From 2daf692c95df35f912861c0651654fa36e533e8d Mon Sep 17 00:00:00 2001 From: Johanna Amann Date: Tue, 4 Mar 2025 15:38:20 +0000 Subject: [PATCH] Add two protocol mismatch testcases These traces contain different protocols being used by originator/responder. Traces from GH-4251 --- .../conn-http-to-ssh.log | 11 +++++++++++ .../conn-https-to-http.log | 11 +++++++++++ testing/btest/Traces/http/http-to-ssh.pcap | Bin 0 -> 1259 bytes testing/btest/Traces/tls/https-to-http.pcap | Bin 0 -> 1763 bytes .../request-response-protocol-differences.zeek | 10 ++++++++++ 5 files changed, 32 insertions(+) create mode 100644 testing/btest/Baseline/scripts.base.frameworks.analyzer.request-response-protocol-differences/conn-http-to-ssh.log create mode 100644 testing/btest/Baseline/scripts.base.frameworks.analyzer.request-response-protocol-differences/conn-https-to-http.log create mode 100644 testing/btest/Traces/http/http-to-ssh.pcap create mode 100644 testing/btest/Traces/tls/https-to-http.pcap create mode 100644 testing/btest/scripts/base/frameworks/analyzer/request-response-protocol-differences.zeek diff --git a/testing/btest/Baseline/scripts.base.frameworks.analyzer.request-response-protocol-differences/conn-http-to-ssh.log b/testing/btest/Baseline/scripts.base.frameworks.analyzer.request-response-protocol-differences/conn-http-to-ssh.log new file mode 100644 index 0000000000..af72f66ac8 --- /dev/null +++ b/testing/btest/Baseline/scripts.base.frameworks.analyzer.request-response-protocol-differences/conn-http-to-ssh.log @@ -0,0 +1,11 @@ +### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. +#separator \x09 +#set_separator , +#empty_field (empty) +#unset_field - +#path conn +#open XXXX-XX-XX-XX-XX-XX +#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents ip_proto +#types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] count +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 40896 127.0.0.1 22 tcp - 0.001845 75 78 RSTR T T 0 ShADadFr 7 447 6 398 - 6 +#close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/scripts.base.frameworks.analyzer.request-response-protocol-differences/conn-https-to-http.log b/testing/btest/Baseline/scripts.base.frameworks.analyzer.request-response-protocol-differences/conn-https-to-http.log new file mode 100644 index 0000000000..5e026f7c3d --- /dev/null +++ b/testing/btest/Baseline/scripts.base.frameworks.analyzer.request-response-protocol-differences/conn-https-to-http.log @@ -0,0 +1,11 @@ +### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. +#separator \x09 +#set_separator , +#empty_field (empty) +#unset_field - +#path conn +#open XXXX-XX-XX-XX-XX-XX +#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents ip_proto +#types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] count +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 50382 127.0.0.1 80 tcp - 0.028273 517 468 RSTO T T 0 ShADadfR 5 785 4 684 - 6 +#close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Traces/http/http-to-ssh.pcap b/testing/btest/Traces/http/http-to-ssh.pcap new file mode 100644 index 0000000000000000000000000000000000000000..7393dd6f53007c966c58ddf8278fb29b40180088 GIT binary patch literal 1259 zcmaKrKWGzi6vuzLq_$i*X@k_d-Jn(jx#W`CrnO2>3`T=kXzG^KCb1!u;*EzXg}Q$EvSu}2mc-7}Gx1mabQkL@h7nAVD9k>f<$Vvk$& zCf&sTt}l6~JWnZ~aHb>WKBb&>Gco0RZ(^8;TLXz>@YhTJPaNub-4B{h-g!>6z4yU8 P-#!7v#1U~5?#0eOv}z&= literal 0 HcmV?d00001 diff --git a/testing/btest/Traces/tls/https-to-http.pcap b/testing/btest/Traces/tls/https-to-http.pcap new file mode 100644 index 0000000000000000000000000000000000000000..5037527177b9d9ca7d4bf216c6459353155b37ee GIT binary patch literal 1763 zcmds%{cqbu7{{MGJE`lzR7mMwc#+#xv}@@SCtYbPH%u#CqtT5@w38;4N$zaosa=vL z&Xh@;2ydejFA_+M{lL170oo9g3PJ%YG`zZkGOGRnX!&&l6@FkE0trE3BRpp(TgpoR z03PYF@9w$#+}G!?{jL4MDGEH4qEG-J*b&>T=)xZ!*p6+M1fReYiz!tBz_#`f1 zIWrIaQtrcTZ01Q?$cJhGC|}6)R1jYu`AK8rgySk0Sy)_&48X|BREZ4zGxO&zKfVs> zy(jN1eDyZ&QBG#`61fh^TX83r<>6><&0k<-9ZKY)=3b<)&sI^Gqo|R%dKr~zt*r1u zFOIV;4@RUN`DsQR{&QL4S_*IGZV(Mdtl;n1rylC1&z?Qy z2~LsmK?QeGbzjRaE&_n0<+bR zZ6#Y3KY{g9F4vc>BG7P#qXY> z;%6@}EHal&p-cYTcX^w+MEkqs688t0>pORO&sFr@_1XHRE@8yQ6^Vl{IZkdZ5nU(m mx#~Fi4hpl