diff --git a/testing/btest/Baseline/scripts.base.protocols.dce-rpc.dce-rpc-backing-discard/out b/testing/btest/Baseline/scripts.base.protocols.dce-rpc.dce-rpc-backing-discard/out new file mode 100644 index 0000000000..63c9346e2c --- /dev/null +++ b/testing/btest/Baseline/scripts.base.protocols.dce-rpc.dce-rpc-backing-discard/out @@ -0,0 +1,66 @@ +### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 2775301094, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 2775301094, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 2775301094, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 2775301094, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 2775301094, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 2780179611, backing, 2 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 2780179611, backing, 2 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 2780179611, backing, 2 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 5622680288, backing, 3 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 5622680288, backing, 3 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 5622680288, backing, 3 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 770495516, backing, 4 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 770495516, backing, 4 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 770495516, backing, 4 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 3230398483, backing, 5 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 3230398483, backing, 5 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 3230398483, backing, 5 +smb_discarded_dce_rpc_analyzers, CHhAvVGS1DHFjwGM9 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 3404240006, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 3404240006, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 3404240006, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 581185132, backing, 2 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 581185132, backing, 2 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 581185132, backing, 2 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 1419732663, backing, 3 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 1419732663, backing, 3 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 1419732663, backing, 3 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 6525719129, backing, 4 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 6525719129, backing, 4 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 6525719129, backing, 4 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 7865351196, backing, 5 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 7865351196, backing, 5 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 7865351196, backing, 5 +smb_discarded_dce_rpc_analyzers, CHhAvVGS1DHFjwGM9 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 7808965122, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 7808965122, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 7808965122, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 5744501780, backing, 2 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 5744501780, backing, 2 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 5744501780, backing, 2 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 4423347481, backing, 3 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 4423347481, backing, 3 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 4423347481, backing, 3 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 2572299628, backing, 4 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 2572299628, backing, 4 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 2572299628, backing, 4 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 3551409164, backing, 5 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 3551409164, backing, 5 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 3551409164, backing, 5 +smb_discarded_dce_rpc_analyzers, CHhAvVGS1DHFjwGM9 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 4758761704, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 4758761704, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 4758761704, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 5174655977, backing, 2 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 5174655977, backing, 2 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 5174655977, backing, 2 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 2565910467, backing, 3 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 2565910467, backing, 3 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 2565910467, backing, 3 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 4869689094, backing, 4 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 4869689094, backing, 4 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 4869689094, backing, 4 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 4356815780, backing, 5 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 4356815780, backing, 5 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 4356815780, backing, 5 diff --git a/testing/btest/Baseline/scripts.base.protocols.dce-rpc.dce-rpc-backing-discard/weird.log b/testing/btest/Baseline/scripts.base.protocols.dce-rpc.dce-rpc-backing-discard/weird.log new file mode 100644 index 0000000000..b544657b9e --- /dev/null +++ b/testing/btest/Baseline/scripts.base.protocols.dce-rpc.dce-rpc-backing-discard/weird.log @@ -0,0 +1,11 @@ +### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. +#separator \x09 +#set_separator , +#empty_field (empty) +#unset_field - +#path weird +#open XXXX-XX-XX-XX-XX-XX +#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer source +#types time string addr port addr port string string bool string string +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 172.17.0.1 38016 172.17.0.2 445 SMB_discarded_dce_rpc_analyzers - F zeek SMB +#close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/scripts.base.protocols.dce-rpc.dce-rpc-backing-size/out b/testing/btest/Baseline/scripts.base.protocols.dce-rpc.dce-rpc-backing-size/out new file mode 100644 index 0000000000..46f303a0a3 --- /dev/null +++ b/testing/btest/Baseline/scripts.base.protocols.dce-rpc.dce-rpc-backing-size/out @@ -0,0 +1,103 @@ +### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 2775301094, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 2775301094, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 2775301094, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 2775301094, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 2775301094, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 2775301094, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 2775301094, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 2780179611, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 2780179611, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 2780179611, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 2780179611, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 2780179611, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 5622680288, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 5622680288, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 5622680288, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 5622680288, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 5622680288, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 770495516, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 770495516, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 770495516, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 770495516, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 770495516, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 3230398483, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 3230398483, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 3230398483, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 3230398483, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 3230398483, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 3404240006, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 3404240006, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 3404240006, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 3404240006, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 3404240006, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 581185132, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 581185132, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 581185132, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 581185132, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 581185132, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 1419732663, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 1419732663, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 1419732663, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 1419732663, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 1419732663, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 6525719129, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 6525719129, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 6525719129, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 6525719129, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 6525719129, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 7865351196, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 7865351196, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 7865351196, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 7865351196, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 7865351196, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 7808965122, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 7808965122, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 7808965122, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 7808965122, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 7808965122, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 5744501780, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 5744501780, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 5744501780, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 5744501780, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 5744501780, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 4423347481, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 4423347481, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 4423347481, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 4423347481, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 4423347481, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 2572299628, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 2572299628, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 2572299628, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 2572299628, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 2572299628, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 3551409164, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 3551409164, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 3551409164, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 3551409164, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 3551409164, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 4758761704, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 4758761704, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 4758761704, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 4758761704, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 4758761704, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 5174655977, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 5174655977, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 5174655977, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 5174655977, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 5174655977, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 2565910467, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 2565910467, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 2565910467, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 2565910467, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 2565910467, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 4869689094, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 4869689094, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 4869689094, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 4869689094, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 4869689094, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 4356815780, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 4356815780, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 4356815780, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 4356815780, backing, 1 +dce_rpc_request, CHhAvVGS1DHFjwGM9, fid, 4356815780, backing, 1 diff --git a/testing/btest/Traces/dce-rpc/20-fids-no-close.pcap b/testing/btest/Traces/dce-rpc/20-fids-no-close.pcap new file mode 100644 index 0000000000..108d246fdd Binary files /dev/null and b/testing/btest/Traces/dce-rpc/20-fids-no-close.pcap differ diff --git a/testing/btest/Traces/dce-rpc/20-fids.pcap b/testing/btest/Traces/dce-rpc/20-fids.pcap new file mode 100644 index 0000000000..25abdd354d Binary files /dev/null and b/testing/btest/Traces/dce-rpc/20-fids.pcap differ diff --git a/testing/btest/scripts/base/protocols/dce-rpc/dce-rpc-backing-discard.zeek b/testing/btest/scripts/base/protocols/dce-rpc/dce-rpc-backing-discard.zeek new file mode 100644 index 0000000000..05b7fb39f9 --- /dev/null +++ b/testing/btest/scripts/base/protocols/dce-rpc/dce-rpc-backing-discard.zeek @@ -0,0 +1,19 @@ +# @TEST-DOC: Pcap does not contain close requests for the involved fids (filtered out with wireshark) +# @TEST-EXEC: zeek -C -r $TRACES/dce-rpc/20-fids-no-close.pcap %INPUT >out +# @TEST-EXEC: btest-diff out +# @TEST-EXEC: btest-diff weird.log + +@load base/protocols/smb +@load base/protocols/dce-rpc + +redef SMB::max_dce_rpc_analyzers = 5; + +event dce_rpc_request(c: connection, fid: count, ctx_id: count, opnum: count, stub_len: count) + { + print "dce_rpc_request", c$uid, "fid", fid, "backing", |c$dce_rpc_backing|; + } + +event smb_discarded_dce_rpc_analyzers(c: connection) + { + print "smb_discarded_dce_rpc_analyzers", c$uid; + } diff --git a/testing/btest/scripts/base/protocols/dce-rpc/dce-rpc-backing-size.zeek b/testing/btest/scripts/base/protocols/dce-rpc/dce-rpc-backing-size.zeek new file mode 100644 index 0000000000..8b5dbb6432 --- /dev/null +++ b/testing/btest/scripts/base/protocols/dce-rpc/dce-rpc-backing-size.zeek @@ -0,0 +1,19 @@ +# @TEST-DOC: Ensure dce_rpc_backing state stays bounded when pipes are closed properly. +# @TEST-EXEC: zeek -C -r $TRACES/dce-rpc/20-fids.pcap %INPUT >out +# @TEST-EXEC: btest-diff out +# @TEST-EXEC: test ! -f weird.log + +@load base/protocols/smb +@load base/protocols/dce-rpc + +redef SMB::max_dce_rpc_analyzers = 5; + +event dce_rpc_request(c: connection, fid: count, ctx_id: count, opnum: count, stub_len: count) + { + print "dce_rpc_request", c$uid, "fid", fid, "backing", |c$dce_rpc_backing|; + } + +event smb_discarded_dce_rpc_analyzers(c: connection) + { + print "UNEXPECTED", "smb_discarded_dce_rpc_analyzers", c$uid; + }