.types/ssh.log diff --git a/testing/btest/Baseline/logging.unset-record/testing.log b/testing/btest/Baseline/policy.frameworks.logging.unset-record/testing.log similarity index 100% rename from testing/btest/Baseline/logging.unset-record/testing.log rename to testing/btest/Baseline/policy.frameworks.logging.unset-record/testing.log diff --git a/testing/btest/Baseline/logging.vec/ssh.log b/testing/btest/Baseline/policy.frameworks.logging.vec/ssh.log similarity index 100% rename from testing/btest/Baseline/logging.vec/ssh.log rename to testing/btest/Baseline/policy.frameworks.logging.vec/ssh.log diff --git a/testing/btest/btest.cfg b/testing/btest/btest.cfg index d067bb56d6..c46dd2d58a 100644 --- a/testing/btest/btest.cfg +++ b/testing/btest/btest.cfg @@ -1,5 +1,5 @@ [btest] -TestDirs = doc bifs logging language core policy istate frameworks +TestDirs = doc bifs language core policy istate TmpDir = %(testbase)s/.tmp BaselineDir = %(testbase)s/Baseline IgnoreDirs = .svn CVS .tmp diff --git a/testing/btest/frameworks/intel/insert-and-matcher.bro b/testing/btest/policy/frameworks/intel/insert-and-matcher.bro similarity index 100% rename from testing/btest/frameworks/intel/insert-and-matcher.bro rename to testing/btest/policy/frameworks/intel/insert-and-matcher.bro diff --git a/testing/btest/logging/adapt-filter.bro b/testing/btest/policy/frameworks/logging/adapt-filter.bro similarity index 100% rename from testing/btest/logging/adapt-filter.bro rename to testing/btest/policy/frameworks/logging/adapt-filter.bro diff --git a/testing/btest/logging/ascii-binary.bro b/testing/btest/policy/frameworks/logging/ascii-binary.bro similarity index 100% rename from testing/btest/logging/ascii-binary.bro rename to testing/btest/policy/frameworks/logging/ascii-binary.bro diff --git a/testing/btest/logging/ascii-empty.bro b/testing/btest/policy/frameworks/logging/ascii-empty.bro similarity index 100% rename from testing/btest/logging/ascii-empty.bro rename to testing/btest/policy/frameworks/logging/ascii-empty.bro diff --git a/testing/btest/logging/ascii-escape.bro b/testing/btest/policy/frameworks/logging/ascii-escape.bro similarity index 100% rename from testing/btest/logging/ascii-escape.bro rename to testing/btest/policy/frameworks/logging/ascii-escape.bro diff --git a/testing/btest/logging/ascii-options.bro b/testing/btest/policy/frameworks/logging/ascii-options.bro similarity index 100% rename from testing/btest/logging/ascii-options.bro rename to testing/btest/policy/frameworks/logging/ascii-options.bro diff --git a/testing/btest/logging/attr-extend.bro b/testing/btest/policy/frameworks/logging/attr-extend.bro similarity index 100% rename from testing/btest/logging/attr-extend.bro rename to testing/btest/policy/frameworks/logging/attr-extend.bro diff --git a/testing/btest/logging/attr.bro b/testing/btest/policy/frameworks/logging/attr.bro similarity index 100% rename from testing/btest/logging/attr.bro rename to testing/btest/policy/frameworks/logging/attr.bro diff --git a/testing/btest/logging/disable-stream.bro b/testing/btest/policy/frameworks/logging/disable-stream.bro similarity index 100% rename from testing/btest/logging/disable-stream.bro rename to testing/btest/policy/frameworks/logging/disable-stream.bro diff --git a/testing/btest/logging/empty-event.bro b/testing/btest/policy/frameworks/logging/empty-event.bro similarity index 100% rename from testing/btest/logging/empty-event.bro rename to testing/btest/policy/frameworks/logging/empty-event.bro diff --git a/testing/btest/logging/events.bro b/testing/btest/policy/frameworks/logging/events.bro similarity index 100% rename from testing/btest/logging/events.bro rename to testing/btest/policy/frameworks/logging/events.bro