Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-04 07:38:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Merge remote-tracking branch 'origin/master' into topic/johanna/imap-starttls

Browse source
This commit is contained in:
Johanna Amann 2016-04-26 10:52:16 -07:00
commit 3669b6aa9c
626 changed files with 13981 additions and 3994 deletions
Download patch file Download diff file Expand all files Collapse all files

13
testing/btest/scripts/base/files/entropy/basic.test Normal file
View file

@ -0,0 +1,13 @@
# @TEST-EXEC: bro -r $TRACES/http/get.trace %INPUT
# @TEST-EXEC: btest-diff .stdout
event file_new(f: fa_file)
{
Files::add_analyzer(f, Files::ANALYZER_ENTROPY);
}
event file_entropy(f: fa_file, ent: entropy_test_result)
{
print ent;
}

13
testing/btest/scripts/base/frameworks/input/raw/offset.bro
View file

@ -1,5 +1,8 @@
# @TEST-EXEC: cp input.log input2.log
# @TEST-EXEC: btest-bg-run bro bro -b %INPUT
# @TEST-EXEC: btest-bg-wait 5
# @TEST-EXEC: sleep 2
# @TEST-EXEC: echo "hi" >> input2.log
# @TEST-EXEC: btest-bg-wait 10
# @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-sort btest-diff out
@TEST-START-FILE input.log
@ -7,6 +10,7 @@ sdfkh:KH;fdkncv;ISEUp34:Fkdj;YVpIODhfDF
@TEST-END-FILE
redef exit_only_after_terminate = T;
@load base/frameworks/communication # keep network time running
global outfile: file;
global try: count;
@ -21,9 +25,8 @@ event line(description: Input::EventDescription, tpe: Input::Event, s: string)
{
print outfile, s;
try = try + 1;
if ( try == 2 )
if ( try == 3 )
{
Input::remove("input");
close(outfile);
terminate();
}
@ -39,7 +42,11 @@ event bro_init()
local config_strings_two: table[string] of string = {
["offset"] = "-3", # 2 characters before end, last char is newline.
};
local config_strings_three: table[string] of string = {
["offset"] = "-1", # End of file
};
Input::add_event([$source="../input.log", $config=config_strings, $reader=Input::READER_RAW, $mode=Input::STREAM, $name="input", $fields=Val, $ev=line, $want_record=F]);
Input::add_event([$source="../input.log", $config=config_strings_two, $reader=Input::READER_RAW, $mode=Input::STREAM, $name="input2", $fields=Val, $ev=line, $want_record=F]);
Input::add_event([$source="../input2.log", $config=config_strings_three, $reader=Input::READER_RAW, $mode=Input::STREAM, $name="input3", $fields=Val, $ev=line, $want_record=F]);
}

27
testing/btest/scripts/base/frameworks/logging/ascii-json-optional.bro Normal file
View file

@ -0,0 +1,27 @@
#
# @TEST-EXEC: bro -b %INPUT
# @TEST-EXEC: btest-diff testing.log
@load tuning/json-logs.bro
module testing;
export {
redef enum Log::ID += { LOG };
type Info: record {
ts: time &log &optional;
msg: string &log &optional;
};
global log_test: event(rec: Info);
}
event bro_init() &priority=5
{
Log::create_stream(testing::LOG, [$columns=testing::Info, $ev=log_test]);
local info: Info;
info$msg = "Testing 1 2 3 ";
Log::write(testing::LOG, info);
}

122
testing/btest/scripts/base/frameworks/netcontrol/acld-hook.bro Normal file
View file

@ -0,0 +1,122 @@
# @TEST-SERIALIZE: brokercomm
# @TEST-REQUIRES: grep -q ENABLE_BROKER $BUILD/CMakeCache.txt
# @TEST-EXEC: btest-bg-run recv "bro -b ../recv.bro broker_port=$BROKER_PORT >recv.out"
# @TEST-EXEC: btest-bg-run send "bro -b -r $TRACES/tls/ecdhe.pcap --pseudo-realtime ../send.bro broker_port=$BROKER_PORT >send.out"
# @TEST-EXEC: btest-bg-wait 20
# @TEST-EXEC: btest-diff recv/recv.out
# @TEST-EXEC: btest-diff send/send.out
@TEST-START-FILE send.bro
@load base/frameworks/netcontrol
const broker_port: port &redef;
redef exit_only_after_terminate = T;
event NetControl::init()
{
suspend_processing();
local netcontrol_acld = NetControl::create_acld(NetControl::AcldConfig($acld_host=127.0.0.1, $acld_port=broker_port, $acld_topic="bro/event/netcontroltest"));
NetControl::activate(netcontrol_acld, 0);
}
event NetControl::init_done()
{
continue_processing();
}
event Broker::outgoing_connection_established(peer_address: string,
peer_port: port,
peer_name: string)
{
print "Broker::outgoing_connection_established", peer_address, peer_port;
}
event Broker::outgoing_connection_broken(peer_address: string,
peer_port: port)
{
terminate();
}
hook NetControl::acld_rule_policy(p: NetControl::PluginState, r: NetControl::Rule, ar: NetControl::AclRule)
{
# use nullzero instead of drop for address drops
if ( r$ty == NetControl::DROP && r$entity$ty == NetControl::ADDRESS && ar$command == "drop" )
ar$command = "nullzero";
}
event connection_established(c: connection)
{
local id = c$id;
local flow1 = NetControl::Flow(
$src_h=addr_to_subnet(c$id$orig_h),
$dst_h=addr_to_subnet(c$id$resp_h)
);
local e1: NetControl::Entity = [$ty=NetControl::FLOW, $flow=flow1];
local r1: NetControl::Rule = [$ty=NetControl::DROP, $target=NetControl::FORWARD, $entity=e1, $expire=10hrs, $location="here"];
local flow2 = NetControl::Flow(
$dst_p=c$id$resp_p
);
local e2: NetControl::Entity = [$ty=NetControl::FLOW, $flow=flow2];
local r2: NetControl::Rule = [$ty=NetControl::DROP, $target=NetControl::FORWARD, $entity=e2, $expire=10hrs, $location="there"];
NetControl::add_rule(r1);
NetControl::add_rule(r2);
NetControl::drop_address(id$orig_h, 10hrs);
}
event NetControl::rule_added(r: NetControl::Rule, p: NetControl::PluginState, msg: string)
{
print "rule added", r$entity, r$ty;
NetControl::remove_rule(r$id);
}
event NetControl::rule_removed(r: NetControl::Rule, p: NetControl::PluginState, msg: string)
{
print "rule removed", r$entity, r$ty;
}
@TEST-END-FILE
@TEST-START-FILE recv.bro
@load base/frameworks/netcontrol
@load base/frameworks/broker
const broker_port: port &redef;
redef exit_only_after_terminate = T;
event bro_init()
{
Broker::enable();
Broker::subscribe_to_events("bro/event/netcontroltest");
Broker::listen(broker_port, "127.0.0.1");
}
event Broker::incoming_connection_established(peer_name: string)
{
print "Broker::incoming_connection_established";
}
event NetControl::acld_add_rule(id: count, r: NetControl::Rule, ar: NetControl::AclRule)
{
print "add_rule", id, r$entity, r$ty, ar;
Broker::event("bro/event/netcontroltest", Broker::event_args(NetControl::acld_rule_added, id, r, ar$command));
}
event NetControl::acld_remove_rule(id: count, r: NetControl::Rule, ar: NetControl::AclRule)
{
print "remove_rule", id, r$entity, r$ty, ar;
Broker::event("bro/event/netcontroltest", Broker::event_args(NetControl::acld_rule_removed, id, r, ar$command));
if ( r$cid == 4 )
terminate();
}
@TEST-END-FILE

