mirror of
https://github.com/zeek/zeek.git
synced 2025-10-08 17:48:21 +00:00
Fixing tests.
Part of this involves making the file-analysis tests independent of specific hash values. I've done that only partially though.
This commit is contained in:
Robin Sommer
parent
7b50f97d39
commit
4ccd6d76fd
48 changed files with 294 additions and 197 deletions
|
|
@ -3,19 +3,19 @@
|
|||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path loaded_scripts
|
||||
#open 2013-05-15-23-01-21
|
||||
#open 2013-05-17-03-57-47
|
||||
#fields name
|
||||
#types string
|
||||
scripts/base/init-bare.bro
|
||||
build/src/base/const.bif.bro
|
||||
build/src/base/types.bif.bro
|
||||
build/src/base/strings.bif.bro
|
||||
build/src/base/bro.bif.bro
|
||||
build/src/base/reporter.bif.bro
|
||||
build/src/base/event.bif.bro
|
||||
build/scripts/base/bif/const.bif.bro
|
||||
build/scripts/base/bif/types.bif.bro
|
||||
build/scripts/base/bif/strings.bif.bro
|
||||
build/scripts/base/bif/bro.bif.bro
|
||||
build/scripts/base/bif/reporter.bif.bro
|
||||
build/scripts/base/bif/event.bif.bro
|
||||
scripts/base/frameworks/logging/__load__.bro
|
||||
scripts/base/frameworks/logging/main.bro
|
||||
build/src/base/logging.bif.bro
|
||||
build/scripts/base/bif/logging.bif.bro
|
||||
scripts/base/frameworks/logging/postprocessors/__load__.bro
|
||||
scripts/base/frameworks/logging/postprocessors/scp.bro
|
||||
scripts/base/frameworks/logging/postprocessors/sftp.bro
|
||||
|
|
@ -26,15 +26,65 @@ scripts/base/init-bare.bro
|
|||
scripts/base/frameworks/logging/writers/none.bro
|
||||
scripts/base/frameworks/input/__load__.bro
|
||||
scripts/base/frameworks/input/main.bro
|
||||
build/src/base/input.bif.bro
|
||||
build/scripts/base/bif/input.bif.bro
|
||||
scripts/base/frameworks/input/readers/ascii.bro
|
||||
scripts/base/frameworks/input/readers/raw.bro
|
||||
scripts/base/frameworks/input/readers/benchmark.bro
|
||||
scripts/base/frameworks/input/readers/binary.bro
|
||||
scripts/base/frameworks/input/readers/sqlite.bro
|
||||
scripts/base/frameworks/analyzer/__load__.bro
|
||||
scripts/base/frameworks/analyzer/main.bro
|
||||
build/scripts/base/bif/analyzer.bif.bro
|
||||
scripts/base/frameworks/file-analysis/__load__.bro
|
||||
scripts/base/frameworks/file-analysis/main.bro
|
||||
build/src/base/file_analysis.bif.bro
|
||||
build/scripts/base/bif/file_analysis.bif.bro
|
||||
build/scripts/base/bif/plugins/__load__.bro
|
||||
build/scripts/base/bif/plugins/Bro_ARP.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_AYIYA.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_BackDoor.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_BitTorrent.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_ConnSize.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_DCE_RPC.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_DHCP.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_DNS.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_FTP.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_FTP.functions.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_File.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_Finger.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_GTPv1.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_Gnutella.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_HTTP.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_HTTP.functions.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_ICMP.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_IRC.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_Ident.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_InterConn.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_Login.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_Login.functions.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_MIME.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_Modbus.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_NCP.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_NTP.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_NetBIOS.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_NetBIOS.functions.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_NetFlow.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_PIA.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_POP3.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_RPC.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_SMB.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_SMTP.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_SMTP.functions.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_SOCKS.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_SSH.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_SSL.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_SSL.functions.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_SteppingStone.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_Syslog.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_TCP.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_TCP.functions.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_Teredo.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_UDP.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_ZIP.events.bif.bro
|
||||
scripts/policy/misc/loaded-scripts.bro
|
||||
scripts/base/utils/paths.bro
|
||||
#close 2013-05-15-23-01-21
|
||||
#close 2013-05-17-03-57-47
|
||||
|
|
|
|||
|
|
@ -3,19 +3,19 @@
|