diff --git a/testing/btest/logging/exclude.bro b/testing/btest/policy/frameworks/logging/exclude.bro similarity index 100% rename from testing/btest/logging/exclude.bro rename to testing/btest/policy/frameworks/logging/exclude.bro diff --git a/testing/btest/logging/file.bro b/testing/btest/policy/frameworks/logging/file.bro similarity index 100% rename from testing/btest/logging/file.bro rename to testing/btest/policy/frameworks/logging/file.bro diff --git a/testing/btest/logging/include.bro b/testing/btest/policy/frameworks/logging/include.bro similarity index 100% rename from testing/btest/logging/include.bro rename to testing/btest/policy/frameworks/logging/include.bro diff --git a/testing/btest/logging/no-local.bro b/testing/btest/policy/frameworks/logging/no-local.bro similarity index 100% rename from testing/btest/logging/no-local.bro rename to testing/btest/policy/frameworks/logging/no-local.bro diff --git a/testing/btest/logging/path-func.bro b/testing/btest/policy/frameworks/logging/path-func.bro similarity index 100% rename from testing/btest/logging/path-func.bro rename to testing/btest/policy/frameworks/logging/path-func.bro diff --git a/testing/btest/logging/pred.bro b/testing/btest/policy/frameworks/logging/pred.bro similarity index 100% rename from testing/btest/logging/pred.bro rename to testing/btest/policy/frameworks/logging/pred.bro diff --git a/testing/btest/logging/remote-types.bro b/testing/btest/policy/frameworks/logging/remote-types.bro similarity index 100% rename from testing/btest/logging/remote-types.bro rename to testing/btest/policy/frameworks/logging/remote-types.bro diff --git a/testing/btest/logging/remote.bro b/testing/btest/policy/frameworks/logging/remote.bro similarity index 100% rename from testing/btest/logging/remote.bro rename to testing/btest/policy/frameworks/logging/remote.bro diff --git a/testing/btest/logging/remove.bro b/testing/btest/policy/frameworks/logging/remove.bro similarity index 100% rename from testing/btest/logging/remove.bro rename to testing/btest/policy/frameworks/logging/remove.bro diff --git a/testing/btest/logging/rotate-custom.bro b/testing/btest/policy/frameworks/logging/rotate-custom.bro similarity index 100% rename from testing/btest/logging/rotate-custom.bro rename to testing/btest/policy/frameworks/logging/rotate-custom.bro diff --git a/testing/btest/logging/rotate.bro b/testing/btest/policy/frameworks/logging/rotate.bro similarity index 100% rename from testing/btest/logging/rotate.bro rename to testing/btest/policy/frameworks/logging/rotate.bro diff --git a/testing/btest/logging/rotation.trace b/testing/btest/policy/frameworks/logging/rotation.trace similarity index 100% rename from testing/btest/logging/rotation.trace rename to testing/btest/policy/frameworks/logging/rotation.trace diff --git a/testing/btest/logging/stdout.bro b/testing/btest/policy/frameworks/logging/stdout.bro similarity index 100% rename from testing/btest/logging/stdout.bro rename to testing/btest/policy/frameworks/logging/stdout.bro diff --git a/testing/btest/logging/test-logging.bro b/testing/btest/policy/frameworks/logging/test-logging.bro similarity index 100% rename from testing/btest/logging/test-logging.bro rename to testing/btest/policy/frameworks/logging/test-logging.bro diff --git a/testing/btest/logging/types.bro b/testing/btest/policy/frameworks/logging/types.bro similarity index 100% rename from testing/btest/logging/types.bro rename to testing/btest/policy/frameworks/logging/types.bro diff --git a/testing/btest/logging/unset-record.log b/testing/btest/policy/frameworks/logging/unset-record.log similarity index 100% rename from testing/btest/logging/unset-record.log