115
testing/btest/scripts/base/frameworks/netcontrol/acld.bro Normal file
View file

@ -0,0 +1,115 @@
# @TEST-SERIALIZE: brokercomm
# @TEST-REQUIRES: grep -q ENABLE_BROKER $BUILD/CMakeCache.txt
# @TEST-EXEC: btest-bg-run recv "bro -b ../recv.bro broker_port=$BROKER_PORT >recv.out"
# @TEST-EXEC: btest-bg-run send "bro -b -r $TRACES/tls/ecdhe.pcap --pseudo-realtime ../send.bro broker_port=$BROKER_PORT >send.out"
# @TEST-EXEC: btest-bg-wait 20
# @TEST-EXEC: btest-diff recv/recv.out
# @TEST-EXEC: btest-diff send/send.out
@TEST-START-FILE send.bro
@load base/frameworks/netcontrol
const broker_port: port &redef;
redef exit_only_after_terminate = T;
event NetControl::init()
{
suspend_processing();
local netcontrol_acld = NetControl::create_acld(NetControl::AcldConfig($acld_host=127.0.0.1, $acld_port=broker_port, $acld_topic="bro/event/netcontroltest"));
NetControl::activate(netcontrol_acld, 0);
}
event Broker::outgoing_connection_established(peer_address: string,
peer_port: port,
peer_name: string)
{
print "Broker::outgoing_connection_established", peer_address, peer_port;
}
event NetControl::init_done()
{
continue_processing();
}
event Broker::outgoing_connection_broken(peer_address: string,
peer_port: port)
{
terminate();
}
event connection_established(c: connection)
{
local id = c$id;
local flow1 = NetControl::Flow(
$src_h=addr_to_subnet(c$id$orig_h),
$dst_h=addr_to_subnet(c$id$resp_h)
);
local e1: NetControl::Entity = [$ty=NetControl::FLOW, $flow=flow1];
local r1: NetControl::Rule = [$ty=NetControl::DROP, $target=NetControl::FORWARD, $entity=e1, $expire=10hrs, $location="here"];
local flow2 = NetControl::Flow(
$dst_p=c$id$resp_p
);
local e2: NetControl::Entity = [$ty=NetControl::FLOW, $flow=flow2];
local r2: NetControl::Rule = [$ty=NetControl::DROP, $target=NetControl::FORWARD, $entity=e2, $expire=10hrs, $location="there"];
NetControl::add_rule(r1);
NetControl::add_rule(r2);
NetControl::drop_address(id$orig_h, 10hrs);
}
event NetControl::rule_added(r: NetControl::Rule, p: NetControl::PluginState, msg: string)
{
print "rule added", r$entity, r$ty;
NetControl::remove_rule(r$id);
}
event NetControl::rule_removed(r: NetControl::Rule, p: NetControl::PluginState, msg: string)
{
print "rule removed", r$entity, r$ty;
}
@TEST-END-FILE
@TEST-START-FILE recv.bro
@load base/frameworks/netcontrol
@load base/frameworks/broker
const broker_port: port &redef;
redef exit_only_after_terminate = T;
event bro_init()
{
Broker::enable();
Broker::subscribe_to_events("bro/event/netcontroltest");
Broker::listen(broker_port, "127.0.0.1");
}
event Broker::incoming_connection_established(peer_name: string)
{
print "Broker::incoming_connection_established";
}
event NetControl::acld_add_rule(id: count, r: NetControl::Rule, ar: NetControl::AclRule)
{
print "add_rule", id, r$entity, r$ty, ar;
Broker::event("bro/event/netcontroltest", Broker::event_args(NetControl::acld_rule_added, id, r, ar$command));
}
event NetControl::acld_remove_rule(id: count, r: NetControl::Rule, ar: NetControl::AclRule)
{
print "remove_rule", id, r$entity, r$ty, ar;
Broker::event("bro/event/netcontroltest", Broker::event_args(NetControl::acld_rule_removed, id, r, ar$command));
if ( r$cid == 4 )
terminate();
}
@TEST-END-FILE

62
testing/btest/scripts/base/frameworks/netcontrol/basic-cluster.bro Normal file
View file

@ -0,0 +1,62 @@
# @TEST-SERIALIZE: comm
#
# @TEST-EXEC: btest-bg-run manager-1 "cp ../cluster-layout.bro . && CLUSTER_NODE=manager-1 bro %INPUT"
# @TEST-EXEC: sleep 1
# @TEST-EXEC: btest-bg-run worker-1 "cp ../cluster-layout.bro . && CLUSTER_NODE=worker-1 bro --pseudo-realtime -C -r $TRACES/tls/ecdhe.pcap %INPUT"
# @TEST-EXEC: sleep 1
# @TEST-EXEC: btest-bg-run worker-2 "cp ../cluster-layout.bro . && CLUSTER_NODE=worker-2 bro --pseudo-realtime -C -r $TRACES/tls/ecdhe.pcap %INPUT"
# @TEST-EXEC: btest-bg-wait 20
# @TEST-EXEC: btest-diff manager-1/netcontrol.log
@TEST-START-FILE cluster-layout.bro
redef Cluster::nodes = {
["manager-1"] = [$node_type=Cluster::MANAGER, $ip=127.0.0.1, $p=37757/tcp, $workers=set("worker-1", "worker-2")],
["worker-1"] = [$node_type=Cluster::WORKER, $ip=127.0.0.1, $p=37760/tcp, $manager="manager-1", $interface="eth0"],
["worker-2"] = [$node_type=Cluster::WORKER, $ip=127.0.0.1, $p=37761/tcp, $manager="manager-1", $interface="eth0"],
};
@TEST-END-FILE
redef Log::default_rotation_interval = 0secs;
#redef exit_only_after_terminate = T;
@load base/frameworks/netcontrol
@if ( Cluster::local_node_type() == Cluster::WORKER )
event bro_init()
{
suspend_processing();
}
@endif
event NetControl::init()
{
local netcontrol_debug = NetControl::create_debug(T);
NetControl::activate(netcontrol_debug, 0);
}
@if ( Cluster::local_node_type() == Cluster::WORKER )
event remote_connection_handshake_done(p: event_peer)
{
continue_processing();
}
@endif
event connection_established(c: connection)
{
local id = c$id;
NetControl::shunt_flow([$src_h=id$orig_h, $src_p=id$orig_p, $dst_h=id$resp_h, $dst_p=id$resp_p], 1sec);
NetControl::drop_address(id$orig_h, 1sec);
}
event terminate_me() {
terminate();
}
event remote_connection_closed(p: event_peer) {
schedule 1sec { terminate_me() };
}
event NetControl::rule_added(r: NetControl::Rule, p: NetControl::PluginState, msg: string &default="")
{
print "Rule added", r$id, r$cid;
}

