mirror of
https://github.com/zeek/zeek.git
synced 2025-10-11 19:18:19 +00:00
Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath: Trick for parallelizing input framework unit tests. Maybe fix reliability of a unit test that relies on when statements. Remove unused attributes
This commit is contained in:
commit
3438a8d8f9
48 changed files with 88 additions and 248 deletions
14
CHANGES
14
CHANGES
|
@ -1,4 +1,18 @@
|
||||||
|
|
||||||
|
2.1-223 | 2012-12-12 14:25:15 -0800
|
||||||
|
|
||||||
|
* Trick for parallelizing input framework unit tests. Instead of
|
||||||
|
loading listen.bro to block until files are read, just read a pcap
|
||||||
|
file in pseudo-realtime. (Jon Siwek)
|
||||||
|
|
||||||
|
* Fix reliability of a unit test that relies on when statements.
|
||||||
|
(Jon Siwek)
|
||||||
|
|
||||||
|
* Remove unused attributes. (Daniel Thayer)
|
||||||
|
- Removed attributes &postprocessor and &match from documentation and source code.
|
||||||
|
- Removed undocumented attribute &attr from source code.
|
||||||
|
- Removed internal attribute "(&tracked)" from documentation.
|
||||||
|
|
||||||
2.1-218 | 2012-12-10 14:45:04 -0800
|
2.1-218 | 2012-12-10 14:45:04 -0800
|
||||||
|
|
||||||
* Add GPRS Tunnelling Protocol (GTPv1) decapsulation. This currently
|
* Add GPRS Tunnelling Protocol (GTPv1) decapsulation. This currently
|
||||||
|
|
2
VERSION
2
VERSION
|
@ -1 +1 @@
|
||||||
2.1-218
|
2.1-223
|
||||||
|
|
|
@ -663,20 +663,12 @@ scripting language supports the following built-in attributes.
|
||||||
``&synchronized`` variable is automatically propagated to all peers
|
``&synchronized`` variable is automatically propagated to all peers
|
||||||
when it changes.
|
when it changes.
|
||||||
|
|
||||||
.. bro:attr:: &postprocessor
|
|
||||||
|
|
||||||
.. TODO: needs to be documented.
|
|
||||||
|
|
||||||
.. bro:attr:: &encrypt
|
.. bro:attr:: &encrypt
|
||||||
|
|
||||||
Encrypts files right before writing them to disk.
|
Encrypts files right before writing them to disk.
|
||||||
|
|
||||||
.. TODO: needs to be documented in more detail.
|
.. TODO: needs to be documented in more detail.
|
||||||
|
|
||||||
.. bro:attr:: &match
|
|
||||||
|
|
||||||
.. TODO: needs to be documented.
|
|
||||||
|
|
||||||
.. bro:attr:: &raw_output
|
.. bro:attr:: &raw_output
|
||||||
|
|
||||||
Opens a file in raw mode, i.e., non-ASCII characters are not
|
Opens a file in raw mode, i.e., non-ASCII characters are not
|
||||||
|
@ -710,6 +702,3 @@ scripting language supports the following built-in attributes.
|
||||||
|
|
||||||
.. TODO: needs documented
|
.. TODO: needs documented
|
||||||
|
|
||||||
.. bro:attr:: (&tracked)
|
|
||||||
|
|
||||||
.. TODO: needs documented or removed if it's not used anywhere.
|
|
||||||
|
|
|
@ -14,8 +14,8 @@ const char* attr_name(attr_tag t)
|
||||||
"&rotate_interval", "&rotate_size",
|
"&rotate_interval", "&rotate_size",
|
||||||
"&add_func", "&delete_func", "&expire_func",
|
"&add_func", "&delete_func", "&expire_func",
|
||||||
"&read_expire", "&write_expire", "&create_expire",
|
"&read_expire", "&write_expire", "&create_expire",
|
||||||
"&persistent", "&synchronized", "&postprocessor",
|
"&persistent", "&synchronized",
|
||||||
"&encrypt", "&match",
|
"&encrypt",
|
||||||
"&raw_output", "&mergeable", "&priority",
|
"&raw_output", "&mergeable", "&priority",
|
||||||
"&group", "&log", "&error_handler", "&type_column",
|
"&group", "&log", "&error_handler", "&type_column",
|
||||||
"(&tracked)",
|
"(&tracked)",
|
||||||
|
@ -337,11 +337,6 @@ void Attributes::CheckAttr(Attr* a)
|
||||||
Error("&rotate_size only applicable to files");
|
Error("&rotate_size only applicable to files");
|
||||||
break;
|
break;
|
||||||
|
|
||||||
case ATTR_POSTPROCESSOR:
|
|
||||||
if ( type->Tag() != TYPE_FILE )
|
|
||||||
Error("&postprocessor only applicable to files");
|
|
||||||
break;
|
|
||||||
|
|
||||||
case ATTR_ENCRYPT:
|
case ATTR_ENCRYPT:
|
||||||
if ( type->Tag() != TYPE_FILE )
|
if ( type->Tag() != TYPE_FILE )
|
||||||
Error("&encrypt only applicable to files");
|
Error("&encrypt only applicable to files");
|
||||||
|
|
|
@ -25,9 +25,7 @@ typedef enum {
|
||||||
ATTR_EXPIRE_CREATE,
|
ATTR_EXPIRE_CREATE,
|
||||||
ATTR_PERSISTENT,
|
ATTR_PERSISTENT,
|
||||||
ATTR_SYNCHRONIZED,
|
ATTR_SYNCHRONIZED,
|
||||||
ATTR_POSTPROCESSOR,
|
|
||||||
ATTR_ENCRYPT,
|
ATTR_ENCRYPT,
|
||||||
ATTR_MATCH,
|
|
||||||
ATTR_RAW_OUTPUT,
|
ATTR_RAW_OUTPUT,
|
||||||
ATTR_MERGEABLE,
|
ATTR_MERGEABLE,
|
||||||
ATTR_PRIORITY,
|
ATTR_PRIORITY,
|
||||||
|
|
|
@ -56,7 +56,7 @@ public:
|
||||||
// Rotates the logfile. Returns rotate_info.
|
// Rotates the logfile. Returns rotate_info.
|
||||||
RecordVal* Rotate();
|
RecordVal* Rotate();
|
||||||
|
|
||||||
// Set &rotate_interval, &rotate_size, &postprocessor,
|
// Set &rotate_interval, &rotate_size,
|
||||||
// and &raw_output attributes.
|
// and &raw_output attributes.
|
||||||
void SetAttrs(Attributes* attrs);
|
void SetAttrs(Attributes* attrs);
|
||||||
|
|
||||||
|
|
|
@ -17,7 +17,7 @@
|
||||||
%token TOK_STRING TOK_SUBNET TOK_SWITCH TOK_TABLE
|
%token TOK_STRING TOK_SUBNET TOK_SWITCH TOK_TABLE
|
||||||
%token TOK_TIME TOK_TIMEOUT TOK_TIMER TOK_TYPE TOK_UNION TOK_VECTOR TOK_WHEN
|
%token TOK_TIME TOK_TIMEOUT TOK_TIMER TOK_TYPE TOK_UNION TOK_VECTOR TOK_WHEN
|
||||||
|
|
||||||
%token TOK_ATTR_ADD_FUNC TOK_ATTR_ATTR TOK_ATTR_ENCRYPT TOK_ATTR_DEFAULT
|
%token TOK_ATTR_ADD_FUNC TOK_ATTR_ENCRYPT TOK_ATTR_DEFAULT
|
||||||
%token TOK_ATTR_OPTIONAL TOK_ATTR_REDEF TOK_ATTR_ROTATE_INTERVAL
|
%token TOK_ATTR_OPTIONAL TOK_ATTR_REDEF TOK_ATTR_ROTATE_INTERVAL
|
||||||
%token TOK_ATTR_ROTATE_SIZE TOK_ATTR_DEL_FUNC TOK_ATTR_EXPIRE_FUNC
|
%token TOK_ATTR_ROTATE_SIZE TOK_ATTR_DEL_FUNC TOK_ATTR_EXPIRE_FUNC
|
||||||
%token TOK_ATTR_EXPIRE_CREATE TOK_ATTR_EXPIRE_READ TOK_ATTR_EXPIRE_WRITE
|
%token TOK_ATTR_EXPIRE_CREATE TOK_ATTR_EXPIRE_READ TOK_ATTR_EXPIRE_WRITE
|
||||||
|
|
|
@ -319,7 +319,6 @@ vector return TOK_VECTOR;
|
||||||
when return TOK_WHEN;
|
when return TOK_WHEN;
|
||||||
|
|
||||||
&add_func return TOK_ATTR_ADD_FUNC;
|
&add_func return TOK_ATTR_ADD_FUNC;
|
||||||
&attr return TOK_ATTR_ATTR;
|
|
||||||
&create_expire return TOK_ATTR_EXPIRE_CREATE;
|
&create_expire return TOK_ATTR_EXPIRE_CREATE;
|
||||||
&default return TOK_ATTR_DEFAULT;
|
&default return TOK_ATTR_DEFAULT;
|
||||||
&delete_func return TOK_ATTR_DEL_FUNC;
|
&delete_func return TOK_ATTR_DEL_FUNC;
|
||||||
|
|
|
@ -1,12 +0,0 @@
|
||||||
1300475167.096535 expression error in /Users/jsiwek/Projects/bro/bro/testing/btest/.tmp/core.dns-interpreter-exceptions/dns-interpreter-exceptions.bro, line 28: field value missing [p$ip]
|
|
||||||
1300475167.096535 expression error in /Users/jsiwek/Projects/bro/bro/testing/btest/.tmp/core.dns-interpreter-exceptions/dns-interpreter-exceptions.bro, line 49: field value missing [p$ip]
|
|
||||||
1300475168.902195 expression error in /Users/jsiwek/Projects/bro/bro/testing/btest/.tmp/core.dns-interpreter-exceptions/dns-interpreter-exceptions.bro, line 39: field value missing [p$ip]
|
|
||||||
1300475168.902195 expression error in /Users/jsiwek/Projects/bro/bro/testing/btest/.tmp/core.dns-interpreter-exceptions/dns-interpreter-exceptions.bro, line 12: field value missing [p$ip]
|
|
||||||
timeout g(), F
|
|
||||||
timeout g(), T
|
|
||||||
timeout
|
|
||||||
g() done, no exception, T
|
|
||||||
localhost resolved
|
|
||||||
localhost resolved from f(), T
|
|
||||||
localhost resolved from f(), F
|
|
||||||
f() done, no exception, T
|
|
|
@ -0,0 +1,5 @@
|
||||||
|
1355264617.053514 expression error in /home/jsiwek/bro/testing/btest/.tmp/core.when-interpreter-exceptions/when-interpreter-exceptions.bro, line 32: field value missing [p$ip]
|
||||||
|
1355264617.053514 expression error in /home/jsiwek/bro/testing/btest/.tmp/core.when-interpreter-exceptions/when-interpreter-exceptions.bro, line 53: field value missing [p$ip]
|
||||||
|
1355264617.053514 expression error in /home/jsiwek/bro/testing/btest/.tmp/core.when-interpreter-exceptions/when-interpreter-exceptions.bro, line 43: field value missing [p$ip]
|
||||||
|
1355264617.053514 expression error in /home/jsiwek/bro/testing/btest/.tmp/core.when-interpreter-exceptions/when-interpreter-exceptions.bro, line 16: field value missing [p$ip]
|
||||||
|
1355264617.053514 received termination signal
|
|
@ -0,0 +1,8 @@
|
||||||
|
timeout g(), F
|
||||||
|
timeout g(), T
|
||||||
|
timeout
|
||||||
|
g() done, no exception, T
|
||||||
|
localhost resolved
|
||||||
|
localhost resolved from f(), T
|
||||||
|
localhost resolved from f(), F
|
||||||
|
f() done, no exception, T
|
|
@ -1,8 +1,8 @@
|
||||||
error: ../input.log/Input::READER_ASCII: Number '12129223372036854775800' out of supported range.
|
1355266097.683599 error: ../input.log/Input::READER_ASCII: Number '12129223372036854775800' out of supported range.
|
||||||
error: ../input.log/Input::READER_ASCII: Could not convert line '12129223372036854775800 121218446744073709551612' to Val. Ignoring line.
|
1355266097.683599 error: ../input.log/Input::READER_ASCII: Could not convert line '12129223372036854775800 121218446744073709551612' to Val. Ignoring line.
|
||||||
warning: ../input.log/Input::READER_ASCII: Number '9223372036854775801TEXTHERE' contained non-numeric trailing characters. Ignored trailing characters 'TEXTHERE'
|
1355266097.683599 warning: ../input.log/Input::READER_ASCII: Number '9223372036854775801TEXTHERE' contained non-numeric trailing characters. Ignored trailing characters 'TEXTHERE'
|
||||||
warning: ../input.log/Input::READER_ASCII: Number '1Justtext' contained non-numeric trailing characters. Ignored trailing characters 'Justtext'
|
1355266097.683599 warning: ../input.log/Input::READER_ASCII: Number '1Justtext' contained non-numeric trailing characters. Ignored trailing characters 'Justtext'
|
||||||
error: ../input.log/Input::READER_ASCII: String 'Justtext' contained no parseable number
|
1355266097.683599 error: ../input.log/Input::READER_ASCII: String 'Justtext' contained no parseable number
|
||||||
error: ../input.log/Input::READER_ASCII: Could not convert line 'Justtext 1' to Val. Ignoring line.
|
1355266097.683599 error: ../input.log/Input::READER_ASCII: Could not convert line 'Justtext 1' to Val. Ignoring line.
|
||||||
received termination signal
|
1355266097.683599 received termination signal
|
||||||
>>>
|
>>>
|
||||||
|
|
|
@ -1,4 +1,4 @@
|
||||||
error: ../input.log/Input::READER_ASCII: String 'l' contained no parseable number
|
1355265853.593476 error: ../input.log/Input::READER_ASCII: String 'l' contained no parseable number
|
||||||
error: ../input.log/Input::READER_ASCII: Could not convert line ' l' to Val. Ignoring line.
|
1355265853.593476 error: ../input.log/Input::READER_ASCII: Could not convert line ' l' to Val. Ignoring line.
|
||||||
received termination signal
|
1355265853.593476 received termination signal
|
||||||
>>>
|
>>>
|
||||||
|
|
|
@ -1,5 +1,5 @@
|
||||||
error: does-not-exist.dat/Input::READER_ASCII: Init: cannot open does-not-exist.dat
|
1355265996.626106 error: does-not-exist.dat/Input::READER_ASCII: Init: cannot open does-not-exist.dat
|
||||||
error: does-not-exist.dat/Input::READER_ASCII: Init failed
|
1355265996.626106 error: does-not-exist.dat/Input::READER_ASCII: Init failed
|
||||||
warning: Stream input is already queued for removal. Ignoring remove.
