From 0e9cf7b0195244aef58b3ad260995d9ec25cd481 Mon Sep 17 00:00:00 2001
From: Johanna Amann <johanna@corelight.com>
Date: Thu, 6 Feb 2025 09:13:10 +0000
Subject: [PATCH] DPD: update test baselines; change options for external
 tests.

As services are sorted by default now, this disables the canonifier that
sorts the service field for the external baseline.

This also adds the tracking of disabled services in the service field
via DPD::track_removed_services_in_connection - to make such changes
more visible, and check that the feature works as desired.
---
 testing/external/commit-hash.zeek-testing     |  2 +-
 .../external/commit-hash.zeek-testing-private |  2 +-
 testing/external/scripts/testing-setup.zeek   |  1 +
 testing/scripts/diff-canonifier-external      |  1 -
 testing/scripts/diff-sort-conn-service        | 62 -------------------
 5 files changed, 3 insertions(+), 65 deletions(-)
 delete mode 100755 testing/scripts/diff-sort-conn-service

diff --git a/testing/external/commit-hash.zeek-testing b/testing/external/commit-hash.zeek-testing
index 71bb23074a..68acb346d6 100644
--- a/testing/external/commit-hash.zeek-testing
+++ b/testing/external/commit-hash.zeek-testing
@@ -1 +1 @@
-fe1c3a18274c2deaf060fa7c90e679d5244a99b1
+8d0a9f716837833be39bb67de1ae656058c81627
diff --git a/testing/external/commit-hash.zeek-testing-private b/testing/external/commit-hash.zeek-testing-private
index 3faaa09711..616deec535 100644
--- a/testing/external/commit-hash.zeek-testing-private
+++ b/testing/external/commit-hash.zeek-testing-private
@@ -1 +1 @@
-ae8e70135812845ef68ac0f8ce2426ad2ff82469
+e9ef2cc66068fceb881aed43fbc21a747d2f7e1f
diff --git a/testing/external/scripts/testing-setup.zeek b/testing/external/scripts/testing-setup.zeek
index e165d38ef2..8c7c03e1b9 100644
--- a/testing/external/scripts/testing-setup.zeek
+++ b/testing/external/scripts/testing-setup.zeek
@@ -3,6 +3,7 @@
 @load external-ca-list
 
 @load protocols/conn/failed-service-logging
+redef DPD::track_removed_services_in_connection=T;
 
 @ifdef ( SMTP::never_calc_md5 )
 	# MDD5s can depend on libmagic output.
diff --git a/testing/scripts/diff-canonifier-external b/testing/scripts/diff-canonifier-external
index d139420564..95949f8ec3 100755
--- a/testing/scripts/diff-canonifier-external
+++ b/testing/scripts/diff-canonifier-external
@@ -23,7 +23,6 @@ $(dirname $0)/diff-remove-timestamps |
     $(dirname $0)/diff-remove-uids |
     $(dirname $0)/diff-remove-file-ids |
     $(dirname $0)/diff-remove-x509-names |
-    $(dirname $0)/diff-sort-conn-service |
     $(dirname $0)/diff-sort-set-elements |
     $(dirname $0)/diff-remove-spicy-abspath |
     $(dirname $0)/diff-sort |
diff --git a/testing/scripts/diff-sort-conn-service b/testing/scripts/diff-sort-conn-service
deleted file mode 100755
index b66ff61350..0000000000
--- a/testing/scripts/diff-sort-conn-service
+++ /dev/null
@@ -1,62 +0,0 @@
-#! /usr/bin/env bash
-#
-# A diff canonifier that sorts conn.log service field (it's derived from a set
-# type and output may be unstable)
-
-awk '
-BEGIN {
-    FS="\t";
-    OFS="\t";
-    process = 0;
-    }
-
-function bubble_sort(arr, len,    keep_going, i, tmp)
-    {
-    keep_going = 1;
-
-    while ( keep_going == 1 )
-        {
-        keep_going = 0;
-
-        for ( i = 1; i <= len - 1; ++i )
-            {
-            if ( arr[i] > arr[i + 1] )
-                {
-                tmp = arr[i];
-                arr[i] = arr[i + 1];
-                arr[i + 1] = tmp;
-                keep_going = 1;
-                }
-            }
-        }
-
-    return len;
-    }
-
-$1 == "#path" && $2 == "conn" {
-    process = 1;
-    }
-
-/^[^#]/ {
-    if ( process && column1 > 0 && $column1 != "-" )
-        {
-        n = split($column1, set_contents, ",");
-        n = bubble_sort(set_contents, n);
-        sorted_field = set_contents[1];
-
-        for ( e = 2; e <= n; ++e )
-            sorted_field = sorted_field "," set_contents[e];
-
-        $column1 = sorted_field;
-        }
-    }
-
-/^#fields/ {
-    for ( i = 2; i <= NF; ++i ) {
-        if ( $i == "service" )
-            column1 = i - 1;
-        }
-    }
-
-{ print }
-'