From 727b7783f94d138e23026ece7424bfad7ca42229 Mon Sep 17 00:00:00 2001 From: Jon Siwek Date: Tue, 5 Jun 2012 15:17:27 -0500 Subject: [PATCH] Add AYIYA tunnel decapsulation unit test. --- .../btest/Baseline/core.tunnels.ayiya/conn.log | 15 +++++++++++++++ .../btest/Baseline/core.tunnels.ayiya/http.log | 10 ++++++++++ .../Baseline/core.tunnels.ayiya/tunnel.log | 11 +++++++++++ testing/btest/Traces/tunnels/ayiya3.trace | Bin 0 -> 13440 bytes testing/btest/core/tunnels/ayiya.test | 4 ++++ 5 files changed, 40 insertions(+) create mode 100644 testing/btest/Baseline/core.tunnels.ayiya/conn.log create mode 100644 testing/btest/Baseline/core.tunnels.ayiya/http.log create mode 100644 testing/btest/Baseline/core.tunnels.ayiya/tunnel.log create mode 100644 testing/btest/Traces/tunnels/ayiya3.trace create mode 100644 testing/btest/core/tunnels/ayiya.test diff --git a/testing/btest/Baseline/core.tunnels.ayiya/conn.log b/testing/btest/Baseline/core.tunnels.ayiya/conn.log new file mode 100644 index 0000000000..5c23b4c404 --- /dev/null +++ b/testing/btest/Baseline/core.tunnels.ayiya/conn.log @@ -0,0 +1,15 @@ +#separator \x09 +#set_separator , +#empty_field (empty) +#unset_field - +#path conn +#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes parents +#types time string addr port addr port enum string interval count count string bool count string count count count count table[string] +1257655301.595604 5OKnoww6xl4 2001:4978:f:4c::2 53382 2001:4860:b002::68 80 tcp http 2.101052 2981 4665 S1 - 0 ShADad 10 3605 11 5329 k6kgXLOoSKl +1257655296.585034 k6kgXLOoSKl 192.168.3.101 53859 216.14.98.22 5072 udp ayiya 20.879001 5129 6109 SF - 0 Dd 21 5717 13 6473 (empty) +1257655293.629048 UWkUyAuUGXf 192.168.3.101 53796 216.14.98.22 5072 udp ayiya - - - SHR - 0 d 0 0 1 176 (empty) +1257655296.585333 FrJExwHcSal :: 135 ff02::1:ff00:2 136 icmp - - - - OTH - 0 - 1 64 0 0 k6kgXLOoSKl +1257655293.629048 arKYeMETxOg 2001:4978:f:4c::1 128 2001:4978:f:4c::2 129 icmp - 23.834987 168 56 OTH - 0 - 3 312 1 104 UWkUyAuUGXf,k6kgXLOoSKl +1257655296.585188 TEfuqmmG4bh fe80::216:cbff:fe9a:4cb9 131 ff02::1:ff00:2 130 icmp - 0.919988 32 0 OTH - 0 - 2 144 0 0 k6kgXLOoSKl +1257655296.585151 j4u32Pc5bif fe80::216:cbff:fe9a:4cb9 131 ff02::2:f901:d225 130 icmp - 0.719947 32 0 OTH - 0 - 2 144 0 0 k6kgXLOoSKl +1257655296.585034 nQcgTWjvg4c fe80::216:cbff:fe9a:4cb9 131 ff02::1:ff9a:4cb9 130 icmp - 4.922880 32 0 OTH - 0 - 2 144 0 0 k6kgXLOoSKl diff --git a/testing/btest/Baseline/core.tunnels.ayiya/http.log b/testing/btest/Baseline/core.tunnels.ayiya/http.log new file mode 100644 index 0000000000..7cef1a1b8e --- /dev/null +++ b/testing/btest/Baseline/core.tunnels.ayiya/http.log @@ -0,0 +1,10 @@ +#separator \x09 +#set_separator , +#empty_field (empty) +#unset_field - +#path http +#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied mime_type md5 extraction_file +#types time string addr port addr port count string string string string string count count count string count string string table[enum] string string table[string] string string file +1257655301.652206 5OKnoww6xl4 2001:4978:f:4c::2 53382 2001:4860:b002::68 80 1 GET ipv6.google.com / - Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en; rv:1.9.0.15pre) Gecko/2009091516 Camino/2.0b4 (like Firefox/3.0.15pre) 0 10102 200 OK - - - (empty) - - - text/html - - +1257655302.514424 5OKnoww6xl4 2001:4978:f:4c::2 53382 2001:4860:b002::68 80 2 GET ipv6.google.com /csi?v=3&s=webhp&action=&tran=undefined&e=17259,19771,21517,21766,21887,22212&ei=BUz2Su7PMJTglQfz3NzCAw&rt=prt.77,xjs.565,ol.645 http://ipv6.google.com/ Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en; rv:1.9.0.15pre) Gecko/2009091516 Camino/2.0b4 (like Firefox/3.0.15pre) 0 0 204 No Content - - - (empty) - - - - - - +1257655303.603569 5OKnoww6xl4 2001:4978:f:4c::2 53382 2001:4860:b002::68 80 3 GET ipv6.google.com /gen_204?atyp=i&ct=fade&cad=1254&ei=BUz2Su7PMJTglQfz3NzCAw&zx=1257655303600 http://ipv6.google.com/ Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en; rv:1.9.0.15pre) Gecko/2009091516 Camino/2.0b4 (like Firefox/3.0.15pre) 0 0 204 No Content - - - (empty) - - - - - - diff --git a/testing/btest/Baseline/core.tunnels.ayiya/tunnel.log b/testing/btest/Baseline/core.tunnels.ayiya/tunnel.log new file mode 100644 index 0000000000..69e331b477 --- /dev/null +++ b/testing/btest/Baseline/core.tunnels.ayiya/tunnel.log @@ -0,0 +1,11 @@ +#separator \x09 +#set_separator , +#empty_field (empty) +#unset_field - +#path tunnel +#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p action tunnel_type user +#types time string addr port addr port enum enum string +1257655293.629048 UWkUyAuUGXf 192.168.3.101 53796 216.14.98.22 5072 Tunnel::DISCOVER Tunnel::AYIYA - +1257655296.585034 k6kgXLOoSKl 192.168.3.101 53859 216.14.98.22 5072 Tunnel::DISCOVER Tunnel::AYIYA - +1257655317.464035 k6kgXLOoSKl 192.168.3.101 53859 216.14.98.22 5072 Tunnel::CLOSE Tunnel::AYIYA - +1257655317.464035 UWkUyAuUGXf 192.168.3.101 53796 216.14.98.22 5072 Tunnel::CLOSE Tunnel::AYIYA - diff --git a/testing/btest/Traces/tunnels/ayiya3.trace b/testing/btest/Traces/tunnels/ayiya3.trace new file mode 100644 index 0000000000000000000000000000000000000000..83193050dcf1160bfbee5c947567bd37b0094249 GIT binary patch literal 13440 zcmeI3c{r5a|Ho%6*|JMYYIsVLnK5P`Ci}kcTV=)=3}cKjV@s4MNm7YODJp40rHw+- zN<@XS6e%jAM2YGE9Pzka{p_r4t0J@+~HIj^(5KWEP8%#+&}j`2YRAV05( z2?zuVd>FSJwjgARKyCu}V1O+CWEF*lELi293loMILm)*Eh#mwZZ6?+%;VoZrik~i9 z->?#rohG2~Aic(7*m4{OHIINuLae}-feZTT;cfB68-nUB%8kkcw=??V_nrMh0b}$? zdb88c`pmZla>RPV!V1C%BnQbV3&g-T=YLrZTUhi7LyiD%fMKd0Q+1lGO=|a207N=N z3aklOqXwF6JtX>J?Nn{7AhU_~Fi&I#!HSvgC8wi9? z{^7)rEURl1AokP+od7Wm}>m&2)vua_(O0dl|=DQY%COi~ch$6d1aE|Iqqh0$=%sb}}BM<@F0g(t$WI z{5BF2qnCrUkVP|Sxx6ED(Nf}?GaN2A4hc#t2XuTP=pMtkTMYj`UgcZwWeK+4%j-!*$2JQ2 zM#?unP6kUMS^lY%QcJLu%GLjADIR|;C0-XSDFq7D5A) zpWt-ALTC3u)g7U)_K~JzapRrtl~Ou#xlCsV3fLEa9)k=~iK z^+I#eKDcmqMT%G@u%_v3x=)Hgac8Hy)`b~2Xq=;`~ zg5?N^lz>1Ll%F38g$j$3j;c)B00H0~klb-l^*`aIapyY#4HC}A`mL_~90P?L`ZS+$w&!%#cQf}Vu zYXOkP+DT1Jw0xRs$Mc^>AP8Vt1BTgz0x)C@NNBF~E1|%`qOiFL#ZM<7uE^N88My7r z8GBig(RU{;1SI4y`j>HU(BMd-BYif#%8V0ji zbQ)NF5-bpmq=J#)^WZ=RkjT!#*o16uL`I_snp7WeEi8_PLu;YvBxf=aL%`8}wdi;) z8jeoHp-E2GWRw;bgCc4X@tP#7sZUy3XdDhlawL13yIM!u8l!QxI3M32Zh$t-2FO>7 zK;{?)G0jc9-FYEqk(z94j*B5XD#F^=5^v9p4E8s`=(9p1jo9I#R=y}-Lkm}rs6ZEE z78~vq6>4Pd>cRE1u=l{2YuRG0*j@pwU>ACxOk&!K4>pD znzO%+8xiki8t&q+MQ{o*wehy%618ED0Em&jzP`R02KZ;B>1^UnbJFyHvvI~KILE*g zhcR(OhgcK6*aUq`lp)H9=g+_}>>a6eb4TY;jz5hSLJKg1Te;fPEkZ1#>=;HKgg|GE zdx)VH#?{Xx3eSynB~YE%5hiFR9Si5$I$N{-XjGa%&&1Wt7sv6^H^F!_Oxgaya28N3 zA>2HS?e6M1)HxKzRKSTA%@y z7;GC5$+h7++F6T>ii?8!mf#@vkG{=T;rMA4#?Me;HqUVm^?-JKu@D~WX;mI7fQuyg zKZ-ab^$ACzncjHX+S$+xan6yL5=4| za}gqUEv?%k{T5EKzrYT>lAjkJqpS-O3e+$7*MyN@AdsKR1_QJPW@{-fY6MI>63mgu z(tv3aU^c;FUKdwIshS9_Tue!nA93A0yoM7(H*$$K|F1liuFwi=HJ)Ag43JgDV{X)n0 zwQ4s?YT=c8%BTrA(t z$2I=G7|HuWh2u|TKPLz5Jy?