mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
spicy-redis: Add some script logic for logging
Also "rebrands" from RESP to Redis.
This commit is contained in:
parent
757cbbf902
commit
22bda56af3
36 changed files with 266 additions and 86 deletions
|
@ -0,0 +1,5 @@
|
|||
# @TEST-DOC: Test CLIENT REPLY OFF, but turns on with new connection
|
||||
#
|
||||
# @TEST-EXEC: zeek -Cr $TRACES/redis/reply-off-on-2conn.trace base/protocols/redis %INPUT >output
|
||||
# @TEST-EXEC: btest-diff redis.log
|
||||
|
|
@ -0,0 +1,5 @@
|
|||
# @TEST-DOC: Test CLIENT REPLY OFF then ON again and a SKIP
|
||||
#
|
||||
# @TEST-EXEC: zeek -Cr $TRACES/redis/reply-off-on.trace base/protocols/redis %INPUT >output
|
||||
# @TEST-EXEC: btest-diff redis.log
|
||||
|
|
@ -0,0 +1,5 @@
|
|||
# @TEST-DOC: Test CLIENT REPLY OFF then ON again and a SKIP
|
||||
#
|
||||
# @TEST-EXEC: zeek -Cr $TRACES/redis/client-skip-while-off.trace base/protocols/redis %INPUT >output
|
||||
# @TEST-EXEC: btest-diff redis.log
|
||||
|
|
@ -2,7 +2,7 @@
|
|||
#
|
||||
# @TEST-EXEC: zeek -Cr $TRACES/redis/django-cloud.trace base/protocols/redis %INPUT >output
|
||||
# @TEST-EXEC: btest-diff output
|
||||
# @TEST-EXEC: btest-diff resp.log
|
||||
# @TEST-EXEC: btest-diff redis.log
|
||||
|
||||
redef Redis::ports += {
|
||||
10625/tcp,
|
||||
|
|
|
@ -2,7 +2,7 @@
|
|||
#
|
||||
# @TEST-EXEC: zeek -Cr $TRACES/redis/django-cache.trace base/protocols/redis %INPUT >output
|
||||
# @TEST-EXEC: btest-diff output
|
||||
# @TEST-EXEC: btest-diff resp.log
|
||||
# @TEST-EXEC: btest-diff redis.log
|
||||
|
||||
event Redis::set_command(c: connection, is_orig: bool, command: Redis::SetCommand)
|
||||
{
|
||||
|
|
|
@ -0,0 +1,8 @@
|
|||
# @TEST-DOC: Test Zeek parsing "pipelined" data responses
|
||||
#
|
||||
# @TEST-EXEC: zeek -Cr $TRACES/redis/excessive-pipelining.trace base/protocols/redis %INPUT >output
|
||||
# @TEST-EXEC: btest-diff redis.log
|
||||
# @TEST-EXEC: btest-diff weird.log
|
||||
|
||||
# Make sure we get a weird if we go over the pipelining threshold (intentionally limited)
|
||||
redef Redis::max_pending_requests = 5;
|
|
@ -2,7 +2,7 @@
|
|||
#
|
||||
# @TEST-EXEC: zeek -Cr $TRACES/redis/pipeline-quotes.trace base/protocols/redis %INPUT >output
|
||||
# @TEST-EXEC: btest-diff output
|
||||
# @TEST-EXEC: btest-diff resp.log
|
||||
# @TEST-EXEC: btest-diff redis.log
|
||||
# TODO: Make it so weird.log exists again with `zeek::weird` for inline commands
|
||||
# btest-diff weird.log
|
||||
|
||||
|
|
|
@ -2,7 +2,7 @@
|
|||
#
|
||||
# @TEST-EXEC: zeek -Cr $TRACES/redis/pipeline-with-commands.trace base/protocols/redis %INPUT >output
|
||||
# @TEST-EXEC: btest-diff output
|
||||
# @TEST-EXEC: btest-diff resp.log
|
||||
# @TEST-EXEC: btest-diff redis.log
|
||||
|
||||
# Sometimes commands aren't serialized, like when pipelining. This still works! So we
|
||||
# should handle this. This particular example has a few commands, amongst them a SET and
|
||||
|
|
|
@ -2,7 +2,7 @@
|
|||
#
|
||||
# @TEST-EXEC: zeek -Cr $TRACES/redis/pipelining-example.trace base/protocols/redis %INPUT >output
|
||||
# @TEST-EXEC: btest-diff output
|
||||
# @TEST-EXEC: btest-diff resp.log
|
||||
# @TEST-EXEC: btest-diff redis.log
|
||||
|
||||
# Testing the example of "pipelining" in REDIS docs:
|
||||
# https://redis.io/docs/latest/develop/use/pipelining/
|
||||
|
|
|
@ -2,7 +2,7 @@
|
|||
#
|
||||
# @TEST-EXEC: zeek -Cr $TRACES/redis/pubsub.trace base/protocols/redis %INPUT >output
|
||||
# @TEST-EXEC: btest-diff output
|
||||
# @TEST-EXEC: btest-diff resp.log
|
||||
# @TEST-EXEC: btest-diff redis.log
|
||||
|
||||
# Testing the example of pub sub in REDIS docs:
|
||||
# https://redis.io/docs/latest/develop/interact/pubsub/
|
||||
|
|
|
@ -1,11 +1,11 @@
|
|||
# @TEST-DOC: Test parsing behavior of RESP.
|
||||
#
|
||||
# @TEST-EXEC: spicyc ${DIST}/analyzer/resp.spicy ${DIST}/analyzer/redis.spicy -j -d -o resp.hlto
|
||||
# @TEST-EXEC: spicyc ${DIST}/analyzer/resp.spicy ${DIST}/analyzer/redis.spicy -j -d -o redis.hlto
|
||||
#
|
||||
# TODO: A lot of tests are possible from the docs and having them would be nice.
|
||||
# But, a lot of characters ($, -, etc.) cause problems with TEST_EXEC. ugh.
|
||||
# @TEST-EXEC: printf "+OK\x0d\x0a" | spicy-dump -p RESP::Data resp.hlto >>output 2>&1
|
||||
# @TEST-EXEC: printf ":1000\x0d\x0a" | spicy-dump -p RESP::Data resp.hlto >>output 2>&1
|
||||
# @TEST-EXEC: printf ":-1000\x0d\x0a" | spicy-dump -p RESP::Data resp.hlto >>output 2>&1
|
||||
# @TEST-EXEC: printf ":+1000\x0d\x0a" | spicy-dump -p RESP::Data resp.hlto >>output 2>&1
|
||||
# @TEST-EXEC: printf "+OK\x0d\x0a" | spicy-dump -p RESP::Data redis.hlto >>output 2>&1
|
||||
# @TEST-EXEC: printf ":1000\x0d\x0a" | spicy-dump -p RESP::Data redis.hlto >>output 2>&1
|
||||
# @TEST-EXEC: printf ":-1000\x0d\x0a" | spicy-dump -p RESP::Data redis.hlto >>output 2>&1
|
||||
# @TEST-EXEC: printf ":+1000\x0d\x0a" | spicy-dump -p RESP::Data redis.hlto >>output 2>&1
|
||||
# @TEST-EXEC: TEST_DIFF_CANONIFIER= btest-diff output
|
||||
|
|
|
@ -1,7 +1,7 @@
|
|||
# @TEST-DOC: Test Zeek parsing pubsub commands
|
||||
#
|
||||
# @TEST-EXEC: zeek -Cr $TRACES/redis/stream.trace base/protocols/redis %INPUT >output
|
||||
# @TEST-EXEC: btest-diff resp.log
|
||||
# @TEST-EXEC: btest-diff redis.log
|
||||
|
||||
# Streams like with XRANGE return arrays of bulk strings. We shouldn't count the
|
||||
# response as commands.
|
||||
|
|
|
@ -1,6 +1,6 @@
|
|||
# @TEST-DOC: Test Zeek with RESP over TLS so it doesn't get gibberish
|
||||
#
|
||||
# @TEST-EXEC: zeek -Cr $TRACES/redis/tls.trace base/protocols/redis %INPUT >output
|
||||
# @TEST-EXEC-FAIL: test -f resp.log
|
||||
# @TEST-EXEC-FAIL: test -f redis.log
|
||||
|
||||
# The logs should probably be empty since it's all encrypted
|
||||
|
|
|
@ -2,7 +2,7 @@
|
|||
#
|
||||
# @TEST-EXEC: zeek -Cr $TRACES/redis/loop-redis.trace base/protocols/redis %INPUT >output
|
||||
# @TEST-EXEC: btest-diff output
|
||||
# @TEST-EXEC: btest-diff resp.log
|
||||
# @TEST-EXEC: btest-diff redis.log
|
||||
|
||||
event Redis::set_command(c: connection, is_orig: bool, command: Redis::SetCommand)
|
||||
{
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue