Merge remote-tracking branch 'origin/master' into topic/johanna/dtls13

* origin/master: (35 commits)
  Update doc submodule [nomail] [skip ci]
  Updating submodule(s) [nomail]
  zeek.bif: Add log2() and ceil()
  Use the same rules as cmake submodule to reformat Zeek
  Update cmake submodule after reformat
  Fixup Val.h/Val.cc: Actually move ValFromJSON into zeek::detail
  Implement from_json bif
  Revert "Skip version.h by default for Zeek sources"
  BTest baseline updates for -O gen-C++
  updates to C++ maintenance scripts to better handle uncompilable BTests
  added ZEEK_REPORT_UNCOMPILABLE environment variable for "-O report-uncompilable"
  Skip version.h by default for Zeek sources
  core.network_time.broker: Test reliability improvement
  cluster/supervisor: Multi-logger awareness
  Bump zeek-archiver submodule
  ci: Add public-ecr-vacuum.sh
  Update doc submodule [nomail] [skip ci]
  generate-docs: Only update submodule pointer during scheduled builds
  BTest baseline updates for ZAM
  NTP: Detect out-of-order packets
  ...
This commit is contained in:
Johanna Amann 2023-05-10 13:02:08 +01:00
commit 527c0dc09f
239 changed files with 3023 additions and 1862 deletions

View file

@ -0,0 +1,12 @@
# @TEST-EXEC: zeek -b -C -r $TRACES/ntp/misordered-ntp.pcap %INPUT
# @TEST-EXEC: btest-diff ntp.log
# @TEST-EXEC: btest-diff conn.log
# @TEST-EXEC: btest-diff .stdout
@load base/protocols/conn
@load base/protocols/ntp
event ntp_message(c: connection, is_orig: bool, msg: NTP::Message)
{
print fmt("ntp_message %s -> %s:%d (%s)", c$id$orig_h, c$id$resp_h, c$id$resp_p, c$history);
}

View file

@ -0,0 +1,18 @@
# @TEST-DOC: Pcap contains 100 file transfers (read requests), force BPF filtering such that the responses aren't seen and we have state growth. Verify a low SMB::max_pending_messages triggers, logs a weird and that script-land message state is reset.
# @TEST-EXEC: zeek -b -C -r $TRACES/smb/smb2_100_small_files.pcap -f 'src port not 445 or tcp[tcpflags] & (tcp-syn|tcp-fin|tcp-rst) != 0' %INPUT >out
# @TEST-EXEC: btest-diff weird.log
# @TEST-EXEC: btest-diff out
@load base/protocols/smb
redef SMB::max_pending_messages = 20;
event smb2_discarded_messages_state(c: connection, request: string) &priority=10
{
print "smb2_discarded_messages_state before", request, |c$smb_state$pending_cmds|;
}
event smb2_discarded_messages_state(c: connection, request: string) &priority=-10
{
print "smb2_discarded_messages_state after", request, |c$smb_state$pending_cmds|;
}

View file

@ -0,0 +1,5 @@
# This tests that no error messages are output when a protocol violation occurs
# @TEST-EXEC: zeek -C -r $TRACES/tls/tls1.2-protocol-violation.pcap %INPUT
# @TEST-EXEC: test -f dpd.log
# @TEST-EXEC: btest-diff .stderr