~;&n&@Y9(S}^-3#XpX>%QEkvv zNLF3=rF6@J8<`h8O-CAx>W!E%=!UgXDTtoKJu0g_KdbBuRnIPeq#N`Bs#0lWWty{U zbldrNN^GQGrb4Y-XFl5UahQBp*ZyNaUKM_?Y~hZ)=>7PXI!3ZbLy|i?5XnjZjM}yMRi~N1<%gZDej6*AyA3nTnLb2$!;JC5>gCpH+hVRPb zesRKj!waM)hUupojqrug%~~H04Qd`#JwjnLpyVz0<4XHAZOCyO)~e_Plq_v)lE|&; zd{updIJo^rcSFq6f?COjvQSG-ZFtm4zfF%4Y@*wqY>>=aI3bJ~AsD?*Wtzpqam#c& z+LRZ@Tq|!vBFDl%B7$hfRap6iz3aWMW;{Bx^b4o;f%n=&pH79o%33LzFRLjL!_deu zxr;uE`rs;lz*8q=XbCUR>dK)N0*C6ewRaI#{a`C^7ekmKwjYjvbZHNadRw%BAaqoM z;`Ll52bm?T^(u}37Wt+u#@4JgfUI=UF7R!|bD63>Zb>*iyN(HDxiV*qz$&J)+7mmvsN1SvEYivf=cLnSa(X{P6 zu_#pe)$6QFcR#e$cDwVZ-iOx;el{!9_m)>R{BnQeg_Vbr?s&M%KqaFm0{EW)Jno!^ z?do2Y+Qhq6(ajev4^nR3=A|MA?@*7}$i{wE73SL_xnUoYPtzHd%z#-8FW`4F=`kr< z*o34b8ko&O#|AOJH;3=M7zy7NW1TSW-H=<+aPeXqy4ByX^Vac#qqt55=2n<*&Em&J z9q(@#BNU3>tJERx`hJRce$65q40I&;z7}OI@k8vghe?0loYg#{ShTuFso@=#VV!i~ zoD03MM(ms&+}_X;zEq1X(sr)v1HX;1T_hv_MBmZKr*iAN(5Ag=Er+UGv!w9)gjJya z?|=R8)wL2am%8pKmMA^6wv_$O()(e&hK+=bmD@OaL{{QFzzSTH%uGLX{ zxh{Yn8j{0zAcj$V?Rgc&Sy<~7^RA$u4no@Ed&5epy@^Fi_re@6dzOrkB)-$LKk$B_ zAmdF#_1YI{{@bOiddiLwTRQ~}?7Wqf34is*OYFPUdtf8x^UWJst>6w^cJ&C_v4OX8Y2A-g+Pl+UZyeef zYkFEAt9>tfS8NGlqEs>KI;*VFQ$|TM+YwbOd#-%FeDDqW=KD*|e&yvSid6^rq-_*G z=Cp-(zSDuUNGaQoH4?Qz;Jr$E&Ee_>MEl2V^>_#L+1#G7IFFigE`l;};q_V=D&nn{ z*&B3mmZep|f;S~ZoFN*w`VQYV<-`L78)?4Xf@`)Z-$+Ph4z_BitTFN1Bwu_mZejPr z0_EGaYnHsIQkGg8y5(EeDEFGv=*gWzH_CtL5G^W2WxtLN=v_0_Qg4(!-VW^-}a!Trh9!Td%9rL+rl3)$r!BrCr*v zG^IMXHNz9_$8a4I>&*N`Ia zWA9W0Z##d(*N%232Oe$_lifpc8%T0l z4=|(x_qsyL_EiQHsz`6jjR*SI)vfP7(GNB3UAc@a)3dt%F5zX|K+b~5du}`(+fwHn zeSPa%Lb16~`Y>ptfFt5wPi5jp*T};!0`#4gKNHs$vCcwB%N&rambkUc;5mY~R8t*8 z`1hB{M)xWBb8Je_tmDdZHZ97hUJs<3H$TG;)IWe~AIgfdudHi{ABCnvea$d$w3qv3 zaXoCvr?x3r9DT42ieLL?cM?i2Z57JxjMUpp&dGsI0uSS|txl!ub=BN@PZ4()&p7`6 zK$UtFO3qHx;`6dg#YyJB>Y21nxT@;r^LmN7q80LD{yRe{Hi?uoHp;( zP77RyD)0ZEqN)TBToE$?^{Mid}f7>84%*lUr(=R#d+< z^N73pGTqK;V@+9c6{~F^B~bw%(0oEND z3wJ4Ua(b{%IfI`I2ky&AhcgyDIoLvh(X9>K%mVNqA#(icarZy_p@eHULWK4}~u`7Dk3 zb)Sz=UY*QCkI1VG66Gf{fGh86*BMLgUUBV9$^I7Jvdd1 zomyRo_WyhR&vclB5Zbx|lBBnPiy@HZPC-0_ zBO47Pohr^%XX*#l-A}&GtFb3B{3qVfZp~_t4 z)OvURuCkOtTaimKo+$ksdf>&B*9(;=_+17abFSS=l5jB0$uHq>(AGi5*Y(bOUwxNm zBN^y#eMF5Ak!vS7DxHRrPSXw<+ha$Hg~4x+-?msvKbcda_2FXCfwq0kEzCATUD5KJ zZDVrP!Fb(<*L{>7`Hii4^)#wZ`jXLC`5&81y>yj^M`EJI48ofx{`w|87E-?HisGruvW-{%(Nho?Wc@nBsuWO~}i!IN_V$P#I9>ai4bPtuA#W zZDs0NrPC~>GYxxOAnR`ZNVZSEn5V*XzU!*H&F(G!#+~I25<2y3YF(EgT%dVxP8q~s zS)nOrTG1b>Am~mwipgHIBhza?HKdB&#eSfCEcULkO+m#dHX(}8k*K8+wpsUN>KDW3 zYab>cT*zgf25!n?NlN(UmS;)1ez9JTLjE?AN$68Mu0*LcNbHYqYslUoeg4GOFx7$p zzkTXXb`gc2EK{$_P;%8hlT>gvv@%Yj^Iik?w|A0tXY_-5D5ss@pVkyTS_4D)Kg|nS zzbpk>*W4BHD4q!QmJ7YeOOzXd8b0w2jX(>G3{py6i#Np2S6! zYR?8b@7sS_nwy}czkfmUrc#v0oF1f2F=dw ze5w~UZ9`{=cmHdzMR(SW4EGc%z?*RY2)efrN;}FAs6zS>ey%ctxAgt3Qym=_p8(*d%lSA zib|EIQRUqXVfs~$uA;|g*SA*|wyIc-Y6?a?xE8kE@3n$gj-IR2diE9h_EU17&)RPzzA&p= zXQ|1Z2bE#t%leATeBV_qmh7XXI2QNoUsv<5BoAohmxwEFNs>jV7cMF+Q`_Rcs)E(4T!CIJi6)qw&*C&9Sd_9gRebTycrlHydddh@kWL(1iLC~zxw)4fm@(kXsPt&n4+Yl z?&FoHbX8`d>)OYp@pqh~QsvieVxykg=md5S^*PraC}0F_ITs;TGy3XW3+v&;`2H0+ z_iKNA4W1aN8~*{AOwjL))_se)*|EA_B6T;bL8x6S1FCP za{kOZ5&pk+?zievs5k>(7QP;R>x?v=d$V_INEYo<{inM!sYedh_@-=M^L~7A4w#+#p!vA#&p&ef?O#E&P|xIGcQ|%L%|Jvae zE-6`+Rj#|rZj($#IK^k%(vJb--%KbAH&L|1B@)8=1uVbF9^|D9SPtVWY68w9t_GIm zx;#|u8(L63?s~N5f~$v;&jTf;rZa~YZ;ZU=6s@=-=PYZ_!fQT72qj0^wkPznx4fQ# z$VYIT{kwIBZY1cX zxU+t0odF$P2r+{K`(;3wJrkg$shME9_1BpIRc#-dgAf|K!8HH$_DjUbzV6-ODFrVy=kkjcvH4=tNV5}xq}nh3Xd+qEnTl{aq| zkbevvuDQCcX%qRPWZHlbvhYbE!{s}Fndt%Q#=`cq+Ru8p$sQ&QZx z`wxDKds4LKl85*nsj6MC<+^(9OkItoY6=O#2=v41QJ(y#!uW3!HmhOSu+>xTDnGXH zpZ(k4R+v$n!4)R-`plj$)SjbV`J(ld+Uw&?PCnWxYj*xrQ;hJ*J>!$@`ma`)dPuP6 zt4{*%C}3lpAwtH(W;^3aJsiYTa`NL?;xvkIaC&z z#{!%w3>Mu-l}<+CwXj4D6cLX{X=nj{B|PvSkHZ1~2?XF?OADo?N@tJ_oTIcHd3ZZ( z3nxFOy>ArSCdyDhT$RHmvpHM@9Hn?+%z^Gp=YX5){#-7bghbBrX(IpYBKtq!A_E1iH~W_(0P}Q_z52OD zI$OY?o6em$V_H)EDr#Xveo_R#;pHpkz0(pqPY0A9(o_A8pq-TJszcsW68pee6cPg% zRxtc#T-npc)pCY$U5|v$A+b>A%|fzbQFK_Yal%VwmF_KNb*YCyLMUXu#&w!dL3Pzu z!VDJ~25^YMrkzy3JE8!G)0FqjmF}Yf(?Y>4s4UQXhJm4oBrJ-A)|~R5*>R|TK~xfq z6$}S`q@Xi;4j0-#DgO4jP3Dcl!yM^sAX_{ZD2IgBBB7@9{^>!Rej^8{zUgmiu z=Z+wer>_W_^EJuSgn&st4;;3gG|9kG5HBrFj4qWM$tE*YXuQ0YLyMsIn9vDKke;N>fw+Wgn5UPjKld-5R?B%>SA9iK_4^;~q!2kNGE-`) za8wk61S~5UezUI1)7CX>hIJJ`8ao%Eg5Wh(-_9RsZ9${)SH`5jbW_jcCkcz^Yh9-a z6%aWtar3aQvn<(fXGZ>fU29k+5 zhyr)>zrc5H>Hboi+3j5@fCk_v< heXdtCM{S_9-UWV{GgJ%q4Y+0k$sE@JL-$`?{{ye9y%PWc literal 0 HcmV?d00001 diff --git a/testing/btest/core/tunnels/ayiya.test b/testing/btest/core/tunnels/ayiya.test new file mode 100644 index 0000000000..043e06c621 --- /dev/null +++ b/testing/btest/core/tunnels/ayiya.test @@ -0,0 +1,4 @@ +# @TEST-EXEC: bro -r $TRACES/tunnels/ayiya3.trace +# @TEST-EXEC: btest-diff tunnel.log +# @TEST-EXEC: btest-diff conn.log +# @TEST-EXEC: btest-diff http.log