Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-15 13:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

testing/btest/*zeek: Comment all @TEST lines

Browse source
This commit is contained in:
Arne Welzel 2025-04-17 15:32:11 +02:00
parent 2f0be32f5f
commit 85b8c8866b
311 changed files with 1272 additions and 1272 deletions
Download patch file Download diff file Expand all files Collapse all files

4
testing/btest/scripts/base/frameworks/input/bad_patterns.zeek
View file

@ -2,7 +2,7 @@
# @TEST-EXEC: grep -v "already queued for removal" .stderr > out
# @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-sort btest-diff out
@TEST-START-FILE input.log
# @TEST-START-FILE input.log
#separator \x09
#fields i p
#types count pattern
@ -11,7 +11,7 @@
3 /foo|bar
4 this is not a pattern
5 /5
@TEST-END-FILE
# @TEST-END-FILE
module A;

4
testing/btest/scripts/base/frameworks/input/basic.zeek
View file

@ -4,13 +4,13 @@
redef exit_only_after_terminate = T;
@TEST-START-FILE input.log
# @TEST-START-FILE input.log
#separator \x09
#path ssh
#fields b bt i e c p pp sn a d t iv s sc ss se vc ve ns
#types bool int enum count port port subnet addr double time interval string table table table vector vector string
T 1 -42 SSH::LOG 21 123 5/icmp 10.0.0.0/24 1.2.3.4 3.14 1315801931.273616 100.000000 hurz 2,4,1,3 CC,AA,BB EMPTY 10,20,30 EMPTY 4242
@TEST-END-FILE
# @TEST-END-FILE
@load base/protocols/ssh

4
testing/btest/scripts/base/frameworks/input/bignumber.zeek
View file

@ -4,13 +4,13 @@
redef exit_only_after_terminate = T;
@TEST-START-FILE input.log
# @TEST-START-FILE input.log
#separator \x09
#fields i c
#types int count
9223372036854775800 18446744073709551612
-9223372036854775800 18446744073709551612
@TEST-END-FILE
# @TEST-END-FILE
global outfile: file;

BIN
testing/btest/scripts/base/frameworks/input/binary.zeek
View file

Binary file not shown.

4
testing/btest/scripts/base/frameworks/input/config/basic.zeek
View file

@ -6,7 +6,7 @@ redef exit_only_after_terminate = T;
redef InputConfig::empty_field = "EMPTY";
redef InputConfig::set_separator = "\t";
@TEST-START-FILE configfile
# @TEST-START-FILE configfile
testbool F
testcount 1
testcount 2
@ -25,7 +25,7 @@ test_set (empty)
test_set EMPTY
test_set -
teststring abc
@TEST-END-FILE
# @TEST-END-FILE
@load base/protocols/ssh
@load base/protocols/conn

4
testing/btest/scripts/base/frameworks/input/config/enum-set.zeek
View file

@ -3,9 +3,9 @@
# @TEST-EXEC: btest-diff zeek/.stdout
# @TEST-EXEC: btest-diff zeek/config.log
@TEST-START-FILE configfile4
# @TEST-START-FILE configfile4
DPD::ignore_violations Analyzer::ANALYZER_SYSLOG
@TEST-END-FILE
# @TEST-END-FILE
@load base/frameworks/config

4
testing/btest/scripts/base/frameworks/input/config/errors.zeek
View file

@ -5,7 +5,7 @@
redef exit_only_after_terminate = T;
@TEST-START-FILE configfile
# @TEST-START-FILE configfile
testbool A
testtesttesttesttesttest
testbool A B
@ -14,7 +14,7 @@ testenum unknown
testbooool T
test_any F
test_table whatever
@TEST-END-FILE
# @TEST-END-FILE
@load base/protocols/ssh
@load base/protocols/conn

4
testing/btest/scripts/base/frameworks/input/config/spaces.zeek
View file

@ -5,7 +5,7 @@
redef exit_only_after_terminate = T;
redef InputConfig::empty_field = "EMPTY";
@TEST-START-FILE configfile
# @TEST-START-FILE configfile
testbool F
testcount 1
testint -1
@ -13,7 +13,7 @@ testportandproto 45/udp
testaddr 127.0.0.3
test_set 127.0.0.1, 127.0.0.2, 127.0.0.3
test_vector 10.0.0.1/32, 10.0.0.1/16, 10.0.0.1/8
@TEST-END-FILE
# @TEST-END-FILE
@load base/protocols/ssh
@load base/protocols/conn

4
testing/btest/scripts/base/frameworks/input/default.zeek
View file

@ -2,7 +2,7 @@
# @TEST-EXEC: btest-bg-wait 10
# @TEST-EXEC: btest-diff out
@TEST-START-FILE input.log
# @TEST-START-FILE input.log
#separator \x09
#path ssh
#fields i b
@ -14,7 +14,7 @@
5 F
6 F
7 T
@TEST-END-FILE
# @TEST-END-FILE
redef exit_only_after_terminate = T;

8
testing/btest/scripts/base/frameworks/input/empty-values-hashing.zeek
View file

@ -7,7 +7,7 @@
# @TEST-EXEC: btest-diff events.out
# @TEST-EXEC: btest-diff preds.out
@TEST-START-FILE input1.log
# @TEST-START-FILE input1.log
#separator \x09
#fields i s ss
#types int sting string
@ -15,15 +15,15 @@
2 - TEST
3 TEST -
4 TEST TEST
@TEST-END-FILE
@TEST-START-FILE input2.log
# @TEST-END-FILE
# @TEST-START-FILE input2.log
#separator \x09
#fields i s ss
#types int sting string
1 TEST2 -
4 TEST2 TEST2
5 - TEST2
@TEST-END-FILE
# @TEST-END-FILE
redef exit_only_after_terminate = T;

8
testing/btest/scripts/base/frameworks/input/emptyvals.zeek
View file

@ -8,7 +8,7 @@
# @TEST-EXEC: btest-bg-wait 10
# @TEST-EXEC: btest-diff out
@TEST-START-FILE input1.log
# @TEST-START-FILE input1.log
#separator \x09
#path ssh
#fields b i
@ -16,9 +16,9 @@
T 1
- 2
F -
@TEST-END-FILE
# @TEST-END-FILE
@TEST-START-FILE input2.log
# @TEST-START-FILE input2.log
#separator \x09
#path ssh
#fields b i j
@ -26,7 +26,7 @@ F -
T 1 1
- 2 2
F - 3
@TEST-END-FILE
# @TEST-END-FILE
redef exit_only_after_terminate = T;

4
testing/btest/scripts/base/frameworks/input/errors.zeek
View file

@ -4,13 +4,13 @@
# @TEST-EXEC: btest-diff .stderr
# @TEST-EXEC: btest-diff out
@TEST-START-FILE input.log
# @TEST-START-FILE input.log
#separator \x09
#path ssh
#fields b i e c p sn a d t iv s sc ss se vc ve ns
#types bool int enum count port subnet addr double time interval string table table table vector vector string
T -42 SSH::LOG 21 123 10.0.0.0/24 1.2.3.4 3.14 1315801931.273616 100.000000 hurz 2,4,1,3 CC,AA,BB EMPTY 10,20,30 EMPTY 4242
@TEST-END-FILE
# @TEST-END-FILE
redef Input::accept_unsupported_types = T;