|||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path loaded_scripts
|
||||
#open 2013-05-16-00-19-22
|
||||
#open 2013-05-17-03-58-48
|
||||
#fields name
|
||||
#types string
|
||||
scripts/base/init-bare.bro
|
||||
build/src/base/const.bif.bro
|
||||
build/src/base/types.bif.bro
|
||||
build/src/base/strings.bif.bro
|
||||
build/src/base/bro.bif.bro
|
||||
build/src/base/reporter.bif.bro
|
||||
build/src/base/event.bif.bro
|
||||
build/scripts/base/bif/const.bif.bro
|
||||
build/scripts/base/bif/types.bif.bro
|
||||
build/scripts/base/bif/strings.bif.bro
|
||||
build/scripts/base/bif/bro.bif.bro
|
||||
build/scripts/base/bif/reporter.bif.bro
|
||||
build/scripts/base/bif/event.bif.bro
|
||||
scripts/base/frameworks/logging/__load__.bro
|
||||
scripts/base/frameworks/logging/main.bro
|
||||
build/src/base/logging.bif.bro
|
||||
build/scripts/base/bif/logging.bif.bro
|
||||
scripts/base/frameworks/logging/postprocessors/__load__.bro
|
||||
scripts/base/frameworks/logging/postprocessors/scp.bro
|
||||
scripts/base/frameworks/logging/postprocessors/sftp.bro
|
||||
|
|
@ -26,15 +26,65 @@ scripts/base/init-bare.bro
|
|||
scripts/base/frameworks/logging/writers/none.bro
|
||||
scripts/base/frameworks/input/__load__.bro
|
||||
scripts/base/frameworks/input/main.bro
|
||||
build/src/base/input.bif.bro
|
||||
build/scripts/base/bif/input.bif.bro
|
||||
scripts/base/frameworks/input/readers/ascii.bro
|
||||
scripts/base/frameworks/input/readers/raw.bro
|
||||
scripts/base/frameworks/input/readers/benchmark.bro
|
||||
scripts/base/frameworks/input/readers/binary.bro
|
||||
scripts/base/frameworks/input/readers/sqlite.bro
|
||||
scripts/base/frameworks/analyzer/__load__.bro
|
||||
scripts/base/frameworks/analyzer/main.bro
|
||||
build/scripts/base/bif/analyzer.bif.bro
|
||||
scripts/base/frameworks/file-analysis/__load__.bro
|
||||
scripts/base/frameworks/file-analysis/main.bro
|
||||
build/src/base/file_analysis.bif.bro
|
||||
build/scripts/base/bif/file_analysis.bif.bro
|
||||
build/scripts/base/bif/plugins/__load__.bro
|
||||
build/scripts/base/bif/plugins/Bro_ARP.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_AYIYA.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_BackDoor.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_BitTorrent.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_ConnSize.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_DCE_RPC.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_DHCP.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_DNS.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_FTP.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_FTP.functions.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_File.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_Finger.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_GTPv1.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_Gnutella.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_HTTP.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_HTTP.functions.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_ICMP.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_IRC.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_Ident.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_InterConn.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_Login.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_Login.functions.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_MIME.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_Modbus.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_NCP.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_NTP.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_NetBIOS.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_NetBIOS.functions.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_NetFlow.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_PIA.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_POP3.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_RPC.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_SMB.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_SMTP.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_SMTP.functions.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_SOCKS.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_SSH.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_SSL.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_SSL.functions.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_SteppingStone.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_Syslog.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_TCP.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_TCP.functions.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_Teredo.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_UDP.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_ZIP.events.bif.bro
|
||||
scripts/base/init-default.bro
|
||||
scripts/base/utils/site.bro
|
||||
scripts/base/utils/patterns.bro
|
||||
|
|
@ -141,4 +191,4 @@ scripts/base/init-default.bro
|
|||
scripts/base/protocols/syslog/main.bro
|
||||
scripts/base/misc/find-checksum-offloading.bro
|
||||
scripts/policy/misc/loaded-scripts.bro
|
||||
#close 2013-05-16-00-19-22
|
||||
#close 2013-05-17-03-58-48
|
||||
|
|
|
|||
|
|
@ -109,17 +109,6 @@ Notices
|
|||
|
||||
Configuration Changes
|
||||
#####################
|
||||
Port Analysis
|
||||
^^^^^^^^^^^^^
|
||||
Loading this script makes the following changes to :bro:see:`dpd_config`.