|
1355265996.626106 warning: Stream input is already queued for removal. Ignoring remove.
|
||||||
error: does-not-exist.dat/Input::READER_ASCII: terminating thread
|
1355265996.626106 error: does-not-exist.dat/Input::READER_ASCII: terminating thread
|
||||||
received termination signal
|
1355265996.626106 received termination signal
|
||||||
|
|
|
@ -1,6 +1,10 @@
|
||||||
# @TEST-EXEC: bro -b -r $TRACES/wikipedia.trace %INPUT >out 2>&1
|
# @TEST-EXEC: btest-bg-run bro bro -b --pseudo-realtime -r $TRACES/rotation.trace %INPUT
|
||||||
# @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-remove-abspath btest-diff out
|
# @TEST-EXEC: btest-bg-wait -k 3
|
||||||
|
# @TEST-EXEC: TEST_DIFF_CANONIFIER="$SCRIPTS/diff-remove-abspath | $SCRIPTS/diff-remove-timestamps" btest-diff bro/.stderr
|
||||||
|
# @TEST-EXEC: btest-diff bro/.stdout
|
||||||
|
|
||||||
# interpreter exceptions in "when" blocks shouldn't cause termination
|
# interpreter exceptions in "when" blocks shouldn't cause termination
|
||||||
|
|
||||||
global p: pkt_hdr;
|
global p: pkt_hdr;
|
||||||
|
|
||||||
function f(do_exception: bool): bool
|
function f(do_exception: bool): bool
|
|
@ -1,7 +1,4 @@
|
||||||
# (uses listen.bro just to ensure input sources are more reliably fully-read).
|
# @TEST-EXEC: btest-bg-run bro bro -b --pseudo-realtime -r $TRACES/socks.trace %INPUT
|
||||||
# @TEST-SERIALIZE: comm
|
|
||||||
#
|
|
||||||
# @TEST-EXEC: btest-bg-run bro bro -b %INPUT
|
|
||||||
# @TEST-EXEC: btest-bg-wait -k 5
|
# @TEST-EXEC: btest-bg-wait -k 5
|
||||||
# @TEST-EXEC: btest-diff out
|
# @TEST-EXEC: btest-diff out
|
||||||
|
|
||||||
|
@ -14,7 +11,6 @@ T -42 SSH::LOG 21 123 10.0.0.0/24 1.2.3.4 3.14 1315801931.273616 100.000000 hurz
|
||||||
@TEST-END-FILE
|
@TEST-END-FILE
|
||||||
|
|
||||||
@load base/protocols/ssh
|
@load base/protocols/ssh
|
||||||
@load frameworks/communication/listen
|
|
||||||
|
|
||||||
global outfile: file;
|
global outfile: file;
|
||||||
|
|
||||||
|
|
|
@ -1,7 +1,4 @@
|
||||||
# (uses listen.bro just to ensure input sources are more reliably fully-read).
|
# @TEST-EXEC: btest-bg-run bro bro -b --pseudo-realtime -r $TRACES/socks.trace %INPUT
|
||||||
# @TEST-SERIALIZE: comm
|
|
||||||
#
|
|
||||||
# @TEST-EXEC: btest-bg-run bro bro -b %INPUT
|
|
||||||
# @TEST-EXEC: btest-bg-wait -k 5
|
# @TEST-EXEC: btest-bg-wait -k 5
|
||||||
# @TEST-EXEC: btest-diff out
|
# @TEST-EXEC: btest-diff out
|
||||||
|
|
||||||
|
@ -13,8 +10,6 @@
|
||||||
-9223372036854775800 18446744073709551612
|
-9223372036854775800 18446744073709551612
|
||||||
@TEST-END-FILE
|
@TEST-END-FILE
|
||||||
|
|
||||||
@load frameworks/communication/listen
|
|
||||||
|
|
||||||
global outfile: file;
|
global outfile: file;
|
||||||
|
|
||||||
module A;
|
module A;
|
||||||
|
|
|
@ -1,7 +1,4 @@
|
||||||
# (uses listen.bro just to ensure input sources are more reliably fully-read).
|
# @TEST-EXEC: btest-bg-run bro bro -b --pseudo-realtime -r $TRACES/socks.trace %INPUT
|
||||||
# @TEST-SERIALIZE: comm
|
|
||||||
#
|
|
||||||
# @TEST-EXEC: btest-bg-run bro bro -b %INPUT
|
|
||||||
# @TEST-EXEC: btest-bg-wait -k 5
|
# @TEST-EXEC: btest-bg-wait -k 5
|
||||||
# @TEST-EXEC: btest-diff out
|
# @TEST-EXEC: btest-diff out
|
||||||
|
|
||||||
|
@ -25,8 +22,6 @@ abc\xff\x7cdef|DATA2
|
||||||
#end|2012-07-20-01-49-19
|
#end|2012-07-20-01-49-19
|
||||||
@TEST-END-FILE
|
@TEST-END-FILE
|
||||||
|
|
||||||
@load frameworks/communication/listen
|
|
||||||
|
|
||||||
global outfile: file;
|
global outfile: file;
|
||||||
global try: count;
|
global try: count;
|
||||||
|
|
||||||
|
|
|
@ -1,8 +1,5 @@
|
||||||
# (uses listen.bro just to ensure input sources are more reliably fully-read).
|
|
||||||
# @TEST-SERIALIZE: comm
|
|
||||||
#
|
|
||||||
# @TEST-EXEC: cp input1.log input.log
|
# @TEST-EXEC: cp input1.log input.log
|
||||||
# @TEST-EXEC: btest-bg-run bro bro -b %INPUT
|
# @TEST-EXEC: btest-bg-run bro bro -b --pseudo-realtime -r $TRACES/socks.trace %INPUT
|
||||||
# @TEST-EXEC: sleep 2
|
# @TEST-EXEC: sleep 2
|
||||||
# @TEST-EXEC: cp input2.log input.log
|
# @TEST-EXEC: cp input2.log input.log
|
||||||
# @TEST-EXEC: btest-bg-wait -k 5
|
# @TEST-EXEC: btest-bg-wait -k 5
|
||||||
|
@ -23,9 +20,6 @@
|
||||||
2 TEST TEST
|
2 TEST TEST
|
||||||
@TEST-END-FILE
|
@TEST-END-FILE
|
||||||
|
|
||||||
@load frameworks/communication/listen
|
|
||||||
|
|
||||||
|
|
||||||
module A;
|
module A;
|
||||||
|
|
||||||
type Idx: record {
|
type Idx: record {
|
||||||
|
|
|
@ -1,7 +1,4 @@
|
||||||
# (uses listen.bro just to ensure input sources are more reliably fully-read).
|
# @TEST-EXEC: btest-bg-run bro bro -b --pseudo-realtime -r $TRACES/socks.trace %INPUT
|
||||||
# @TEST-SERIALIZE: comm
|
|
||||||
#
|
|
||||||
# @TEST-EXEC: btest-bg-run bro bro -b %INPUT
|
|
||||||
# @TEST-EXEC: btest-bg-wait -k 5
|
# @TEST-EXEC: btest-bg-wait -k 5
|
||||||
# @TEST-EXEC: btest-diff out
|
# @TEST-EXEC: btest-diff out
|
||||||
|
|
||||||
|
@ -14,8 +11,6 @@ T 1
|
||||||
- 2
|
- 2
|
||||||
@TEST-END-FILE
|
@TEST-END-FILE
|
||||||
|
|
||||||
@load frameworks/communication/listen
|
|
||||||
|
|
||||||
global outfile: file;
|
global outfile: file;
|
||||||
|
|
||||||
redef InputAscii::empty_field = "EMPTY";
|
redef InputAscii::empty_field = "EMPTY";