4
testing/btest/scripts/base/frameworks/input/event.zeek
View file

@ -2,7 +2,7 @@
# @TEST-EXEC: btest-bg-wait 10
# @TEST-EXEC: btest-diff out
@TEST-START-FILE input.log
# @TEST-START-FILE input.log
#separator \x09
#path ssh
#fields i b
@ -14,7 +14,7 @@
5 F
6 F
7 T
@TEST-END-FILE
# @TEST-END-FILE
redef exit_only_after_terminate = T;

4
testing/btest/scripts/base/frameworks/input/from_json.zeek
View file

@ -2,14 +2,14 @@
# @TEST-EXEC: zeek -b %INPUT >out
# @TEST-EXEC: TEST_DIFF_CANONIFIER= btest-diff out
@TEST-START-FILE denylist.jsonl
# @TEST-START-FILE denylist.jsonl
{"ip": "192.168.0.1", "source": "local", "timestamp": "1990-09-22T12:13:14"}
{"ip": "192.168.0.1", "source": "local", "timestamp": "1990-09-23T13:14:15"}
{"ip": "192.168.0.2", "source": "local"}
{"source": "local"}
{... ]
{"ip": "8.8.4.4", "source": "remote"}
@TEST-END-FILE
# @TEST-END-FILE
redef exit_only_after_terminate = T;

4
testing/btest/scripts/base/frameworks/input/invalid-lines-duplicate.zeek
View file

@ -6,7 +6,7 @@
redef exit_only_after_terminate = T;
redef InputAscii::fail_on_invalid_lines = F;
@TEST-START-FILE input.log
# @TEST-START-FILE input.log
#fields a b c
#types string bool bool
hello
@ -23,7 +23,7 @@ hello
hello
hello
hello
@TEST-END-FILE
# @TEST-END-FILE
type Key: record {
a: string;

4
testing/btest/scripts/base/frameworks/input/invalid-lines.zeek
View file

@ -7,7 +7,7 @@
redef exit_only_after_terminate = T;
redef InputAscii::fail_on_invalid_lines = F;
@TEST-START-FILE input.log
# @TEST-START-FILE input.log
#separator \x09
#path ssh
#fields b i e c p pt sn a d t iv s sc ss se vc ve ns
@ -19,7 +19,7 @@ T -44 SSH::LOG 21 123 udp 10.0.0.0/24 342.2.3.4 3.14 1315801931.273616 100.00000
T -41
T -41 EMPTY 21 123 tcp 10.0.0.0/24 1.2.3.4 3.14 1315801931.273616 100.000000 hurz 2,4,1,3 CC,AA,BB EMPTY 10,20,30 EMPTY 4242
T -41 21 123 tcp 10.0.0.0/24 1.2.3.4 3.14 1315801931.273616 100.000000 hurz 2,4,1,3 CC,AA,BB EMPTY 10,20,30 EMPTY 4242
@TEST-END-FILE
# @TEST-END-FILE
@load base/protocols/ssh

4
testing/btest/scripts/base/frameworks/input/invalidnumbers.zeek
View file

@ -6,7 +6,7 @@
# Note the tab+space separator in the last line of the following is
# intentional. It verifies our whitespace handling.
@TEST-START-FILE input.log
# @TEST-START-FILE input.log
#separator \x09
#fields i c
#types int count
@ -14,7 +14,7 @@
9223372036854775801TEXTHERE 1Justtext
Justtext 1
9223372036854775800 -18446744073709551612
@TEST-END-FILE
# @TEST-END-FILE
redef exit_only_after_terminate = T;

4
testing/btest/scripts/base/frameworks/input/invalidset.zeek
View file

@ -4,12 +4,12 @@
# @TEST-EXEC: sed 1d .stderr > .stderrwithoutfirstline
# @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-remove-abspath btest-diff .stderrwithoutfirstline
@TEST-START-FILE input.log
# @TEST-START-FILE input.log
#separator \x09
#fields i s
name -
name 127.0.0.1
@TEST-END-FILE
# @TEST-END-FILE
redef exit_only_after_terminate = T;
redef InputAscii::fail_on_invalid_lines = T;

4
testing/btest/scripts/base/frameworks/input/invalidtable.zeek
View file

@ -4,12 +4,12 @@
# @TEST-EXEC: sed 1d .stderr > .stderrwithoutfirstline
# @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-remove-abspath btest-diff .stderrwithoutfirstline
@TEST-START-FILE input.log
# @TEST-START-FILE input.log
#separator \x09
#fields i y s
name - 127.0.0.1
name name2 127.0.0.1
@TEST-END-FILE
# @TEST-END-FILE
redef exit_only_after_terminate = T;
redef InputAscii::fail_on_invalid_lines = T;

4
testing/btest/scripts/base/frameworks/input/invalidtext.zeek
View file

@ -4,13 +4,13 @@
# @TEST-EXEC: sed 1d .stderr > .stderrwithoutfirstline
# @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-remove-abspath btest-diff .stderrwithoutfirstline
@TEST-START-FILE input.log
# @TEST-START-FILE input.log
#separator \x09
#fields i c
#types int count
l
5
@TEST-END-FILE
# @TEST-END-FILE
redef exit_only_after_terminate = T;
redef InputAscii::fail_on_invalid_lines = T;

4
testing/btest/scripts/base/frameworks/input/missing-enum.zeek
View file

@ -3,10 +3,10 @@
# @TEST-EXEC: btest-diff zeek/.stderr
# @TEST-EXEC: btest-diff zeek/.stdout
@TEST-START-FILE input.log
# @TEST-START-FILE input.log
#fields e i
IdoNot::Exist 1
@TEST-END-FILE
# @TEST-END-FILE
redef exit_only_after_terminate = T;

4
testing/btest/scripts/base/frameworks/input/missing-file-initially.zeek
View file

@ -13,13 +13,13 @@
# @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-sort btest-diff zeek/.stdout
# @TEST-EXEC: TEST_DIFF_CANONIFIER='sed -E "/Suppressed [0-9]+ warning\(s\)$/d" | $SCRIPTS/diff-sort' btest-diff zeek/.stderr
@TEST-START-FILE does-exist.dat
# @TEST-START-FILE does-exist.dat
#separator \x09
#fields line
#types string
1 now it does
2 and more!
@TEST-END-FILE
# @TEST-END-FILE
redef exit_only_after_terminate = T;

4
testing/btest/scripts/base/frameworks/input/missing-table-value.zeek
View file

@ -3,13 +3,13 @@
# @TEST-EXEC: btest-diff zeek/.stderr
# @TEST-EXEC: btest-diff zeek/.stdout
@TEST-START-FILE denylist.txt
# @TEST-START-FILE denylist.txt
#separator \x09
#fields ip colors
192.168.17.1 Red,White
192.168.27.2 White,asdf
192.168.250.3 Blue
@TEST-END-FILE
# @TEST-END-FILE
# test.zeek
type Idx: record {

