From 278704f7a366546f915d8638f9fdef5caa8c177f Mon Sep 17 00:00:00 2001 From: Daniel Thayer Date: Thu, 16 Feb 2012 15:17:55 -0600 Subject: [PATCH] Add a test for FTP over IPv6 --- .../conn.log | 13 +++++++++++++ .../scripts.base.protocols.ftp.ftp-ipv6/ftp.log | 9 +++++++++ testing/btest/Traces/ipv6-ftp.trace | Bin 0 -> 18679 bytes .../scripts/base/protocols/ftp/ftp-ipv6.bro | 6 ++++++ 4 files changed, 28 insertions(+) create mode 100644 testing/btest/Baseline/scripts.base.protocols.ftp.ftp-ipv6/conn.log create mode 100644 testing/btest/Baseline/scripts.base.protocols.ftp.ftp-ipv6/ftp.log create mode 100644 testing/btest/Traces/ipv6-ftp.trace create mode 100644 testing/btest/scripts/base/protocols/ftp/ftp-ipv6.bro diff --git a/testing/btest/Baseline/scripts.base.protocols.ftp.ftp-ipv6/conn.log b/testing/btest/Baseline/scripts.base.protocols.ftp.ftp-ipv6/conn.log new file mode 100644 index 0000000000..6bab9332c8 --- /dev/null +++ b/testing/btest/Baseline/scripts.base.protocols.ftp.ftp-ipv6/conn.log @@ -0,0 +1,13 @@ +#separator \x09 +#set_separator , +#empty_field (empty) +#unset_field - +#path conn +#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes +#types time string addr port addr port enum string interval count count string bool count string count count count count +1329327783.316897 arKYeMETxOg 2001:470:1f11:81f:c999:d94:aa7c:2e3e 49186 2001:470:4867:99::21 57086 tcp ftp-data 0.219721 0 342 SF - 0 ShAdfFa 5 372 4 642 +1329327786.524332 k6kgXLOoSKl 2001:470:1f11:81f:c999:d94:aa7c:2e3e 49187 2001:470:4867:99::21 57087 tcp ftp-data 0.217501 0 43 SF - 0 ShAdfFa 5 372 4 343 +1329327787.289095 nQcgTWjvg4c 2001:470:1f11:81f:c999:d94:aa7c:2e3e 49188 2001:470:4867:99::21 57088 tcp ftp-data 0.217941 0 77 SF - 0 ShAdfFa 5 372 4 377 +1329327795.571921 j4u32Pc5bif 2001:470:4867:99::21 55785 2001:470:1f11:81f:c999:d94:aa7c:2e3e 49189 tcp ftp-data 0.109813 77 0 SF - 0 ShADFaf 5 449 4 300 +1329327800.017649 TEfuqmmG4bh 2001:470:4867:99::21 55647 2001:470:1f11:81f:c999:d94:aa7c:2e3e 49190 tcp ftp-data 0.109181 342 0 SF - 0 ShADFaf 5 714 4 300 +1329327777.822004 UWkUyAuUGXf 2001:470:1f11:81f:c999:d94:aa7c:2e3e 49185 2001:470:4867:99::21 21 tcp ftp 26.658219 310 3448 SF - 0 ShAdDfFa 57 4426 34 5908 diff --git a/testing/btest/Baseline/scripts.base.protocols.ftp.ftp-ipv6/ftp.log b/testing/btest/Baseline/scripts.base.protocols.ftp.ftp-ipv6/ftp.log new file mode 100644 index 0000000000..670855414e --- /dev/null +++ b/testing/btest/Baseline/scripts.base.protocols.ftp.ftp-ipv6/ftp.log @@ -0,0 +1,9 @@ +#separator \x09 +#set_separator , +#empty_field (empty) +#unset_field - +#path ftp +#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p user password command arg mime_type mime_desc file_size reply_code reply_msg tags extraction_file +#types time string addr port addr port string string string string string string count count string table[string] file +1329327787.396984 UWkUyAuUGXf 2001:470:1f11:81f:c999:d94:aa7c:2e3e 49185 2001:470:4867:99::21 21 anonymous test RETR ftp://2001:470:4867:99::21/robots.txt - - 77 226 Transfer complete. - - +1329327795.463946 UWkUyAuUGXf 2001:470:1f11:81f:c999:d94:aa7c:2e3e 49185 2001:470:4867:99::21 21 anonymous test RETR ftp://2001:470:4867:99::21/robots.txt - - 77 226 Transfer complete. - - diff --git a/testing/btest/Traces/ipv6-ftp.trace b/testing/btest/Traces/ipv6-ftp.trace new file mode 100644 index 0000000000000000000000000000000000000000..81313fac11b5270986b03b04c0aaeb8e7ef6fbd3 GIT binary patch literal 18679 zcmeHPdwdjCmagt}0we?wQ5bdC%Oj9Lclwc#M+2G=fRGqRCiaBmVVjQAqixM zs5?FY-y_QEsQB1*#C7oPPmzf-?u_n?KW7D%aX^^`M;@z-JGv|CWWQ6ltNM{ficS5w z{YxdO>hAm9^PO|g{qE^oy?4*E+s%SSP#*&Wf?&eQ_RnW6{>!G3f*1eO@u9=J;LR6) zWzCrteDcNvYj8!d=G8EhC3^8W!!LeoTj5Wi>@B^7&KI-`+vsULCiYJh&YQaF$E)dN zr+Hvt-YtS)w&Xr+%E>XAOvCftrejU?oW;x$ueFZS5IGjd)ex&P5i)xqoYy}wFZMrE zfVyVq*fB!+A2h@~LIjwJP%UPYiEKOt#AUchM;05IZX4GCwWx1QU!&y^Ah>NW6WSv{ zIsT#`+>H}DGVQwP3t?5BUb~9OuD%IEUH^?7g%DuR%PyCLwZ)^QO;UWWXI^O}*3Ra) zHZxg@t&?J`m|wQx6@KP&I312Mm!pKmB+=hfT9{8=T=xd>e6P~0a z3;j!U)9(fSQKEnM^BffoTHL0S_m-78*=3!Q9B08udmzjrYppEa6O~v`q%+3CVn|}5 z%%Y+!cST};P)^T!wcR#$6fOFgxP`P2rY z&>NMRFA@&p{eg9O1x`9+@JebXF>s4EtVYAs-U1uyNh2y~< z=IM+^(I>Fd92Dbikr?`kSJ-BxW7%yC?X0oc8JniI)XSLYi^Re!Tou+b*D5O$gYA(R z{fTyn_!IJ1l!FtzEag#bUukFP7cSXXrnH2Y2inCI)@am6EyaBJ6&GUxEAvX;NVmdm zdP{a#MXj%)*3+7Tmt`ySNpf2N&G;f-F&MWpKT>tbC(8IYvr~)NVq7ax8cZ?;IBA`C zg%}H2LxHGFU9-v^W$0cW6XQZ95veaZIZ4!k>1 zR#l+|PFhpNt4m85v5w!&o=O$Y1Kv=$3q}TdBH;ko33i6XiYjEx#3QXG#!3+e_BHfe zdP5=6w<1LE!+sbGNAwZ958SO9@S{IU1n?l@o1;TzQhECE0?aZck zmMUimN;^{`GtF^fsY~XKP*1>4Sn7@|W<}bF{gifk=isrpq@-ldoD#MYuA}oLNztH) zK_|uok+93kq9G9+MPpLb%49L@k46Gvgn`gwclO;P01^g!X5tg`#}sX6%62G%WwiA;KAMvgM(=?N_aDHZ8> zq^2UoF&@RN7~=wYL^)Hv?vW%$QlU%o%7Hl4LY#HP<59QW-qqEWqUtDZC=Ym=S(Oe@ z1gQPhB9bkaNQxkz1(jJO9uvcI8zLIo$d9xV3gNHJ16pYhA+$m1k@5?}ws?Lcf)n=g z*_K{Ze?{}+mR8oZxV53Kp7)&pZVpPKEU|C|J&$*w@06AizB0`@@s5DZ#V8qusVOdE z67$7+qVY(3OpJB}e7qGo(iZO$WBfI-NHB=R-bup{O-QW1n;K=c{!kzskYNu2U@mO$ zMDACxitB4zN}#Q%tNeFUBn(;;UC^2ji9JZn%pd6r2P2{%D3KV803+5FfEAJgq+I2# z#3Y+`4P!6Dit&2<5h3gdSqxGGF-Z>iF)snH1ap)Zvq%F-x3b27w?|A&tDa6jU21|Q z9c*C)S>1{mHWm=61u={{nz}(#b~qmEA&@T6)1eTswA53|Iz(t%GEfS6#aMd;-E4;z zkkibb+oKs52)9$yoihC+ivd4VX|R$u#bkw8YmZ41Jr6j*^Y$^DO6^EB2q6TF`ch;e z*a<7uC*Us_shlc~S6_%w;O!)Ji#5fW6b0}wxUwpipN>i5gtsGif(DfrSOnh_U&`em z;sFF8PzQ-{(TAy2Cg;Rs0VpDhNiiA?(z1uriuHPvQOQd-&FvfWW6ytFqb09DtI2Ek zPfVI5&Z5Dm>ek>J@(2YQyz;4Z6wj5OR&LR%X*otLc7TIKc^%2`2insT<)2;7nQUoO z!xgL*D;zg#tYXWMSU{~ip#C#W}_heH|!}X|Z$cGnImGTU4SiD#Gp@5sWCDj?L$FJ%xVN`=W~HO5qPK+iYSmtY#`s;}xg0!~ANd!Jfrnsj0r7lj zpG7OWW{F@uW!^~#|60&=crRL1%DlPbw4!UG%sW76N|~1s<=#9EF_Ue)%z9?F5B{}( z(g!ZvT|nKpb8Mfmu|h*kDf13IL}gw=topkl=K^lyKA=*mt?`$$6HJ-~rKn6OyMUrr zzOpc>f12n1Lc~_xmWEQ$*g(@fVZB^5T(}iv(UHj^O3KU6%%M^$M_eFc@1ux)Em1r~ zgCpIr$~n`)7DuHp1#GRSuAza2C`$b(ZIFsr3QSO85Q=P?-5UtogYq<}D(akPszC|j zJ_PPs(Cs+L8&UE*&mBg*qo485Ed*vBjiga!Q2J-4sTB6U@0+v~m<6n23US zBo1+3UE!>B73K$HUETC!>!vzeEE0(`sB=jQk{nkaWiD3R+0L953`KTFH7gB4dy4H6 zvt7cXonAYy?%6SO&0ADo%GVUOgcL5!_w&YW)P7mE_GdaX+Lz*3IoV=e$`2}I=vIZp zfv%u{;g$W2l~=o*<>i;T)|jMEMHQ5b zem=q&`NI8$h%M<&LmAtIMIMihyhR1V?Et1DlS9atE6<#n6Y}LbMC@Y}u@@v3XJ`-+ zJMyNpkuPn5Aj+kvB9VY0!W+=NArj6L(PIeR6Cm9F!4n!4C#j2svY@FzxDF?DWRQ^i z-=l?vXC~nw4yY|C3qlC~It zf?2tsQA7C>aiK8w@X3+J%*rR!(Q@-fjWHT6Cr>vk6O#vlKE$Zd215=l_iH{lPqnd- z>L$uyVBaQDh7=X65ET%+$R=cC&7ruja zhEg@dPMD$g8{)I4VCMw*Z0`F%Qtcd71(VJtlxr?D2`COLM;11ny4mC? zU~`XJJvVa{D(_)kl3Y9x?9zU-=EN+t7VD;U0%(1WXniV?rpPcipk2-~R$0lZ{1ea& zq4G6Q$w1|TeVFyQj2ZQ)N@ddX?D?@nR1D>0~bNN2Cs%RcPO6B>oz>uq5Q$7~1{q;xGRYfk|_qZnB z5^_;NQ{*DqHFnfct6d)p{Zp0{_>Kd0Imt!uRt+&lE{+~Wa*+_P2I3Hzws5l2A4I6_$j6v`uXWH6F@$95rfW=0YLc7g(oWaJx1HAXOVj$XeM`$%mlWQF5y zHa&k{K*qL$NEiMujkm8)JI^?cd()rxu6HTKY#TZ;T7>$mK}^vjsKWA`I+}=4B6J`H zB?~b+geE7(U#$=Wp~(`HJs}V=ij!X&vXhgxxD{Kl0L`@JfnA28Kxl6NL__&hW$eyn z#*}|@wyJ~c?|;EjfIx%m$mxV8G5I~vhnTmx(4^t=G?=V;Z@y~d7>IX1T%_eAjLBOZ z1$pbYccr7yN1B83R=1cmZb-rCMlfDM`j!=I)KV~hN)#SHm2ZsVd>RfsLfP@g%QX}@ za7+_PBdTsYs+<*0r^``R#dF>L-{u?Ryd!Yl8*tv-f75FIV`wM+xaVNssyB0taUMs3 z^B#Fqb)M}TLK&nu33l~0xyC5YH$dyxMC)dh@Df6PvfFI?Mpc}Ib^vIGjDxR1<=dcg z!SjDqjV$%S$jOAVb8W7$87FjP5${WNi+7F!Du4D-I!b*rc8m48dJ!&8cX_45?QC;8 z-Br#ux39Xo+U>6{cZ*`B&+U@Rq~7vsXH_-!98%Xl8aqsgqg!-jj1^ipU2^6bEwOHT zd+Mf*Gl=f%f2Pqr#ceM2(Yi_LUSca8Z6uLHgg?nxhAn50a;t)(Rels(6qLMnLs1|{_xz`33p^w!C_D0use4*V z)xqWagrks8$Tz2xqr_zOuw+FtgGszym%oxxF&|9UJlm<-=sm4JFVe=}mxs=$v?|h9-tJ{2OWo9|K7Gj8yr#O?*lEqFvsf!PV zrC>8mY(8?IX6JU;X(g1^u91c)(v2JiY;O98bdij?~BF8W|dNN<7@X#SY9U0W8^P=VA&DBBJuZ{N(~YTcXIHgXg=;j8hg z6F3Ur#P%|i*R|zq|ewp!Smty|Pq8Ovuoh4d{#_LkV%&@#H5lS!~oJL%EIpKz)@G?bc7U z$bk&4*+3|<6DC8p16sBqKJTFT?0H2)L44MXN|m8!u^o^)_Z2#4NZ{Uqz}j$HRzeqAR zWLw75cEI!BAB^(#9XW<jY~9YkybuEod72$ue;Njdxkbr-uMW4qvm1M z3`jk?&9zI^ydiE)q6{ha#v}H2QG&kbZ#W7NC~tha3%0nP%r)fm-GnWeRzJH+wPguO zY}=Bh4cJ^oSeLg9)37ouqVk#EZ(smt@Y+_I3?6z&v#7#tUUH4g<-|8I5Y`*O8f(J7 z2OL?j{;0Q9XTeP=!1|F;*VdPgMO&-q(WZ0U^Vx>G;*}le%1xy*3U;{djCJ9=HJmfc z`DbtR4GAtrJG#`HB3qSR+&}p4a!PEY2Uzt_Yy2o; Ii>ZD83rTW1%m4rY literal 0 HcmV?d00001 diff --git a/testing/btest/scripts/base/protocols/ftp/ftp-ipv6.bro b/testing/btest/scripts/base/protocols/ftp/ftp-ipv6.bro new file mode 100644 index 0000000000..7ce31808c9 --- /dev/null +++ b/testing/btest/scripts/base/protocols/ftp/ftp-ipv6.bro @@ -0,0 +1,6 @@ +# This tests both active and passive FTP over IPv6. +# +# @TEST-EXEC: bro -r $TRACES/ipv6-ftp.trace +# @TEST-EXEC: btest-diff conn.log +# @TEST-EXEC: btest-diff ftp.log +