|
||||||
|
|
|
@ -1,7 +1,4 @@
|
||||||
# (uses listen.bro just to ensure input sources are more reliably fully-read).
|
# @TEST-EXEC: btest-bg-run bro bro -b --pseudo-realtime -r $TRACES/socks.trace %INPUT
|
||||||
# @TEST-SERIALIZE: comm
|
|
||||||
#
|
|
||||||
# @TEST-EXEC: btest-bg-run bro bro -b %INPUT
|
|
||||||
# @TEST-EXEC: btest-bg-wait -k 5
|
# @TEST-EXEC: btest-bg-wait -k 5
|
||||||
# @TEST-EXEC: btest-diff out
|
# @TEST-EXEC: btest-diff out
|
||||||
|
|
||||||
|
@ -19,8 +16,6 @@
|
||||||
7 T
|
7 T
|
||||||
@TEST-END-FILE
|
@TEST-END-FILE
|
||||||
|
|
||||||
@load frameworks/communication/listen
|
|
||||||
|
|
||||||
global outfile: file;
|
global outfile: file;
|
||||||
|
|
||||||
module A;
|
module A;
|
||||||
|
|
|
@ -1,7 +1,4 @@
|
||||||
# (uses listen.bro just to ensure input sources are more reliably fully-read).
|
# @TEST-EXEC: btest-bg-run bro bro -b --pseudo-realtime -r $TRACES/socks.trace %INPUT
|
||||||
# @TEST-SERIALIZE: comm
|
|
||||||
#
|
|
||||||
# @TEST-EXEC: btest-bg-run bro bro -b %INPUT
|
|
||||||
# @TEST-EXEC: btest-bg-wait -k 5
|
# @TEST-EXEC: btest-bg-wait -k 5
|
||||||
# @TEST-EXEC: cat out.tmp | sed 's/^ *//g' >out
|
# @TEST-EXEC: cat out.tmp | sed 's/^ *//g' >out
|
||||||
# @TEST-EXEC: btest-diff out
|
# @TEST-EXEC: btest-diff out
|
||||||
|
@ -17,8 +14,6 @@ sdf
|
||||||
3rw43wRRERLlL#RWERERERE.
|
3rw43wRRERLlL#RWERERERE.
|
||||||
@TEST-END-FILE
|
@TEST-END-FILE
|
||||||
|
|
||||||
@load frameworks/communication/listen
|
|
||||||
|
|
||||||
global outfile: file;
|
global outfile: file;
|
||||||
|
|
||||||
type Val: record {
|
type Val: record {
|
||||||
|
|
|
@ -1,11 +1,8 @@
|
||||||
# (uses listen.bro just to ensure input sources are more reliably fully-read).
|
# @TEST-EXEC: btest-bg-run bro bro -b --pseudo-realtime -r $TRACES/socks.trace %INPUT
|
||||||
# @TEST-SERIALIZE: comm
|
|
||||||
#
|
|
||||||
# @TEST-EXEC: btest-bg-run bro bro -b %INPUT
|
|
||||||
# @TEST-EXEC: btest-bg-wait -k 5
|
# @TEST-EXEC: btest-bg-wait -k 5
|
||||||
# @TEST-EXEC: btest-diff out
|
# @TEST-EXEC: btest-diff out
|
||||||
# @TEST-EXEC: sed 1d .stderr > .stderrwithoutfirstline
|
# @TEST-EXEC: sed 1d .stderr > .stderrwithoutfirstline
|
||||||
# @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-remove-abspath btest-diff .stderrwithoutfirstline
|
# @TEST-EXEC: TEST_DIFF_CANONIFIER="$SCRIPTS/diff-remove-abspath | $SCRIPTS/diff-remove-timestamps" btest-diff .stderrwithoutfirstline
|
||||||
|
|
||||||
@TEST-START-FILE input.log
|
@TEST-START-FILE input.log
|
||||||
#separator \x09
|
#separator \x09
|
||||||
|
@ -17,8 +14,6 @@ Justtext 1
|
||||||
9223372036854775800 -18446744073709551612
|
9223372036854775800 -18446744073709551612
|
||||||
@TEST-END-FILE
|
@TEST-END-FILE
|
||||||
|
|
||||||
@load frameworks/communication/listen
|
|
||||||
|
|
||||||
global outfile: file;
|
global outfile: file;
|
||||||
|
|
||||||
module A;
|
module A;
|
||||||
|
|
|
@ -1,11 +1,8 @@
|
||||||
# (uses listen.bro just to ensure input sources are more reliably fully-read).
|
# @TEST-EXEC: btest-bg-run bro bro -b --pseudo-realtime -r $TRACES/socks.trace %INPUT
|
||||||
# @TEST-SERIALIZE: comm
|
|
||||||
#
|
|
||||||
# @TEST-EXEC: btest-bg-run bro bro -b %INPUT
|
|
||||||
# @TEST-EXEC: btest-bg-wait -k 5
|
# @TEST-EXEC: btest-bg-wait -k 5
|
||||||
# @TEST-EXEC: btest-diff out
|
# @TEST-EXEC: btest-diff out
|
||||||
# @TEST-EXEC: sed 1d .stderr > .stderrwithoutfirstline
|
# @TEST-EXEC: sed 1d .stderr > .stderrwithoutfirstline
|
||||||
# @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-remove-abspath btest-diff .stderrwithoutfirstline
|
# @TEST-EXEC: TEST_DIFF_CANONIFIER="$SCRIPTS/diff-remove-abspath | $SCRIPTS/diff-remove-timestamps" btest-diff .stderrwithoutfirstline
|
||||||
|
|
||||||
@TEST-START-FILE input.log
|
@TEST-START-FILE input.log
|
||||||
#separator \x09
|
#separator \x09
|
||||||
|
@ -15,8 +12,6 @@
|
||||||
5
|
5
|
||||||
@TEST-END-FILE
|
@TEST-END-FILE
|
||||||
|
|
||||||
@load frameworks/communication/listen
|
|
||||||
|
|
||||||
global outfile: file;
|
global outfile: file;
|
||||||
|
|
||||||
module A;
|
module A;
|
||||||
|
|
|
@ -1,12 +1,7 @@
|
||||||
# (uses listen.bro just to ensure input sources are more reliably fully-read).
|
# @TEST-EXEC: btest-bg-run bro bro -b --pseudo-realtime -r $TRACES/socks.trace %INPUT
|
||||||
# @TEST-SERIALIZE: comm
|
|
||||||
#
|
|
||||||
# @TEST-EXEC: btest-bg-run bro bro -b %INPUT
|
|
||||||
# @TEST-EXEC: btest-bg-wait -k 5
|
# @TEST-EXEC: btest-bg-wait -k 5
|
||||||
# @TEST-EXEC: btest-diff bro/.stderr
|
# @TEST-EXEC: btest-diff bro/.stderr
|
||||||
|
|
||||||
@load frameworks/communication/listen
|
|
||||||
|
|
||||||
global outfile: file;
|
global outfile: file;
|
||||||
global try: count;
|
global try: count;
|
||||||
|
|
||||||
|
|
|
@ -1,7 +1,4 @@
|
||||||
# (uses listen.bro just to ensure input sources are more reliably fully-read).
|
# @TEST-EXEC: btest-bg-run bro bro -b --pseudo-realtime -r $TRACES/socks.trace %INPUT
|
||||||
# @TEST-SERIALIZE: comm
|
|
||||||
#
|
|
||||||
# @TEST-EXEC: btest-bg-run bro bro -b %INPUT
|
|
||||||
# @TEST-EXEC: btest-bg-wait -k 5
|
# @TEST-EXEC: btest-bg-wait -k 5
|
||||||
# @TEST-EXEC: btest-diff out
|
# @TEST-EXEC: btest-diff out
|
||||||
|
|
||||||
|
@ -13,8 +10,6 @@
|
||||||
T -42
|
T -42
|
||||||
@TEST-END-FILE
|
@TEST-END-FILE
|
||||||
|
|
||||||
@load frameworks/communication/listen
|
|
||||||
|
|
||||||
global outfile: file;
|
global outfile: file;
|
||||||
|
|
||||||
redef InputAscii::empty_field = "EMPTY";
|
redef InputAscii::empty_field = "EMPTY";
|
||||||
|
|
|
@ -1,7 +1,4 @@
|
||||||
# (uses listen.bro just to ensure input sources are more reliably fully-read).
|
# @TEST-EXEC: btest-bg-run bro bro -b --pseudo-realtime -r $TRACES/socks.trace %INPUT
|
||||||
# @TEST-SERIALIZE: comm
|
|
||||||
#
|
|
||||||
# @TEST-EXEC: btest-bg-run bro bro -b %INPUT
|
|
||||||
# @TEST-EXEC: btest-bg-wait -k 5
|
# @TEST-EXEC: btest-bg-wait -k 5
|
||||||
# @TEST-EXEC: btest-diff out
|
# @TEST-EXEC: btest-diff out
|
||||||
|
|
||||||
|
@ -13,8 +10,6 @@
|
||||||
T -42
|
T -42
|
||||||
@TEST-END-FILE
|
@TEST-END-FILE
|
||||||
|
|
||||||
@load frameworks/communication/listen
|
|
||||||
|
|
||||||
global outfile: file;
|
global outfile: file;
|
||||||
|
|
||||||
redef InputAscii::empty_field = "EMPTY";
|
redef InputAscii::empty_field = "EMPTY";
|
||||||
|
|
|
@ -1,7 +1,4 @@
|
||||||
# (uses listen.bro just to ensure input sources are more reliably fully-read).
|
# @TEST-EXEC: btest-bg-run bro bro -b --pseudo-realtime -r $TRACES/socks.trace %INPUT
|
||||||
# @TEST-SERIALIZE: comm
|
|
||||||
#
|
|
||||||
# @TEST-EXEC: btest-bg-run bro bro -b %INPUT
|
|
||||||
# @TEST-EXEC: btest-bg-wait -k 5
|
# @TEST-EXEC: btest-bg-wait -k 5
|
||||||
# @TEST-EXEC: btest-diff out
|
# @TEST-EXEC: btest-diff out
|
||||||
|
|
||||||
|
@ -19,8 +16,6 @@
|
||||||
7 T
|
7 T
|
||||||
@TEST-END-FILE
|
@TEST-END-FILE
|
||||||
|
|
||||||
@load frameworks/communication/listen
|
|
||||||
|
|
||||||
global outfile: file;
|
global outfile: file;
|
||||||
|
|
||||||
redef InputAscii::empty_field = "EMPTY";
|
redef InputAscii::empty_field = "EMPTY";
|
||||||
|
|
|
@ -1,7 +1,4 @@
|
||||||
# (uses listen.bro just to ensure input sources are more reliably fully-read).
|
# @TEST-EXEC: btest-bg-run bro bro -b --pseudo-realtime -r $TRACES/socks.trace %INPUT
|
||||||
# @TEST-SERIALIZE: comm
|
|
||||||
#
|
|
||||||
# @TEST-EXEC: btest-bg-run bro bro -b %INPUT
|
|
||||||
# @TEST-EXEC: btest-bg-wait -k 5
|
# @TEST-EXEC: btest-bg-wait -k 5
|
||||||
# @TEST-EXEC: btest-diff out
|
# @TEST-EXEC: btest-diff out
|
||||||
|
|
||||||
|
@ -12,8 +9,6 @@
|
||||||
1.2.3.6 30 unknown
|
1.2.3.6 30 unknown
|
||||||
@TEST-END-FILE
|
@TEST-END-FILE
|
||||||
|
|
||||||
@load frameworks/communication/listen
|
|
||||||
|
|
||||||
global outfile: file;
|
global outfile: file;
|
||||||
|
|
||||||
redef InputAscii::empty_field = "EMPTY";
|
redef InputAscii::empty_field = "EMPTY";
|
||||||
|
|
|
@ -1,7 +1,4 @@
|
||||||
# (uses listen.bro just to ensure input sources are more reliably fully-read).
|
# @TEST-EXEC: btest-bg-run bro bro -b --pseudo-realtime -r $TRACES/socks.trace %INPUT
|
||||||
# @TEST-SERIALIZE: comm
|
|
||||||
#
|
|
||||||
# @TEST-EXEC: btest-bg-run bro bro -b %INPUT
|
|
||||||
# @TEST-EXEC: btest-bg-wait -k 5
|
# @TEST-EXEC: btest-bg-wait -k 5
|
||||||
# @TEST-EXEC: btest-diff out
|
# @TEST-EXEC: btest-diff out
|
||||||
#
|
#
|
||||||
|
@ -23,8 +20,6 @@
|
||||||
7 T
|
7 T
|
||||||
@TEST-END-FILE
|
@TEST-END-FILE
|
||||||
|
|
||||||
@load frameworks/communication/listen
|
|
||||||
|
|
||||||
global outfile: file;
|
global outfile: file;
|
||||||
|
|
||||||
redef InputAscii::empty_field = "EMPTY";
|
redef InputAscii::empty_field = "EMPTY";
|
||||||
|
|
|
@ -1,7 +1,4 @@
|
||||||
# (uses listen.bro just to ensure input sources are more reliably fully-read).
|
# @TEST-EXEC: btest-bg-run bro bro -b --pseudo-realtime -r $TRACES/socks.trace %INPUT
|
||||||
# @TEST-SERIALIZE: comm
|
|
||||||
#
|
|
||||||
# @TEST-EXEC: btest-bg-run bro bro -b %INPUT
|
|
||||||
# @TEST-EXEC: btest-bg-wait -k 5
|
# @TEST-EXEC: btest-bg-wait -k 5
|
||||||
# @TEST-EXEC: btest-diff out
|
# @TEST-EXEC: btest-diff out
|
||||||
|
|
||||||
|
@ -19,8 +16,6 @@
|
||||||
7 T
|
7 T
|
||||||
@TEST-END-FILE
|
@TEST-END-FILE
|
||||||
|
|
||||||
@load frameworks/communication/listen
|
|
||||||
|
|
||||||
global outfile: file;
|
global outfile: file;
|
||||||
|
|
||||||
redef InputAscii::empty_field = "EMPTY";
|
redef InputAscii::empty_field = "EMPTY";
|
||||||
|
|
|
@ -1,7 +1,4 @@
|
||||||
# (uses listen.bro just to ensure input sources are more reliably fully-read).
|
# @TEST-EXEC: btest-bg-run bro bro -b --pseudo-realtime -r $TRACES/socks.trace %INPUT
|
||||||
# @TEST-SERIALIZE: comm
|
|
||||||
#
|
|
||||||
# @TEST-EXEC: btest-bg-run bro bro -b %INPUT
|
|
||||||
# @TEST-EXEC: btest-bg-wait -k 5
|
# @TEST-EXEC: btest-bg-wait -k 5
|
||||||
# @TEST-EXEC: btest-diff out
|
# @TEST-EXEC: btest-diff out
|
||||||
|
|
||||||
|
@ -14,8 +11,6 @@
|
||||||
2 T test2 idx2
|
2 T test2 idx2
|
||||||
@TEST-END-FILE
|
@TEST-END-FILE
|
||||||
|
|
||||||
@load frameworks/communication/listen
|
|
||||||
|
|
||||||
global outfile: file;
|
global outfile: file;
|
||||||
|
|
||||||
redef InputAscii::empty_field = "EMPTY";
|
redef InputAscii::empty_field = "EMPTY";
|
||||||
|
|
|
@ -1,8 +1,5 @@
|
||||||
# (uses listen.bro just to ensure input sources are more reliably fully-read).
|
|
||||||
# @TEST-SERIALIZE: comm
|
|
||||||
#
|
|
||||||
# @TEST-EXEC: cp input1.log input.log
|
# @TEST-EXEC: cp input1.log input.log
|
||||||
# @TEST-EXEC: btest-bg-run bro bro -b %INPUT
|
# @TEST-EXEC: btest-bg-run bro bro -b --pseudo-realtime -r $TRACES/socks.trace %INPUT
|
||||||
# @TEST-EXEC: sleep 2
|
# @TEST-EXEC: sleep 2
|
||||||
# @TEST-EXEC: cp input2.log input.log
|
# @TEST-EXEC: cp input2.log input.log
|
||||||
# @TEST-EXEC: sleep 2
|
# @TEST-EXEC: sleep 2
|
||||||
|
@ -58,8 +55,6 @@
|
||||||
1 T test1 idx1
|
1 T test1 idx1
|
||||||
@TEST-END-FILE
|
@TEST-END-FILE
|
||||||
|
|
||||||
@load frameworks/communication/listen
|
|
||||||
|
|
||||||
redef InputAscii::empty_field = "EMPTY";
|
redef InputAscii::empty_field = "EMPTY";
|
||||||
|
|
||||||
module A;
|
module A;
|
||||||
|
|
|
@ -1,7 +1,4 @@
|
||||||
# (uses listen.bro just to ensure input sources are more reliably fully-read).
|
# @TEST-EXEC: btest-bg-run bro bro -b --pseudo-realtime -r $TRACES/socks.trace %INPUT
|
||||||
# @TEST-SERIALIZE: comm
|
|
||||||
#
|
|
||||||
# @TEST-EXEC: btest-bg-run bro bro -b %INPUT
|
|
||||||
# @TEST-EXEC: btest-bg-wait -k 5
|
# @TEST-EXEC: btest-bg-wait -k 5
|
||||||
# @TEST-EXEC: btest-diff out
|
# @TEST-EXEC: btest-diff out
|
||||||
|
|
||||||
|
@ -17,8 +14,6 @@ need-to-know 8c864306-d21a-37b1-8705-746a786719bf medium 95 1342569600 1.228.83.
|
||||||
need-to-know 8c864306-d21a-37b1-8705-746a786719bf medium 65 1342656000 1.228.83.33 - - 9318 HANARO-AS Hanaro Telecom Inc. 1.224.0.0/13 apnic KR spam infrastructure spamming;malware domain public http://reputation.alienvault.com/reputation.generic
|
need-to-know 8c864306-d21a-37b1-8705-746a786719bf medium 65 1342656000 1.228.83.33 - - 9318 HANARO-AS Hanaro Telecom Inc. 1.224.0.0/13 apnic KR spam infrastructure spamming;malware domain public http://reputation.alienvault.com/reputation.generic
|
||||||
@TEST-END-FILE
|
@TEST-END-FILE
|
||||||
|
|
||||||
@load frameworks/communication/listen
|
|
||||||
|
|
||||||
global outfile: file;
|
global outfile: file;
|
||||||
|
|
||||||
redef InputAscii::empty_field = "EMPTY";
|
redef InputAscii::empty_field = "EMPTY";
|
||||||
|
|
|
@ -1,7 +1,4 @@
|
||||||
# (uses listen.bro just to ensure input sources are more reliably fully-read).
|
# @TEST-EXEC: btest-bg-run bro bro -b --pseudo-realtime -r $TRACES/socks.trace %INPUT
|
||||||
# @TEST-SERIALIZE: comm
|
|
||||||
#
|
|
||||||
# @TEST-EXEC: btest-bg-run bro bro -b %INPUT
|
|
||||||
# @TEST-EXEC: btest-bg-wait -k 5
|
# @TEST-EXEC: btest-bg-wait -k 5
|
||||||
# @TEST-EXEC: btest-diff out
|
# @TEST-EXEC: btest-diff out
|
||||||
|
|
||||||
|
@ -16,8 +13,6 @@ sdf
|
||||||
3rw43wRRERLlL#RWERERERE.
|
3rw43wRRERLlL#RWERERERE.
|
||||||
@TEST-END-FILE
|
@TEST-END-FILE
|
||||||
|
|
||||||
@load frameworks/communication/listen
|
|
||||||
|
|
||||||
global outfile: file;
|
global outfile: file;
|
||||||
global try: count;
|
global try: count;
|
||||||
|
|
||||||
|
|
|
@ -1,7 +1,4 @@
|
||||||
# (uses listen.bro just to ensure input sources are more reliably fully-read).
|
# @TEST-EXEC: btest-bg-run bro bro -b --pseudo-realtime -r $TRACES/socks.trace %INPUT
|
||||||
# @TEST-SERIALIZE: comm
|
|
||||||
#
|
|
||||||
# @TEST-EXEC: btest-bg-run bro bro -b %INPUT
|
|
||||||
# @TEST-EXEC: btest-bg-wait -k 5
|
# @TEST-EXEC: btest-bg-wait -k 5
|
||||||
# @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-sort btest-diff out
|
# @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-sort btest-diff out
|
||||||
|
|
||||||
|
@ -13,8 +10,6 @@
|
||||||
1 T
|
1 T
|
||||||
@TEST-END-FILE
|
@TEST-END-FILE
|
||||||
|
|
||||||
@load frameworks/communication/listen
|
|
||||||
|
|
||||||
global outfile: file;
|
global outfile: file;
|
||||||
global try: count;
|
global try: count;
|
||||||
|
|
||||||
|
|
|
@ -1,8 +1,5 @@
|
||||||
# (uses listen.bro just to ensure input sources are more reliably fully-read).
|
|
||||||
# @TEST-SERIALIZE: comm
|
|
||||||
#
|
|
||||||
# @TEST-EXEC: cp input1.log input.log
|
# @TEST-EXEC: cp input1.log input.log
|
||||||
# @TEST-EXEC: btest-bg-run bro bro -b %INPUT
|
# @TEST-EXEC: btest-bg-run bro bro -b --pseudo-realtime -r $TRACES/socks.trace %INPUT
|
||||||
# @TEST-EXEC: sleep 2
|
# @TEST-EXEC: sleep 2
|
||||||
# @TEST-EXEC: cp input2.log input.log
|
# @TEST-EXEC: cp input2.log input.log
|
||||||
# @TEST-EXEC: sleep 2
|
# @TEST-EXEC: sleep 2
|
||||||
|
@ -59,7 +56,6 @@ F -48 SSH::LOG 21 123 10.0.0.0/24 1.2.3.4 3.14 1315801931.273616 100.000000 hurz
|
||||||
@TEST-END-FILE
|
@TEST-END-FILE
|
||||||
|
|
||||||
@load base/protocols/ssh
|
@load base/protocols/ssh
|
||||||
@load frameworks/communication/listen
|
|
||||||
|
|
||||||
redef InputAscii::empty_field = "EMPTY";
|
redef InputAscii::empty_field = "EMPTY";
|
||||||
|
|
||||||
|
|
|
@ -1,7 +1,4 @@
|
||||||
# (uses listen.bro just to ensure input sources are more reliably fully-read).
|
# @TEST-EXEC: btest-bg-run bro bro -b --pseudo-realtime -r $TRACES/socks.trace %INPUT
|
||||||
# @TEST-SERIALIZE: comm
|
|
||||||
#
|
|
||||||
# @TEST-EXEC: btest-bg-run bro bro -b %INPUT
|
|
||||||
# @TEST-EXEC: btest-bg-wait -k 5
|
# @TEST-EXEC: btest-bg-wait -k 5
|
||||||
# @TEST-EXEC: btest-diff out
|
# @TEST-EXEC: btest-diff out
|
||||||
|
|
||||||
|
@ -16,8 +13,6 @@ sdf
|
||||||
3rw43wRRERLlL#RWERERERE.
|
3rw43wRRERLlL#RWERERERE.
|
||||||
@TEST-END-FILE
|
@TEST-END-FILE
|
||||||
|
|
||||||
@load frameworks/communication/listen
|
|
||||||
|
|
||||||
global outfile: file;
|
global outfile: file;
|
||||||
global try: count;
|
global try: count;
|
||||||
|
|
||||||
|
|
|
@ -1,7 +1,4 @@
|
||||||
# (uses listen.bro just to ensure input sources are more reliably fully-read).
|
# @TEST-EXEC: btest-bg-run bro bro -b --pseudo-realtime -r $TRACES/socks.trace %INPUT
|
||||||
# @TEST-SERIALIZE: comm
|
|
||||||
#
|
|
||||||
# @TEST-EXEC: btest-bg-run bro bro -b %INPUT
|
|
||||||
# @TEST-EXEC: btest-bg-wait -k 5
|
# @TEST-EXEC: btest-bg-wait -k 5
|
||||||
# @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-sort btest-diff out
|
# @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-sort btest-diff out
|
||||||
|
|
||||||
|
@ -16,8 +13,6 @@
|
||||||
192.168.17.42
|
192.168.17.42
|
||||||
@TEST-END-FILE
|
@TEST-END-FILE
|
||||||
|
|
||||||
@load frameworks/communication/listen
|
|
||||||
|
|
||||||
global outfile: file;
|
global outfile: file;
|
||||||
|
|
||||||
redef InputAscii::empty_field = "EMPTY";
|
redef InputAscii::empty_field = "EMPTY";
|
||||||
|
|
|
@ -1,7 +1,4 @@
|
||||||
# (uses listen.bro just to ensure input sources are more reliably fully-read).
|
# @TEST-EXEC: btest-bg-run bro bro -b --pseudo-realtime -r $TRACES/socks.trace %INPUT
|
||||||
# @TEST-SERIALIZE: comm
|
|
||||||
#
|
|
||||||
# @TEST-EXEC: btest-bg-run bro bro -b %INPUT
|
|
||||||
# @TEST-EXEC: btest-bg-wait -k 5
|
# @TEST-EXEC: btest-bg-wait -k 5
|
||||||
# @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-sort btest-diff out
|
# @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-sort btest-diff out
|
||||||
|
|
||||||
|
@ -13,8 +10,6 @@
|
||||||
|
|
||||||
redef InputAscii::set_separator = "|";
|
redef InputAscii::set_separator = "|";
|
||||||
|
|
||||||
@load frameworks/communication/listen
|
|
||||||
|
|
||||||
global outfile: file;
|
global outfile: file;
|
||||||
|
|
||||||
module A;
|
module A;
|
||||||
|
|
|
@ -1,7 +1,4 @@
|
||||||
# (uses listen.bro just to ensure input sources are more reliably fully-read).
|
# @TEST-EXEC: btest-bg-run bro bro -b --pseudo-realtime -r $TRACES/socks.trace %INPUT
|
||||||
# @TEST-SERIALIZE: comm
|
|
||||||
#
|
|
||||||
# @TEST-EXEC: btest-bg-run bro bro -b %INPUT
|
|
||||||
# @TEST-EXEC: btest-bg-wait -k 5
|
# @TEST-EXEC: btest-bg-wait -k 5
|
||||||
# @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-sort btest-diff out
|
# @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-sort btest-diff out
|
||||||
|
|
||||||
|
@ -16,9 +13,6 @@
|
||||||
6
|
6
|
||||||
@TEST-END-FILE
|
@TEST-END-FILE
|
||||||
|
|
||||||
|
|
||||||
@load frameworks/communication/listen
|
|
||||||
|
|
||||||
global outfile: file;
|
global outfile: file;
|
||||||
|
|
||||||
module A;
|
module A;
|
||||||
|
|
|
@ -1,8 +1,5 @@
|
||||||
# (uses listen.bro just to ensure input sources are more reliably fully-read).
|
|
||||||
# @TEST-SERIALIZE: comm
|
|
||||||
#
|
|
||||||
# @TEST-EXEC: cp input1.log input.log
|
# @TEST-EXEC: cp input1.log input.log
|
||||||
# @TEST-EXEC: btest-bg-run bro bro -b %INPUT
|
# @TEST-EXEC: btest-bg-run bro bro -b --pseudo-realtime -r $TRACES/socks.trace %INPUT
|
||||||
# @TEST-EXEC: sleep 3
|
# @TEST-EXEC: sleep 3
|
||||||
# @TEST-EXEC: cat input2.log >> input.log
|
# @TEST-EXEC: cat input2.log >> input.log
|
||||||
# @TEST-EXEC: sleep 3
|
# @TEST-EXEC: sleep 3
|
||||||
|
@ -25,7 +22,6 @@ F -43 SSH::LOG 21 123 10.0.0.0/24 1.2.3.4 3.14 1315801931.273616 100.000000 hurz
|
||||||
@TEST-END-FILE
|
@TEST-END-FILE
|
||||||
|
|
||||||
@load base/protocols/ssh
|
@load base/protocols/ssh
|
||||||
@load frameworks/communication/listen
|
|
||||||
|
|
||||||
redef InputAscii::empty_field = "EMPTY";
|
redef InputAscii::empty_field = "EMPTY";
|
||||||
|
|
||||||
|
|
|
@ -1,8 +1,5 @@
|
||||||
# (uses listen.bro just to ensure input sources are more reliably fully-read).
|
|
||||||
# @TEST-SERIALIZE: comm
|
|
||||||
#
|
|
||||||
# @TEST-EXEC: cp input1.log input.log
|
# @TEST-EXEC: cp input1.log input.log
|
||||||
# @TEST-EXEC: btest-bg-run bro bro -b %INPUT
|
# @TEST-EXEC: btest-bg-run bro bro -b --pseudo-realtime -r $TRACES/socks.trace %INPUT
|
||||||
# @TEST-EXEC: sleep 3
|
# @TEST-EXEC: sleep 3
|
||||||
# @TEST-EXEC: cat input2.log >> input.log
|
# @TEST-EXEC: cat input2.log >> input.log
|
||||||
# @TEST-EXEC: sleep 3
|
# @TEST-EXEC: sleep 3
|
||||||
|
@ -27,8 +24,6 @@ sdf
|
||||||
3rw43wRRERLlL#RWERERERE.
