mirror of
https://github.com/zeek/zeek.git
synced 2025-10-09 10:08:20 +00:00
Merge remote-tracking branch 'origin/master' into topic/johanna/ocsp-new
This commit is contained in:
Johanna Amann
commit
7aa219758c
99 changed files with 2110 additions and 795 deletions
|
|
@ -0,0 +1,67 @@
|
|||
# @TEST-EXEC: btest-bg-run bro bro -b %INPUT
|
||||
# @TEST-EXEC: btest-bg-wait 10
|
||||
# @TEST-EXEC: btest-diff out
|
||||
|
||||
redef exit_only_after_terminate = T;
|
||||
redef InputAscii::fail_on_invalid_lines = F;
|
||||
|
||||
@TEST-START-FILE input.log
|
||||
#separator \x09
|
||||
#path ssh
|
||||
#fields b i e c p sn a d t iv s sc ss se vc ve ns
|
||||
#types bool int enum count port subnet addr double time interval string table table table vector vector string
|
||||
T -42 SSH::LOG 21 123 10.0.0.0/24 1.2.3.4 3.14 1315801931.273616 100.000000 hurz 2,4,1,3 CC,AA,BB EMPTY 10,20,30
|
||||
T -42 SSH::LOG 21 123 10.0.0.0/24 1.2.3.4 3.14 1315801931.273616 100.000000 hurz 2,4,1,3 CC,AA,BB EMPTY 10,20,30 EMPTY 4242
|
||||
T -43 SSH::LOG 21 123 10.0.0.0/24 1.2.3.4 3.14 1315801931.273616 100.000000 hurz 2,4,1,3 CC,AA,BB EMPTY 10,20,30 EMPTY 4242 HOHOHO
|
||||
T -41
|
||||
@TEST-END-FILE
|
||||
|
||||
@load base/protocols/ssh
|
||||
|
||||
global outfile: file;
|
||||
|
||||
redef InputAscii::empty_field = "EMPTY";
|
||||
|
||||
module A;
|
||||
|
||||
type Idx: record {
|
||||
i: int;
|
||||
};
|
||||
|
||||
type Val: record {
|
||||
b: bool;
|
||||
e: Log::ID;
|
||||
c: count;
|
||||
p: port;
|
||||
sn: subnet;
|
||||
a: addr;
|
||||
d: double;
|
||||
t: time;
|
||||
iv: interval;
|
||||
s: string;
|
||||
ns: string;
|
||||
sc: set[count];
|
||||
ss: set[string];
|
||||
se: set[string];
|
||||
vc: vector of int;
|
||||
ve: vector of int;
|
||||
};
|
||||
|
||||
global servers: table[int] of Val = table();
|
||||
global servers2: table[int] of Val = table();
|
||||
|
||||
event bro_init()
|
||||
{
|
||||
outfile = open("../out");
|
||||
# first read in the old stuff into the table...
|
||||
Input::add_table([$source="../input.log", $name="ssh", $idx=Idx, $val=Val, $destination=servers]);
|
||||
Input::add_table([$source="../input.log", $name="ssh2", $idx=Idx, $val=Val, $destination=servers2, $config=table(["fail_on_invalid_lines"] = "T")]);
|
||||
}
|
||||
|
||||
event Input::end_of_data(name: string, source:string)
|
||||
{
|
||||
print outfile, servers;
|
||||
Input::remove("ssh");
|
||||
close(outfile);
|
||||
terminate();
|
||||
}
|
||||
|
|
@ -13,6 +13,7 @@
|
|||
@TEST-END-FILE
|
||||
|
||||
redef exit_only_after_terminate = T;
|
||||
redef InputAscii::fail_on_invalid_lines = T;
|
||||
|
||||
global outfile: file;
|
||||
|
||||
|
|
|
|||
|
|
@ -0,0 +1,49 @@
|
|||
# This tests files that don't exist initially and then do later during
|
||||
# runtime to make sure the ascii reader is resilient to files missing.
|
||||
# It does a second test at the same time which configures the old
|
||||
# failing behavior.
|
||||
|
||||
# @TEST-EXEC: btest-bg-run bro bro %INPUT
|
||||
# @TEST-EXEC: sleep 2; cp does-exist.dat does-not-exist.dat
|
||||
# @TEST-EXEC: sleep 2; mv does-not-exist.dat does-not-exist-again.dat; echo "Streaming still works" >> does-not-exist-again.dat
|
||||
# @TEST-EXEC: btest-bg-wait -k 3
|
||||
# @TEST-EXEC: btest-diff bro/.stdout
|
||||
# @TEST-EXEC: btest-diff bro/.stderr
|
||||
|
||||
@TEST-START-FILE does-exist.dat
|
||||
#separator \x09
|
||||
#fields line
|
||||
#types string
|
||||
now it does
|
||||
and more!
|
||||
@TEST-END-FILE
|
||||
|
||||
redef exit_only_after_terminate = T;
|
||||
|
||||
@load base/frameworks/input
|
||||
|
||||
module A;
|
||||
|
||||
type Val: record {
|
||||
line: string;
|
||||
};
|
||||
|
||||
event line(description: Input::EventDescription, tpe: Input::Event, v: Val)
|
||||
{
|
||||
print v$line;
|
||||
}
|
||||
|
||||
event line2(description: Input::EventDescription, tpe: Input::Event, v: Val)
|
||||
{
|
||||
print "DONT PRINT THIS LINE";
|
||||
}
|
||||
|
||||
|
||||
event bro_init()
|
||||
{
|
||||
Input::add_event([$source="../does-not-exist.dat", $name="input", $reader=Input::READER_ASCII, $mode=Input::REREAD, $fields=Val, $ev=line, $want_record=T]);
|
||||
Input::add_event([$source="../does-not-exist.dat", $name="inputstream", $reader=Input::READER_ASCII, $mode=Input::STREAM, $fields=Val, $ev=line, $want_record=T]);
|
||||
Input::add_event([$source="../does-not-exist.dat", $name="inputmanual", $reader=Input::READER_ASCII, $mode=Input::MANUAL, $fields=Val, $ev=line, $want_record=T]);
|
||||
Input::add_event([$source="../does-not-exist.dat", $name="input2", $reader=Input::READER_ASCII, $mode=Input::REREAD, $fields=Val, $ev=line2, $want_record=T,
|
||||
$config=table(["fail_on_file_problem"] = "T")]);
|
||||
}
|
||||
|
|
@ -3,6 +3,7 @@
|
|||
# @TEST-EXEC: btest-diff bro/.stderr
|
||||
|
||||
redef exit_only_after_terminate = T;
|
||||
redef InputAscii::fail_on_file_problem = T;
|
||||
|
||||
global outfile: file;
|
||||
global try: count;
|
||||
|
|
|
|||
|
|
@ -20,11 +20,28 @@ redef table_expire_interval = 3sec;
|
|||
global runs = 0;
|
||||
event do_it()
|
||||
{
|
||||
++runs;
|
||||
print fmt("-- Run %s --", runs);
|
||||
|
||||
print "Trigger: 1.2.3.4";
|
||||
Intel::seen([$host=1.2.3.4,
|
||||
$where=SOMEWHERE]);
|
||||
|
||||
++runs;
|
||||
if ( runs == 2 )
|
||||
{
|
||||
# Reinserting the indicator should reset the expiration
|
||||
print "Reinsert: 1.2.3.4";
|
||||
local item = [
|
||||
$indicator="1.2.3.4",
|
||||
$indicator_type=Intel::ADDR,
|
||||
$meta=[
|
||||
$source="source2",
|
||||
$desc="this host is still bad",
|
||||
$url="http://some-data-distributor.com/2"]
|
||||
];
|
||||
Intel::insert(item);
|
||||
}
|
||||
|
||||
if ( runs < 6 )
|
||||
schedule 3sec { do_it() };
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,132 +0,0 @@
|
|||
# @TEST-SERIALIZE: comm
|
||||
#
|
||||
# @TEST-EXEC: btest-bg-run manager-1 "cp ../cluster-layout.bro . && CLUSTER_NODE=manager-1 bro %INPUT"
|
||||
# @TEST-EXEC: sleep 1
|
||||
# @TEST-EXEC: btest-bg-run worker-1 "cp ../cluster-layout.bro . && CLUSTER_NODE=worker-1 bro --pseudo-realtime -C -r $TRACES/tls/ecdhe.pcap %INPUT"
|
||||
# @TEST-EXEC: btest-bg-run worker-2 "cp ../cluster-layout.bro . && CLUSTER_NODE=worker-2 bro --pseudo-realtime -C -r $TRACES/tls/ecdhe.pcap %INPUT"
|
||||
# @TEST-EXEC: btest-bg-wait 20
|
||||
# @TEST-EXEC: TEST_DIFF_CANONIFIER='grep -v ^# | $SCRIPTS/diff-remove-timestamps' btest-diff manager-1/netcontrol.log
|
||||
# @TEST-EXEC: btest-diff manager-1/netcontrol_catch_release.log
|
||||
# @TEST-EXEC: btest-diff worker-2/.stdout
|
||||
|
||||
@TEST-START-FILE cluster-layout.bro
|
||||
redef Cluster::nodes = {
|
||||
["manager-1"] = [$node_type=Cluster::MANAGER, $ip=127.0.0.1, $p=37757/tcp, $workers=set("worker-1", "worker-2")],
|
||||
["worker-1"] = [$node_type=Cluster::WORKER, $ip=127.0.0.1, $p=37760/tcp, $manager="manager-1", $interface="eth0"],
|
||||
["worker-2"] = [$node_type=Cluster::WORKER, $ip=127.0.0.1, $p=37761/tcp, $manager="manager-1", $interface="eth0"],
|
||||
};
|
||||
@TEST-END-FILE
|
||||
|
||||
redef exit_only_after_terminate = T;
|
||||
|
||||
redef Log::default_rotation_interval = 0secs;
|
||||
|
||||
@load base/frameworks/netcontrol
|
||||
redef NetControl::catch_release_warn_blocked_ip_encountered = T;
|
||||
|
||||
global ready_for_data_1: event();
|
||||
global ready_for_data_2: event();
|
||||
redef Cluster::manager2worker_events += /^ready_for_data_(1|2)$/;
|
||||
|
||||
@if ( Cluster::local_node_type() == Cluster::MANAGER )
|
||||
|
||||
global peer_count = 0;
|
||||
event remote_connection_handshake_done(p: event_peer) &priority=-5
|
||||
{
|
||||
++peer_count;
|
||||
print "remote_connection_handshake_done", peer_count;
|
||||
if ( peer_count == 2 )
|
||||
{
|
||||
event ready_for_data_1();
|
||||
schedule 1.5sec { ready_for_data_2() };
|
||||
}
|
||||
}
|
||||
|
||||
@endif
|
||||
|
||||
@if ( Cluster::local_node_type() == Cluster::WORKER )
|
||||
event bro_init()
|
||||
{
|
||||
print "Suspend", Cluster::node;
|
||||
suspend_processing();
|
||||
}
|
||||
|
||||
event remote_connection_closed(p: event_peer) {
|
||||
print "remote connection closed";
|
||||
terminate();
|
||||
}
|
||||
@endif
|
||||
|
||||
@if ( Cluster::node == "worker-1" )
|
||||
event ready_for_data_1()
|
||||
{
|
||||
print "Resume", Cluster::node;
|
||||
continue_processing();
|
||||
}
|
||||
@endif
|
||||
|
||||
@if ( Cluster::node == "worker-2" )
|
||||
event ready_for_data_2()
|
||||
{
|
||||
print "Resume", Cluster::node;
|
||||
continue_processing();
|
||||
}
|
||||
@endif
|
||||
|
||||
event NetControl::init()
|
||||
{
|
||||
local netcontrol_debug = NetControl::create_debug(T);
|
||||
NetControl::activate(netcontrol_debug, 0);
|
||||
}
|
||||
|
||||
global i: count = 0;
|
||||
|
||||
event connection_established(c: connection)
|
||||
{
|
||||
print "Connection established";
|
||||
local id = c$id;
|
||||
local info = NetControl::get_catch_release_info(id$orig_h);
|
||||
print "Info", info;
|
||||
NetControl::drop_address_catch_release(id$orig_h, cat("connection drop ", Cluster::node));
|
||||
if ( info$current_block_id != "" )
|
||||
{
|
||||
NetControl::unblock_address_catch_release(id$orig_h, Cluster::node);
|
||||
}
|
||||
}
|
||||
|
||||
@if ( Cluster::node == "worker-1" )
|
||||
event connection_established(c: connection)
|
||||
{
|
||||
NetControl::drop_address(8.8.8.8, 0.1secs, cat("direct drop ", Cluster::node));
|
||||
NetControl::drop_address_catch_release(8.8.8.8, cat("direct cr ", Cluster::node));
|
||||
}
|
||||
@endif
|
||||
|
||||
@if ( Cluster::node == "worker-2" )
|
||||
event connection_established(c: connection)
|
||||
{
|
||||
NetControl::catch_release_seen(8.8.8.8);
|
||||
}
|
||||
@endif
|
||||
|
||||
event NetControl::catch_release_block_new(a: addr, b: NetControl::BlockInfo)
|
||||
{
|
||||
print "New block", a, b;
|
||||
}
|
||||
|
||||
event NetControl::catch_release_block_delete(a: addr)
|
||||
{
|
||||
print "Delete block", a;
|
||||
}
|
||||
|
||||
event terminate_me() {
|
||||
terminate();
|
||||
}
|
||||
|
||||
@if ( Cluster::local_node_type() == Cluster::MANAGER )
|
||||
event NetControl::rule_added(r: NetControl::Rule, p: NetControl::PluginState, msg: string)
|
||||
{
|
||||
print "Scheduling terminate";
|
||||
schedule 3sec { terminate_me() };
|
||||
}
|
||||
@endif
|
||||
|
|
@ -0,0 +1,6 @@
|
|||
# Test a more complicated radius session with multiple attempts
|
||||
|
||||
# @TEST-EXEC: bro -b -C -r $TRACES/radius/radius_localhost.pcapng %INPUT
|
||||
# @TEST-EXEC: btest-diff radius.log
|
||||
|
||||
@load base/protocols/radius
|
||||
Loading…
Add table
Add a link
Reference in a new issue