From 11028f45a783584cf848544e813b2c46c8b5e1c3 Mon Sep 17 00:00:00 2001 From: Jon Siwek Date: Fri, 8 Nov 2019 12:29:12 -0800 Subject: [PATCH 1/4] Fix compile warnings on OpenBSD warning: '__inet_makeaddr' has C-linkage specified, but returns incomplete type 'struct in_addr' which could be incompatible with C --- src/Sessions.cc | 1 + src/analyzer/protocol/dns/DNS.cc | 1 + 2 files changed, 2 insertions(+) diff --git a/src/Sessions.cc b/src/Sessions.cc index d3042784a0..7639152ab0 100644 --- a/src/Sessions.cc +++ b/src/Sessions.cc @@ -3,6 +3,7 @@ #include "zeek-config.h" +#include #include #include diff --git a/src/analyzer/protocol/dns/DNS.cc b/src/analyzer/protocol/dns/DNS.cc index 5c35e4f271..eab5b48461 100644 --- a/src/analyzer/protocol/dns/DNS.cc +++ b/src/analyzer/protocol/dns/DNS.cc @@ -5,6 +5,7 @@ #include #include #include +#include #include #include "NetVar.h" From b182c357628af2fad8b149be0c79aca6d5a6b373 Mon Sep 17 00:00:00 2001 From: Jon Siwek Date: Fri, 8 Nov 2019 12:30:56 -0800 Subject: [PATCH 2/4] Fix undefined symbols loading libbroker on OpenBSD python3.7:/usr/local/lib/libbroker.so.2: undefined symbol '__inet_ntop' python3.7:/usr/local/lib/libbroker.so.2: undefined symbol '__inet_pton' An independent Broker build doesn't have that problem because it usually picks up those functions from libc. But when building Broker as part of Zeek, include search paths were already modified to reflect Zeek's libbind dependency and Broker ends up using libbind headers which defines its own version of these, but then does not link to libbind (since it's a dependency of Zeek, not Broker) to actually get those symbols (e.g. when dlopen'ing independently from Zeek, like for the Python bindings). Solution is to re-order include_directories() for Zeek dependencies such that they won't effect sub-projects. --- CMakeLists.txt | 84 ++++++++++++++++++++++++-------------------------- 1 file changed, 41 insertions(+), 43 deletions(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index c786f5ee59..df596c7433 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -181,6 +181,46 @@ if (MISSING_PREREQS) message(FATAL_ERROR "Configuration aborted due to missing prerequisites") endif () +if ( CAF_ROOT_DIR ) + find_package(CAF COMPONENTS core io openssl REQUIRED) +endif () + +add_subdirectory(aux/paraglob) +set(zeekdeps ${zeekdeps} paraglob) + +if ( BROKER_ROOT_DIR ) + # Avoid calling find_package(CAF) twice. + if ( NOT CAF_ROOT_DIR ) + find_package(CAF COMPONENTS core io openssl REQUIRED) + endif () + find_package(Broker REQUIRED) + set(zeekdeps ${zeekdeps} ${BROKER_LIBRARY}) + set(broker_includes ${BROKER_INCLUDE_DIR}) +else () + set(ENABLE_STATIC_ONLY_SAVED ${ENABLE_STATIC_ONLY}) + + if ( BUILD_STATIC_BROKER ) + set(ENABLE_STATIC_ONLY true) + endif() + + add_subdirectory(aux/broker) + set(ENABLE_STATIC_ONLY ${ENABLE_STATIC_ONLY_SAVED}) + + if ( BUILD_STATIC_BROKER ) + set(zeekdeps ${zeekdeps} broker_static) + else() + set(zeekdeps ${zeekdeps} broker) + endif() + set(broker_includes ${CMAKE_CURRENT_SOURCE_DIR}/aux/broker/include ${CMAKE_CURRENT_BINARY_DIR}/aux/broker/include) +endif () + +# CAF_LIBRARIES and CAF_INCLUDE_DIRS are defined either by calling +# find_package(CAF) or by calling add_subdirectory(aux/broker). In either case, +# we have to care about CAF here because Broker headers can pull in CAF +# headers. +set(zeekdeps ${zeekdeps} ${CAF_LIBRARIES}) +include_directories(BEFORE ${broker_includes} ${CAF_INCLUDE_DIRS}) +include_directories(BEFORE ${CMAKE_CURRENT_SOURCE_DIR}/aux/paraglob/include) include_directories(BEFORE ${PCAP_INCLUDE_DIR} ${BIND_INCLUDE_DIR} @@ -254,7 +294,7 @@ if ( ${CMAKE_SYSTEM_NAME} MATCHES Linux AND EXISTS /etc/os-release ) endif () endif () -set(zeekdeps +set(zeekdeps ${zeekdeps} ${BinPAC_LIBRARY} ${PCAP_LIBRARY} ${OPENSSL_LIBRARIES} @@ -339,48 +379,6 @@ InstallSymlink("${CMAKE_INSTALL_PREFIX}/bin/zeek-wrapper" "${CMAKE_INSTALL_PREFI ######################################################################## ## Recurse on sub-directories -if ( CAF_ROOT_DIR ) - find_package(CAF COMPONENTS core io openssl REQUIRED) -endif () - -if ( BROKER_ROOT_DIR ) - # Avoid calling find_package(CAF) twice. - if ( NOT CAF_ROOT_DIR ) - find_package(CAF COMPONENTS core io openssl REQUIRED) - endif () - find_package(Broker REQUIRED) - set(zeekdeps ${zeekdeps} ${BROKER_LIBRARY}) - include_directories(BEFORE ${BROKER_INCLUDE_DIR}) -else () - set(ENABLE_STATIC_ONLY_SAVED ${ENABLE_STATIC_ONLY}) - - if ( BUILD_STATIC_BROKER ) - set(ENABLE_STATIC_ONLY true) - endif() - - add_subdirectory(aux/broker) - set(ENABLE_STATIC_ONLY ${ENABLE_STATIC_ONLY_SAVED}) - - if ( BUILD_STATIC_BROKER ) - set(zeekdeps ${zeekdeps} broker_static) - else() - set(zeekdeps ${zeekdeps} broker) - endif() - include_directories(BEFORE ${CMAKE_CURRENT_SOURCE_DIR}/aux/broker/include - ${CMAKE_CURRENT_BINARY_DIR}/aux/broker/include) -endif () - -# CAF_LIBRARIES and CAF_INCLUDE_DIRS are defined either by calling -# find_package(CAF) or by calling add_subdirectory(aux/broker). In either case, -# we have to care about CAF here because Broker headers can pull in CAF -# headers. -set(zeekdeps ${zeekdeps} ${CAF_LIBRARIES}) -include_directories(BEFORE ${CAF_INCLUDE_DIRS}) - -add_subdirectory(aux/paraglob) -set(zeekdeps ${zeekdeps} paraglob) -include_directories(BEFORE ${CMAKE_CURRENT_SOURCE_DIR}/aux/paraglob/include) - add_subdirectory(src) add_subdirectory(scripts) add_subdirectory(man) From 7965dcd04103c852f1d0b3013b747378c63c315a Mon Sep 17 00:00:00 2001 From: Jon Siwek Date: Fri, 8 Nov 2019 13:08:06 -0800 Subject: [PATCH 3/4] Convert pcapng test suite files to pcap format The former isn't supported by default on OpenBSD. --- .../dce-rpc/ntlm-empty-av-sequence.pcap | Bin 788 -> 651 bytes .../ntlm-unterminated-av-sequence.pcap | Bin 820 -> 683 bytes testing/btest/Traces/erspanII.pcap | Bin 1088 -> 744 bytes .../btest/Traces/radius/radius_localhost.pcap | Bin 0 -> 2511 bytes .../Traces/radius/radius_localhost.pcapng | Bin 2952 -> 0 bytes testing/btest/Traces/rfb/vncmac.pcap | Bin 8848 -> 6033 bytes testing/btest/Traces/smb/smb3.pcap | Bin 15692 -> 14564 bytes testing/btest/Traces/smb/smb311.pcap | Bin 10304 -> 9642 bytes testing/btest/Traces/smtp-multi-addr.pcap | Bin 3620 -> 3146 bytes testing/btest/Traces/smtp.trace | Bin 43316 -> 40943 bytes testing/btest/Traces/tcp/tcp-fast-open.pcap | Bin 3604 -> 3054 bytes testing/btest/Traces/tls/hrr.pcap | Bin 5480 -> 4288 bytes .../Traces/tls/tls13_psk_succesfull.pcap | Bin 4088 -> 2760 bytes .../radius/radius-multiple-attempts.test | 2 +- 14 files changed, 1 insertion(+), 1 deletion(-) create mode 100644 testing/btest/Traces/radius/radius_localhost.pcap delete mode 100644 testing/btest/Traces/radius/radius_localhost.pcapng diff --git a/testing/btest/Traces/dce-rpc/ntlm-empty-av-sequence.pcap b/testing/btest/Traces/dce-rpc/ntlm-empty-av-sequence.pcap index 2d7e7631f904e027ee326ba163fd1c3f05088ead..bc8253d681c0c299ea4382ddd20f9900983999e3 100644 GIT binary patch delta 99 zcmbQj*3GJV(xt_!(sY delta 228 zcmZ3@x`oY!i*G5~45lH`s0+1MpF9N0i|A(;Ifcyj?27!=+%nU|itE46> zxJf}oL9#JmIf(3fkZhid1V{{BPDdOlw+kV614*Bn#44%DY>fLQ89<^SogyH|00GF( p7FnR|S;l)xASa42_~xf%re&t4C?r)Xgl86|x~627fRuu?007FfEBgQd diff --git a/testing/btest/Traces/erspanII.pcap b/testing/btest/Traces/erspanII.pcap index c601f2978162570ac17e4f1f0c644b624e29758d..4ce446af8c5fa37a2fdad9b5c95d53206de2684c 100644 GIT binary patch delta 92 zcmX@W@q$(1%Hd55nHX3Y5P*e&5y;todv@?k11^Ti2~38QIT@=tKmreqpaN&10*g(- P0&BpsE6ky?q0H3)wCfyO literal 1088 zcmd<$<>jhiU|{gI(UxKa(*L1=nL(DpH!)ekKUl%gK+jUoSV6-jv8X&VPr=Yw&q&We z6R4JjL6^a$G`Ao*u|UC4&qB{kK_fWKPa!C^Ou@v$(8Nd~ttdZNLBFJ^G%s5hr~sq~ z1VHwI?DB!q|Nk>EFflMQq~@72Z~|r6fZ{wv*bh_&HUp&o2#5m&M}D&~tn`Whx&+7u z;S`3Cj~Io(BqIldD+9wc1_lR)fBI#{OhCX01Of~l`xqG5Sp>v6Qa~mE)jniq29Zom zU>zwOQ-I;Z*vcRdbS4lpb1;N&We@|Y1%ef-*H@pV41(N_?uUhbWcYy<*$+%i5T9W9 zff?iv28MW=`yn}y3_q|T`vEN;rh?+3yC@F#B;Ra=~u=*^vc*qDQ!w>Ap zen5){gdbq>Ky^Q`0)rz594L_dAo+9BS4IXI2Iu_Jypq(SVugaD{IblH)D(rJN`(|i i24-U50Oy@MQH`INp=@EGJ{BMwlr}+t705;gAUgmxU23EN diff --git a/testing/btest/Traces/radius/radius_localhost.pcap b/testing/btest/Traces/radius/radius_localhost.pcap new file mode 100644 index 0000000000000000000000000000000000000000..7333fc9c96845b618baca181dfb5f2ea84fdbd2d GIT binary patch literal 2511 zcmcJQdr%Ws7{zZAk_7@0V+=v@2?!1dR)PAMwh*f0o&0pFcDF408pgv27o;gfUf}{U}|xN7$6#!6B57%c1@gi zq%-~U1+{%*P!Ow$04b8TBySZA-L*_6%7SS-sZSgcWxumV3Iblk$GxNY4 zdlZt?LIJB$KuktRfBr2zq#;*tm`f4>4_VBb(n#vYL+{CppF60gSMn$p3BV$deqRdb zoIP}9jV|+^Lw#xCtY~y?IEiLfovso5+DMtPIx?`Kyn7efXMfd6b;nrj+uX)vQvj1M z_Z>OV^0_5RvHRQ&zUnGI0G@3I;!Ec5E6a`!m*+Efpw*H7TOACeQ%N(c&c#GL2E;(h z4Aqf=%!MB^#@0<;R?g@e?Pj@d;*764GORk+sl#Vp*(<{CobpV&WP6MnNDuq)r+09G z|D#_Pyi&`js5)45?epOi+Jb>rCs|&PWZrWKLmp11nN^2J!Xq1!!>S_(%6%8JJFRu8 zB`emQ&avy6|C=ef2B!m6Y2}AIa=TpUC6y7k@yY#6wSTzc-us4<9})F~aQQBC7_>Tu zL3}k!iw6BV{dNCnkH|e{B3qhYJ9mJDk1lG-ljCDP&NE-% z$?|yCPJD`4&q0VF0ky?sw2sXQ$6G^;7fQf`V~Bjf&GQOwsdJB7Bo?`NobM16j3baF z)K;>|3J6h4Oh#LQV;kOftQws-7)~Il!0O_<*Abx?tjk1?Cmc-;qwF+JOq!%3CsleZ zTeA2I=xXT7-Rd)J{K&^jsw{(DrG<26M|sOc>Ja9=E6U1jUV6)Oqd_S9~u1YP6%Cj>M6bSZv~kv=2-4i zQNj^IA?*!;g^TJDf3^vKMJ>edkE?O>xe?zg)vtex$8Q>bqg&~wue@1T@P6xZ!Rk|} zwN1ad^(Xxw-TEAA?Sz-scph;AC$Ebx?3ymd>CG4LV~u(HsA(< zky}MJIjlBYO2tUZs!gG*Hm#IB?94vT?7MTk)1Ljq*>n0GU!Lck@jRd3_xV1Ix~8VO zJ^;Y;3sXG;{3*iOb$dagD9u(6Roq*|SkaLS^Vph9jE1ASGr-!3m&$h35q7cD0qB-uG~#@n5& znHt1MpiYqguAB$GuNevz;wmoVv5Mdr3FA7QcO1_}p|=@FNRKBp88&#n!s z7@L2_VL>+;El8xG?*uh+xfW^O6f(3OsG}z&>Xf+naC1JNuK}m34>jd)W9q;LwN?+_|lBhBQ>4_DYtbS3v=h8JejTGtPLs=@0Ojv8^?k|nS#be3 zzc)`juX&Q{MGN@zcN;%<*ZViDpEn5g#GN{{p5FJTdvb=_7YMSR@fP<|{xyF!9+C*< z{4q)R9^~Gl{0V_*|GD%o^?`%}XP+|}TF)$hRe0O9;9yl^@v+X#K0{hTWzcoJw?9*7 z-E+SEv8mukS;O5x;oeW_VE*Kt*>$hTd*>)vmrvH75kB>949vnm`4hu2DwMw)o|1@k zI7Y(qmptZ;=azdPD@`H_LFBXMfDe=~dPan;cX)X~9(^+2lSu*;*(jNMnNXW^+t@H> zKonQkfLQTXRzvs>9vl!FR=??ttI+Gz1-rvp3AD$YwUC4NGGtKOA2l0`d0kQ0ZLWNis znJ^>SaEyepgk=QcSt#@;BEXb}5?R0{%fhd%-gL8lY>c5%mU|)wF5B);JAB7s zv(v5~HP)>quWtQcp0t!Wa+Grt3oqux|FNwdSWZlVJ5Tg@U+BK9?9LA|-AbnYm?9^7 zT&LMr#ZHNCUd#HpuB&VDmYm&mE3h_yY-^SNVA|X*2J;m;@q^x=LOH2_>&>x&VEJW7{i{?ffy{*ZBTg-oG4JYdltYwLa%# z^lFZWqQ8lE(xZ3i6BesCpNFMr<;rMfUvkqv4@<<2>Yd6gyGHRWZ5h}Zpg=>z48GXjf^m-@zNo6LEtQ^PH2ID|i=U(9_u)HH39FBC7uA})GX>y(yIO@%Wl4ssMFwFGpkzlBzcM2y(Q z#qfcPAhiw-Vi5!4qAfZ&C|d9brxNQ@q(~P_p%{IC4)mrxzwev(?smSm&-(QG>3yHj z#lJ@v8i45MEw>?pqPF20`1?^ZDAZMr!B+%xhEzR1o78y=30J?~ zERZFGJ?gD9)XD~j2&j1F5i?`pundRn4-w3HV6qGVH}7lXGKB<BT#;iV3%>snluV*S)2(h+W1 zjoC&Q*wmO{qTIp6uG2s)b-1K%O`r;`XXC6kk$4wpHF3_%UhZUd4-(6r4rNOh037dP za2LU{2d+(H4qD3z&ShqR!27QzvXmV`0`Gr5$&Ncf;M@M0WW!<=4C5&-&;QnhYNU!3 zokD=oisa~(KS1P6shV;>Io=xhZNd0TnjMdK1Cfi!dNX}cBg;o*u%z0}mW8}e)YrP< z*m$&)r@V&hPTNG{eL?^4*qYT(woPEEW!B=B!$lx)l|Y79DU6~6R+-JPzNyW E0T@+2;Q#;t literal 8848 zcmd6scUTnX7RHBVK}1$iKu{A|Q3NF+7?vtc#EOz2(GUx|AOxg{6r;r8VicnnOc01- z7aO7oKGsB3P}E>RgGP;oTr5~0QOmVjzparj8-G>%oN+g7ZCPprZl}3cg=Y_>fL!uXiM!{bpL_`l_v5V6jCmBI# z6TJyvdHffVvC@%_b}~DA_*_gl5Q(92^O9oXq&Cr!A#tJdIO(FW_yoM!NIOS62kHCL z(Q$FnVf4F>vf+4Vf#r77DFO1G(IdWRvH)~kB^M~ zocwD9ey$5=I(13(`#^`-ZrNMz57&4utv>hLkvkh^G^9s%>JeiJ!uxzLZ^B#m*>9!! zq69dNDwmlVI2<4T3ErSs)YTPT12nPD5iMrTCdxgg>0I#m-c{Aef81A) zZ*F9&^OEKtLjKfoK2m#o2Rj!RSAES|glZ8ATGZD#&-wcKds)TIe> zAt$|nTVgK3hb!m@+Y5EMSOFg4fqfCT!&DA41I`WvkMCS?4Eg%bf_(5|!gM8Hb{F}g zK||m^%z1*V0omN%*a{ld=V81AHN-sN)I$!v`5Zln!cmjGS-aF;Pj;8h=hi^c&0h?! zc%TPfj_w-x!DYyw{(&IBkCABz42R;^&!G4?mvgzu!*MfvQpd@i?n!g}C28o72m8RJ&e&TcpW`BUK9eB%l`d&;`=v&Zd!q3jv^Y4YIaSE!{X zp7wz11JqN99_XggwGXB|U}le-eFfB=+lNVWGE_!{g@`9I9*_j_vORFQNE~HK!iw&>JP_fzAO+ z1MpAV>v@UU9&l@*^Z;M+!1-}}rH6bB{EjCt4~};#k$=llkPjX_&SUcjy;U9+z`_Ih zF4tA#=Vw6oYvdn{;nbi6GLS)ze;-`~UG#uGezh6E54!os+CAjs;2KXZU(01m74pL^ z1o<%j)*&=sLh?m~Lb>~_Fua{NIO43V{6fgT6nEdL9xn3NTl0BkqNvyDJ)?{_Sq4nf zTe4Oru6dTz|8SMtn1S}T`Z0gZF>(Iro?}c*z}c}6R~}sy5}b0OWwOuHJ1nm^*UZ*r^7;fJ4I z{o{%LsQa%T#?>tmZ_3Mz$~7;1C*9)U{>g{ZPbEkKwJIKTF8#^3zsdIacCFn#q>D-~ zHy-)3;ZAJI#-kOv=5v}O4ffrevCVLV_WDCk`?f}$J^J)d7spNIb$ybTU*3O)Sgvo? zcwN86*Xq@K&I3+CgE8kMZVgtz8#q5JumEsi25O)N>U+Td6j=iYP6jh-XE&BY1|(wo zdA+^@dO*VFtL*_4*3GXQ;3@ZkYdpCM{YFhQwws7!@!_~ER>-O)~8{ux6 z)lYZvrNo3w&R@yDTe-3KsvoMq&&{jLO|5A5Hwhk-(c5K}Pw}H+FP|mY9K1Mv#r8Rl zIR>?fQ}?(P97&jy@BGSIdw5An=r0>G)9)^EtFA~3csB5K{K=OIK~*=h4DLp3c7Gk6 zBys7gTJ4vS=inds!b76(`bp2_WyZ%>P5S=cOWk=>Ez1_(NuJoc*IHT|LzFb7*S)*L zd93g92m4D+q@AY^PHUE&8M-;Vz$2w7+v|GD`fW9zUU^vAV^Sc8D zTqB>k4t%8TEguK(;mPB>)a*t6OUx0rd~W>l0uB7WU$;f8LgY& z$4Jr!x1#n)?co$(=y?Qr=si9Q;DO`b1zh#tXPr2Q<9;Kh$DL|s(9@{375_DUpLJ*> z`#IGryFDB~<3FczJrH^xSsbkLfR_VV`fSugPLJCKvL6XojC~0=Zwm05oBbV8 znzH|e6Y@O{GJIF@;W%b*3CNzESZ=3&%Q<4)H= zmBBR9i>GuAq9FS&Y%kPh5Ov^z{C?3YFL)X7c3X)2WXwOe2hwoAD(=o8)Pdxy_kycM z$P2GTl^6V6ocJ2Gyou)2C9S7Xn~3z{4qX>F)Wi0ITMGq@A9KN6o6k4LY1pH^a!3Bj zVnIH5F(HuV=OX`~?a|smgZeytdKWd!HeuJJO$7b1n)JYo(g6G_$OGrQeQphu9^fk; zn1_z%aT@k$;u7Q+I|%Z@gO7T%`TzYM&9756etrfn*&@HboKu6L&Z^!YOdu_@se*J9jXq!d1@?@5!|5lV7d-9~{ zXk|~W<>rT6#Q}YSHy;hY+2g^6sB+g#vy*iRMP4IJi1VJkURxV>N{n}f4ZU-}tIG5G zwUok|lQ$-rt~R**i`fRvH4xgP1wswf_khDbtU>B{P6oBZzRe<^(W84%H30u_Ko9I> z^VRkMBLjBMz=vz$J(~XwY-p<_g7mN>fRcjer44J$CXpA>l~1*E&8T5d0BMF1-aw#zTcmyj;$Y- zI&j!T?KMBXsZ7i4eJky%U(S%SIpe3lxH;%#V|lq}@}8U|*^K_q{y%$M%-I=WxYztb zgK2iMZF1_zuBTp496t5ec&GBd0aMGae&TfICnLA|E5+}|ZJuCgU$>mogFOGiXPk!> zWCv1n(Cx{p`t#?2C~|)=k@I|zmC@6v9p?ba{1(c8@V*E#0RId9R&xM@@9&wQVUHHD z9_t@EjXei+^P&FppE-_-?(NDrC>`QSl*1DjvQ8vonyD<`VP&(A>g8stw1=hPq* zG9V_$|AOMf*hg4pcg$svA6s2$pMC<~#{<_vkFW&!m+(8DJbp~s66C-15ah%7R}ZB5 zBaz=jA$F0P!(P1${}|~Z1&+bwPtlqGJl3uyf2Dp*k%vx+jE$5A2KusmbAE%ir~Cb!@AsVF@BEf*n~mtx z6VD!6SP}dGD`FCexX*JqvLLhQ%#ecL9~Wh2JeC?IQg7V~oPtxj%V_ML1!ZE!HP^pKT2i5m(t z!DEsqx*|oM$}VWt?nslRzo*dB?Mx9}06GQ1Dejk@JX$tFl=l^SFRv8dIiP9qrpbG) z{0$B9$6-iV*Z6hUD1n;@#@1^5;wqE64Gt)57;?jOxNi3&vZ+t-o{F2F(mKf&G8E>5 z{kULjPQ&Yw#m>)+V*dt>w|JjYa6ADw*DEZdymu1Yz`9y|IVvwtqF?_^q7?<6rNeI$ zD0>G0*L`=jSa$>g=8Z~`pHER<Klp%0ozl|BOpj)zG`FxYD z;JxQJr^xdjC=XO=Mz*?KB2wQBB&@snu9`6dy$EnnZLJt|{|NN0u7ho2-;$$H#@n3U zk|Pj54&ZA2EQ#MBjP|WF!aIG1N*cet?G=@Gb^r)Bye4t>77Cag+Abz15a8t29p*o4 CZ6xU@y zx%`PD=!e)UsYMaAii%6Y1(hNy-PF4MxS_bzdnRf7D9(jR-rRHMynF7uueYv!dxMml zD_s%Qc1tX(BqEz?H^w9>5lbZEn`@MKRPseV6f^xEk3WQ!6d6P}#I{Lls7ej_ zgKEH68S+IdJ)VH-tqS_pXw+Aw#)6te1tL%|inXNw1tCjcXVZH-J&23tBZRu3tTiev zR^))K$43;vo`z)Y!ixo>E0qS^35){pgO##&mDX3;Nt1=m%{XUI;lpL#uc9qpIFjbf zVqWSYx6|WlS!<&ACMJ(EC)Z^i2N48loyUe0*fYOI)(+760E^^Vm@|6^@qmN(gdPNV zulLGY3$0u9+OA}uasmYljX{95V4tiVrS(x=tzqPDasV8>60W=>$7C&;Gs+@5kp()1 zLw^yPLGKxjU1m0W^k)(Q3|c-%bDowp*6ebyRnl9c00PC&QJO$0_c~a`n0_(_2owuP zxs#N&FO>VD8*9kvw&^fv8#C#L0?rP#P{r}w<(ae-^1!n=ncHo&lc&VaUXFbaO*AT`G&fyH$0VadTqdI62ECeW z)RbMIpecP*_*(eUm-C2%(H}jP8~vr+;l+qiMDIn7U6$mpsWun~jzi+xtBoTiv^P*- zpDyq4f*mz`C3`V3~}9#N9zUOQSkFtNY6n^9ds5_M{?6-o5_ z2X`*51SZ42PSJ`iQ2x`y4f>}JwtmLl!O!_y_Xh-T;Qr8!;}5g=AfaKmgSmp&4D9a# N1&1kydT4jtm4C*km7M?p diff --git a/testing/btest/Traces/smb/smb311.pcap b/testing/btest/Traces/smb/smb311.pcap index b6f4521676c00ea33943e6efbc1afceea60a3941..466924c0005c68238aa686735bfbed012591e11b 100644 GIT binary patch delta 599 zcmYk3&nrYx6vxkf?+wq)ycsi|pHB>#L0F6w%3m-RC`qzmM~WqCA~seGcVVUcScry< zw@{h|BTAB)No<&ylm$DsxC0Mn_o3F|9?G-%sonl+XaaKa*)OF8pC%aXvH;yxUAXZW3bTa|zYR62@rydz)d?(kp_I6NZ1KEFr9h8VSs?