|
3rw43wRRERLlL#RWERERERE.
|
||||||
@TEST-END-FILE
|
@TEST-END-FILE
|
||||||
|
|
||||||
@load frameworks/communication/listen
|
|
||||||
|
|
||||||
module A;
|
module A;
|
||||||
|
|
||||||
type Val: record {
|
type Val: record {
|
||||||
|
|
|
@ -1,7 +1,4 @@
|
||||||
# (uses listen.bro just to ensure input sources are more reliably fully-read).
|
# @TEST-EXEC: btest-bg-run bro bro -b --pseudo-realtime -r $TRACES/socks.trace %INPUT
|
||||||
# @TEST-SERIALIZE: comm
|
|
||||||
#
|
|
||||||
# @TEST-EXEC: btest-bg-run bro bro -b %INPUT
|
|
||||||
# @TEST-EXEC: btest-bg-wait -k 5
|
# @TEST-EXEC: btest-bg-wait -k 5
|
||||||
# @TEST-EXEC: btest-diff out
|
# @TEST-EXEC: btest-diff out
|
||||||
|
|
||||||
|
@ -14,7 +11,6 @@ T -42 SSH::LOG 21 123 10.0.0.0/24 1.2.3.4 3.14 1315801931.273616 100.000000 hurz
|
||||||
@TEST-END-FILE
|
@TEST-END-FILE
|
||||||
|
|
||||||
@load base/protocols/ssh
|
@load base/protocols/ssh
|
||||||
@load frameworks/communication/listen
|
|
||||||
|
|
||||||
global outfile: file;
|
global outfile: file;
|
||||||
global try: count;
|
global try: count;
|
||||||
|
|
|
@ -1,7 +1,4 @@
|
||||||
# (uses listen.bro just to ensure input sources are more reliably fully-read).
|
# @TEST-EXEC: btest-bg-run bro bro -b --pseudo-realtime -r $TRACES/socks.trace %INPUT
|
||||||
# @TEST-SERIALIZE: comm
|
|
||||||
#
|
|
||||||
# @TEST-EXEC: btest-bg-run bro bro -b %INPUT
|
|
||||||
# @TEST-EXEC: btest-bg-wait -k 5
|
# @TEST-EXEC: btest-bg-wait -k 5
|
||||||
# @TEST-EXEC: btest-diff out
|
# @TEST-EXEC: btest-diff out
|
||||||
|
|
||||||
|
@ -14,7 +11,6 @@ T -42 SSH::LOG 21 123 10.0.0.0/24 1.2.3.4 3.14 1315801931.273616 100.000000 hurz
|
||||||
@TEST-END-FILE
|
@TEST-END-FILE
|
||||||
|
|
||||||
@load base/protocols/ssh
|
@load base/protocols/ssh
|
||||||
@load frameworks/communication/listen
|
|
||||||
|
|
||||||
global outfile: file;
|
global outfile: file;
|
||||||
|
|
||||||
|
|
|
@ -1,7 +1,4 @@
|
||||||
# (uses listen.bro just to ensure input sources are more reliably fully-read).
|
# @TEST-EXEC: btest-bg-run bro bro -b --pseudo-realtime -r $TRACES/socks.trace %INPUT
|
||||||
# @TEST-SERIALIZE: comm
|
|
||||||
#
|
|
||||||
# @TEST-EXEC: btest-bg-run bro bro -b %INPUT
|
|
||||||
# @TEST-EXEC: btest-bg-wait -k 5
|
# @TEST-EXEC: btest-bg-wait -k 5
|
||||||
# @TEST-EXEC: btest-diff out
|
# @TEST-EXEC: btest-diff out
|
||||||
|
|
||||||
|
@ -19,8 +16,6 @@
|
||||||
7 T
|
7 T
|
||||||
@TEST-END-FILE
|
@TEST-END-FILE
|
||||||
|
|
||||||
@load frameworks/communication/listen
|
|
||||||
|
|
||||||
global outfile: file;
|
global outfile: file;
|
||||||
global try: count;
|
global try: count;
|
||||||
|
|
||||||
|
|
|
@ -1,8 +1,5 @@
|
||||||
# (uses listen.bro just to ensure input sources are more reliably fully-read).
|
|
||||||
# @TEST-SERIALIZE: comm
|
|
||||||
#
|
|
||||||
# @TEST-EXEC: cp input1.log input.log
|
# @TEST-EXEC: cp input1.log input.log
|
||||||
# @TEST-EXEC: btest-bg-run bro bro -b %INPUT
|
# @TEST-EXEC: btest-bg-run bro bro -b --pseudo-realtime -r $TRACES/socks.trace %INPUT
|
||||||
# @TEST-EXEC: sleep 5
|
# @TEST-EXEC: sleep 5
|
||||||
# @TEST-EXEC: cp input3.log input.log
|
# @TEST-EXEC: cp input3.log input.log
|
||||||
# @TEST-EXEC: btest-bg-wait -k 10
|
# @TEST-EXEC: btest-bg-wait -k 10
|
||||||
|
@ -34,7 +31,6 @@ F -44 SSH::LOG 21 123 10.0.0.0/24 1.2.3.4 3.14 1315801931.273616 100.000000 hurz
|
||||||
@TEST-END-FILE
|
@TEST-END-FILE
|
||||||
|
|
||||||
@load base/protocols/ssh
|
@load base/protocols/ssh
|
||||||
@load frameworks/communication/listen
|
|
||||||
|
|
||||||
redef InputAscii::empty_field = "EMPTY";
|
redef InputAscii::empty_field = "EMPTY";
|
||||||
|
|
||||||
|
|
|
@ -1,7 +1,4 @@
|
||||||
# (uses listen.bro just to ensure input sources are more reliably fully-read).
|
# @TEST-EXEC: btest-bg-run bro bro -b --pseudo-realtime -r $TRACES/socks.trace %INPUT
|
||||||
# @TEST-SERIALIZE: comm
|
|
||||||
#
|
|
||||||
# @TEST-EXEC: btest-bg-run bro bro -b %INPUT
|
|
||||||
# @TEST-EXEC: btest-bg-wait -k 5
|
# @TEST-EXEC: btest-bg-wait -k 5
|
||||||
# @TEST-EXEC: btest-diff out
|
# @TEST-EXEC: btest-diff out
|
||||||
|
|
||||||
|
@ -14,7 +11,6 @@ whatever T -42 SSH::LOG 21 123 10.0.0.0/24 1.2.3.4 3.14 1315801931.273616 100.00
|
||||||
@TEST-END-FILE
|
@TEST-END-FILE
|
||||||
|
|
||||||
@load base/protocols/ssh
|
@load base/protocols/ssh
|
||||||
@load frameworks/communication/listen
|
|
||||||
|
|
||||||
global outfile: file;
|
global outfile: file;
|
||||||
|
|
||||||
|
|
Loading…
Add table
Add a link
Reference in a new issue