Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-12 19:48:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Several final fixes for PacketFilter framework.

Browse source 
- Fixed how the dpd_* variables are written.

- Fixed a bug with the shunting code.

- Updated a few tests.
This commit is contained in:
Seth Hall 2012-05-02 21:16:30 -04:00
parent 2ec7fbae62
commit 0c97c3c1de
17 changed files with 94 additions and 85 deletions
Download patch file Download diff file Expand all files Collapse all files

2
testing/btest/Baseline/core.print-bpf-filters/conn.log
View file

@ -5,4 +5,4 @@
#path conn
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes
#types time string addr port addr port enum string interval count count string bool count string count count count count
1128727435.450898 UWkUyAuUGXf 141.42.64.125 56730 125.190.109.199 80 tcp http 1.733303 98 9417 SF - 0 ShADdFaf 12 730 10 9945
1278600802.069419 UWkUyAuUGXf 10.20.80.1 50343 10.0.0.15 80 tcp - 0.004152 9 3429 SF - 0 ShADadfF 7 381 7 3801

14
testing/btest/Baseline/core.print-bpf-filters/output
View file

@ -5,7 +5,7 @@
#path packet_filter
#fields ts node filter init success
#types time string string bool bool
1328294052.330721 - ip or not ip T T
1335502481.107322 - ip or not ip T T
#separator \x09
#set_separator ,
#empty_field (empty)
@ -13,7 +13,7 @@
#path packet_filter
#fields ts node filter init success
#types time string string bool bool
1328294052.542418 - ((((((((((((((((((((((((port 53) or (tcp port 989)) or (tcp port 443)) or (port 6669)) or (udp and port 5353)) or (port 6668)) or (udp and port 5355)) or (tcp port 22)) or (tcp port 995)) or (port 21)) or (tcp port 25 or tcp port 587)) or (port 6667)) or (tcp port 614)) or (tcp port 990)) or (udp port 137)) or (tcp port 993)) or (tcp port 5223)) or (port 514)) or (tcp port 585)) or (tcp port 992)) or (tcp port 563)) or (tcp port 994)) or (tcp port 636)) or (tcp and port (80 or 81 or 631 or 1080 or 3138 or 8000 or 8080 or 8888))) or (port 6666) T T
1335502481.417564 - port 42 T T
#separator \x09
#set_separator ,
#empty_field (empty)
@ -21,12 +21,4 @@
#path packet_filter
#fields ts node filter init success
#types time string string bool bool
1328294052.748480 - port 42 T T
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path packet_filter
#fields ts node filter init success
#types time string string bool bool
1328294052.952845 - port 56730 T T
1335502481.737329 - (vlan) and (ip or not ip) T T

8
testing/btest/core/print-bpf-filters.bro
View file

@ -1,10 +1,8 @@
# @TEST-EXEC: bro -r $TRACES/empty.trace -e '' >output
# @TEST-EXEC: bro -r $TRACES/empty.trace >output
# @TEST-EXEC: cat packet_filter.log >>output
# @TEST-EXEC: bro -r $TRACES/empty.trace PacketFilter::all_packets=F >>output
# @TEST-EXEC: bro -r $TRACES/empty.trace -f "port 42" >>output
# @TEST-EXEC: cat packet_filter.log >>output
# @TEST-EXEC: bro -r $TRACES/empty.trace -f "port 42" -e '' >>output
# @TEST-EXEC: cat packet_filter.log >>output
# @TEST-EXEC: bro -r $TRACES/empty.trace -C -f "port 56730" -r $TRACES/mixed-vlan-mpls.trace >>output
# @TEST-EXEC: bro -r $TRACES/mixed-vlan-mpls.trace PacketFilter::restricted_filter="vlan" >>output
# @TEST-EXEC: cat packet_filter.log >>output
# @TEST-EXEC: btest-diff output
# @TEST-EXEC: btest-diff conn.log