Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Modify known-services policy script to add storage framework support

Browse source 
This adds a flag to enable using the storage framework instead of Broker stores,
plus a btest for both broker and the the storage framework.
This commit is contained in:
Tim Wojtulewicz 2025-04-10 10:33:13 -07:00
parent 6446bdf0dc
commit 1f64bb2870
5 changed files with 154 additions and 18 deletions
Download patch file Download diff file Expand all files Collapse all files

17
testing/btest/Baseline/scripts.policy.protocols.conn.known-services/knownservices-broker-store.log Normal file
View file

@ -0,0 +1,17 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path known_services
#open XXXX-XX-XX-XX-XX-XX
#fields ts host port_num port_proto service
#types time addr port enum set[string]
XXXXXXXXXX.XXXXXX 172.16.238.131 22 tcp SSH
XXXXXXXXXX.XXXXXX 172.16.238.131 80 tcp HTTP
XXXXXXXXXX.XXXXXX 172.16.238.2 53 udp DNS
XXXXXXXXXX.XXXXXX 74.125.225.81 80 tcp HTTP
XXXXXXXXXX.XXXXXX 172.16.238.131 21 tcp FTP
XXXXXXXXXX.XXXXXX 141.142.192.39 22 tcp SSH
XXXXXXXXXX.XXXXXX 69.50.219.51 123 udp NTP
#close XXXX-XX-XX-XX-XX-XX

17
testing/btest/Baseline/scripts.policy.protocols.conn.known-services/knownservices-storage-framework.log Normal file
View file

@ -0,0 +1,17 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path known_services
#open XXXX-XX-XX-XX-XX-XX
#fields ts host port_num port_proto service
#types time addr port enum set[string]
XXXXXXXXXX.XXXXXX 172.16.238.131 22 tcp SSH
XXXXXXXXXX.XXXXXX 172.16.238.131 80 tcp HTTP
XXXXXXXXXX.XXXXXX 172.16.238.2 53 udp DNS
XXXXXXXXXX.XXXXXX 74.125.225.81 80 tcp HTTP
XXXXXXXXXX.XXXXXX 172.16.238.131 21 tcp FTP
XXXXXXXXXX.XXXXXX 141.142.192.39 22 tcp SSH
XXXXXXXXXX.XXXXXX 69.50.219.51 123 udp NTP
#close XXXX-XX-XX-XX-XX-XX

1
testing/btest/Baseline/scripts.policy.protocols.conn.known-services/logs-diff.txt Normal file
View file

@ -0,0 +1 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.

37
testing/btest/scripts/policy/protocols/conn/known-services.zeek
View file

@ -1,4 +1,4 @@
# A basic test of the known-services script's logging and asset_tracking options
# @TEST-DOC: A basic test of the known-services script's logging and asset_tracking options
# Don't run for C++ scripts because there's no script to compile.
# @TEST-REQUIRES: test "${ZEEK_USE_CPP}" != "1"
@ -18,6 +18,41 @@
# @TEST-EXEC: zeek -r $TRACES/var-services-std-ports.trace %INPUT Known::service_tracking=NO_HOSTS
# @TEST-EXEC: test '!' -e known_services.log
# @TEST-EXEC: zeek -r $TRACES/var-services-std-ports.trace %INPUT broker-store-config.zeek
# @TEST-EXEC: mv known_services.log knownservices-broker-store.log
# @TEST-EXEC: btest-diff knownservices-broker-store.log
# @TEST-EXEC: zeek -r $TRACES/var-services-std-ports.trace %INPUT storage-framework-config.zeek
# @TEST-EXEC: mv known_services.log knownservices-storage-framework.log
# @TEST-EXEC: btest-diff knownservices-storage-framework.log
# @TEST-EXEC: cat knownservices-broker-store.log | $SCRIPTS/diff-remove-timestamps > broker-store.log
# @TEST-EXEC: cat knownservices-storage-framework.log | $SCRIPTS/diff-remove-timestamps > storage-framework.log
# @TEST-EXEC: diff broker-store.log storage-framework.log > logs-diff.txt
# @TEST-EXEC: btest-diff logs-diff.txt
@load protocols/conn/known-services
redef Site::local_nets += {172.16.238.0/24};
# @TEST-START-FILE broker-store-config.zeek
redef Known::service_tracking=ALL_HOSTS;
redef Known::use_service_store=T;
redef Known::use_storage_framework=F;
# @TEST-END-FILE
# @TEST-START-FILE storage-framework-config.zeek
@load policy/frameworks/storage/backend/sqlite
redef Known::service_tracking=ALL_HOSTS;
redef Known::use_service_store=T;
redef Known::use_storage_framework=T;
redef Known::service_store_backend_type = Storage::STORAGE_BACKEND_SQLITE;
redef Known::service_store_backend_options = [ $sqlite = [
$database_path="test.sqlite", $table_name=Known::service_store_prefix ]];
# @TEST-END-FILE