Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-13 03:58:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Merge remote-tracking branch 'origin/master' into topic/johanna/netcontrol

Browse source
This commit is contained in:
Johanna Amann 2016-03-07 14:59:25 -08:00
commit 69b62be5d4
42 changed files with 459 additions and 238 deletions
Download patch file Download diff file Expand all files Collapse all files

4
testing/btest/scripts/base/protocols/http/http-bad-request-with-version.bro Normal file
View file

@ -0,0 +1,4 @@
# @TEST-EXEC: bro -Cr $TRACES/http/http-bad-request-with-version.trace %INPUT
# @TEST-EXEC: btest-diff http.log
# @TEST-EXEC: btest-diff weird.log

16
testing/btest/scripts/base/protocols/irc/events.test Normal file
View file

@ -0,0 +1,16 @@
# Test IRC events
# @TEST-EXEC: bro -r $TRACES/irc-dcc-send.trace %INPUT
# @TEST-EXEC: bro -r $TRACES/irc-basic.trace %INPUT
# @TEST-EXEC: bro -r $TRACES/irc-whitespace.trace %INPUT
# @TEST-EXEC: btest-diff .stdout
event irc_privmsg_message(c: connection, is_orig: bool, source: string, target: string, message: string)
{
print fmt("%s -> %s: %s", source, target, message);
}
event irc_quit_message(c: connection, is_orig: bool, nick: string, message: string)
{
print fmt("quit: %s (%s)", nick, message);
}

10
testing/btest/scripts/base/protocols/irc/privmsg.test
View file

@ -1,10 +0,0 @@
# Test the privmsg event
# @TEST-EXEC: bro -r $TRACES/irc-dcc-send.trace %INPUT
# @TEST-EXEC: btest-diff .stdout
event irc_privmsg_message(c: connection, is_orig: bool, source: string, target: string, message: string)
{
print fmt("%s -> %s: %s", source, target, message);
}

3
testing/btest/scripts/base/protocols/ssh/basic.test
View file

@ -1,4 +1,5 @@
# This tests some SSH connections and the output log.
# @TEST-EXEC: bro -r $TRACES/ssh/ssh.trace %INPUT
# @TEST-EXEC: btest-diff ssh.log
# @TEST-EXEC: btest-diff ssh.log
# @TEST-EXEC: btest-diff conn.log

19
testing/btest/scripts/policy/misc/dump-events.bro
View file

@ -1,7 +1,18 @@
# @TEST-EXEC: bro -r $TRACES/smtp.trace policy/misc/dump-events.bro >all-events.log
# @TEST-EXEC: bro -r $TRACES/smtp.trace policy/misc/dump-events.bro DumpEvents::include_args=F >all-events-no-args.log
# @TEST-EXEC: bro -r $TRACES/smtp.trace policy/misc/dump-events.bro DumpEvents::include=/smtp_/ >smtp-events.log
#
# @TEST-EXEC: bro -r $TRACES/smtp.trace policy/misc/dump-events.bro %INPUT >all-events.log
# @TEST-EXEC: bro -r $TRACES/smtp.trace policy/misc/dump-events.bro %INPUT DumpEvents::include_args=F >all-events-no-args.log
# @TEST-EXEC: bro -r $TRACES/smtp.trace policy/misc/dump-events.bro %INPUT DumpEvents::include=/smtp_/ >smtp-events.log
#
# @TEST-EXEC: btest-diff all-events.log
# @TEST-EXEC: btest-diff all-events-no-args.log
# @TEST-EXEC: btest-diff smtp-events.log
# There is some kind of race condition between the MD5 and SHA1 events, which are added
# by the SSL parser. Just remove MD5, this is not important for this test.
event file_over_new_connection(f: fa_file, c: connection, is_orig: bool) &priority=-5
{
if ( ! c?$ssl )
return;
Files::remove_analyzer(f, Files::ANALYZER_MD5);
}