Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Add two protocol mismatch testcases

Browse source 
These traces contain different protocols being used by originator/responder.

Traces from GH-4251
This commit is contained in:
Johanna Amann 2025-03-04 15:38:20 +00:00
parent b8c135d7cb
commit 2daf692c95
5 changed files with 32 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

11
testing/btest/Baseline/scripts.base.frameworks.analyzer.request-response-protocol-differences/conn-http-to-ssh.log Normal file
View file

@ -0,0 +1,11 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path conn
#open XXXX-XX-XX-XX-XX-XX
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents ip_proto
#types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] count
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 40896 127.0.0.1 22 tcp - 0.001845 75 78 RSTR T T 0 ShADadFr 7 447 6 398 - 6
#close XXXX-XX-XX-XX-XX-XX

11
testing/btest/Baseline/scripts.base.frameworks.analyzer.request-response-protocol-differences/conn-https-to-http.log Normal file
View file

@ -0,0 +1,11 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path conn
#open XXXX-XX-XX-XX-XX-XX
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents ip_proto
#types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] count
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 50382 127.0.0.1 80 tcp - 0.028273 517 468 RSTO T T 0 ShADadfR 5 785 4 684 - 6
#close XXXX-XX-XX-XX-XX-XX

BIN
testing/btest/Traces/http/http-to-ssh.pcap Normal file
View file

Binary file not shown.

BIN
testing/btest/Traces/tls/https-to-http.pcap Normal file
View file

Binary file not shown.

10
testing/btest/scripts/base/frameworks/analyzer/request-response-protocol-differences.zeek Normal file
View file

@ -0,0 +1,10 @@
# This test checks behavior when the originator and responder protocols
# differ - e.g. when a HTTPS client connects to a HTTP port.
#
# @TEST-EXEC: zeek -r ${TRACES}/http/http-to-ssh.pcap
# @TEST-EXEC: mv conn.log conn-http-to-ssh.log
# @TEST-EXEC: zeek -r ${TRACES}/tls/https-to-http.pcap
# @TEST-EXEC: mv conn.log conn-https-to-http.log
# @TEST-EXEC: btest-diff conn-http-to-ssh.log
# @TEST-EXEC: btest-diff conn-https-to-http.log