rename to testing/btest/policy/frameworks/logging/unset-record.log diff --git a/testing/btest/logging/vec.bro b/testing/btest/policy/frameworks/logging/vec.bro similarity index 100% rename from testing/btest/logging/vec.bro rename to testing/btest/policy/frameworks/logging/vec.bro diff --git a/testing/btest/software/default-version-parsing.bro b/testing/btest/software/default-version-parsing.bro deleted file mode 100644 index 70941ce54c..0000000000 --- a/testing/btest/software/default-version-parsing.bro +++ /dev/null @@ -1,66 +0,0 @@ -# @TEST-EXEC: bro %INPUT > output -# @TEST-EXEC: btest-diff output - -@load software - -global ts = network_time(); -global matched_software: table[string] of Software::Info = { - ["OpenSSH_4.4"] = - [$name="OpenSSH", $version=[$major=4,$minor=4], $host=0.0.0.0, $ts=ts], - ["OpenSSH_5.2"] = - [$name="OpenSSH", $version=[$major=5,$minor=2], $host=0.0.0.0, $ts=ts], - ["Apache/2.0.63 (Unix) mod_auth_kerb/5.3 mod_ssl/2.0.63 OpenSSL/0.9.7a mod_fastcgi/2.4.2"] = - [$name="Apache", $version=[$major=2,$minor=0,$minor2=63,$addl="Unix"], $host=0.0.0.0, $ts=ts], - ["Apache/1.3.19 (Unix)"] = - [$name="Apache", $version=[$major=1,$minor=3,$minor2=19,$addl="Unix"], $host=0.0.0.0, $ts=ts], - # $addl is not quite right here, but it's close enough. - ["ProFTPD 1.2.5rc1 Server (Debian)"] = - [$name="ProFTPD", $version=[$major=1,$minor=2,$minor2=5,$addl="rc"], $host=0.0.0.0, $ts=ts], - ["wu-2.4.2-academ[BETA-18-VR14](1)"] = - [$name="wu", $version=[$major=2,$minor=4,$minor2=2,$addl="academ"], $host=0.0.0.0, $ts=ts], - ["wu-2.6.2(1)"] = - [$name="wu", $version=[$major=2,$minor=6,$minor2=2,$addl="1"], $host=0.0.0.0, $ts=ts], - ["Java1.2.2-JDeveloper"] = - [$name="Java", $version=[$major=1,$minor=2,$minor2=2,$addl="JDeveloper"], $host=0.0.0.0, $ts=ts], - ["Java/1.6.0_13"] = - [$name="Java", $version=[$major=1,$minor=6,$minor2=0,$addl="13"], $host=0.0.0.0, $ts=ts], - # Web Browers are going to have to be pre processed before sending here. - # They can't be handled generically by the software framework. - ["Firefox/3.6.7"] = - [$name="Firefox", $version=[$major=3,$minor=6,$minor2=7], $host=0.0.0.0, $ts=ts], - ["Firefox/4.0b9pre"] = - [$name="Firefox", $version=[$major=4,$minor=0, $addl="b9pre"], $host=0.0.0.0, $ts=ts], - ["Python-urllib/3.1"] = - [$name="Python-urllib", $version=[$major=3,$minor=1], $host=0.0.0.0, $ts=ts], - ["libwww-perl/5.820"] = - [$name="libwww-perl", $version=[$major=5,$minor=820], $host=0.0.0.0, $ts=ts], - ["Wget/1.9+cvs-stable (Red Hat modified)"] = - [$name="Wget", $version=[$major=1,$minor=9,$addl="+cvs"], $host=0.0.0.0, $ts=ts], - ["Wget/1.11.4 (Red Hat modified)"] = - [$name="Wget", $version=[$major=1,$minor=11,$minor2=4,$addl="Red"], $host=0.0.0.0, $ts=ts], - # This is currently broken due to the do_split bug. - #["curl/7.15.1 (i486-pc-linux-gnu) libcurl/7.15.1 OpenSSL/0.9.8a zlib/1.2.3 libidn/0.5.18"] = - # [$name="curl", $version=[$major=7,$minor=15,$minor2=1], $host=0.0.0.0, $ts=ts], - ["Apache"] = - [$name="Apache", $host=0.0.0.0, $ts=ts], - ["Zope/(Zope 2.7.8-final, python 2.3.5, darwin) ZServer/1.1 Plone/Unknown"] = - [$name="Zope/(Zope", $version=[$major=2,$minor=7,$minor2=8,$addl="final"], $host=0.0.0.0, $ts=ts], -}; - -event bro_init() - { - for ( sw in matched_software ) - { - local output = Software::parse(sw, 0.0.0.0, Software::UNKNOWN); - local sw_test: Software::Info = matched_software[sw]; - if ( sw_test$name == output$name && - Software::cmp_versions(sw_test$version,output$version) == 0 ) - print fmt("success on: %s", sw); - else - { - print fmt("failure on: %s", sw); - print fmt(" name: %s", output$name); - print fmt(" version: %s", output$version); - } - } - } \ No newline at end of file