|
||||
|
||||
SSL::
|
||||
|
||||
[ports={
|
||||
443/tcp,
|
||||
562/tcp
|
||||
}]
|
||||
|
||||
Packet Filter
|
||||
^^^^^^^^^^^^^
|
||||
Loading this script makes the following changes to :bro:see:`capture_filters`.
|
||||
|
|
|
|||
|
|
@ -1,11 +1,11 @@
|
|||
FILE_NEW
|
||||
sidhzrR4IT8, 0, 0
|
||||
5LcdtqrLA97, 0, 0
|
||||
FILE_BOF_BUFFER
|
||||
The Nationa
|
||||
MIME_TYPE
|
||||
text/x-pascal
|
||||
FILE_STATE_REMOVE
|
||||
sidhzrR4IT8, 16557, 0
|
||||
5LcdtqrLA97, 16557, 0
|
||||
[orig_h=141.142.228.5, orig_p=50737/tcp, resp_h=141.142.192.162, resp_p=38141/tcp]
|
||||
source: FTP_DATA
|
||||
MD5: 7192a8075196267203adb3dfaa5c908d
|
||||
|
|
|
|||
|
|
@ -1 +1 @@
|
|||
555523 7gZBKVUgy4l-file0
|
||||
555523 file-0
|
||||
|
|
|
|||
|
|
@ -1,19 +1,19 @@
|
|||
FILE_NEW
|
||||
oDwT1BbzjM1, 0, 0
|
||||
Cvu8OAp0WEd, 0, 0
|
||||
MIME_TYPE
|
||||
application/x-dosexec
|
||||
FILE_STATE_REMOVE
|
||||
oDwT1BbzjM1, 1022920, 0
|
||||
Cvu8OAp0WEd, 1022920, 0
|
||||
[orig_h=192.168.72.14, orig_p=3254/tcp, resp_h=65.54.95.206, resp_p=80/tcp]
|
||||
total bytes: 1022920
|
||||
source: HTTP
|
||||
FILE_NEW
|
||||
oDwT1BbzjM1, 0, 0
|
||||
Cvu8OAp0WEd, 0, 0
|
||||
MIME_TYPE
|
||||
application/octet-stream
|
||||
FILE_TIMEOUT
|
||||
FILE_STATE_REMOVE
|
||||
oDwT1BbzjM1, 206024, 0
|
||||
Cvu8OAp0WEd, 206024, 0
|
||||
[orig_h=192.168.72.14, orig_p=3257/tcp, resp_h=65.54.95.14, resp_p=80/tcp]
|
||||
total bytes: 1022920
|
||||
source: HTTP
|
||||
|
|
|
|||
|
|
@ -1 +1 @@
|
|||
1022920 oDwT1BbzjM1-file0
|
||||
1022920 file-0
|
||||
|
|
|
|||
|
|
@ -1,10 +1,10 @@
|
|||
FILE_NEW
|
||||
uHS14uhRKGe, 0, 0
|
||||
me4WAjZH0Ik, 0, 0
|
||||
MIME_TYPE
|
||||
application/octet-stream
|
||||
FILE_OVER_NEW_CONNECTION
|
||||
FILE_STATE_REMOVE
|
||||
uHS14uhRKGe, 498702, 0
|
||||
me4WAjZH0Ik, 498702, 0
|
||||
[orig_h=10.45.179.94, orig_p=19950/tcp, resp_h=129.174.93.170, resp_p=80/tcp]
|
||||
[orig_h=10.45.179.94, orig_p=19953/tcp, resp_h=129.174.93.170, resp_p=80/tcp]
|
||||
total bytes: 498668
|
||||
|
|
|
|||
|
|
@ -1 +1 @@
|
|||
498668 uHS14uhRKGe-file0
|
||||
498668 file-0
|
||||
|
|
|
|||
|
Before Width: | Height: | Size: 94 B After Width: | Height: | Size: 94 B |
|
Before Width: | Height: | Size: 2.3 KiB After Width: | Height: | Size: 2.3 KiB |
|
Before Width: | Height: | Size: 27 KiB After Width: | Height: | Size: 27 KiB |
|
|
@ -3,19 +3,19 @@
|
|||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path ftp
|
||||
#open 2013-04-12-16-32-25
|
||||
#open 2013-05-18-00-48-19
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p user password command arg mime_type file_size reply_code reply_msg tags data_channel.passive data_channel.orig_h data_channel.resp_h data_channel.resp_p extraction_file
|
||||
#types time string addr port addr port string string string string string count count string table[string] bool addr addr port string
|
||||
1329843175.680248 UWkUyAuUGXf 141.142.220.235 50003 199.233.217.249 21 anonymous test PASV - - - 227 Entering Passive Mode (199,233,217,249,221,90) (empty) T 141.142.220.235 199.233.217.249 56666 -
|
||||
1329843175.791528 UWkUyAuUGXf 141.142.220.235 50003 199.233.217.249 21 anonymous test LIST - - - 226 Transfer complete. (empty) - - - - -
|
||||
1329843179.815947 UWkUyAuUGXf 141.142.220.235 50003 199.233.217.249 21 anonymous test PASV - - - 227 Entering Passive Mode (199,233,217,249,221,91) (empty) T 141.142.220.235 199.233.217.249 56667 -
|
||||
1329843193.984222 arKYeMETxOg 141.142.220.235 37604 199.233.217.249 56666 <ftp-data> - - - - - - - (empty) - - - - ftp-item-Rqjkzoroau4-0.dat
|
||||
1329843193.984222 k6kgXLOoSKl 141.142.220.235 59378 199.233.217.249 56667 <ftp-data> - - - - - - - (empty) - - - - ftp-item-BTsa70Ua9x7-1.dat
|
||||
1329843193.984222 arKYeMETxOg 141.142.220.235 37604 199.233.217.249 56666 <ftp-data> - - - - - - - (empty) - - - - ftp-item-pVhQhhFsB2b-0.dat
|
||||
1329843193.984222 k6kgXLOoSKl 141.142.220.235 59378 199.233.217.249 56667 <ftp-data> - - - - - - - (empty) - - - - ftp-item-fFCPkV1sEsc-1.dat
|
||||
1329843179.926563 UWkUyAuUGXf 141.142.220.235 50003 199.233.217.249 21 anonymous test RETR ftp://199.233.217.249/./robots.txt text/plain 77 226 Transfer complete. (empty) - - - - -
|
||||
1329843194.040188 UWkUyAuUGXf 141.142.220.235 50003 199.233.217.249 21 anonymous test PORT 141,142,220,235,131,46 - - 200 PORT command successful. (empty) F 199.233.217.249 141.142.220.235 33582 -
|
||||
1329843194.095782 UWkUyAuUGXf 141.142.220.235 50003 199.233.217.249 21 anonymous test LIST - - - 226 Transfer complete. (empty) - - - - -
|
||||
1329843197.672179 UWkUyAuUGXf 141.142.220.235 50003 199.233.217.249 21 anonymous test PORT 141,142,220,235,147,203 - - 200 PORT command successful. (empty) F 199.233.217.249 141.142.220.235 37835 -
|
||||
1329843199.968212 nQcgTWjvg4c 199.233.217.249 61920 141.142.220.235 33582 <ftp-data> - - - - - - - (empty) - - - - ftp-item-VLQvJybrm38-2.dat
|
||||
1329843199.968212 nQcgTWjvg4c 199.233.217.249 61920 141.142.220.235 33582 <ftp-data> - - - - - - - (empty) - - - - ftp-item-g3zS3MuJFh-2.dat
|
||||
1329843197.727769 UWkUyAuUGXf 141.142.220.235 50003 199.233.217.249 21 anonymous test RETR ftp://199.233.217.249/./robots.txt text/plain 77 226 Transfer complete. (empty) - - - - -
|
||||
1329843200.079930 j4u32Pc5bif 199.233.217.249 61918 141.142.220.235 37835 <ftp-data> - - - - - - - (empty) - - - - ftp-item-zrfwSs9K1yk-3.dat
|
||||
#close 2013-04-12-16-32-25
|
||||
1329843200.079930 j4u32Pc5bif 199.233.217.249 61918 141.142.220.235 37835 <ftp-data> - - - - - - - (empty) - - - - ftp-item-lMf4UWRkEO5-3.dat
|
||||
#close 2013-05-18-00-48-19
|
||||
|
|
|
|||
|
|
@ -3,8 +3,8 @@
|
|||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path http
|
||||
#open 2013-03-22-14-38-28
|
||||
#open 2013-05-17-23-19-09
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied mime_type md5 extraction_file
|
||||
#types time string addr port addr port count string string string string string count count count string count string string table[enum] string string table[string] string string string
|
||||
1128727435.634189 arKYeMETxOg 141.42.64.125 56730 125.190.109.199 80 1 GET www.icir.org / - Wget/1.10 0 9130 200 OK - - - (empty) - - - text/html - http-item-BFymS6bFgT3-0.dat
|
||||
#close 2013-03-22-14-38-28
|
||||
1128727435.634189 arKYeMETxOg 141.42.64.125 56730 125.190.109.199 80 1 GET www.icir.org / - Wget/1.10 0 9130 200 OK - - - (empty) - - - text/html - http-item-54zlJFqn0x6-0.dat
|
||||
#close 2013-05-17-23-19-09
|
||||
|
|
|
|||
|
|
@ -3,11 +3,11 @@
|
|||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path irc
|
||||
#open 2013-03-27-18-49-16
|
||||
#open 2013-05-17-23-19-21
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p nick user command value addl dcc_file_name dcc_file_size dcc_mime_type extraction_file
|
||||
#types time string addr port addr port string string string string string string count string string
|
||||
1311189164.119437 UWkUyAuUGXf 192.168.1.77 57640 66.198.80.67 6667 - - NICK bloed - - - - -
|
||||
1311189164.119437 UWkUyAuUGXf 192.168.1.77 57640 66.198.80.67 6667 bloed - USER sdkfje sdkfje Montreal.QC.CA.Undernet.org dkdkrwq - - - -
|
||||
1311189174.474127 UWkUyAuUGXf 192.168.1.77 57640 66.198.80.67 6667 bloed sdkfje JOIN #easymovies (empty) - - - -
|
||||
1311189316.326025 UWkUyAuUGXf 192.168.1.77 57640 66.198.80.67 6667 bloed sdkfje DCC #easymovies (empty) ladyvampress-default(2011-07-07)-OS.zip 42208 FAKE_MIME irc-dcc-item-wqKMAamJVSb-0.dat
|
||||
#close 2013-03-27-18-49-16
|
||||
1311189316.326025 UWkUyAuUGXf 192.168.1.77 57640 66.198.80.67 6667 bloed sdkfje DCC #easymovies (empty) ladyvampress-default(2011-07-07)-OS.zip 42208 FAKE_MIME irc-dcc-item-A3OSdqG9zvk-0.dat
|
||||
#close 2013-05-17-23-19-21
|
||||
|
|
|
|||
|
|
@ -3,10 +3,10 @@
|
|||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path smtp_entities
|
||||
#open 2013-03-26-20-43-14
|
||||
#open 2013-05-17-23-19-41
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth filename content_len mime_type md5 extraction_file excerpt
|
||||
#types time string addr port addr port count string count string string string string
|
||||