4
testing/btest/scripts/base/frameworks/input/onecolumn-norecord.zeek
View file

@ -2,13 +2,13 @@
# @TEST-EXEC: btest-bg-wait 10
# @TEST-EXEC: btest-diff out
@TEST-START-FILE input.log
# @TEST-START-FILE input.log
#separator \x09
#path ssh
#fields b i
#types bool int
T -42
@TEST-END-FILE
# @TEST-END-FILE
redef exit_only_after_terminate = T;

4
testing/btest/scripts/base/frameworks/input/onecolumn-record.zeek
View file

@ -2,13 +2,13 @@
# @TEST-EXEC: btest-bg-wait 10
# @TEST-EXEC: btest-diff out
@TEST-START-FILE input.log
# @TEST-START-FILE input.log
#separator \x09
#path ssh
#fields b i
#types bool int
T -42
@TEST-END-FILE
# @TEST-END-FILE
redef exit_only_after_terminate = T;

4
testing/btest/scripts/base/frameworks/input/optional.zeek
View file

@ -2,7 +2,7 @@
# @TEST-EXEC: btest-bg-wait 10
# @TEST-EXEC: btest-diff out
@TEST-START-FILE input.log
# @TEST-START-FILE input.log
#separator \x09
#path ssh
#fields i b
@ -14,7 +14,7 @@
5 F
6 F
7 T
@TEST-END-FILE
# @TEST-END-FILE
redef exit_only_after_terminate = T;

8
testing/btest/scripts/base/frameworks/input/path-prefix/absolute-prefix.zeek
View file

@ -12,12 +12,12 @@
# @TEST-EXEC: ZEEKPATH=$ZEEKPATH:$TEST_BASE/scripts/base/frameworks/input/path-prefix zeek -b input.zeek >output
# @TEST-EXEC: btest-diff output
@TEST-START-FILE subdir/input.data
# @TEST-START-FILE subdir/input.data
#fields ip tag
127.0.3.1 just
127.0.3.2 some
127.0.3.3 value
@TEST-END-FILE
# @TEST-END-FILE
@load path-prefix-common-table.zeek
redef InputAscii::path_prefix = "@path_prefix@";
@ -28,7 +28,7 @@ event zeek_init()
$destination=destination, $want_record=F]);
}
# @TEST-START-NEXT
# # @TEST-START-NEXT
#
# The same test, but using event streams for input.
@ -41,7 +41,7 @@ event zeek_init()
$fields=Val, $ev=inputev]);
}
# @TEST-START-NEXT
# # @TEST-START-NEXT
#
# The same test again, but using file analysis w/ binary readers.

8
testing/btest/scripts/base/frameworks/input/path-prefix/absolute-source.zeek
View file

@ -6,12 +6,12 @@
# @TEST-EXEC: ZEEKPATH=$ZEEKPATH:$TEST_BASE/scripts/base/frameworks/input/path-prefix zeek -b input.zeek >output
# @TEST-EXEC: btest-diff output
@TEST-START-FILE input.data
# @TEST-START-FILE input.data
#fields ip tag
127.0.4.1 just
127.0.4.2 some
127.0.4.3 value
@TEST-END-FILE
# @TEST-END-FILE
@load path-prefix-common-table.zeek
redef InputAscii::path_prefix = "/this/does/not/exist";
@ -22,7 +22,7 @@ event zeek_init()
$destination=destination, $want_record=F]);
}
# @TEST-START-NEXT
# # @TEST-START-NEXT
#
# The same test, but using event streams for input.
@ -35,7 +35,7 @@ event zeek_init()
$fields=Val, $ev=inputev]);
}
# @TEST-START-NEXT
# # @TEST-START-NEXT
#
# The same test again, but using file analysis w/ binary readers.

8
testing/btest/scripts/base/frameworks/input/path-prefix/no-paths.zeek
View file

@ -4,12 +4,12 @@
# @TEST-EXEC: ZEEKPATH=$ZEEKPATH:$TEST_BASE/scripts/base/frameworks/input/path-prefix zeek -b %INPUT >output
# @TEST-EXEC: btest-diff output
@TEST-START-FILE input.data
# @TEST-START-FILE input.data
#fields ip tag
127.0.0.1 just
127.0.0.2 some
127.0.0.3 value
@TEST-END-FILE
# @TEST-END-FILE
@load path-prefix-common-table.zeek
@ -19,7 +19,7 @@ event zeek_init()
$destination=destination, $want_record=F]);
}
# @TEST-START-NEXT
# # @TEST-START-NEXT
#
# The same test, but using event streams for input.
@ -31,7 +31,7 @@ event zeek_init()
$fields=Val, $ev=inputev]);
}
# @TEST-START-NEXT
# # @TEST-START-NEXT
#
# The same test again, but using file analysis w/ binary readers.

8
testing/btest/scripts/base/frameworks/input/path-prefix/relative-prefix.zeek
View file

@ -6,12 +6,12 @@
# @TEST-EXEC: ZEEKPATH=$ZEEKPATH:$TEST_BASE/scripts/base/frameworks/input/path-prefix zeek -b %INPUT >output
# @TEST-EXEC: btest-diff output
@TEST-START-FILE alternative/input.data
# @TEST-START-FILE alternative/input.data
#fields ip tag
127.0.1.1 just
127.0.1.2 some
127.0.1.3 value
@TEST-END-FILE
# @TEST-END-FILE
@load path-prefix-common-table.zeek
redef InputAscii::path_prefix = "alternative";
@ -22,7 +22,7 @@ event zeek_init()
$destination=destination, $want_record=F]);
}
# @TEST-START-NEXT
# # @TEST-START-NEXT
#
# The same test, but using event streams for input.
@ -35,7 +35,7 @@ event zeek_init()
$fields=Val, $ev=inputev]);
}
# @TEST-START-NEXT
# # @TEST-START-NEXT
#
# The same test again, but using file analysis w/ binary readers.

4
testing/btest/scripts/base/frameworks/input/patterns.zeek
View file

@ -4,7 +4,7 @@
redef exit_only_after_terminate = T;
@TEST-START-FILE input.log
# @TEST-START-FILE input.log
#separator \x09
#fields i p
#types count pattern
@ -12,7 +12,7 @@ redef exit_only_after_terminate = T;
2 /cat/
3 /foo|bar/
4 /^oob/
@TEST-END-FILE
# @TEST-END-FILE
global outfile: file;

4
testing/btest/scripts/base/frameworks/input/port-embedded.zeek
View file

@ -3,14 +3,14 @@
# @TEST-EXEC: btest-diff zeek/.stdout
# @TEST-EXEC: btest-diff zeek/.stderr
@TEST-START-FILE input.log
# @TEST-START-FILE input.log
#fields i p
1.2.3.4 80/tcp
1.2.3.5 52/udp
1.2.3.6 30/unknown
1.2.3.7 50/trash
1.2.3.8 -1/tcp
@TEST-END-FILE
# @TEST-END-FILE
redef exit_only_after_terminate = T;

4
testing/btest/scripts/base/frameworks/input/port.zeek
View file

@ -2,12 +2,12 @@
# @TEST-EXEC: btest-bg-wait 10
# @TEST-EXEC: btest-diff out
@TEST-START-FILE input.log
# @TEST-START-FILE input.log
#fields i p t
1.2.3.4 80 tcp
1.2.3.5 52 udp
1.2.3.6 30 unknown
@TEST-END-FILE
# @TEST-END-FILE
redef exit_only_after_terminate = T;

4
testing/btest/scripts/base/frameworks/input/predicate-stream.zeek
View file

@ -6,7 +6,7 @@
# the reason is, that the code-paths are quite different, because then the
# ascii reader uses the put and not the sendevent interface
@TEST-START-FILE input.log
# @TEST-START-FILE input.log
#separator \x09
#path ssh
#fields i b
@ -18,7 +18,7 @@
5 F
6 F
7 T
@TEST-END-FILE
# @TEST-END-FILE
redef exit_only_after_terminate = T;

4
testing/btest/scripts/base/frameworks/input/predicate.zeek
View file

@ -2,7 +2,7 @@
# @TEST-EXEC: btest-bg-wait 10
# @TEST-EXEC: btest-diff out
@TEST-START-FILE input.log
# @TEST-START-FILE input.log
#separator \x09
#path ssh
#fields i b
@ -14,7 +14,7 @@
5 F
6 F
7 T
@TEST-END-FILE
# @TEST-END-FILE
redef exit_only_after_terminate = T;

4
testing/btest/scripts/base/frameworks/input/predicatemodify.zeek
View file

@ -2,14 +2,14 @@
# @TEST-EXEC: btest-bg-wait 10
# @TEST-EXEC: btest-diff out
@TEST-START-FILE input.log
# @TEST-START-FILE input.log
#separator \x09
#path ssh
#fields i b s ss
#types int bool string string
1 T test1 idx1
2 T test2 idx2
@TEST-END-FILE
# @TEST-END-FILE
redef exit_only_after_terminate = T;

20
testing/btest/scripts/base/frameworks/input/predicatemodifyandreread.zeek
View file

@ -12,48 +12,48 @@
# @TEST-EXEC: btest-diff out
#
@TEST-START-FILE input1.log
# @TEST-START-FILE input1.log
#separator \x09
#path ssh
#fields i b s ss
#types int bool string string
1 T test1 idx1
2 T test2 idx2
@TEST-END-FILE
# @TEST-END-FILE
@TEST-START-FILE input2.log
# @TEST-START-FILE input2.log
#separator \x09
#path ssh
#fields i b s ss
#types int bool string string
1 F test1 idx1
2 T test2 idx2
@TEST-END-FILE
# @TEST-END-FILE
@TEST-START-FILE input3.log
# @TEST-START-FILE input3.log
#separator \x09
#path ssh
#fields i b s ss
#types int bool string string
1 F test1 idx1
2 F test2 idx2
@TEST-END-FILE
# @TEST-END-FILE
@TEST-START-FILE input4.log
# @TEST-START-FILE input4.log
#separator \x09
#path ssh
#fields i b s ss
#types int bool string string
2 F test2 idx2
@TEST-END-FILE
# @TEST-END-FILE
@TEST-START-FILE input5.log
# @TEST-START-FILE input5.log
#separator \x09
#path ssh
#fields i b s ss
#types int bool string string
1 T test1 idx1
@TEST-END-FILE
# @TEST-END-FILE
redef exit_only_after_terminate = T;

4
testing/btest/scripts/base/frameworks/input/predicaterefusesecondsamerecord.zeek
View file

@ -7,12 +7,12 @@
# where the predicate accepts the first one and refuses the second one.
# Desired result -> first entry stays.
@TEST-START-FILE input.log
# @TEST-START-FILE input.log
#fields restriction guid severity confidence detecttime address protocol portlist asn prefix rir cc impact description alternativeid_restriction alternativeid
need-to-know 8c864306-d21a-37b1-8705-746a786719bf medium 65 1342656000 1.0.17.227 - - 2519 VECTANT VECTANT Ltd. 1.0.16.0/23 apnic JP spam infrastructure spamming public http://reputation.alienvault.com/reputation.generic
need-to-know 8c864306-d21a-37b1-8705-746a786719bf medium 95 1342569600 1.228.83.33 6 25 9318 HANARO-AS Hanaro Telecom Inc. 1.224.0.0/13 apnic KR spam infrastructure direct ube sources, spam operations & spam services public http://www.spamhaus.org/query/bl?ip=1.228.83.33
need-to-know 8c864306-d21a-37b1-8705-746a786719bf medium 65 1342656000 1.228.83.33 - - 9318 HANARO-AS Hanaro Telecom Inc. 1.224.0.0/13 apnic KR spam infrastructure spamming;malware domain public http://reputation.alienvault.com/reputation.generic
@TEST-END-FILE
# @TEST-END-FILE
redef exit_only_after_terminate = T;

4
testing/btest/scripts/base/frameworks/input/raw/basic.zeek
View file

@ -2,7 +2,7 @@
# @TEST-EXEC: btest-bg-wait 10
# @TEST-EXEC: btest-diff out
@TEST-START-FILE input.log
# @TEST-START-FILE input.log
sdfkh:KH;fdkncv;ISEUp34:Fkdj;YVpIODhfDF
DSF"DFKJ"SDFKLh304yrsdkfj@#(*U$34jfDJup3UF
q3r3057fdf
@ -11,7 +11,7 @@ sdfs\d
dfsdf
sdf
3rw43wRRERLlL#RWERERERE.
@TEST-END-FILE
# @TEST-END-FILE
redef exit_only_after_terminate = T;

4
testing/btest/scripts/base/frameworks/input/raw/execute.zeek
View file

@ -3,7 +3,7 @@
# @TEST-EXEC: cat out.tmp | sed 's/^ *//g' >out
# @TEST-EXEC: btest-diff out
@TEST-START-FILE input.log
# @TEST-START-FILE input.log
sdfkh:KH;fdkncv;ISEUp34:Fkdj;YVpIODhfDF
DSF"DFKJ"SDFKLh304yrsdkfj@#(*U$34jfDJup3UF
q3r3057fdf
@ -12,7 +12,7 @@ sdfs\d
dfsdf
sdf
3rw43wRRERLlL#RWERERERE.
@TEST-END-FILE
# @TEST-END-FILE
redef exit_only_after_terminate = T;

4
testing/btest/scripts/base/frameworks/input/raw/executestream-leftover.zeek
View file

@ -8,7 +8,7 @@ redef exit_only_after_terminate = T;
redef Threading::heartbeat_interval = 0.01sec;
@TEST-START-FILE run.sh
# @TEST-START-FILE run.sh
#!/usr/bin/env bash
echo -e -n "aaa\nb"
sleep 0.1
@ -17,7 +17,7 @@ sleep 0.1
echo "nal"
sleep infinity
@TEST-END-FILE
# @TEST-END-FILE
module A;

4
testing/btest/scripts/base/frameworks/input/raw/executestream-no-last-separator.zeek
View file

@ -8,7 +8,7 @@ redef exit_only_after_terminate = T;
redef Threading::heartbeat_interval = 0.01sec;
@TEST-START-FILE run.sh
# @TEST-START-FILE run.sh
#!/usr/bin/env bash
sleep 0.1
echo "aaa"
@ -19,7 +19,7 @@ echo -n "final"
sleep 0.1
exit 0
@TEST-END-FILE
# @TEST-END-FILE
module A;

4
testing/btest/scripts/base/frameworks/input/raw/executestream-slow-long.zeek
View file

@ -8,7 +8,7 @@ redef exit_only_after_terminate = T;
redef Threading::heartbeat_interval = 0.01sec;
@TEST-START-FILE run.sh
# @TEST-START-FILE run.sh
#!/usr/bin/env bash
sleep 0.1
echo -n "binary start"
@ -28,7 +28,7 @@ sleep 0.1
echo "final"
sleep infinity
@TEST-END-FILE
# @TEST-END-FILE
module A;

4
testing/btest/scripts/base/frameworks/input/raw/executestream-slow.zeek
View file

@ -8,7 +8,7 @@ redef exit_only_after_terminate = T;
redef Threading::heartbeat_interval = 0.01sec;
@TEST-START-FILE run.sh
# @TEST-START-FILE run.sh
#!/usr/bin/env bash
sleep 0.1
echo -n "aaa-"
@ -21,7 +21,7 @@ echo "aaa-bbb-ccc"
echo "final"
sleep infinity
@TEST-END-FILE
# @TEST-END-FILE
module A;

12
testing/btest/scripts/base/frameworks/input/raw/executestream.zeek
View file

@ -9,22 +9,22 @@
redef exit_only_after_terminate = T;
@TEST-START-FILE input1.log
# @TEST-START-FILE input1.log
sdfkh:KH;fdkncv;ISEUp34:Fkdj;YVpIODhfDF
@TEST-END-FILE
# @TEST-END-FILE
@TEST-START-FILE input2.log
# @TEST-START-FILE input2.log
DSF"DFKJ"SDFKLh304yrsdkfj@#(*U$34jfDJup3UF
q3r3057fdf
@TEST-END-FILE
# @TEST-END-FILE
@TEST-START-FILE input3.log
# @TEST-START-FILE input3.log
sdfs\d
dfsdf
sdf
3rw43wRRERLlL#RWERERERE.
@TEST-END-FILE
# @TEST-END-FILE
module A;

4
testing/btest/scripts/base/frameworks/input/raw/offset.zeek
View file

@ -5,9 +5,9 @@
# @TEST-EXEC: btest-bg-wait 10
# @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-sort btest-diff out
@TEST-START-FILE input.log
# @TEST-START-FILE input.log
sdfkh:KH;fdkncv;ISEUp34:Fkdj;YVpIODhfDF
@TEST-END-FILE
# @TEST-END-FILE
redef exit_only_after_terminate = T;

8
testing/btest/scripts/base/frameworks/input/raw/rereadraw.zeek
View file

@ -2,7 +2,7 @@
# @TEST-EXEC: btest-bg-wait 10
# @TEST-EXEC: btest-diff out
@TEST-START-FILE input.log
# @TEST-START-FILE input.log
sdfkh:KH;fdkncv;ISEUp34:Fkdj;YVpIODhfDF
DSF"DFKJ"SDFKLh304yrsdkfj@#(*U$34jfDJup3UF
q3r3057fdf
@ -11,13 +11,13 @@ sdfs\d
dfsdf
sdf
3rw43wRRERLlL#RWERERERE.
@TEST-END-FILE
# @TEST-END-FILE
@TEST-START-FILE input2.log
# @TEST-START-FILE input2.log
Beginning of input2.log
3rw43wRRERLlL#RWERERERE.
game over
@TEST-END-FILE
# @TEST-END-FILE
redef Threading::heartbeat_interval = 100msec;
redef exit_only_after_terminate = T;

4
testing/btest/scripts/base/frameworks/input/raw/rereadraw2.zeek
View file

@ -3,13 +3,13 @@
# @TEST-EXEC: zeek -b %INPUT > out
# @TEST-EXEC: btest-diff out
@TEST-START-FILE input.log
# @TEST-START-FILE input.log
First
Second
Third
Fourth
@TEST-END-FILE
# @TEST-END-FILE
@load base/frameworks/input

12
testing/btest/scripts/base/frameworks/input/raw/streamraw.zeek
View file

@ -9,22 +9,22 @@
redef exit_only_after_terminate = T;
@TEST-START-FILE input1.log
# @TEST-START-FILE input1.log
sdfkh:KH;fdkncv;ISEUp34:Fkdj;YVpIODhfDF
@TEST-END-FILE
# @TEST-END-FILE
@TEST-START-FILE input2.log
# @TEST-START-FILE input2.log
DSF"DFKJ"SDFKLh304yrsdkfj@#(*U$34jfDJup3UF
q3r3057fdf
@TEST-END-FILE
# @TEST-END-FILE
@TEST-START-FILE input3.log
# @TEST-START-FILE input3.log
sdfs\d
dfsdf
sdf
3rw43wRRERLlL#RWERERERE.
@TEST-END-FILE
# @TEST-END-FILE
module A;

12
testing/btest/scripts/base/frameworks/input/raw/streamtail.zeek
View file

@ -23,17 +23,17 @@
redef exit_only_after_terminate = T;
@TEST-START-FILE input1.log
# @TEST-START-FILE input1.log
sdfkh:KH;fdkncv;ISEUp34:Fkdj;YVpIODhfDF
@TEST-END-FILE
# @TEST-END-FILE
@TEST-START-FILE input2.log
# @TEST-START-FILE input2.log
DSF"DFKJ"SDFKLh304yrsdkfj@#(*U$34jfDJup3UF
@TEST-END-FILE
# @TEST-END-FILE
@TEST-START-FILE input3.log
# @TEST-START-FILE input3.log
3rw43wRRERLlL#RWERERERE.
@TEST-END-FILE
# @TEST-END-FILE
module A;

12
testing/btest/scripts/base/frameworks/input/raw/streamtail2.zeek
View file

@ -23,17 +23,17 @@
redef exit_only_after_terminate = T;
@TEST-START-FILE input1.log
# @TEST-START-FILE input1.log
sdfkh:KH;fdkncv;ISEUp34:Fkdj;YVpIODhfDF
@TEST-END-FILE
# @TEST-END-FILE
@TEST-START-FILE input2.log
# @TEST-START-FILE input2.log
DSF"DFKJ"SDFKLh304yrsdkfj@#(*U$34jfDJup3UF
@TEST-END-FILE
# @TEST-END-FILE
@TEST-START-FILE input3.log
# @TEST-START-FILE input3.log
3rw43wRRERLlL#RWERERERE.
@TEST-END-FILE
# @TEST-END-FILE
module A;

4
testing/btest/scripts/base/frameworks/input/repeat.zeek
View file

@ -2,13 +2,13 @@
# @TEST-EXEC: btest-bg-wait 10
# @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-sort btest-diff out
@TEST-START-FILE input.log
# @TEST-START-FILE input.log
#separator \x09
#path ssh
#fields i b
#types int bool
1 T
@TEST-END-FILE
# @TEST-END-FILE
redef exit_only_after_terminate = T;

20
testing/btest/scripts/base/frameworks/input/reread.zeek
View file

@ -16,30 +16,30 @@
# @TEST-EXEC: btest-diff events.out
# @TEST-EXEC: btest-diff preds.out
@TEST-START-FILE input1.log
# @TEST-START-FILE input1.log
#separator \x09
#path ssh
#fields b i e c p sn a d t iv s sc ss se vc ve f
#types bool int enum count port subnet addr double time interval string table table table vector vector func
T -42 SSH::LOG 21 123 10.0.0.0/24 1.2.3.4 3.14 1315801931.273616 100.000000 hurz 2,4,1,3 CC,AA,BB EMPTY 10,20,30 EMPTY SSH::foo\x0a{ \x0aif (0 < SSH::i) \x0a\x09return (Foo);\x0aelse\x0a\x09return (Bar);\x0a\x0a}
@TEST-END-FILE
@TEST-START-FILE input2.log
# @TEST-END-FILE
# @TEST-START-FILE input2.log
#separator \x09
#path ssh
#fields b i e c p sn a d t iv s sc ss se vc ve f
#types bool int enum count port subnet addr double time interval string table table table vector vector func
T -42 SSH::LOG 21 123 10.0.0.0/24 1.2.3.4 3.14 1315801931.273616 100.000000 hurz 2,4,1,3 CC,AA,BB EMPTY 10,20,30 EMPTY SSH::foo\x0a{ \x0aif (0 < SSH::i) \x0a\x09return (Foo);\x0aelse\x0a\x09return (Bar);\x0a\x0a}
T -43 SSH::LOG 21 123 10.0.0.0/24 1.2.3.4 3.14 1315801931.273616 100.000000 hurz 2,4,1,3 CC,AA,BB EMPTY 10,20,30 EMPTY SSH::foo\x0a{ \x0aif (0 < SSH::i) \x0a\x09return (Foo);\x0aelse\x0a\x09return (Bar);\x0a\x0a}
@TEST-END-FILE
@TEST-START-FILE input3.log
# @TEST-END-FILE
# @TEST-START-FILE input3.log
#separator \x09
#path ssh
#fields b i e c p sn a d t iv s sc ss se vc ve f
#types bool int enum count port subnet addr double time interval string table table table vector vector func
T -42 SSH::LOG 21 123 10.0.0.0/24 1.2.3.4 3.14 1315801931.273616 100.000000 hurz 2,4,1,3 CC,AA,BB EMPTY 10,20,30 EMPTY SSH::foo\x0a{ \x0aif (0 < SSH::i) \x0a\x09return (Foo);\x0aelse\x0a\x09return (Bar);\x0a\x0a}
F -43 SSH::LOG 21 123 10.0.0.0/24 1.2.3.4 3.14 1315801931.273616 100.000000 hurz 2,4,1,3 CC,AA,BB EMPTY 10,20,30 EMPTY SSH::foo\x0a{ \x0aif (0 < SSH::i) \x0a\x09return (Foo);\x0aelse\x0a\x09return (Bar);\x0a\x0a}
@TEST-END-FILE
@TEST-START-FILE input4.log
# @TEST-END-FILE
# @TEST-START-FILE input4.log
#separator \x09
#path ssh
#fields b i e c p sn a d t iv s sc ss se vc ve f
@ -51,14 +51,14 @@ F -45 SSH::LOG 21 123 10.0.0.0/24 1.2.3.4 3.14 1315801931.273616 100.000000 hurz
0 -46 SSH::LOG 21 123 10.0.0.0/24 1.2.3.4 3.14 1315801931.273616 100.000000 hurz 2,4,1,3 CC,AA,BB EMPTY 10,20,30 EMPTY SSH::foo\x0a{ \x0aif (0 < SSH::i) \x0a\x09return (Foo);\x0aelse\x0a\x09return (Bar);\x0a\x0a}
F -47 SSH::LOG 21 123 10.0.0.0/24 1.2.3.4 3.14 1315801931.273616 100.000000 hurz 2,4,1,3 CC,AA,BB EMPTY 10,20,30 EMPTY SSH::foo\x0a{ \x0aif (0 < SSH::i) \x0a\x09return (Foo);\x0aelse\x0a\x09return (Bar);\x0a\x0a}
F -48 SSH::LOG 21 123 10.0.0.0/24 1.2.3.4 3.14 1315801931.273616 100.000000 hurz 2,4,1,3 CC,AA,BB EMPTY 10,20,30 EMPTY SSH::foo\x0a{ \x0aif (0 < SSH::i) \x0a\x09return (Foo);\x0aelse\x0a\x09return (Bar);\x0a\x0a}
@TEST-END-FILE
@TEST-START-FILE input5.log
# @TEST-END-FILE
# @TEST-START-FILE input5.log
#separator \x09
#path ssh
#fields b i e c p sn a d t iv s sc ss se vc ve f
#types bool int enum count port subnet addr double time interval string table table table vector vector func
F -48 SSH::LOG 21 123 10.0.0.0/24 1.2.3.4 3.14 1315801931.273616 100.000000 hurz 2,4,1,3 CC,AA,BB EMPTY 10,20,30 EMPTY SSH::foo\x0a{ \x0aif (0 < SSH::i) \x0a\x09return (Foo);\x0aelse\x0a\x09return (Bar);\x0a\x0a}
@TEST-END-FILE
# @TEST-END-FILE
@load base/protocols/ssh

12
testing/btest/scripts/base/frameworks/input/set-event-reread.zeek
View file

@ -7,23 +7,23 @@
# @TEST-EXEC: btest-bg-wait 30
# @TEST-EXEC: btest-diff out
@TEST-START-FILE entries.set1
# @TEST-START-FILE entries.set1
#fields s
one
two
three
@TEST-END-FILE
# @TEST-END-FILE
@TEST-START-FILE entries.set2
# @TEST-START-FILE entries.set2
#fields s
one
@TEST-END-FILE
# @TEST-END-FILE
@TEST-START-FILE entries.set3
# @TEST-START-FILE entries.set3
#fields s
one
four
@TEST-END-FILE
# @TEST-END-FILE
redef exit_only_after_terminate=T;

8
testing/btest/scripts/base/frameworks/input/set-event-stream.zeek
View file

@ -5,18 +5,18 @@
# @TEST-EXEC: btest-bg-wait 30
# @TEST-EXEC: btest-diff out
@TEST-START-FILE entries.set1
# @TEST-START-FILE entries.set1
#fields s
one
two
three
@TEST-END-FILE
# @TEST-END-FILE
@TEST-START-FILE entries.set2
# @TEST-START-FILE entries.set2
four
five
six
@TEST-END-FILE
# @TEST-END-FILE
redef exit_only_after_terminate=T;

4
testing/btest/scripts/base/frameworks/input/set.zeek
View file

@ -2,7 +2,7 @@
# @TEST-EXEC: btest-bg-wait 10
# @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-sort btest-diff out
@TEST-START-FILE input.log
# @TEST-START-FILE input.log
#separator \x09
#fields ip
#types addr
@ -11,7 +11,7 @@
192.168.17.7
192.168.17.14
192.168.17.42
@TEST-END-FILE
# @TEST-END-FILE
redef exit_only_after_terminate = T;

4
testing/btest/scripts/base/frameworks/input/setseparator.zeek
View file

@ -2,11 +2,11 @@
# @TEST-EXEC: btest-bg-wait 10
# @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-sort btest-diff out
@TEST-START-FILE input.log
# @TEST-START-FILE input.log
#separator \x09
#fields i s ss
1 a|b|c|d|e|f 1|2|3|4|5|6
@TEST-END-FILE
# @TEST-END-FILE
redef InputAscii::set_separator = "|";

4
testing/btest/scripts/base/frameworks/input/setspecialcases.zeek
View file

@ -2,7 +2,7 @@
# @TEST-EXEC: btest-bg-wait 10
# @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-sort btest-diff out
@TEST-START-FILE input.log
# @TEST-START-FILE input.log
#separator \x09
#fields i s ss
1 testing\x2ctesting\x2ctesting\x2c testing\x2ctesting\x2ctesting\x2c
@ -11,7 +11,7 @@
4 testing, testing,
5 ,,, ,,,
6
@TEST-END-FILE
# @TEST-END-FILE
redef exit_only_after_terminate = T;

4
testing/btest/scripts/base/frameworks/input/sqlite/basic.zeek
View file

@ -8,7 +8,7 @@
# @TEST-EXEC: btest-bg-wait 10
# @TEST-EXEC: btest-diff out
@TEST-START-FILE conn.sql
# @TEST-START-FILE conn.sql
PRAGMA foreign_keys=OFF;
BEGIN TRANSACTION;
CREATE TABLE conn (
@ -71,7 +71,7 @@ INSERT INTO "conn" VALUES(1.30047516978033089643e+09,'1xFx4PGdeq5','141.142.220.
INSERT INTO "conn" VALUES(1.3004751686520030498e+09,'WIG1ud65z22','141.142.220.118',35634,'208.80.152.2',80,6,'tcp',NULL,6.1328887939453125e-02,463,350,'OTH',NULL,NULL,0,'DdA',2,567,1,402,'(empty)',6);
INSERT INTO "conn" VALUES(1.3004751688929131031e+09,'o2gAkl4V7sa','141.142.220.118',49999,'208.80.152.3',80,6,'tcp','http',2.20960855484008789062e-01,1137,733,'S1',NULL,NULL,0,'ShADad',6,1457,4,949,'(empty)',6);
COMMIT;
@TEST-END-FILE
# @TEST-END-FILE
@load base/protocols/conn

4
testing/btest/scripts/base/frameworks/input/sqlite/error.zeek
View file

@ -9,7 +9,7 @@
# @TEST-EXEC: sed '1d' .stderr | sort > cmpfile
# @TEST-EXEC: btest-diff cmpfile
@TEST-START-FILE ssh.sql
# @TEST-START-FILE ssh.sql
PRAGMA foreign_keys=OFF;
BEGIN TRANSACTION;
CREATE TABLE ssh (
@ -33,7 +33,7 @@ CREATE TABLE ssh (
);
INSERT INTO "ssh" VALUES(1,-42,'SSH::LOG',21,123,'10.0.0.0/24','1.2.3.4',3.14,1.35837684939385390286e+09,100.0,'hurz','2,4,1,3','CC,AA,BB','(empty)','10,20,30','', null);
COMMIT;
@TEST-END-FILE
# @TEST-END-FILE
redef exit_only_after_terminate = T;

4
testing/btest/scripts/base/frameworks/input/sqlite/port.zeek
View file

@ -8,7 +8,7 @@
# @TEST-EXEC: btest-bg-wait 10
# @TEST-EXEC: btest-diff out
@TEST-START-FILE port.sql
# @TEST-START-FILE port.sql
PRAGMA foreign_keys=OFF;
BEGIN TRANSACTION;
CREATE TABLE port (
@ -18,7 +18,7 @@ CREATE TABLE port (
INSERT INTO "port" VALUES(5353,'udp');
INSERT INTO "port" VALUES(6162,'tcp');
COMMIT;
@TEST-END-FILE
# @TEST-END-FILE
redef exit_only_after_terminate = T;

4
testing/btest/scripts/base/frameworks/input/sqlite/types.zeek
View file

@ -8,7 +8,7 @@
# @TEST-EXEC: btest-bg-wait 10
# @TEST-EXEC: btest-diff out
@TEST-START-FILE ssh.sql
# @TEST-START-FILE ssh.sql
PRAGMA foreign_keys=OFF;
BEGIN TRANSACTION;
CREATE TABLE ssh (
@ -32,7 +32,7 @@ CREATE TABLE ssh (
);
INSERT INTO "ssh" VALUES(1,-42,'SSH::LOG',21,123,'10.0.0.0/24','1.2.3.4',3.14,1.35837684939385390286e+09,100.0,'hurz','2,4,1,3','CC,AA,BB','(empty)','10,20,30','', null);
COMMIT;
@TEST-END-FILE
# @TEST-END-FILE
redef exit_only_after_terminate = T;

12
testing/btest/scripts/base/frameworks/input/stream.zeek
View file

@ -7,19 +7,19 @@
# @TEST-EXEC: btest-bg-wait 10
# @TEST-EXEC: btest-diff out
@TEST-START-FILE input1.log
# @TEST-START-FILE input1.log
#separator \x09
#path ssh
#fields b i e c p sn a d t iv s sc ss se vc ve f
#types bool int enum count port subnet addr double time interval string table table table vector vector func
T -42 SSH::LOG 21 123 10.0.0.0/24 1.2.3.4 3.14 1315801931.273616 100.000000 hurz 2,4,1,3 CC,AA,BB EMPTY 10,20,30 EMPTY SSH::foo\x0a{ \x0aif (0 < SSH::i) \x0a\x09return (Foo);\x0aelse\x0a\x09return (Bar);\x0a\x0a}
@TEST-END-FILE
@TEST-START-FILE input2.log
# @TEST-END-FILE
# @TEST-START-FILE input2.log
T -43 SSH::LOG 21 123 10.0.0.0/24 1.2.3.4 3.14 1315801931.273616 100.000000 hurz 2,4,1,3 CC,AA,BB EMPTY 10,20,30 EMPTY SSH::foo\x0a{ \x0aif (0 < SSH::i) \x0a\x09return (Foo);\x0aelse\x0a\x09return (Bar);\x0a\x0a}
@TEST-END-FILE
@TEST-START-FILE input3.log
# @TEST-END-FILE
# @TEST-START-FILE input3.log
F -43 SSH::LOG 21 123 10.0.0.0/24 1.2.3.4 3.14 1315801931.273616 100.000000 hurz 2,4,1,3 CC,AA,BB EMPTY 10,20,30 EMPTY SSH::foo\x0a{ \x0aif (0 < SSH::i) \x0a\x09return (Foo);\x0aelse\x0a\x09return (Bar);\x0a\x0a}
@TEST-END-FILE
# @TEST-END-FILE
@load base/protocols/ssh
redef exit_only_after_terminate = T;

4
testing/btest/scripts/base/frameworks/input/subrecord-event.zeek
View file

@ -2,13 +2,13 @@
# @TEST-EXEC: btest-bg-wait 10
# @TEST-EXEC: btest-diff out
@TEST-START-FILE input.log
# @TEST-START-FILE input.log
#separator \x09
#path ssh
#fields sub.b i sub.e sub.c sub.p sub.sn sub.two.a sub.two.d t iv s sc ss se vc ve f
#types bool int enum count port subnet addr double time interval string table table table vector vector func
T -42 SSH::LOG 21 123 10.0.0.0/24 1.2.3.4 3.14 1315801931.273616 100.000000 hurz 2,4,1,3 CC,AA,BB EMPTY 10,20,30 EMPTY SSH::foo\x0a{ \x0aif (0 < SSH::i) \x0a\x09return (Foo);\x0aelse\x0a\x09return (Bar);\x0a\x0a}
@TEST-END-FILE
# @TEST-END-FILE
@load base/protocols/ssh
redef exit_only_after_terminate = T;

4
testing/btest/scripts/base/frameworks/input/subrecord.zeek
View file

@ -2,13 +2,13 @@
# @TEST-EXEC: btest-bg-wait 10
# @TEST-EXEC: btest-diff out
@TEST-START-FILE input.log
# @TEST-START-FILE input.log
#separator \x09
#path ssh
#fields sub.b i sub.e sub.c sub.p sub.sn sub.two.a sub.two.d t iv s sc ss se vc ve f
#types bool int enum count port subnet addr double time interval string table table table vector vector func
T -42 SSH::LOG 21 123 10.0.0.0/24 1.2.3.4 3.14 1315801931.273616 100.000000 hurz 2,4,1,3 CC,AA,BB EMPTY 10,20,30 EMPTY SSH::foo\x0a{ \x0aif (0 < SSH::i) \x0a\x09return (Foo);\x0aelse\x0a\x09return (Bar);\x0a\x0a}
@TEST-END-FILE
# @TEST-END-FILE
@load base/protocols/ssh
redef exit_only_after_terminate = T;

4
testing/btest/scripts/base/frameworks/input/tableevent.zeek
View file

@ -2,7 +2,7 @@
# @TEST-EXEC: btest-bg-wait 10
# @TEST-EXEC: btest-diff out
@TEST-START-FILE input.log
# @TEST-START-FILE input.log
#separator \x09
#path ssh
#fields i b
@ -14,7 +14,7 @@
5 F
6 F
7 T
@TEST-END-FILE
# @TEST-END-FILE
redef exit_only_after_terminate = T;

12
testing/btest/scripts/base/frameworks/input/twotables.zeek
View file

@ -8,27 +8,27 @@
# @TEST-EXEC: btest-diff pred2.out
# @TEST-EXEC: btest-diff fin.out
@TEST-START-FILE input1.log
# @TEST-START-FILE input1.log
#separator \x09
#path ssh
#fields b i e c p sn a d t iv s sc ss se vc ve f
#types bool int enum count port subnet addr double time interval string table table table vector vector func
T -42 SSH::LOG 21 123 10.0.0.0/24 1.2.3.4 3.14 1315801931.273616 100.000000 hurz 2,4,1,3 CC,AA,BB EMPTY 10,20,30 EMPTY SSH::foo\x0a{ \x0aif (0 < SSH::i) \x0a\x09return (Foo);\x0aelse\x0a\x09return (Bar);\x0a\x0a}
@TEST-END-FILE
@TEST-START-FILE input2.log
# @TEST-END-FILE
# @TEST-START-FILE input2.log
#separator \x09
#path ssh
#fields b i e c p sn a d t iv s sc ss se vc ve f
#types bool int enum count port subnet addr double time interval string table table table vector vector func
T -43 SSH::LOG 21 123 10.0.0.0/24 1.2.3.4 3.14 1315801931.273616 100.000000 hurz 2,4,1,3 CC,AA,BB EMPTY 10,20,30 EMPTY SSH::foo\x0a{ \x0aif (0 < SSH::i) \x0a\x09return (Foo);\x0aelse\x0a\x09return (Bar);\x0a\x0a}
@TEST-END-FILE
@TEST-START-FILE input3.log
# @TEST-END-FILE
# @TEST-START-FILE input3.log
#separator \x09
#path ssh
#fields b i e c p sn a d t iv s sc ss se vc ve f
#types bool int enum count port subnet addr double time interval string table table table vector vector func
F -44 SSH::LOG 21 123 10.0.0.0/24 1.2.3.4 3.14 1315801931.273616 100.000000 hurz 2,4,1,3 CC,AA,BB EMPTY 10,20,30 EMPTY SSH::foo\x0a{ \x0aif (0 < SSH::i) \x0a\x09return (Foo);\x0aelse\x0a\x09return (Bar);\x0a\x0a}
@TEST-END-FILE
# @TEST-END-FILE
@load base/protocols/ssh
redef exit_only_after_terminate = T;

4
testing/btest/scripts/base/frameworks/input/unsupported_types.zeek
View file

@ -2,13 +2,13 @@
# @TEST-EXEC: btest-bg-wait 10
# @TEST-EXEC: btest-diff out
@TEST-START-FILE input.log
# @TEST-START-FILE input.log
#separator \x09
#path ssh
#fields fi b i e c p sn a d t iv s sc ss se vc ve f
#types file bool int enum count port subnet addr double time interval string table table table vector vector func
whatever T -42 SSH::LOG 21 123 10.0.0.0/24 1.2.3.4 3.14 1315801931.273616 100.000000 hurz 2,4,1,3 CC,AA,BB EMPTY 10,20,30 EMPTY SSH::foo\x0a{ \x0aif (0 < SSH::i) \x0a\x09return (Foo);\x0aelse\x0a\x09return (Bar);\x0a\x0a}
@TEST-END-FILE
# @TEST-END-FILE
@load base/protocols/ssh
redef exit_only_after_terminate = T;

4
testing/btest/scripts/base/frameworks/input/windows.zeek
View file

@ -6,13 +6,13 @@
redef exit_only_after_terminate = T;
@TEST-START-FILE input.log
# @TEST-START-FILE input.log
#separator \x09
#path ssh
#fields b i e c p sn a d t iv s sc ss se vc ve ns
#types bool int enum count port subnet addr double time interval string table table table vector vector string
T -42 SSH::LOG 21 123 10.0.0.0/24 1.2.3.4 3.14 1315801931.273616 100.000000 hurz 2,4,1,3 CC,AA,BB EMPTY 10,20,30 EMPTY 4242
@TEST-END-FILE
# @TEST-END-FILE
@load base/protocols/ssh