mirror of
https://github.com/zeek/zeek.git
synced 2025-10-11 02:58:20 +00:00
General btest cleanup
- Use `-b` most everywhere, it will save time. - Start some intel tests upon the input file being fully read instead of at an arbitrary time. - Improve termination condition for some sumstats/cluster tests. - Filter uninteresting output from some supervisor tests. - Test for `notice_policy.log` is no longer needed.
This commit is contained in:
Jon Siwek
Tim Wojtulewicz
parent
670bf02c95
commit
7967a5b0aa
350 changed files with 1139 additions and 638 deletions
|
|
@ -1,9 +1,11 @@
|
|||
# @TEST-EXEC: zeek -r $TRACES/http/content-range-gap-skip.trace %INPUT
|
||||
# @TEST-EXEC: zeek -b -r $TRACES/http/content-range-gap-skip.trace %INPUT
|
||||
|
||||
# In this trace, we should be able to determine that a gap lies
|
||||
# entirely within the body of an entity that specifies Content-Range,
|
||||
# and so further deliveries after the gap can still be made.
|
||||
|
||||
@load base/protocols/http
|
||||
|
||||
global got_gap = F;
|
||||
global got_data_after_gap = F;
|
||||
|
||||
|
|
|
|||
|
|
@ -1,6 +1,9 @@
|
|||
# @TEST-EXEC: zeek -r $TRACES/http/content-range-gap.trace %INPUT
|
||||
# @TEST-EXEC: zeek -b -r $TRACES/http/content-range-gap.trace %INPUT
|
||||
# @TEST-EXEC: btest-diff extract_files/thefile
|
||||
|
||||
@load base/protocols/http
|
||||
@load base/files/extract
|
||||
|
||||
event file_new(f: fa_file)
|
||||
{
|
||||
Files::add_analyzer(f, Files::ANALYZER_EXTRACT,
|
||||
|
|
|
|||
|
|
@ -1,3 +1,6 @@
|
|||
# @TEST-EXEC: zeek -r $TRACES/http/content-range-less-than-len.pcap
|
||||
# @TEST-EXEC: zeek -b -r $TRACES/http/content-range-less-than-len.pcap %INPUT
|
||||
# @TEST-EXEC: btest-diff http.log
|
||||
# @TEST-EXEC: btest-diff weird.log
|
||||
|
||||
@load base/protocols/http
|
||||
@load base/frameworks/notice/weird
|
||||
|
|
|
|||
|
|
@ -1,7 +1,10 @@
|
|||
# @TEST-EXEC: zeek -r $TRACES/http/entity_gap.trace %INPUT
|
||||
# @TEST-EXEC: zeek -b -r $TRACES/http/entity_gap.trace %INPUT
|
||||
# @TEST-EXEC: btest-diff entity_data
|
||||
# @TEST-EXEC: btest-diff extract_files/file0
|
||||
|
||||
@load base/protocols/http
|
||||
@load base/files/extract
|
||||
|
||||
global f = open("entity_data");
|
||||
global fn = 0;
|
||||
|
||||
|
|
|
|||
|
|
@ -1,7 +1,10 @@
|
|||
# @TEST-EXEC: zeek -r $TRACES/http/entity_gap2.trace %INPUT
|
||||
# @TEST-EXEC: zeek -b -r $TRACES/http/entity_gap2.trace %INPUT
|
||||
# @TEST-EXEC: btest-diff entity_data
|
||||
# @TEST-EXEC: btest-diff extract_files/file0
|
||||
|
||||
@load base/protocols/http
|
||||
@load base/files/extract
|
||||
|
||||
global f = open("entity_data");
|
||||
global fn = 0;