44
testing/btest/scripts/base/frameworks/netcontrol/basic.bro Normal file
View file

@ -0,0 +1,44 @@
# @TEST-EXEC: bro %INPUT
# @TEST-EXEC: btest-diff netcontrol.log
# @TEST-EXEC: btest-diff netcontrol_shunt.log
# @TEST-EXEC: btest-diff netcontrol_drop.log
# @TEST-EXEC: btest-diff .stdout
@load base/frameworks/netcontrol
event NetControl::init()
{
local netcontrol_debug = NetControl::create_debug(T);
NetControl::activate(netcontrol_debug, 0);
}
function test_mac_flow()
{
local flow = NetControl::Flow(
$src_m = "FF:FF:FF:FF:FF:FF"
);
local e: NetControl::Entity = [$ty=NetControl::FLOW, $flow=flow];
local r: NetControl::Rule = [$ty=NetControl::DROP, $target=NetControl::FORWARD, $entity=e, $expire=15sec];
NetControl::add_rule(r);
}
function test_mac()
{
local e: NetControl::Entity = [$ty=NetControl::MAC, $mac="FF:FF:FF:FF:FF:FF"];
local r: NetControl::Rule = [$ty=NetControl::DROP, $target=NetControl::FORWARD, $entity=e, $expire=15sec];
NetControl::add_rule(r);
}
event NetControl::init_done() &priority=-5
{
NetControl::shunt_flow([$src_h=192.168.17.1, $src_p=32/tcp, $dst_h=192.168.17.2, $dst_p=32/tcp], 30sec);
NetControl::drop_address(1.1.2.2, 15sec, "Hi there");
NetControl::whitelist_address(1.2.3.4, 15sec);
NetControl::redirect_flow([$src_h=192.168.17.1, $src_p=32/tcp, $dst_h=192.168.17.2, $dst_p=32/tcp], 5, 30sec);
NetControl::quarantine_host(127.0.0.2, 8.8.8.8, 127.0.0.3, 15sec);
test_mac();
test_mac_flow();
}

107
testing/btest/scripts/base/frameworks/netcontrol/broker.bro Normal file
View file

@ -0,0 +1,107 @@
# @TEST-SERIALIZE: brokercomm
# @TEST-REQUIRES: grep -q ENABLE_BROKER $BUILD/CMakeCache.txt
# @TEST-EXEC: btest-bg-run recv "bro -b ../recv.bro broker_port=$BROKER_PORT >recv.out"
# @TEST-EXEC: btest-bg-run send "bro -b -r $TRACES/smtp.trace --pseudo-realtime ../send.bro broker_port=$BROKER_PORT >send.out"
# @TEST-EXEC: btest-bg-wait 20
# @TEST-EXEC: btest-diff send/netcontrol.log
# @TEST-EXEC: btest-diff recv/recv.out
# @TEST-EXEC: btest-diff send/send.out
@TEST-START-FILE send.bro
@load base/frameworks/netcontrol
const broker_port: port &redef;
redef exit_only_after_terminate = T;
event NetControl::init()
{
suspend_processing();
local netcontrol_broker = NetControl::create_broker(127.0.0.1, broker_port, "bro/event/netcontroltest", T);
NetControl::activate(netcontrol_broker, 0);
}
event NetControl::init_done()
{
continue_processing();
}
event Broker::outgoing_connection_established(peer_address: string,
peer_port: port,
peer_name: string)
{
print "Broker::outgoing_connection_established", peer_address, peer_port;
}
event Broker::outgoing_connection_broken(peer_address: string,
peer_port: port)
{
terminate();
}
event connection_established(c: connection)
{
local id = c$id;
NetControl::shunt_flow([$src_h=id$orig_h, $src_p=id$orig_p, $dst_h=id$resp_h, $dst_p=id$resp_p], 10hrs);
NetControl::drop_address(id$orig_h, 10hrs);
}
event NetControl::rule_added(r: NetControl::Rule, p: NetControl::PluginState, msg: string)
{
print "rule added", r$entity, r$ty;
NetControl::remove_rule(r$id);
}
event NetControl::rule_removed(r: NetControl::Rule, p: NetControl::PluginState, msg: string)
{
print "rule removed", r$entity, r$ty;
}
event NetControl::rule_timeout(r: NetControl::Rule, i: NetControl::FlowInfo, p: NetControl::PluginState)
{
print "rule timeout", r$entity, r$ty, i;
}
@TEST-END-FILE
@TEST-START-FILE recv.bro
@load base/frameworks/netcontrol
@load base/frameworks/broker
const broker_port: port &redef;
redef exit_only_after_terminate = T;
event bro_init()
{
Broker::enable();
Broker::subscribe_to_events("bro/event/netcontroltest");
Broker::listen(broker_port, "127.0.0.1");
}
event Broker::incoming_connection_established(peer_name: string)
{
print "Broker::incoming_connection_established";
}
event NetControl::broker_add_rule(id: count, r: NetControl::Rule)
{
print "add_rule", id, r$entity, r$ty;
Broker::event("bro/event/netcontroltest", Broker::event_args(NetControl::broker_rule_added, id, r, ""));
}
event NetControl::broker_remove_rule(id: count, r: NetControl::Rule)
{
print "remove_rule", id, r$entity, r$ty;
Broker::event("bro/event/netcontroltest", Broker::event_args(NetControl::broker_rule_timeout, id, r, NetControl::FlowInfo()));
Broker::event("bro/event/netcontroltest", Broker::event_args(NetControl::broker_rule_removed, id, r, ""));
if ( r$cid == 3 )
terminate();
}
@TEST-END-FILE

31
testing/btest/scripts/base/frameworks/netcontrol/catch-and-release.bro Normal file
View file

@ -0,0 +1,31 @@
# @TEST-EXEC: bro -r $TRACES/tls/ecdhe.pcap %INPUT
# @TEST-EXEC: TEST_DIFF_CANONIFIER='grep -v ^# | $SCRIPTS/diff-sort' btest-diff netcontrol.log
@load base/frameworks/netcontrol
event NetControl::init()
{
local netcontrol_debug = NetControl::create_debug(T);
NetControl::activate(netcontrol_debug, 0);
}
module NetControl;
event connection_established(c: connection)
{
local id = c$id;
NetControl::drop_address_catch_release(id$orig_h);
# second one should be ignored because duplicate
NetControl::drop_address_catch_release(id$orig_h);
# mean call directly into framework - simulate new connection
delete current_blocks[id$orig_h];
check_conn(id$orig_h);
delete current_blocks[id$orig_h];
check_conn(id$orig_h);
delete current_blocks[id$orig_h];
check_conn(id$orig_h);
delete current_blocks[id$orig_h];
check_conn(id$orig_h);
}

