Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-03 23:28:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge remote-tracking branch 'origin/master' into topic/seth/smb

Browse source 
# Conflicts:
#	scripts/site/local.bro
This commit is contained in:
Seth Hall 2016-06-14 15:35:05 -04:00
commit 56a24bdef6
80 changed files with 8168 additions and 458 deletions
Download patch file Download diff file Expand all files Collapse all files

64
testing/btest/scripts/base/frameworks/input/windows.bro Normal file
View file

@ -0,0 +1,64 @@
# Test windows linebreaks
# @TEST-EXEC: btest-bg-run bro bro -b %INPUT
# @TEST-EXEC: btest-bg-wait 10
# @TEST-EXEC: btest-diff out
redef exit_only_after_terminate = T;
@TEST-START-FILE input.log
#separator \x09
#path ssh
#fields b i e c p sn a d t iv s sc ss se vc ve ns
#types bool int enum count port subnet addr double time interval string table table table vector vector string
T -42 SSH::LOG 21 123 10.0.0.0/24 1.2.3.4 3.14 1315801931.273616 100.000000 hurz 2,4,1,3 CC,AA,BB EMPTY 10,20,30 EMPTY 4242
@TEST-END-FILE
@load base/protocols/ssh
global outfile: file;
redef InputAscii::empty_field = "EMPTY";
module A;
type Idx: record {
i: int;
};
type Val: record {
b: bool;
e: Log::ID;
c: count;
p: port;
sn: subnet;
a: addr;
d: double;
t: time;
iv: interval;
s: string;
ns: string;
sc: set[count];
ss: set[string];
se: set[string];
vc: vector of int;
ve: vector of int;
};
global servers: table[int] of Val = table();
event bro_init()
{
outfile = open("../out");
# first read in the old stuff into the table...
Input::add_table([$source="../input.log", $name="ssh", $idx=Idx, $val=Val, $destination=servers]);
}
event Input::end_of_data(name: string, source:string)
{
print outfile, servers;
print outfile, to_count(servers[-42]$ns); # try to actually use a string. If null-termination is wrong this will fail.
Input::remove("ssh");
close(outfile);
terminate();
}

29
testing/btest/scripts/base/frameworks/logging/ascii-double.bro Normal file
View file

@ -0,0 +1,29 @@
#
# @TEST-EXEC: bro -b %INPUT
# @TEST-EXEC: btest-diff test.log
#
# Make sure we do not write out scientific notation for doubles.
module Test;
export {
redef enum Log::ID += { LOG };
type Info: record {
d: double &log;
};
}
event bro_init()
{
Log::create_stream(Test::LOG, [$columns=Info]);
Log::write(Test::LOG, [$d=2153226000.0]);
Log::write(Test::LOG, [$d=2153226000.1]);
Log::write(Test::LOG, [$d=2153226000.123456789]);
Log::write(Test::LOG, [$d=1.0]);
Log::write(Test::LOG, [$d=1.1]);
Log::write(Test::LOG, [$d=1.123456789]);
Log::write(Test::LOG, [$d=1.1234]);
Log::write(Test::LOG, [$d=3.14e15]);
}

12
testing/btest/scripts/base/protocols/ftp/cwd-navigation.bro Normal file
View file

@ -0,0 +1,12 @@
# @TEST-EXEC: bro -r $TRACES/ftp/cwd-navigation.pcap >output.log %INPUT
# @TEST-EXEC: btest-diff conn.log
# @TEST-EXEC: btest-diff ftp.log
# @TEST-EXEC: btest-diff output.log
# Make sure we're tracking the CWD correctly.
event ftp_reply(c: connection, code: count, msg: string, cont_resp: bool) &priority=10
{
print "CWD", c$ftp$cwd;
}