|
||||
|
||||
|
|
|
|||
|
|
@ -1,2 +1,2 @@
|
|||
# @TEST-EXEC: zeek -r $TRACES/http/fake-content-length.pcap
|
||||
# @TEST-EXEC: zeek -b -r $TRACES/http/fake-content-length.pcap base/protocols/http
|
||||
# @TEST-EXEC: btest-diff http.log
|
||||
|
|
|
|||
|
|
@ -1,4 +1,6 @@
|
|||
# @TEST-EXEC: zeek -Cr $TRACES/http/http-bad-request-with-version.trace %INPUT
|
||||
# @TEST-EXEC: zeek -b -Cr $TRACES/http/http-bad-request-with-version.trace %INPUT
|
||||
# @TEST-EXEC: btest-diff http.log
|
||||
# @TEST-EXEC: btest-diff weird.log
|
||||
|
||||
@load base/protocols/http
|
||||
@load base/frameworks/notice/weird
|
||||
|
|
|
|||
|
|
@ -1,12 +1,13 @@
|
|||
# This tests that the HTTP analyzer handles HTTP CONNECT proxying correctly
|
||||
# when the server include a header line into its response.
|
||||
#
|
||||
# @TEST-EXEC: zeek -C -r $TRACES/http/connect-with-header.trace %INPUT
|
||||
# @TEST-EXEC: zeek -b -C -r $TRACES/http/connect-with-header.trace %INPUT
|
||||
# @TEST-EXEC: btest-diff conn.log
|
||||
# @TEST-EXEC: btest-diff http.log
|
||||
# @TEST-EXEC: btest-diff tunnel.log
|
||||
|
||||
@load base/protocols/conn
|
||||
@load base/protocols/http
|
||||
@load base/protocols/ssl
|
||||
@load base/protocols/tunnels
|
||||
@load base/frameworks/dpd
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
# This tests that the HTTP analyzer handles HTTP CONNECT proxying correctly.
|
||||
#
|
||||
# @TEST-EXEC: zeek -r $TRACES/http/connect-with-smtp.trace %INPUT
|
||||
# @TEST-EXEC: zeek -b -r $TRACES/http/connect-with-smtp.trace %INPUT
|
||||
# @TEST-EXEC: btest-diff conn.log
|
||||
# @TEST-EXEC: btest-diff http.log
|
||||
# @TEST-EXEC: btest-diff smtp.log
|
||||
|
|
|
|||
|
|
@ -1,8 +1,6 @@
|
|||
# This tests that the HTTP analyzer handles filenames over HTTP correctly.
|
||||
#
|
||||
# @TEST-EXEC: zeek -r $TRACES/http/http-filename.pcap %INPUT
|
||||
# @TEST-EXEC: zeek -b -r $TRACES/http/http-filename.pcap %INPUT
|
||||
# @TEST-EXEC: btest-diff http.log
|
||||
|
||||
# The base analysis scripts are loaded by default.
|
||||
#@load base/protocols/http
|
||||
|
||||
@load base/protocols/http
|
||||
|
|
|
|||
|
|
@ -2,9 +2,8 @@
|
|||
# it gets confused whether it's in a header or not; it shouldn't report
|
||||
# the http_no_crlf_in_header_list wierd.
|
||||
#
|
||||
# @TEST-EXEC: zeek -r $TRACES/http/byteranges.trace %INPUT
|
||||
# @TEST-EXEC: zeek -b -r $TRACES/http/byteranges.trace %INPUT
|
||||
# @TEST-EXEC: test ! -f weird.log
|
||||
|
||||
# The base analysis scripts are loaded by default.
|
||||
#@load base/protocols/http
|
||||
|
||||
@load base/protocols/http
|
||||
@load base/frameworks/notice/weird
|
||||
|
|
|
|||
|
|
@ -1,9 +1,8 @@
|
|||
# This tests that the HTTP analyzer handles strange HTTP methods properly.
|
||||
#
|
||||
# @TEST-EXEC: zeek -r $TRACES/http/methods.trace %INPUT
|
||||
# @TEST-EXEC: zeek -b -r $TRACES/http/methods.trace %INPUT
|
||||
# @TEST-EXEC: btest-diff weird.log
|
||||
# @TEST-EXEC: btest-diff http.log
|
||||
|
||||
# The base analysis scripts are loaded by default.
|
||||
#@load base/protocols/http
|
||||
|
||||
@load base/protocols/http
|
||||
@load base/frameworks/notice/weird
|
||||
|
|
|
|||
|
|
@ -1,6 +1,8 @@
|
|||
# @TEST-EXEC: zeek -r $TRACES/http/pipelined-requests.trace %INPUT > output
|
||||
# @TEST-EXEC: zeek -b -r $TRACES/http/pipelined-requests.trace %INPUT > output
|
||||
# @TEST-EXEC: btest-diff http.log
|
||||
|
||||
@load base/protocols/http
|
||||
|
||||
# mime type is irrelevant to this test, so filter it out
|
||||
event zeek_init()
|
||||
{
|
||||
|
|
|
|||
|
|
@ -2,5 +2,7 @@
|
|||
# include an appropriate ZLIB header on deflated
|
||||
# content.
|
||||
#
|
||||
# @TEST-EXEC: zeek -r $TRACES/http/missing-zlib-header.pcap %INPUT
|
||||
# @TEST-EXEC: zeek -b -r $TRACES/http/missing-zlib-header.pcap %INPUT
|
||||
# @TEST-EXEC: btest-diff http.log
|
||||
|
||||
@load base/protocols/http
|
||||
|
|
|
|||
|
|
@ -1,7 +1,10 @@
|
|||
# @TEST-EXEC: zeek -C -r $TRACES/http/multipart.trace %INPUT
|
||||
# @TEST-EXEC: zeek -b -C -r $TRACES/http/multipart.trace %INPUT
|
||||
# @TEST-EXEC: btest-diff http.log
|
||||
# @TEST-EXEC: cat extract_files/http-item-* | sort > extractions
|
||||
|
||||
@load base/protocols/http
|
||||
@load base/files/extract
|
||||
|
||||
event file_new(f: fa_file)
|
||||
{
|
||||
local fname = fmt("http-item-%s", f$id);
|
||||
|
|
|
|||
|
|
@ -1,10 +1,10 @@
|
|||
# @TEST-EXEC: zeek -C -r $TRACES/http/multipart.trace
|
||||
# @TEST-EXEC: zeek -b -C -r $TRACES/http/multipart.trace base/protocols/http
|
||||
# @TEST-EXEC: btest-diff http.log
|
||||
# @TEST-EXEC: zeek -C -r $TRACES/http/multipart.trace %INPUT >out-limited
|
||||
# @TEST-EXEC: zeek -b -C -r $TRACES/http/multipart.trace base/protocols/http %INPUT >out-limited
|
||||
# @TEST-EXEC: mv http.log http-limited.log
|
||||
# @TEST-EXEC: btest-diff http-limited.log
|
||||
# @TEST-EXEC: btest-diff out-limited
|
||||
# @TEST-EXEC: zeek -C -r $TRACES/http/multipart.trace %INPUT ignore_http_file_limit=T >out-limit-ignored
|
||||
# @TEST-EXEC: zeek -b -C -r $TRACES/http/multipart.trace base/protocols/http %INPUT ignore_http_file_limit=T >out-limit-ignored
|
||||
# @TEST-EXEC: mv http.log http-limit-ignored.log
|
||||
# @TEST-EXEC: btest-diff http-limit-ignored.log
|
||||
# @TEST-EXEC: btest-diff out-limit-ignored
|
||||
|
|
|
|||
|
|
@ -1,4 +1,6 @@
|
|||
# @TEST-EXEC: zeek -Cr $TRACES/http/no-uri.pcap %INPUT
|
||||
# @TEST-EXEC: zeek -b -Cr $TRACES/http/no-uri.pcap %INPUT
|
||||
# @TEST-EXEC: btest-diff http.log
|
||||
# @TEST-EXEC: btest-diff weird.log
|
||||
|
||||
@load base/protocols/http
|
||||
@load base/frameworks/notice/weird
|
||||
|
|
|
|||
|
|
@ -1,3 +1,4 @@
|
|||
# @TEST-EXEC: zeek -Cr $TRACES/http/no-version.pcap %INPUT
|
||||
# @TEST-EXEC: zeek -b -Cr $TRACES/http/no-version.pcap %INPUT
|
||||
# @TEST-EXEC: btest-diff http.log
|
||||
|
||||
@load base/protocols/http
|
||||
|
|
|
|||
|
|
@ -1,4 +1,6 @@
|
|||
# @TEST-EXEC: zeek -Cr $TRACES/http/percent-end-of-line.pcap %INPUT
|
||||
# @TEST-EXEC: zeek -b -Cr $TRACES/http/percent-end-of-line.pcap %INPUT
|
||||
# @TEST-EXEC: btest-diff http.log
|
||||
# @TEST-EXEC: btest-diff weird.log
|
||||
|
||||
@load base/protocols/http
|
||||
@load base/frameworks/notice/weird
|
||||
|
|
|
|||
|
|
@ -1,2 +1,2 @@
|
|||
# @TEST-EXEC: zeek -r $TRACES/http/x-gzip.pcap
|
||||
# @TEST-EXEC: zeek -b -r $TRACES/http/x-gzip.pcap base/protocols/http
|
||||
# @TEST-EXEC: btest-diff http.log
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue