Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Add btest for "-C" flag vs the script-layer ignore_checksums global.

Browse source
This commit is contained in:
Christian Kreibich 2023-04-21 13:42:36 -07:00
parent 5041efd8e7
commit 1a1feec887
8 changed files with 58 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

3
testing/btest/Baseline/core.checksums-cli/out1 Normal file
View file

@ -0,0 +1,3 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
F
bad_IP_checksum

2
testing/btest/Baseline/core.checksums-cli/out2 Normal file
View file

@ -0,0 +1,2 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
T

2
testing/btest/Baseline/core.checksums-cli/out3 Normal file
View file

@ -0,0 +1,2 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
T

2
testing/btest/Baseline/core.checksums-cli/out4 Normal file
View file

@ -0,0 +1,2 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
T

2
testing/btest/Baseline/core.checksums-cli/out5 Normal file
View file

@ -0,0 +1,2 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
T

2
testing/btest/Baseline/core.checksums-cli/out6 Normal file
View file

@ -0,0 +1,2 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
T

2
testing/btest/Baseline/core.checksums-cli/out7 Normal file
View file

@ -0,0 +1,2 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
ignore_checksums : bool = T &redef

43
testing/btest/core/checksums-cli.test Normal file
View file

@ -0,0 +1,43 @@
# This verifies the interaction between the -C flag and the script-layer
# ignore_checksums global.
#
# Normal use: checksums not ignored, weird-event triggers
# @TEST-EXEC: zeek -b -r $TRACES/chksums/ip4-bad-chksum.pcap %INPUT >out1
# @TEST-EXEC: btest-diff out1
#
# Redef to T works: checksums now ignored, no weird-event.
# @TEST-EXEC: zeek -b -r $TRACES/chksums/ip4-bad-chksum.pcap %INPUT ignore_checksums=T >out2
# @TEST-EXEC: btest-diff out2
#
# "-C" leads to ignore_checksum = T.
# @TEST-EXEC: zeek -C -b -r $TRACES/chksums/ip4-bad-chksum.pcap %INPUT >out3
# @TEST-EXEC: btest-diff out3
#
# "-C" has final say over CLI-based redef.
# @TEST-EXEC: zeek -C -b -r $TRACES/chksums/ip4-bad-chksum.pcap %INPUT ignore_checksums=F >out4
# @TEST-EXEC: btest-diff out4
#
# "-C" applies before global statements, including those given at CLI.
# @TEST-EXEC: zeek -C -e 'print ignore_checksums' >out5
# @TEST-EXEC: btest-diff out5
#
# "-C" applies after declarations, including those given at the CLI.
# @TEST-EXEC: zeek -C -e 'redef ignore_checksums=F' %INPUT >out6
# @TEST-EXEC: btest-diff out6
#
# "-C" applies before the print-id feature.
# @TEST-EXEC: zeek -C -I ignore_checksums >out7
# @TEST-EXEC: btest-diff out7
@load base/frameworks/notice/weird
event zeek_init()
{
print ignore_checksums;
}
event flow_weird(name: string, src: addr, dst: addr, addl: string, source: string)
{
if ( name == "bad_IP_checksum" )
print name;
}