@{mN{*Z@+p zLK5D39O=EXOi+D70`9ANpvCen5*=68?yPbQ!bG~!VcYn{C-nI0Z z%w|)gqA1M``yD#^|C=#`;#JyCU+U<-;;B5-)!o?xx5`sj?W?Y>^;BLH>UAzefxeN@BP`4Z=sv(6+ijum zhC4c`wA(t)Af2_EL`YW@R)5e96Kc-C)Ba8^{XKrq69m*~Jyou8QC_Y32MBAQ!# z@sB8WvXw%03j$wzgb1AMr*Vk%$dUx439k1>xS#HRvB_K0VQhi~bh{-b4yPhKxZ^T( zMHsM6f}2+(e3@d)Lf5xpue>ZFiIe1`Z~lB=F!V zm0Rg-nJ=4|O{H zdTN6>@G_}>DG=jp6k8Jy9xIzC9^koidsN~Xbve){JMKD~kfG1hsTgP5E1Yb@J#Gg8 zf|Jr9Q*{~-spUSs9Z{fic}bUs@;O(wRF>jvM3bbjc!TcEuT6fz_F0X`i8n4*`QaU< VQL~R}msWmtEY8{Bz73iI;eVE*8+!l% diff --git a/testing/btest/Traces/smtp-multi-addr.pcap b/testing/btest/Traces/smtp-multi-addr.pcap index 5651d045a9a9a0f6116308621b8f367fec960716..0029d985324a2523631ce519ee3650db73fe1ccf 100644 GIT binary patch delta 369 zcmZ1?b4o(t%Hd55nHX3Y5P*e&5y%nqNe?^8%gZpaCx{osW)|RO@B)f^O-^JLnJma? z$pI3z0g6uM;gz0T&!`VpwnUVdVIEM~Jg~BdjJ;rGn}MQWWs8~g!2*n8K!G<*sbEf& z1TVwp9A-yGun8J+ybMJ^6N)BI6q)>xB@wKoPZ6j-hBY3nqDzIBArq(~6QtrTYXn%u zG<~3o1hxraPMsmpL=N_EOdR4sNB$ILWSCsQD>d1O%K$8(C9%%e}uon`!=Yf@dFJgyy!I(#%BLt|-zmWlG2u~T9a|FcU;q?M@teb$G R0x0LGEYL1c2)*ak2LSbUT;c!# delta 840 zcmZ9J%}X0m6vf}3dGBE&yHcP@?R%xHb&hGFKObKdXWy!R{ese0ZBhmDs) zi02&*Q4R0nZE2!G3?wG3Noy{ZG)HF5!AxQ_^(vE?7*D4%W;WK?(ik&GrmS?*Y;A7E zN+HN0qyF|?EDE7Rd4N7F0{D4FpIVwS%c={C-fxbbH~XKs@}2$P{jlrUaddH+(;w$$ zTl7AbbVD9w2eIYys{CaWI5fD;cO~%DaqKnpYvjl-Z4n^)%&DMf$N?lTHIAaD4UYlE;K@(N{vv(d8Ur*KSfPtzVB?Qt%TxaxMxji5h8~Lc z!+)^f28L@~mF`E^^IYTDu`MRuG0p<7xeEgfZs1`NQ&9k>Gq@C?Nb`}OmS`Ezw!Ux6%}`Wcl*N>jedhu^L;;Z=^gZ5r=q((Cfl}6b?V-n7)nnN1?v{=e z*6hKNEr07*oM$ik*v3fP0q%bgCX0QLX2cLA^& PiYt88{&7M;99*h5UdyC! diff --git a/testing/btest/Traces/smtp.trace b/testing/btest/Traces/smtp.trace index 3d07e83da2f3f7b30e76d8b5454e440b535db1a5..25b09e5d73161ae1940a9fdbe2c353cab7642b67 100644 GIT binary patch delta 2110 zcmYk6dr*{B7{<@u*l&Rk(3p|gg>h;@h6r6ipp} zP37YeWzenh;eI7ilmGwJL;+&*=vAA4y_O`v?*v+`^`#2MMu}04Rw6W6(Izv|wo)Qy zu$a*jpbSHLCsP*mS(PuXQHEjgZ=kf>VW7V#jnWi^y)#sV`l}XXCPEx4Vu4N;>=dV7 zid%pOoR&yD(0B~r)r2FR{Y@rYfo?@_oLdaG z44#ECTHM~0Z@{YW%&3-G0<yu+_hnszd=nPAb5BjIK&{yKvMy3$bmCVvp_|~JWONTf z+ZjK1;sBciZ8h$hXw$a3lhzdmm$%2X20;XX;T7{-SVc8>m8hl(5E&rA_AYng3N)rF zFIWG3QHO$mAys4u0?$qWtl7>; zXvQpSmdLJ`1iAgZmWTFOcxaIU78&mMV3x0OJ5|L2f~YC$OCx^k7HFilXmR5Zw;5JPnnnT?6RW!8 zT$my;>fIy0+_AzC1gjZf7j&V}h(Oy9z*JZBlUMR6ic_1v$!0ua0Qc*aAWYSuigungQK*3b5r-w^T2sUp7FjZQB;!7r2wPYW! z?yUlFXy5B$}D`F71eS{f3?Wr(fuJYsMIYlMUZRiuZBb7W?%K#g8zLF11od9C@=V90M zVYKsIUtoe+H&=0M!508ps`#$2kDwJMI>0;oj|zLw0X|XO*Gq30+liu@+oHb*o4vXa z*PCMkr>W*k^iIjd6SmS;z4+k#@|7&$7sT}^hZv?_4Yp*v@S6u^wMh<#W z%yXfq&mBC3KobP^(StS=QC#S$xq&x}UII=470~^6g_^h?Hu$Pgt%`SJXGKpV8hJTO z2N$`zF%_$Ib{(M)8*M1Gi6HDvW|?(4pQ0m+@I@DCU864@Yx)B%FAjJR*SF0x8dPUN z(a{z&3U&cpeji>@qk6!ugS|;lSGENrSpOY72llpY3hW*QDi*rOV)yIELeax0^=aQF zRl)!h=Lp;`r-2T(8xcHN0*eCJhJ_=o!zi=JApqIXHJgT)z$xsoV{VGs*eDU5fe4~5 z5_p+9KU1RWVQT&HE;Xug0&f9ZRpsQXu2Ui~V|Ds<6}-~UF$Jnkb||sN@1Nj}V-o>f xJCTFccbQ<-oRhptlOWu8(xJpzzXD~4S?xG$+>ixBw}E14c!-DoW#G>t^M9~A`&0k` delta 4468 zcmZ`+3s6*57`_V&qG4K5?IZIRI!U5vW?CUAGDgKZjv_TA6AP}m?6SMS`pBTfwAZLX z$C?~T#+k-Pj1OFU*~1g@1Q;&&DCDg6xgAeR#8+YWsY4XSsH7;E>!9ysp}-Gb3lzmE zFZ%ivB|*7QneTCVyvsaU91423Eixen-X4a1`37P2uaDHCK+70f{MN}}4t>uN zhLkih$uQ2M;nBR7%cq0lw`7Z0WyoZd$C=bepiFaF#Zf~#Q2;?D6`i1gJco@x7Zm>) zx^I`!XpfA%bHQ9<=E_`#CyqDER6#@07!Y~c9}0>a7F&fqF=K?@jV=jmgl)@0!2|UD zfG{MaiMGUDW(6>G7Saa;IvX2F$8LOtazz;MVqi1?hxT6z3U88Cd}o|I0sshppfo_Z z>*GtoBDyY;>5fX8X#yH8v;9gpWajisaF6pn-N6EyR3Ig~lBSqq8J(}Y78E0s7mU#L z>uCxGvY5T}TCjw!OQb|g^21aPaO6=&9}Mu`+}(=>oJIFR8HE6^qz?w*RqegOQo1gc zGDU+5Rr<1$J|Ob0Ex6wp%BNVqZ0=`+CYgYO#na>Nqha$SM7YsNonv?+g2Rm(0%4=>ve-szL4Z-Ny)%g(SQua( z`R=osIP)krPd>0&m3d|fgT}oE4ZTe(YD49K7bj%7!-TFlgzk$f6!QD;CO+FT^A1gZ z`Qq5}*;~SdgK-FFw}uJBodXKI(Bs>QFvD3w50<|F@l)rzj`WZ`bv|+OQ->!xac}`P zBdai04OnmuHI)cBx#m=*Q@iz(>qY7%2KJ&4b8VqTbiGLKSsSY6Q#!z-``tOi77~9{ z4Rnk9oB=q^l|yrN51wa7KEXKHHoFG$Ok>Aqs@D+`ovwdxR}h8uTKZrFtVzlRgRRg- z*Df)?stj)y0$}!kDeUX<&AFF~RM1 z7ICX*DpB+o4sLJ?ls!I+sPRmoZtBN_-c6_^yL$>9r0ftAeQDxzPmz_r=k6y3L{4icrk&MIE1nG&aOhd@E!f;GHWZZ!3f zG^&bY^3Rd5$$cixXR?T2R&ss5JE`-x*~ExOzB};@ zXSD3l6kcoO3fOEhP-h1y?X4DZp>Y)3>(%f!3yOcs4qG45`{YKNx$2Tx0gQC7CP7D2 zx_YV27P#}d(|C(Q95{FKU2fBy?tEz!Q2>F`Wu!ke;8fN_60=|GFw!p+3P&q!BUt7- zWj$9|$a1}M^G;i!V*SGgl_UW`LqAkt@fQ)YDV8mZ`Sz8u{pUE}M8SHsslwd9h4MlU z=kB32nyljaCVs?n${!kqpKKg{WO`WP#%8Xtn)1Rxo@+pv*6hS{gm`o>jz|ewx38Lc zFAj#^(IGMUp*^<1mFBhtvw|=b_OWJf2E1*X&W*vNC_Wn?vlDQyvy zQ*1p>{Iu5=_+jH`2Gju{+GhG`Xiyy=Y~uGHUySTCdu=5&y+rt)P7}SG_)j{X&NIZ5 zQqC6Mk{4M^L>Hy=T8jriDG*0C{CV0>xVWzMag%=5bNwFyBGommT%S{VHA)WYBK$u? Ce~0`4 diff --git a/testing/btest/Traces/tcp/tcp-fast-open.pcap b/testing/btest/Traces/tcp/tcp-fast-open.pcap index 88e9a99b0d1186589230145e7586db37bb356e89..2893440fa28055e3d833875079290cbaea3d429c 100644 GIT binary patch delta 283 zcmbOt^G;m#%Hd55nHX3Y5P*e&5yF*R7%otwcA$o8AOkws+ULt9>uV7n(bLl{sn zZ1O`^k;#FKt{fmyH7{<4$r~8E!JIsAAZG%P)Z{!S1F*pS1a5}SJD7wR!MwCYsPsQ( zi1dGufDTZ75(`9NS`tuT4a*j=@|_?K$h1kU5ZTmZpuip0Ah7HV5C^Q64I;~33bbnt qTPiD9x*Ny?N_&AhcR-v8P>x|aSVnp>Kd(Mmwx|LuD?PcGS04afQ(0yJ delta 810 zcmZ{iyGsK>5XR?{i)f-CNueeww)Ax|han;eqNeeAV8BixdNBxI67wQ9Y8N3@jQ$5| zX`yzaDOI%e)!EqiKx+|+Gq)+0fZOaaznSlwx!cdSUGJv7rNy2Efa#$gw}f}KcC6rp zsg-y(&-#68Kv9*5p$7v1G6W!$HIhq_BvXB=-#5TIb39P|N-VfI*sn%Zwwy{B%!s5j z(Ud~83#Ea4$Rkv{t5p~W3p7B^h(|LjKojBygw6k$BQl$*hQ#Q^eq=DtTw00Exp|go z-ejC!o+I5@KuTGn`vP6QK>AYbFp~sz0UlLc+K$6rE=hiDCqfmyv;-cqe!g>QC)biw zLQeU5g~NNU@M{qjM33PImsb9g-DS-xmfUg=)8v6l3f9whO4d7kBcvJUWwCu#Xg_$w z_C0wPN2GMUz!Tvwc|zE5%f{Pj!^v0NaKsk1c`!$yzW)Xb%muFO;soN3-Zz?2bP(y< zdre@~@t?r)2MKt}6-Qr+{|K5;Tr#j7)+F%4SRxz8SC?kVR3f*cM|HNi&UF4_EzoFw Z&v3DO##)O<3t>&hxRq}VHjKqX9)B8sp*{cr diff --git a/testing/btest/Traces/tls/hrr.pcap b/testing/btest/Traces/tls/hrr.pcap index d3d55ded24b2550d65e193f5a9e00774c188b638..fa64ab693aa9259958e4c7534bbd1c159ce3086f 100644 GIT binary patch delta 361 zcmaE%bwE+!%Hd55nHX3Y5P*e&5y+8JJ{}Xq%D^zWfx}?338NY>NPx$TfguPe88o?2 zL}c(u896}0+UtR8azvyiC$U(7 z)unD^U|0(@YAx8Pk1TV*%G!XUK%)#N|7Dc~3kYv!VA$-#=E4ZpwD2thLpe}WIat$O z_B61XM?g`aGsD1~+3$cFcsN(Ff_VplJfL|7lU4Yoz$U!?&cM(EG@)nmMOKl?z5LZ+ zWv4Y688+Jp#4v$*a$1ZKO)SC?P4i##Fhl`0MS(Tt3VVW;?Es2`&6W|70t@s=@q+vq P1m>_v134g@bws5ANX20s delta 1515 zcma)*PiWIn9LHbMW*fEJiqnHVW%CdIVWAyc?Q~Ye;bG{-gWx9Awu@L3)6iDila1h* z;0~4yvctT15UCV|dGH|OLC~Yjq#?DP0iE`9$xWTdAtR&~k`GO{1l{52lQOv4^oI*<&&w5!knMfzb84Iuh zHk~O}@|qY=N)u9y=7a1QE9dn28`pL5pqkI>xr{E}l#3<6;!;wIi=(6BDP33P+Sd1@ zlhW8kOo|^u1`3#hA<^xD<*CUUQfz%U$OC&h#L-+IE9kOTDyg(8!WL%sKDa0!f3vW0 z=MUTYZUh>v?V+}e0Y!7MM_})3b5>ovkfL-((Ef}xJiYPmI7oe;J>y7$SaHYAMS(3n zCBm)QHUiB5j{qeIcRhq}Ahc%M2-|sp5(E_~DBz*;_nNgf#wEB}{GaXpLqm_T&ymvF zFjM5BCadXkreyzKhB@%>yKBJzp(vKA^XE@HWwJL%Y3!cLgYcFKQXqa&LjbW~Q>-T5 z&Ed!{^DDo4k_M=`9}Ez{3~C6#&Je8Likr^^dlH>@Y>)!#D$-Cu{h^>(Yo7ws++?R( zK>_6pTjwY<4aKU^xMFW2C0set)fRvNYRQ9oNT|9PGd~Lle6|1;)a!yH#}?+E&=x{H z4Z%G$eno^948uX#Ww=d@dMjq8!oB9t9Ya1YpakKqhtPaR$6_G7Jl?5}5J0$s15E+@ z_r8<;M)(px)y)Zjvfca_BG~2!qg@*J-r4lyie+9N%=$<-FRNi2cdS=Qip0OWPVBu% gXFpP6osXJ{NV3acw|SYoCSDT;CLTqiBmU?AAA1hrB>(^b diff --git a/testing/btest/Traces/tls/tls13_psk_succesfull.pcap b/testing/btest/Traces/tls/tls13_psk_succesfull.pcap index cdf7fcf132e77c678a97583223da93134b69cbc2..ccd9dcebfd621bed9e9def8bafc917dcd5730585 100644 GIT binary patch delta 330 zcmew%e?nCC%Hd55nHX3Y5P*e&5y;uGXGhH6U{(e{Alq;9MjnyLvW&JIAkoz~SQ#eI zV2lED?t(Z5OkQBlyxXh{n|ClhWCZih#KCY)rLql0eO=zuzB%< z%u`BYV`u`}(ge1pki8JBA^H(eg93*mM8iHHZ}I|8FWy~14Qb&F4ADRh(O?aZTwWX? z(RW3R43kfA1##>Ka(Fm6874~%4T&jc`(e*?7ZLn-+yLSf@)?2oV1-0y06kVIl|+R>v&_I}OMLLBawKXm~tZ5!E5bnq!nF+9?FdfZPFr1CVzc z6`^bXK0W4&A8y6iRfBY3rm%nmnDf6YBFy8kUh-_O-gfmm4z@_LV}W6H<{Gm~s}cQ^ zJJg{&D-A()Mg6oS^q=mVZ6c5gAw^SBXNpUrddoBRm%(<`AlX{YGDA>}$J=Q&Wm7eu zXI~3_r#Ic|s@-itCUlq&TD`yAIOrGNxWyB@a+(MI+$7{}_M_0hdDS)%NVPh$&ImYi z*B3h5dgJWs!R=>}MTvXs!{;f&Ja#E_L*PdCy#FHfSH6@Xv|c0GKk_oCS%r=;0zxPJ z&7=DtrTI+F#xG8Mh4ClabgXH*88L9Ij_A|Z{hgkj8S~({ff)^Sia}urI9p>3Y Date: Fri, 8 Nov 2019 17:32:44 -0800 Subject: [PATCH 4/4] Adjust btests for OpenBSD portability --- testing/btest/language/nested-sets.zeek | 25 ++++++++++++++++++- .../base/frameworks/logging/ascii-gz.zeek | 3 ++- 2 files changed, 26 insertions(+), 2 deletions(-) diff --git a/testing/btest/language/nested-sets.zeek b/testing/btest/language/nested-sets.zeek index 8c4f987075..1e83b6184d 100644 --- a/testing/btest/language/nested-sets.zeek +++ b/testing/btest/language/nested-sets.zeek @@ -1,6 +1,29 @@ -# @TEST-EXEC: for i in `seq 21`; do echo 0 >> random.seed; done # @TEST-EXEC: test `zeek -b -G random.seed %INPUT` = "pass" +@TEST-START-FILE random.seed +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +@TEST-END-FILE + type r: record { b: set[count]; }; diff --git a/testing/btest/scripts/base/frameworks/logging/ascii-gz.zeek b/testing/btest/scripts/base/frameworks/logging/ascii-gz.zeek index 37757a638e..2bbde57bbb 100644 --- a/testing/btest/scripts/base/frameworks/logging/ascii-gz.zeek +++ b/testing/btest/scripts/base/frameworks/logging/ascii-gz.zeek @@ -1,6 +1,7 @@ # # @TEST-EXEC: zeek -b %INPUT -# @TEST-EXEC: gunzip -S .gzip ssh.log.gzip +# @TEST-EXEC: mv ssh.log.gzip ssh.log.gz +# @TEST-EXEC: gunzip ssh.log.gz # @TEST-EXEC: btest-diff ssh.log # @TEST-EXEC: btest-diff ssh-uncompressed.log #