From 7ba96099926683ed3fcc59e5b9f9c3ab8e7bbc7c Mon Sep 17 00:00:00 2001 From: Christian Kreibich Date: Tue, 18 Mar 2025 17:45:24 -0700 Subject: [PATCH] Add btests for has_valid_octets() and normalize_mac() These functions reside in base/utils/addrs.zeek and were not tested. We don't use has_valid_octets() anywhere right now, normalize_mac() is used in the RADIUS analyzer, and addr_to_uri() is used in the signatures/dpd.zeek tests. --- .../btest/Baseline/scripts.base.utils.addrs/output | 12 ++++++++++++ testing/btest/scripts/base/utils/addrs.test | 14 ++++++++++++++ 2 files changed, 26 insertions(+) diff --git a/testing/btest/Baseline/scripts.base.utils.addrs/output b/testing/btest/Baseline/scripts.base.utils.addrs/output index 380efe357b..622edef994 100644 --- a/testing/btest/Baseline/scripts.base.utils.addrs/output +++ b/testing/btest/Baseline/scripts.base.utils.addrs/output @@ -61,3 +61,15 @@ F [1.1.1.1] [1.1.1.1] [6:1:2::3:4:5:6] +============ test has_valid_octets() +T +T +T +F +F +============ test normalize_mac() +aa:bb:cc:dd:ee:ff +aa:bb:cc:dd:ee:ff +aa:bb:cc:dd:ee:ff +00:11:aa:bb:cc:dd:ee:ff + diff --git a/testing/btest/scripts/base/utils/addrs.test b/testing/btest/scripts/base/utils/addrs.test index 4c69dd0a58..e0bc384fad 100644 --- a/testing/btest/scripts/base/utils/addrs.test +++ b/testing/btest/scripts/base/utils/addrs.test @@ -149,4 +149,18 @@ event zeek_init() # by a person trying to parse such a string, but that's just what's going # to happen; it's on them to deal). print extract_ip_addresses("IPv6:1:2::3:4:5:6:7"); + + print "============ test has_valid_octets()"; + print has_valid_octets(vector("1", "1", "1", "1")); + print has_valid_octets(vector("0", "0", "0", "0")); + print has_valid_octets(vector("255", "255", "255", "255")); + print has_valid_octets(vector("256", "255", "255", "255")); # F + print has_valid_octets(vector("65535", "255", "255", "255")); # F + + print "============ test normalize_mac()"; + print normalize_mac("aabbccddeeff"); + print normalize_mac("this is aa:bb:cc:dd:ee:ff"); + print normalize_mac("this is aa bb cc dd ee ff"); + print normalize_mac("this is 00:11:aa:bb:cc:dd:ee:ff"); + print normalize_mac("this is nothing mac-related"); }