1254722770.692743 arKYeMETxOg 10.10.1.4 1470 74.53.140.153 25 1 - 79 text/plain - smtp-entity-cwR7l6Zctxb-0.dat (empty)
|
||||
1254722770.692743 arKYeMETxOg 10.10.1.4 1470 74.53.140.153 25 1 - 79 text/plain - smtp-entity-mR3f2AAKo11-0.dat (empty)
|
||||
1254722770.692743 arKYeMETxOg 10.10.1.4 1470 74.53.140.153 25 1 - 1918 text/html - - (empty)
|
||||
1254722770.692804 arKYeMETxOg 10.10.1.4 1470 74.53.140.153 25 1 NEWS.txt 10823 text/plain - smtp-entity-Ltd7QO7jEv3-1.dat (empty)
|
||||
#close 2013-03-26-20-43-14
|
||||
1254722770.692804 arKYeMETxOg 10.10.1.4 1470 74.53.140.153 25 1 NEWS.txt 10823 text/plain - smtp-entity-ZNp0KBSLByc-1.dat (empty)
|
||||
#close 2013-05-17-23-19-41
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
# @TEST-EXEC: bro -b -r $TRACES/tunnels/false-teredo.pcap base/frameworks/dpd protocols/conn/known-services Tunnel::delay_teredo_confirmation=T "Site::local_nets+={192.168.1.0/24}"
|
||||
# @TEST-EXEC: bro -r $TRACES/tunnels/false-teredo.pcap base/frameworks/dpd protocols/conn/known-services Tunnel::delay_teredo_confirmation=T "Site::local_nets+={192.168.1.0/24}"
|
||||
# @TEST-EXEC: test ! -e known_services.log
|
||||
# @TEST-EXEC: bro -b -r $TRACES/tunnels/false-teredo.pcap base/frameworks/dpd protocols/conn/known-services Tunnel::delay_teredo_confirmation=F "Site::local_nets+={192.168.1.0/24}"
|
||||
# @TEST-EXEC: bro -r $TRACES/tunnels/false-teredo.pcap base/frameworks/dpd protocols/conn/known-services Tunnel::delay_teredo_confirmation=F "Site::local_nets+={192.168.1.0/24}"
|
||||
# @TEST-EXEC: btest-diff known_services.log
|
||||
|
||||
# The first case using Tunnel::delay_teredo_confirmation=T doesn't produce
|
||||
|
|
|
|||
|
|
@ -1,13 +1,15 @@
|
|||
# @TEST-EXEC: bro -r $TRACES/http/get.trace $SCRIPTS/file-analysis-test.bro %INPUT >get.out
|
||||
# @TEST-EXEC: bro -r $TRACES/http/get-gzip.trace $SCRIPTS/file-analysis-test.bro %INPUT >get-gzip.out
|
||||
# @TEST-EXEC: bro -r $TRACES/http/get.trace $SCRIPTS/file-analysis-test.bro %INPUT c=1 >get.out
|
||||
# @TEST-EXEC: bro -r $TRACES/http/get-gzip.trace $SCRIPTS/file-analysis-test.bro %INPUT c=2 >get-gzip.out
|
||||
# @TEST-EXEC: btest-diff get.out
|
||||
# @TEST-EXEC: btest-diff get-gzip.out
|
||||
# @TEST-EXEC: btest-diff Cx92a0ym5R8-file
|
||||
# @TEST-EXEC: btest-diff kg59rqyYxN-file
|
||||
# @TEST-EXEC: btest-diff 1-file
|
||||
# @TEST-EXEC: btest-diff 2-file
|
||||
|
||||
redef test_file_analysis_source = "HTTP";
|
||||
|
||||
global c = 0 &redef;
|
||||
|
||||
redef test_get_file_name = function(f: fa_file): string
|
||||
{
|
||||
return fmt("%s-file", f$id);
|
||||
return fmt("%d-file", c);
|
||||
};
|
||||
|
|
|
|||
|
|
@ -1,16 +1,16 @@
|
|||
# @TEST-EXEC: bro -r $TRACES/http/206_example_a.pcap $SCRIPTS/file-analysis-test.bro %INPUT >a.out
|
||||
# @TEST-EXEC: btest-diff a.out
|
||||
# @TEST-EXEC: wc -c 7gZBKVUgy4l-file0 | sed 's/^[ \t]* //g' >a.size
|
||||
# @TEST-EXEC: wc -c file-0 | sed 's/^[ \t]* //g' >a.size
|
||||
# @TEST-EXEC: btest-diff a.size
|
||||
|
||||
# @TEST-EXEC: bro -r $TRACES/http/206_example_b.pcap $SCRIPTS/file-analysis-test.bro %INPUT >b.out
|
||||
# @TEST-EXEC: btest-diff b.out
|
||||
# @TEST-EXEC: wc -c oDwT1BbzjM1-file0 | sed 's/^[ \t]* //g' >b.size
|
||||
# @TEST-EXEC: wc -c file-0 | sed 's/^[ \t]* //g' >b.size
|
||||
# @TEST-EXEC: btest-diff b.size
|
||||
|
||||
# @TEST-EXEC: bro -r $TRACES/http/206_example_c.pcap $SCRIPTS/file-analysis-test.bro %INPUT >c.out
|
||||
# @TEST-EXEC: btest-diff c.out
|
||||
# @TEST-EXEC: wc -c uHS14uhRKGe-file0 | sed 's/^[ \t]* //g' >c.size
|
||||
# @TEST-EXEC: wc -c file-0 | sed 's/^[ \t]* //g' >c.size
|
||||
# @TEST-EXEC: btest-diff c.size
|
||||
|
||||
global cnt: count = 0;
|
||||
|
|
@ -19,7 +19,7 @@ redef test_file_analysis_source = "HTTP";
|
|||
|
||||
redef test_get_file_name = function(f: fa_file): string
|
||||
{
|
||||
local rval: string = fmt("%s-file%d", f$id, cnt);
|
||||
local rval: string = fmt("file-%d", cnt);
|
||||
++cnt;
|
||||
return rval;
|
||||
};
|
||||
|
|
|
|||
|
|
@ -1,14 +1,16 @@
|
|||
# @TEST-EXEC: bro -r $TRACES/http/pipelined-requests.trace $SCRIPTS/file-analysis-test.bro %INPUT >out
|
||||
# @TEST-EXEC: btest-diff out
|
||||
# @TEST-EXEC: btest-diff aFQKI8SPOL2-file
|
||||
# @TEST-EXEC: btest-diff CCU3vUEr06l-file
|
||||
# @TEST-EXEC: btest-diff HCzA0dVwDPj-file
|
||||
# @TEST-EXEC: btest-diff a1Zu1fteVEf-file
|
||||
# @TEST-EXEC: btest-diff xXlF7wFdsR-file
|
||||
# @TEST-EXEC: btest-diff 1-file
|
||||
# @TEST-EXEC: btest-diff 2-file
|
||||
# @TEST-EXEC: btest-diff 3-file
|
||||
# @TEST-EXEC: btest-diff 4-file
|
||||
# @TEST-EXEC: btest-diff 5-file
|
||||
|
||||
redef test_file_analysis_source = "HTTP";
|
||||
|
||||
global c = 0;
|
||||
|
||||
redef test_get_file_name = function(f: fa_file): string
|
||||
{
|
||||
return fmt("%s-file", f$id);
|
||||
return fmt("%d-file", ++c);
|
||||
};
|
||||
|
|
|
|||
|
|
@ -1,11 +1,13 @@
|
|||
# @TEST-EXEC: bro -r $TRACES/http/post.trace $SCRIPTS/file-analysis-test.bro %INPUT >out
|
||||
# @TEST-EXEC: btest-diff out
|
||||
# @TEST-EXEC: btest-diff v5HLI7MxPQh-file
|
||||
# @TEST-EXEC: btest-diff PZS1XGHkIf1-file
|
||||
# @TEST-EXEC: btest-diff 1-file
|
||||
# @TEST-EXEC: btest-diff 2-file
|
||||
|
||||
redef test_file_analysis_source = "HTTP";
|
||||
|
||||
global c = 0;
|
||||
|
||||
redef test_get_file_name = function(f: fa_file): string
|
||||
{
|
||||
return fmt("%s-file", f$id);
|
||||
return fmt("%d-file", ++c);
|
||||
};
|
||||
|
|
|
|||
|
|
@ -3,10 +3,14 @@
|
|||
# @TEST-EXEC: bro -r $TRACES/ftp/ipv4.trace %INPUT
|
||||
# @TEST-EXEC: btest-diff conn.log
|
||||
# @TEST-EXEC: btest-diff ftp.log
|
||||
# @TEST-EXEC: btest-diff ftp-item-Rqjkzoroau4-0.dat
|
||||
# @TEST-EXEC: btest-diff ftp-item-BTsa70Ua9x7-1.dat
|
||||
# @TEST-EXEC: btest-diff ftp-item-VLQvJybrm38-2.dat
|
||||
# @TEST-EXEC: btest-diff ftp-item-zrfwSs9K1yk-3.dat
|
||||
# @TEST-EXEC: mv ftp-item-*-0.dat ftp-item-0.dat
|
||||
# @TEST-EXEC: mv ftp-item-*-1.dat ftp-item-1.dat
|
||||
# @TEST-EXEC: mv ftp-item-*-2.dat ftp-item-2.dat
|
||||
# @TEST-EXEC: mv ftp-item-*-3.dat ftp-item-3.dat
|
||||
# @TEST-EXEC: btest-diff ftp-item-0.dat
|
||||
# @TEST-EXEC: btest-diff ftp-item-1.dat
|
||||
# @TEST-EXEC: btest-diff ftp-item-2.dat
|
||||
# @TEST-EXEC: btest-diff ftp-item-3.dat
|
||||
|
||||
redef FTP::logged_commands += {"LIST"};
|
||||
redef FTP::extract_file_types=/.*/;
|
||||
|
|
|
|||
|
|
@ -1,5 +1,6 @@
|
|||
# @TEST-EXEC: bro -C -r $TRACES/web.trace %INPUT
|
||||
# @TEST-EXEC: btest-diff http.log
|
||||
# @TEST-EXEC: btest-diff http-item-BFymS6bFgT3-0.dat
|
||||
# @TEST-EXEC: mv http-item-*.dat http-item.dat
|
||||
# @TEST-EXEC: btest-diff http-item.dat
|
||||
|
||||
redef HTTP::extract_file_types += /text\/html/;
|
||||
|
|
|
|||
|
|
@ -4,9 +4,10 @@
|
|||
|
||||
# @TEST-EXEC: bro -r $TRACES/irc-dcc-send.trace %INPUT
|
||||
# @TEST-EXEC: btest-diff irc.log
|
||||
# @TEST-EXEC: btest-diff irc-dcc-item-wqKMAamJVSb-0.dat
|
||||
# @TEST-EXEC: mv irc-dcc-item-*-0.dat irc-dcc-item.dat
|
||||
# @TEST-EXEC: btest-diff irc-dcc-item.dat
|
||||
# @TEST-EXEC: bro -r $TRACES/irc-dcc-send.trace %INPUT IRC::extraction_prefix="test"
|
||||
# @TEST-EXEC: test -e test-wqKMAamJVSb-0.dat
|
||||
# @TEST-EXEC: test -e test-*-0.dat
|
||||
|
||||
redef IRC::extract_file_types=/.*/;
|
||||
|
||||
|
|
|
|||
|
|
@ -1,10 +1,12 @@
|
|||
# @TEST-EXEC: bro -r $TRACES/smtp.trace %INPUT
|
||||
# @TEST-EXEC: btest-diff smtp_entities.log
|
||||
# @TEST-EXEC: btest-diff smtp-entity-cwR7l6Zctxb-0.dat
|
||||
# @TEST-EXEC: btest-diff smtp-entity-Ltd7QO7jEv3-1.dat
|
||||
# @TEST-EXEC: mv smtp-entity-*-0.dat smtp-entity-0.dat
|
||||
# @TEST-EXEC: mv smtp-entity-*-1.dat smtp-entity-1.dat
|
||||
# @TEST-EXEC: btest-diff smtp-entity-0.dat
|
||||
# @TEST-EXEC: btest-diff smtp-entity-1.dat
|
||||
# @TEST-EXEC: bro -r $TRACES/smtp.trace %INPUT SMTP::extraction_prefix="test"
|
||||
# @TEST-EXEC: test -e test-cwR7l6Zctxb-0.dat
|
||||
# @TEST-EXEC: test -e test-Ltd7QO7jEv3-1.dat
|
||||
# @TEST-EXEC: test -e test-*-0.dat
|
||||
# @TEST-EXEC: test -e test-*-1.dat
|
||||
|
||||
@load base/protocols/smtp
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue