Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-17 14:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Tweaking notice suppression disable and notice policy order tests.

Browse source 
They should be less sensitive to script-layer changes now.
This commit is contained in:
Jon Siwek 2011-10-14 10:47:32 -05:00
parent d84de52ee0
commit 556b88e322
4 changed files with 21 additions and 23 deletions
Download patch file Download diff file Expand all files Collapse all files

11
testing/btest/Baseline/scripts.base.frameworks.notice.default-policy-order/notice_policy.log
View file

@ -1,11 +0,0 @@
#separator \x09
#path notice_policy
#fields position priority result pred halt suppress_for
#types count count enum func bool interval
0 10 Notice::ACTION_NONE anonymous-function\x0a{ \x0areturn ((Notice::n$note in Notice::lookup_location_types));\x0a} F -
1 9 Notice::ACTION_NO_SUPPRESS anonymous-function\x0a{ \x0areturn ((Notice::n$note in Notice::not_suppressed_types));\x0a} F -
2 9 Notice::ACTION_NONE anonymous-function\x0a{ \x0areturn ((Notice::n$note in Notice::ignored_types));\x0a} T -
3 8 Notice::ACTION_EMAIL anonymous-function\x0a{ \x0areturn ((Notice::n$note in Notice::emailed_types));\x0a} F -
4 8 Notice::ACTION_ALARM anonymous-function\x0a{ \x0areturn ((Notice::n$note in Notice::alarmed_types));\x0a} F -
5 8 Notice::ACTION_NONE anonymous-function\x0a{ \x0aif (Notice::n$note in Notice::type_suppression_intervals) \x0a\x09{ \x0a\x09Notice::n$suppress_for = Notice::type_suppression_intervals[Notice::n$note];\x0a\x09return (T);\x0a\x09}\x0a\x0areturn (F);\x0a} F -
6 0 Notice::ACTION_LOG - F -

6
testing/btest/Baseline/scripts.base.frameworks.notice.suppression-disable/notice.log
View file

@ -1,6 +0,0 @@
#separator \x09
#path notice
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p note msg sub src dst p n peer_descr actions policy_items suppress_for dropped remote_location.country_code remote_location.region remote_location.city remote_location.latitude remote_location.longitude
#types time string addr port addr port enum string string addr addr port count string table table interval bool string string string double double
1317927277.508920 - - - - - Test_Notice test - - - - - bro Notice::ACTION_NO_SUPPRESS,Notice::ACTION_LOG 6,1 3600.000000 - - - - - -
1317927277.508920 - - - - - Test_Notice another test - - - - - bro Notice::ACTION_NO_SUPPRESS,Notice::ACTION_LOG 6,1 3600.000000 - - - - - -

12
testing/btest/scripts/base/frameworks/notice/default-policy-order.test
View file

@ -1,4 +1,10 @@
# This test checks that the default notice policy ordering is the same # This test checks that the default notice policy ordering does not
# as a known baseline. # change from run to run.
# @TEST-EXEC: bro -e '' # @TEST-EXEC: bro -e ''
# @TEST-EXEC: btest-diff notice_policy.log # @TEST-EXEC: mv notice_policy.log notice_policy.log.1
# @TEST-EXEC: bro -e ''
# @TEST-EXEC: mv notice_policy.log notice_policy.log.2
# @TEST-EXEC: bro -e ''
# @TEST-EXEC: mv notice_policy.log notice_policy.log.3
# @TEST-EXEC: diff notice_policy.log.1 notice_policy.log.2
# @TEST-EXEC: diff notice_policy.log.1 notice_policy.log.3

15
testing/btest/scripts/base/frameworks/notice/suppression-disable.bro
View file

@ -1,5 +1,6 @@
# @TEST-EXEC: bro -b %INPUT # @TEST-EXEC: bro -b %INPUT
# @TEST-EXEC: btest-diff notice.log # The "Test_Notice" should be logged twice
# @TEST-EXEC: test `grep Test_Notice notice.log | wc -l` -eq 2
@load base/frameworks/notice @load base/frameworks/notice
@ -9,8 +10,16 @@ redef enum Notice::Type += {
redef Notice::not_suppressed_types += { Test_Notice }; redef Notice::not_suppressed_types += { Test_Notice };
# The second notice needs to be scheduled due to how the notice framework
# uses the event queue.
event second_notice()
{
NOTICE([$note=Test_Notice, $msg="another test", $identifier="static"]);
}
event bro_init() event bro_init()
{ {
NOTICE([$note=Test_Notice, $msg="test", $identifier="static"]); NOTICE([$note=Test_Notice, $msg="test", $identifier="static"]);
NOTICE([$note=Test_Notice, $msg="another test", $identifier="static"]); schedule 1msec { second_notice() };
} }