54
testing/btest/scripts/base/frameworks/netcontrol/delete-internal-state.bro Normal file
View file

@ -0,0 +1,54 @@
# @TEST-EXEC: bro -r $TRACES/tls/ecdhe.pcap %INPUT
# @TEST-EXEC: btest-diff .stdout
# Verify the state of internal tables after rules have been deleted...
@load base/frameworks/netcontrol
module NetControl;
export {
global dump_state: function();
}
function dump_state()
{
print "Dumping state";
print rules;
print rule_entities;
print rules_by_subnets;
}
module GLOBAL;
global rules: vector of string;
event NetControl::init()
{
local netcontrol_debug = NetControl::create_debug(T);
NetControl::activate(netcontrol_debug, 10);
}
event remove_all()
{
for ( i in rules )
NetControl::remove_rule(rules[i]);
}
event dump_info()
{
NetControl::dump_state();
}
event connection_established(c: connection)
{
local id = c$id;
rules[|rules|] = NetControl::shunt_flow([$src_h=id$orig_h, $src_p=id$orig_p, $dst_h=id$resp_h, $dst_p=id$resp_p], 0secs);
rules[|rules|] = NetControl::drop_address(id$orig_h, 0secs);
rules[|rules|] = NetControl::whitelist_address(id$orig_h, 0secs);
rules[|rules|] = NetControl::redirect_flow([$src_h=id$orig_h, $src_p=id$orig_p, $dst_h=id$resp_h, $dst_p=id$resp_p], 5, 0secs);
schedule 1sec { remove_all() };
schedule 2sec { dump_info() };
}

15
testing/btest/scripts/base/frameworks/netcontrol/duplicate.bro Normal file
View file

@ -0,0 +1,15 @@
# @TEST-EXEC: bro -b -r $TRACES/tls/google-duplicate.trace %INPUT
# @TEST-EXEC: btest-diff netcontrol.log
@load base/frameworks/netcontrol
event NetControl::init()
{
local netcontrol_debug = NetControl::create_debug(T);
NetControl::activate(netcontrol_debug, 0);
}
event connection_established(c: connection)
{
NetControl::drop_address(c$id$orig_h, 0secs);
}

34
testing/btest/scripts/base/frameworks/netcontrol/find-rules.bro Normal file
View file

@ -0,0 +1,34 @@
# @TEST-EXEC: bro %INPUT
# @TEST-EXEC: btest-diff out
@load base/frameworks/netcontrol
global outfile: file;
event NetControl::init()
{
local netcontrol_debug = NetControl::create_debug(T);
NetControl::activate(netcontrol_debug, 0);
}
event NetControl::init_done() &priority=-5
{
NetControl::shunt_flow([$src_h=192.168.17.1, $src_p=32/tcp, $dst_h=192.168.17.2, $dst_p=32/tcp], 30sec);
NetControl::drop_address(1.1.2.2, 15sec, "Hi there");
NetControl::whitelist_address(1.2.3.4, 15sec);
NetControl::redirect_flow([$src_h=192.168.17.1, $src_p=32/tcp, $dst_h=192.168.17.2, $dst_p=32/tcp], 5, 30sec);
NetControl::quarantine_host(127.0.0.2, 8.8.8.8, 127.0.0.3, 15sec);
outfile = open("out");
local rules = NetControl::find_rules_addr(1.2.3.4);
print outfile, |rules|;
print outfile, rules[0]$entity;
rules = NetControl::find_rules_addr(1.2.3.5);
print outfile, |rules|;
rules = NetControl::find_rules_addr(127.0.0.2);
print outfile, |rules|;
print outfile, rules[0]$entity, rules[0]$ty;
print outfile, rules[3]$entity, rules[3]$ty;
close(outfile);
}

27
testing/btest/scripts/base/frameworks/netcontrol/hook.bro Normal file
View file

@ -0,0 +1,27 @@
# @TEST-EXEC: bro -r $TRACES/tls/ecdhe.pcap %INPUT
# @TEST-EXEC: btest-diff netcontrol.log
@load base/frameworks/netcontrol
event NetControl::init()
{
local netcontrol_debug = NetControl::create_debug(T);
NetControl::activate(netcontrol_debug, 0);
}
event connection_established(c: connection)
{
local id = c$id;
NetControl::shunt_flow([$src_h=id$orig_h, $src_p=id$orig_p, $dst_h=id$resp_h, $dst_p=id$resp_p], 30sec);
NetControl::drop_address(id$orig_h, 15sec);
NetControl::whitelist_address(id$orig_h, 15sec);
NetControl::redirect_flow([$src_h=id$orig_h, $src_p=id$orig_p, $dst_h=id$resp_h, $dst_p=id$resp_p], 5, 30sec);
}
hook NetControl::rule_policy(r: NetControl::Rule)
{
if ( r$expire == 15sec )
break;
r$entity$flow$src_h = 0.0.0.0/0;
}

37
testing/btest/scripts/base/frameworks/netcontrol/multiple.bro Normal file
View file

@ -0,0 +1,37 @@
# @TEST-EXEC: bro -r $TRACES/tls/ecdhe.pcap %INPUT
# @TEST-EXEC: TEST_DIFF_CANONIFIER='grep -v ^# | $SCRIPTS/diff-sort' btest-diff netcontrol.log
# @TEST-EXEC: btest-diff openflow.log
@load base/frameworks/netcontrol
global rules: vector of string;
event NetControl::init()
{
local netcontrol_debug = NetControl::create_debug(T);
local netcontrol_debug_2 = NetControl::create_debug(T);
local of_controller = OpenFlow::log_new(42);
local netcontrol_of = NetControl::create_openflow(of_controller);
NetControl::activate(netcontrol_debug, 10);
NetControl::activate(netcontrol_of, 10);
NetControl::activate(netcontrol_debug_2, 0);
}
event remove_all()
{
for ( i in rules )
NetControl::remove_rule(rules[i]);
}
event connection_established(c: connection)
{
local id = c$id;
rules[|rules|] = NetControl::shunt_flow([$src_h=id$orig_h, $src_p=id$orig_p, $dst_h=id$resp_h, $dst_p=id$resp_p], 0secs);
rules[|rules|] = NetControl::drop_address(id$orig_h, 0secs);
rules[|rules|] = NetControl::whitelist_address(id$orig_h, 0secs);
rules[|rules|] = NetControl::redirect_flow([$src_h=id$orig_h, $src_p=id$orig_p, $dst_h=id$resp_h, $dst_p=id$resp_p], 5, 0secs);
schedule 1sec { remove_all() };
}

21
testing/btest/scripts/base/frameworks/netcontrol/openflow.bro Normal file
View file

@ -0,0 +1,21 @@
# @TEST-EXEC: bro -r $TRACES/smtp.trace %INPUT
# @TEST-EXEC: btest-diff netcontrol.log
# @TEST-EXEC: btest-diff openflow.log
@load base/frameworks/netcontrol
global of_controller: OpenFlow::Controller;
event NetControl::init()
{
of_controller = OpenFlow::log_new(42);
local netcontrol_of = NetControl::create_openflow(of_controller);
NetControl::activate(netcontrol_of, 0);
}
event connection_established(c: connection)
{
local id = c$id;
NetControl::shunt_flow([$src_h=id$orig_h, $src_p=id$orig_p, $dst_h=id$resp_h, $dst_p=id$resp_p], 30sec);
NetControl::drop_address(id$resp_h, 15sec);
}

18
testing/btest/scripts/base/frameworks/netcontrol/packetfilter.bro Normal file
View file

@ -0,0 +1,18 @@
# @TEST-EXEC: bro -r $TRACES/smtp.trace %INPUT
# @TEST-EXEC: btest-diff conn.log
@load base/frameworks/netcontrol
event NetControl::init()
{
local netcontrol_packetfilter = NetControl::create_packetfilter();
NetControl::activate(netcontrol_packetfilter, 0);
}
event connection_established(c: connection)
{
local e = NetControl::Entity($ty=NetControl::ADDRESS, $ip=addr_to_subnet(c$id$orig_h));
local r = NetControl::Rule($ty=NetControl::DROP, $target=NetControl::MONITOR, $entity=e, $expire=10min);
NetControl::add_rule(r);
}

19
testing/btest/scripts/base/frameworks/netcontrol/quarantine-openflow.bro Normal file
View file

@ -0,0 +1,19 @@
# @TEST-EXEC: bro -r $TRACES/tls/ecdhe.pcap %INPUT
# @TEST-EXEC: btest-diff netcontrol.log
# @TEST-EXEC: btest-diff openflow.log
@load base/frameworks/netcontrol
global of_controller: OpenFlow::Controller;
event NetControl::init()
{
of_controller = OpenFlow::log_new(42);
local netcontrol_of = NetControl::create_openflow(of_controller);
NetControl::activate(netcontrol_of, 0);
}
event connection_established(c: connection)
{
NetControl::quarantine_host(c$id$orig_h, 8.8.8.8, 192.169.18.1, 10hrs);
}

15
testing/btest/scripts/base/frameworks/netcontrol/timeout.bro Normal file
View file

@ -0,0 +1,15 @@
# @TEST-EXEC: bro -b -r $TRACES/tls/ecdhe.pcap --pseudo-realtime %INPUT
# @TEST-EXEC: btest-diff netcontrol.log
@load base/frameworks/netcontrol
event NetControl::init()
{
local netcontrol_debug = NetControl::create_debug(T);
NetControl::activate(netcontrol_debug, 0);
}
event connection_established(c: connection)
{
NetControl::drop_address(c$id$orig_h, 1secs);
}

120
testing/btest/scripts/base/frameworks/openflow/broker-basic.bro Normal file
View file

@ -0,0 +1,120 @@
# @TEST-SERIALIZE: brokercomm
# @TEST-REQUIRES: grep -q ENABLE_BROKER $BUILD/CMakeCache.txt
# @TEST-EXEC: btest-bg-run recv "bro -b ../recv.bro broker_port=$BROKER_PORT >recv.out"
# @TEST-EXEC: btest-bg-run send "bro -b -r $TRACES/smtp.trace --pseudo-realtime ../send.bro broker_port=$BROKER_PORT >send.out"
# @TEST-EXEC: btest-bg-wait 20
# @TEST-EXEC: btest-diff recv/recv.out
# @TEST-EXEC: btest-diff send/send.out
@TEST-START-FILE send.bro
@load base/protocols/conn
@load base/frameworks/openflow
const broker_port: port &redef;
redef exit_only_after_terminate = T;
global of_controller: OpenFlow::Controller;
event bro_init()
{
suspend_processing();
of_controller = OpenFlow::broker_new("broker1", 127.0.0.1, broker_port, "bro/event/openflow", 42);
}
event Broker::outgoing_connection_established(peer_address: string,
peer_port: port,
peer_name: string)
{
print "Broker::outgoing_connection_established", peer_address, peer_port;
}
event OpenFlow::controller_activated(name: string, controller: OpenFlow::Controller)
{
continue_processing();
OpenFlow::flow_clear(of_controller);
OpenFlow::flow_mod(of_controller, [], [$cookie=OpenFlow::generate_cookie(1), $command=OpenFlow::OFPFC_ADD, $actions=[$out_ports=vector(3, 7)]]);
}
event Broker::outgoing_connection_broken(peer_address: string,
peer_port: port)
{
terminate();
}
event connection_established(c: connection)
{
print "connection established";
local match = OpenFlow::match_conn(c$id);
local match_rev = OpenFlow::match_conn(c$id, T);
local flow_mod: OpenFlow::ofp_flow_mod = [
$cookie=OpenFlow::generate_cookie(42),
$command=OpenFlow::OFPFC_ADD,
$idle_timeout=30,
$priority=5
];
OpenFlow::flow_mod(of_controller, match, flow_mod);
OpenFlow::flow_mod(of_controller, match_rev, flow_mod);
}
event OpenFlow::flow_mod_success(name: string, match: OpenFlow::ofp_match, flow_mod: OpenFlow::ofp_flow_mod, msg: string)
{
print "Flow_mod_success";
}
event OpenFlow::flow_mod_failure(name: string, match: OpenFlow::ofp_match, flow_mod: OpenFlow::ofp_flow_mod, msg: string)
{
print "Flow_mod_failure";
}
@TEST-END-FILE
@TEST-START-FILE recv.bro
@load base/frameworks/openflow
const broker_port: port &redef;
redef exit_only_after_terminate = T;
global msg_count: count = 0;
event bro_init()
{
Broker::enable();
Broker::subscribe_to_events("bro/event/openflow");
Broker::listen(broker_port, "127.0.0.1");
}
event Broker::incoming_connection_established(peer_name: string)
{
print "Broker::incoming_connection_established";
}
function got_message()
{
++msg_count;
if ( msg_count >= 4 )
terminate();
}
event OpenFlow::broker_flow_mod(name: string, dpid: count, match: OpenFlow::ofp_match, flow_mod: OpenFlow::ofp_flow_mod)
{
print "got flow_mod", dpid, match, flow_mod;
Broker::event("bro/event/openflow", Broker::event_args(OpenFlow::flow_mod_success, name, match, flow_mod, ""));
Broker::event("bro/event/openflow", Broker::event_args(OpenFlow::flow_mod_failure, name, match, flow_mod, ""));
got_message();
}
event OpenFlow::broker_flow_clear(name: string, dpid: count)
{
print "flow_clear", dpid;
got_message();
}
@TEST-END-FILE

32
testing/btest/scripts/base/frameworks/openflow/log-basic.bro Normal file
View file

@ -0,0 +1,32 @@
# @TEST-EXEC: bro -r $TRACES/smtp.trace %INPUT
# @TEST-EXEC: btest-diff openflow.log
@load base/protocols/conn
@load base/frameworks/openflow
global of_controller: OpenFlow::Controller;
global cookie_id: count = 42;
event bro_init()
{
of_controller = OpenFlow::log_new(42);
OpenFlow::flow_mod(of_controller, [], [$cookie=OpenFlow::generate_cookie(1), $command=OpenFlow::OFPFC_ADD, $actions=[$out_ports=vector(3, 7)]]);
}
event connection_established(c: connection)
{
local match = OpenFlow::match_conn(c$id);
local match_rev = OpenFlow::match_conn(c$id, T);
local flow_mod: OpenFlow::ofp_flow_mod = [
$cookie=OpenFlow::generate_cookie(++cookie_id),
$command=OpenFlow::OFPFC_ADD,
$idle_timeout=30,
$priority=5
];
OpenFlow::flow_mod(of_controller, match, flow_mod);
OpenFlow::flow_mod(of_controller, match_rev, flow_mod);
}

55
testing/btest/scripts/base/frameworks/openflow/log-cluster.bro Normal file
View file

@ -0,0 +1,55 @@
# @TEST-SERIALIZE: comm
#
# @TEST-EXEC: btest-bg-run manager-1 "cp ../cluster-layout.bro . && CLUSTER_NODE=manager-1 bro %INPUT"
# @TEST-EXEC: sleep 1
# @TEST-EXEC: btest-bg-run worker-1 "cp ../cluster-layout.bro . && CLUSTER_NODE=worker-1 bro --pseudo-realtime -C -r $TRACES/smtp.trace %INPUT"
# @TEST-EXEC: btest-bg-wait 20
# @TEST-EXEC: btest-diff manager-1/openflow.log
@TEST-START-FILE cluster-layout.bro
redef Cluster::nodes = {
["manager-1"] = [$node_type=Cluster::MANAGER, $ip=127.0.0.1, $p=37757/tcp, $workers=set("worker-1", "worker-2")],
["worker-1"] = [$node_type=Cluster::WORKER, $ip=127.0.0.1, $p=37760/tcp, $manager="manager-1", $interface="eth0"],
};
@TEST-END-FILE
redef Log::default_rotation_interval = 0secs;
#redef exit_only_after_terminate = T;
@load base/protocols/conn
@load base/frameworks/openflow
global of_controller: OpenFlow::Controller;
event bro_init()
{
of_controller = OpenFlow::log_new(42);
}
event connection_established(c: connection)
{
print "conn established";
local match = OpenFlow::match_conn(c$id);
local match_rev = OpenFlow::match_conn(c$id, T);
local flow_mod: OpenFlow::ofp_flow_mod = [
$cookie=OpenFlow::generate_cookie(42),
$command=OpenFlow::OFPFC_ADD,
$idle_timeout=30,
$priority=5
];
OpenFlow::flow_mod(of_controller, match, flow_mod);
OpenFlow::flow_mod(of_controller, match_rev, flow_mod);
terminate();
}
event terminate_me() {
terminate();
}
event remote_connection_closed(p: event_peer) {
schedule 1sec { terminate_me() };
}

37
testing/btest/scripts/base/frameworks/openflow/ryu-basic.bro Normal file
View file

@ -0,0 +1,37 @@
# @TEST-EXEC: bro -r $TRACES/smtp.trace %INPUT
# @TEST-EXEC: btest-diff .stdout
@load base/protocols/conn
@load base/frameworks/openflow
global of_controller: OpenFlow::Controller;
event bro_init()
{
of_controller = OpenFlow::ryu_new(127.0.0.1, 8080, 42);
of_controller$state$ryu_debug=T;
OpenFlow::flow_clear(of_controller);
OpenFlow::flow_mod(of_controller, [], [$cookie=OpenFlow::generate_cookie(1), $command=OpenFlow::OFPFC_ADD, $actions=[$out_ports=vector(3, 7)]]);
}
event connection_established(c: connection)
{
local match = OpenFlow::match_conn(c$id);
local match_rev = OpenFlow::match_conn(c$id, T);
local flow_mod: OpenFlow::ofp_flow_mod = [
$cookie=OpenFlow::generate_cookie(42),
$command=OpenFlow::OFPFC_ADD,
$idle_timeout=30,
$priority=5
];
OpenFlow::flow_mod(of_controller, match, flow_mod);
OpenFlow::flow_mod(of_controller, match_rev, flow_mod);
}
event OpenFlow::flow_mod_success(name: string, match: OpenFlow::ofp_match, flow_mod: OpenFlow::ofp_flow_mod, msg: string)
{
print "Flow_mod_success";
}

4
testing/btest/scripts/base/frameworks/software/version-parsing.bro
View file

@ -106,6 +106,10 @@ global matched_software: table[string] of Software::Description = {
[$name="vsFTPd", $version=[$major=2,$minor=0,$minor2=5], $unparsed_version=""],
["Apple Mail (2.1084)"] =
[$name="Apple Mail", $version=[$major=2,$minor=1084], $unparsed_version=""],
["Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en) AppleWebKit/420+ (KHTML, like Gecko) AdobeAIR/1.0"] =
[$name="AdobeAIR", $version=[$major=1,$minor=0], $unparsed_version=""],
["Mozilla/5.0 (Windows; U; en) AppleWebKit/420+ (KHTML, like Gecko) AdobeAIR/1.0"] =
[$name="AdobeAIR", $version=[$major=1,$minor=0], $unparsed_version=""],
};
event bro_init()

7
testing/btest/scripts/base/protocols/dns/caa.bro Normal file
View file

@ -0,0 +1,7 @@
# @TEST-EXEC: bro -r $TRACES/dns-caa.pcap %INPUT
# @TEST-EXEC: btest-diff .stdout
event dns_CAA_reply(c: connection, msg: dns_msg, ans: dns_answer, flags: count, tag: string, value: string)
{
print flags,tag,value;
}

7
testing/btest/scripts/base/protocols/dns/huge-ttl.bro Normal file
View file

@ -0,0 +1,7 @@
# @TEST-EXEC: bro -r $TRACES/dns-huge-ttl.pcap %INPUT
# @TEST-EXEC: btest-diff .stdout
event dns_A_reply(c: connection, msg: dns_msg, ans: dns_answer, a: addr)
{
print ans;
}

5
testing/btest/scripts/base/protocols/ftp/ftp-get-file-size.bro Normal file
View file

@ -0,0 +1,5 @@
# This tests extracting the server reported file size
# from FTP sessions.
#
# @TEST-EXEC: bro -r $TRACES/ftp/ftp-with-numbers-in-filename.pcap
# @TEST-EXEC: btest-diff ftp.log

4
testing/btest/scripts/base/protocols/http/http-bad-request-with-version.bro Normal file
View file

@ -0,0 +1,4 @@
# @TEST-EXEC: bro -Cr $TRACES/http/http-bad-request-with-version.trace %INPUT
# @TEST-EXEC: btest-diff http.log
# @TEST-EXEC: btest-diff weird.log

12
testing/btest/scripts/base/protocols/http/http-connect-with-header.bro Normal file
View file

@ -0,0 +1,12 @@
# This tests that the HTTP analyzer handles HTTP CONNECT proxying correctly
# when the server include a header line into its response.
#
# @TEST-EXEC: bro -C -r $TRACES/http/connect-with-header.trace %INPUT
# @TEST-EXEC: btest-diff conn.log
# @TEST-EXEC: btest-diff http.log
# @TEST-EXEC: btest-diff tunnel.log
@load base/protocols/conn
@load base/protocols/http
@load base/protocols/tunnels
@load base/frameworks/dpd

4
testing/btest/scripts/base/protocols/http/no-uri.bro Normal file
View file

@ -0,0 +1,4 @@
# @TEST-EXEC: bro -Cr $TRACES/http/no-uri.pcap %INPUT
# @TEST-EXEC: btest-diff http.log
# @TEST-EXEC: btest-diff weird.log

3
testing/btest/scripts/base/protocols/http/no-version.bro Normal file
View file

@ -0,0 +1,3 @@
# @TEST-EXEC: bro -Cr $TRACES/http/no-version.pcap %INPUT
# @TEST-EXEC: btest-diff http.log

16
testing/btest/scripts/base/protocols/irc/events.test Normal file
View file

@ -0,0 +1,16 @@
# Test IRC events
# @TEST-EXEC: bro -r $TRACES/irc-dcc-send.trace %INPUT
# @TEST-EXEC: bro -r $TRACES/irc-basic.trace %INPUT
# @TEST-EXEC: bro -r $TRACES/irc-whitespace.trace %INPUT
# @TEST-EXEC: btest-diff .stdout
event irc_privmsg_message(c: connection, is_orig: bool, source: string, target: string, message: string)
{
print fmt("%s -> %s: %s", source, target, message);
}
event irc_quit_message(c: connection, is_orig: bool, nick: string, message: string)
{
print fmt("quit: %s (%s)", nick, message);
}

9
testing/btest/scripts/base/protocols/irc/starttls.test Normal file
View file

@ -0,0 +1,9 @@
# @TEST-EXEC: bro -b -C -r $TRACES/tls/irc-starttls.pcap %INPUT
# @TEST-EXEC: btest-diff conn.log
# @TEST-EXEC: btest-diff ssl.log
# @TEST-EXEC: btest-diff x509.log
@load base/protocols/conn
@load base/frameworks/dpd
@load base/protocols/ssl
@load base/protocols/irc

2
testing/btest/scripts/base/protocols/pop3/starttls.bro
View file

@ -1,8 +1,10 @@
# @TEST-EXEC: bro -C -b -r $TRACES/tls/pop3-starttls.pcap %INPUT
# @TEST-EXEC: btest-diff conn.log
# @TEST-EXEC: btest-diff ssl.log
# @TEST-EXEC: btest-diff x509.log
@load base/protocols/conn
@load base/frameworks/dpd
@load base/protocols/ssl
module POP3;

4
testing/btest/scripts/base/protocols/rfb/rfb-apple-remote-desktop.test Normal file
View file

@ -0,0 +1,4 @@
# @TEST-EXEC: bro -C -r $TRACES/rfb/vncmac.pcap
# @TEST-EXEC: btest-diff rfb.log
@load base/protocols/rfb

4
testing/btest/scripts/base/protocols/rfb/vnc-mac-to-linux.test Normal file
View file

@ -0,0 +1,4 @@
# @TEST-EXEC: bro -C -r $TRACES/rfb/vnc-mac-to-linux.pcap
# @TEST-EXEC: btest-diff rfb.log
@load base/protocols/rfb

3
testing/btest/scripts/base/protocols/ssh/basic.test
View file

@ -1,4 +1,5 @@
# This tests some SSH connections and the output log.
# @TEST-EXEC: bro -r $TRACES/ssh/ssh.trace %INPUT
# @TEST-EXEC: btest-diff ssh.log
# @TEST-EXEC: btest-diff ssh.log
# @TEST-EXEC: btest-diff conn.log

6
testing/btest/scripts/base/protocols/ssl/cve-2015-3194.test Normal file
View file

@ -0,0 +1,6 @@
# This tests if Bro does not crash when exposed to CVE-2015-3194
# @TEST-EXEC: bro -r $TRACES/tls/CVE-2015-3194.pcap %INPUT
# @TEST-EXEC: btest-diff ssl.log
@load protocols/ssl/validate-certs.bro

1
testing/btest/scripts/base/protocols/ssl/dpd.test
View file

@ -1,6 +1,7 @@
# @TEST-EXEC: bro -C -b -r $TRACES/tls/ssl-v2.trace %INPUT
# @TEST-EXEC: bro -b -r $TRACES/tls/ssl.v3.trace %INPUT
# @TEST-EXEC: bro -b -r $TRACES/tls/tls1.2.trace %INPUT
# @TEST-EXEC: bro -b -r $TRACES/tls/tls-early-alert.trace %INPUT
# @TEST-EXEC: btest-diff .stdout
@load base/frameworks/dpd

1
testing/btest/scripts/policy/frameworks/intel/seen/certs.bro
View file

@ -8,6 +8,7 @@
#fields indicator indicator_type meta.source meta.desc meta.url
www.pantz.org Intel::DOMAIN source1 test entry http://some-data-distributor.com/100000
www.dresdner-privat.de Intel::DOMAIN source1 test entry http://some-data-distributor.com/100000
2c322ae2b7fe91391345e070b63668978bb1c9da Intel::CERT_HASH source1 test entry http://some-data-distributor.com/100000
@TEST-END-FILE
@load base/frameworks/intel

19
testing/btest/scripts/policy/misc/dump-events.bro
View file

@ -1,7 +1,18 @@
# @TEST-EXEC: bro -r $TRACES/smtp.trace policy/misc/dump-events.bro >all-events.log
# @TEST-EXEC: bro -r $TRACES/smtp.trace policy/misc/dump-events.bro DumpEvents::include_args=F >all-events-no-args.log
# @TEST-EXEC: bro -r $TRACES/smtp.trace policy/misc/dump-events.bro DumpEvents::include=/smtp_/ >smtp-events.log
#
# @TEST-EXEC: bro -r $TRACES/smtp.trace policy/misc/dump-events.bro %INPUT >all-events.log
# @TEST-EXEC: bro -r $TRACES/smtp.trace policy/misc/dump-events.bro %INPUT DumpEvents::include_args=F >all-events-no-args.log
# @TEST-EXEC: bro -r $TRACES/smtp.trace policy/misc/dump-events.bro %INPUT DumpEvents::include=/smtp_/ >smtp-events.log
#
# @TEST-EXEC: btest-diff all-events.log
# @TEST-EXEC: btest-diff all-events-no-args.log
# @TEST-EXEC: btest-diff smtp-events.log
# There is some kind of race condition between the MD5 and SHA1 events, which are added
# by the SSL parser. Just remove MD5, this is not important for this test.
event file_over_new_connection(f: fa_file, c: connection, is_orig: bool) &priority=-5
{
if ( ! c?$ssl )
return;
Files::remove_analyzer(f, Files::ANALYZER_MD5);
}

6
testing/btest/scripts/policy/protocols/conn/vlan-logging.bro Normal file
View file

@ -0,0 +1,6 @@
# A basic test of the vlan logging script
# @TEST-EXEC: bro -r $TRACES/q-in-q.trace %INPUT
# @TEST-EXEC: btest-diff conn.log
@load protocols/conn/vlan-logging

8
testing/btest/scripts/policy/protocols/http/flash-version.bro Normal file
View file

@ -0,0 +1,8 @@
# @TEST-EXEC: bro -r ${TRACES}/http/flash-version.trace %INPUT
# @TEST-EXEC: btest-diff software.log
@load protocols/http/software
@load protocols/http/software-browser-plugins
redef Software::asset_tracking = ALL_HOSTS;

37
testing/btest/scripts/policy/protocols/ssl/validate-certs-cluster.bro
View file

@ -1,37 +0,0 @@
# @TEST-SERIALIZE: comm
#
# @TEST-EXEC: btest-bg-run manager-1 "cp ../cluster-layout.bro . && CLUSTER_NODE=manager-1 bro %INPUT"
# @TEST-EXEC: sleep 1
# @TEST-EXEC: btest-bg-run proxy-1 "cp ../cluster-layout.bro . && CLUSTER_NODE=proxy-1 bro %INPUT"
# @TEST-EXEC: btest-bg-run proxy-2 "cp ../cluster-layout.bro . && CLUSTER_NODE=proxy-2 bro %INPUT"
# @TEST-EXEC: sleep 1
# @TEST-EXEC: btest-bg-run worker-1 "cp ../cluster-layout.bro . && CLUSTER_NODE=worker-1 bro --pseudo-realtime -C -r $TRACES/tls/missing-intermediate.pcap %INPUT"
# @TEST-EXEC: btest-bg-run worker-2 "cp ../cluster-layout.bro . && CLUSTER_NODE=worker-2 bro --pseudo-realtime -C -r $TRACES/tls/missing-intermediate.pcap %INPUT"
# @TEST-EXEC: btest-bg-wait 20
# @TEST-EXEC: cat manager-1/ssl*.log > ssl.log
# @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-remove-file-ids btest-diff ssl.log
#
redef Log::default_rotation_interval = 0secs;
@TEST-START-FILE cluster-layout.bro
redef Cluster::nodes = {
["manager-1"] = [$node_type=Cluster::MANAGER, $ip=127.0.0.1, $p=37757/tcp, $workers=set("worker-1", "worker-2")],
["proxy-1"] = [$node_type=Cluster::PROXY, $ip=127.0.0.1, $p=37758/tcp, $manager="manager-1", $workers=set("worker-1", "worker-2")],
["proxy-2"] = [$node_type=Cluster::PROXY, $ip=127.0.0.1, $p=37759/tcp, $manager="manager-1", $workers=set("worker-2")],
["worker-1"] = [$node_type=Cluster::WORKER, $ip=127.0.0.1, $p=37760/tcp, $manager="manager-1", $proxy="proxy-1", $interface="eth0"],
["worker-2"] = [$node_type=Cluster::WORKER, $ip=127.0.0.1, $p=37761/tcp, $manager="manager-1", $proxy="proxy-1", $interface="eth1"],
};
@TEST-END-FILE
event terminate_me() {
terminate();
}
event remote_connection_closed(p: event_peer) {
schedule 1sec { terminate_me() };
}
@load base/frameworks/cluster
@load protocols/ssl/validate-certs.bro

4
testing/btest/scripts/policy/protocols/ssl/validate-certs-no-cache.bro
View file

@ -1,5 +1,5 @@
# @TEST-EXEC: bro -C -r $TRACES/tls/missing-intermediate.pcap %INPUT
# @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-remove-x509-names btest-diff ssl.log
# @TEST-EXEC: bro -C -r $TRACES/tls/missing-intermediate.pcap $SCRIPTS/external-ca-list.bro %INPUT
# @TEST-EXEC: TEST_DIFF_CANONIFIER="$SCRIPTS/diff-remove-x509-names | $SCRIPTS/diff-remove-timestamps" btest-diff ssl.log
@load protocols/ssl/validate-certs.bro

6
testing/btest/scripts/policy/protocols/ssl/validate-certs.bro
View file

@ -1,7 +1,7 @@
# @TEST-EXEC: bro -r $TRACES/tls/tls-expired-cert.trace %INPUT
# @TEST-EXEC: bro -r $TRACES/tls/tls-expired-cert.trace $SCRIPTS/external-ca-list.bro %INPUT
# @TEST-EXEC: cat ssl.log > ssl-all.log
# @TEST-EXEC: bro -C -r $TRACES/tls/missing-intermediate.pcap %INPUT
# @TEST-EXEC: bro -C -r $TRACES/tls/missing-intermediate.pcap $SCRIPTS/external-ca-list.bro %INPUT
# @TEST-EXEC: cat ssl.log >> ssl-all.log
# @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-remove-x509-names btest-diff ssl-all.log
# @TEST-EXEC: TEST_DIFF_CANONIFIER="$SCRIPTS/diff-remove-x509-names | $SCRIPTS/diff-remove-timestamps" btest-diff ssl-all.log
@load protocols/ssl/validate-certs.bro

12
testing/btest/scripts/policy/protocols/ssl/validate-ocsp.bro
View file

@ -1,10 +1,10 @@
# @TEST-EXEC: bro -C -r $TRACES/tls/ocsp-stapling.trace %INPUT
# @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-remove-x509-names btest-diff ssl.log
# @TEST-EXEC: bro -C -r $TRACES/tls/ocsp-stapling-twimg.trace %INPUT
# @TEST-EXEC: bro $SCRIPTS/external-ca-list.bro -C -r $TRACES/tls/ocsp-stapling.trace %INPUT
# @TEST-EXEC: TEST_DIFF_CANONIFIER="$SCRIPTS/diff-remove-x509-names | $SCRIPTS/diff-remove-timestamps" btest-diff ssl.log
# @TEST-EXEC: bro $SCRIPTS/external-ca-list.bro -C -r $TRACES/tls/ocsp-stapling-twimg.trace %INPUT
# @TEST-EXEC: mv ssl.log ssl-twimg.log
# @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-remove-x509-names btest-diff ssl-twimg.log
# @TEST-EXEC: bro -C -r $TRACES/tls/ocsp-stapling-digicert.trace %INPUT
# @TEST-EXEC: TEST_DIFF_CANONIFIER="$SCRIPTS/diff-remove-x509-names | $SCRIPTS/diff-remove-timestamps" btest-diff ssl-twimg.log
# @TEST-EXEC: bro $SCRIPTS/external-ca-list.bro -C -r $TRACES/tls/ocsp-stapling-digicert.trace %INPUT
# @TEST-EXEC: mv ssl.log ssl-digicert.log
# @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-remove-x509-names btest-diff ssl-digicert.log
# @TEST-EXEC: TEST_DIFF_CANONIFIER="$SCRIPTS/diff-remove-x509-names | $SCRIPTS/diff-remove-timestamps" btest-diff ssl-digicert.log
@load protocols/ssl/validate-ocsp