Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Fixed some tests.

Browse source
This commit is contained in:
Seth Hall 2013-08-12 15:31:31 -04:00
parent 091c8f3ebc
commit 95161a920c
7 changed files with 35 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

3
doc/scripts/DocSourcesList.cmake
View file

@ -70,6 +70,8 @@ rest_target(${CMAKE_BINARY_DIR}/scripts base/bif/plugins/Bro_TCP.events.bif.bro)
rest_target(${CMAKE_BINARY_DIR}/scripts base/bif/plugins/Bro_TCP.functions.bif.bro) rest_target(${CMAKE_BINARY_DIR}/scripts base/bif/plugins/Bro_TCP.functions.bif.bro)
rest_target(${CMAKE_BINARY_DIR}/scripts base/bif/plugins/Bro_Teredo.events.bif.bro) rest_target(${CMAKE_BINARY_DIR}/scripts base/bif/plugins/Bro_Teredo.events.bif.bro)
rest_target(${CMAKE_BINARY_DIR}/scripts base/bif/plugins/Bro_UDP.events.bif.bro) rest_target(${CMAKE_BINARY_DIR}/scripts base/bif/plugins/Bro_UDP.events.bif.bro)
rest_target(${CMAKE_BINARY_DIR}/scripts base/bif/plugins/Bro_Unified2.events.bif.bro)
rest_target(${CMAKE_BINARY_DIR}/scripts base/bif/plugins/Bro_Unified2.types.bif.bro)
rest_target(${CMAKE_BINARY_DIR}/scripts base/bif/plugins/Bro_ZIP.events.bif.bro) rest_target(${CMAKE_BINARY_DIR}/scripts base/bif/plugins/Bro_ZIP.events.bif.bro)
rest_target(${CMAKE_BINARY_DIR}/scripts base/bif/reporter.bif.bro) rest_target(${CMAKE_BINARY_DIR}/scripts base/bif/reporter.bif.bro)
rest_target(${CMAKE_BINARY_DIR}/scripts base/bif/strings.bif.bro) rest_target(${CMAKE_BINARY_DIR}/scripts base/bif/strings.bif.bro)
@ -77,6 +79,7 @@ rest_target(${CMAKE_BINARY_DIR}/scripts base/bif/top-k.bif.bro)
rest_target(${CMAKE_BINARY_DIR}/scripts base/bif/types.bif.bro) rest_target(${CMAKE_BINARY_DIR}/scripts base/bif/types.bif.bro)
rest_target(${psd} base/files/extract/main.bro) rest_target(${psd} base/files/extract/main.bro)
rest_target(${psd} base/files/hash/main.bro) rest_target(${psd} base/files/hash/main.bro)
rest_target(${psd} base/files/unified2/main.bro)
rest_target(${psd} base/frameworks/analyzer/main.bro) rest_target(${psd} base/frameworks/analyzer/main.bro)
rest_target(${psd} base/frameworks/cluster/main.bro) rest_target(${psd} base/frameworks/cluster/main.bro)
rest_target(${psd} base/frameworks/cluster/nodes/manager.bro) rest_target(${psd} base/frameworks/cluster/nodes/manager.bro)

11
scripts/base/files/unified2/main.bro
View file

@ -16,10 +16,14 @@ export {
global alert: event(f: fa_file, ev: Unified2::IDSEvent, pkt: Unified2::Packet); global alert: event(f: fa_file, ev: Unified2::IDSEvent, pkt: Unified2::Packet);
type Info: record { type Info: record {
## The last received IDS event. This is primarily used
## for tying together Unified2 events and packets.
current_event: Unified2::IDSEvent &optional; current_event: Unified2::IDSEvent &optional;
}; };
redef record fa_file += { redef record fa_file += {
## Add a field to store per-file state about Unified2
## files.
unified2: Info &optional; unified2: Info &optional;
}; };
} }
@ -48,8 +52,13 @@ event bro_init()
event file_new(f: fa_file) event file_new(f: fa_file)
{ {
local file_dir = "";
local parts = split_all(f$source, /\/[^\/]*$/);
if ( |parts| == 3 )
file_dir = parts[1];
if ( f$source in watch_file || if ( f$source in watch_file ||
compress_path(extract_path(f$source)) == compress_path(watch_dir) ) compress_path(watch_dir) == file_dir )
{ {
Files::add_analyzer(f, Files::ANALYZER_UNIFIED2); Files::add_analyzer(f, Files::ANALYZER_UNIFIED2);
f$unified2 = Info(); f$unified2 = Info();

9
scripts/base/init-bare.bro
View file

@ -2704,9 +2704,12 @@ export {
impact_flag: count; impact_flag: count;
impact: count; impact: count;
blocked: count; blocked: count;
mpls_label: count &optional; ## Not available in "legacy" IDS events. ## Not available in "legacy" IDS events.
vlan_id: count &optional; ## Not available in "legacy" IDS events. mpls_label: count &optional;
packet_action: count &optional; ## Only available in "legacy" IDS events. ## Not available in "legacy" IDS events.
vlan_id: count &optional;
## Only available in "legacy" IDS events.
packet_action: count &optional;
}; };
type Unified2::Packet: record { type Unified2::Packet: record {

5
scripts/base/utils/paths.bro
View file

@ -9,12 +9,13 @@ const absolute_path_pat = /(\/|[A-Za-z]:[\\\/]).*/;
## Returns: the first absolute path found in input string, else an empty string ## Returns: the first absolute path found in input string, else an empty string
function extract_path(input: string): string function extract_path(input: string): string
{ {
local dir_pattern = /([^\\\/]+)$/; const dir_pattern = /(\/|[A-Za-z]:[\\\/])([^\"\ ]|(\\\ ))*/;
local parts = split_all(input, dir_pattern); local parts = split_all(input, dir_pattern);
if ( |parts| < 3 ) if ( |parts| < 3 )
return ""; return "";
return parts[1]; return parts[2];
} }
## Compresses a given path by removing '..'s and the parent directory it ## Compresses a given path by removing '..'s and the parent directory it

6
testing/btest/Baseline/coverage.bare-load-baseline/canonified_loaded_scripts.log
View file

@ -3,7 +3,7 @@
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path loaded_scripts #path loaded_scripts
#open 2013-08-09-16-13-58 #open 2013-08-12-19-04-42
#fields name #fields name
#types string #types string
scripts/base/init-bare.bro scripts/base/init-bare.bro
@ -61,6 +61,8 @@ scripts/base/init-bare.bro
build/scripts/base/bif/plugins/Bro_TCP.functions.bif.bro build/scripts/base/bif/plugins/Bro_TCP.functions.bif.bro
build/scripts/base/bif/plugins/Bro_Teredo.events.bif.bro build/scripts/base/bif/plugins/Bro_Teredo.events.bif.bro
build/scripts/base/bif/plugins/Bro_UDP.events.bif.bro build/scripts/base/bif/plugins/Bro_UDP.events.bif.bro
build/scripts/base/bif/plugins/Bro_Unified2.events.bif.bro
build/scripts/base/bif/plugins/Bro_Unified2.types.bif.bro
build/scripts/base/bif/plugins/Bro_ZIP.events.bif.bro build/scripts/base/bif/plugins/Bro_ZIP.events.bif.bro
scripts/base/frameworks/logging/__load__.bro scripts/base/frameworks/logging/__load__.bro
scripts/base/frameworks/logging/main.bro scripts/base/frameworks/logging/main.bro
@ -94,4 +96,4 @@ scripts/base/init-bare.bro
build/scripts/base/bif/top-k.bif.bro build/scripts/base/bif/top-k.bif.bro
scripts/policy/misc/loaded-scripts.bro scripts/policy/misc/loaded-scripts.bro
scripts/base/utils/paths.bro scripts/base/utils/paths.bro
#close 2013-08-09-16-13-58 #close 2013-08-12-19-04-42

8
testing/btest/Baseline/coverage.default-load-baseline/canonified_loaded_scripts.log
View file

@ -3,7 +3,7 @@
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path loaded_scripts #path loaded_scripts
#open 2013-08-09-16-13-37 #open 2013-08-12-19-05-30
#fields name #fields name
#types string #types string
scripts/base/init-bare.bro scripts/base/init-bare.bro
@ -61,6 +61,8 @@ scripts/base/init-bare.bro
build/scripts/base/bif/plugins/Bro_TCP.functions.bif.bro build/scripts/base/bif/plugins/Bro_TCP.functions.bif.bro
build/scripts/base/bif/plugins/Bro_Teredo.events.bif.bro build/scripts/base/bif/plugins/Bro_Teredo.events.bif.bro
build/scripts/base/bif/plugins/Bro_UDP.events.bif.bro build/scripts/base/bif/plugins/Bro_UDP.events.bif.bro
build/scripts/base/bif/plugins/Bro_Unified2.events.bif.bro
build/scripts/base/bif/plugins/Bro_Unified2.types.bif.bro
build/scripts/base/bif/plugins/Bro_ZIP.events.bif.bro build/scripts/base/bif/plugins/Bro_ZIP.events.bif.bro
scripts/base/frameworks/logging/__load__.bro scripts/base/frameworks/logging/__load__.bro
scripts/base/frameworks/logging/main.bro scripts/base/frameworks/logging/main.bro
@ -206,6 +208,8 @@ scripts/base/init-default.bro
scripts/base/files/hash/main.bro scripts/base/files/hash/main.bro
scripts/base/files/extract/__load__.bro scripts/base/files/extract/__load__.bro
scripts/base/files/extract/main.bro scripts/base/files/extract/main.bro
scripts/base/files/unified2/__load__.bro
scripts/base/files/unified2/main.bro
scripts/base/misc/find-checksum-offloading.bro scripts/base/misc/find-checksum-offloading.bro
scripts/policy/misc/loaded-scripts.bro scripts/policy/misc/loaded-scripts.bro
#close 2013-08-09-16-13-37 #close 2013-08-12-19-05-30

6
testing/btest/Baseline/scripts.base.frameworks.file-analysis.logging/files.log
View file

@ -3,8 +3,8 @@
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path files #path files
#open 2013-07-25-16-57-31 #open 2013-08-12-19-07-37
#fields ts fuid tx_hosts rx_hosts conn_uids source depth analyzers mime_type filename duration local_orig is_orig seen_bytes total_bytes missing_bytes overflow_bytes timedout parent_fuid md5 sha1 sha256 extracted #fields ts fuid tx_hosts rx_hosts conn_uids source depth analyzers mime_type filename duration local_orig is_orig seen_bytes total_bytes missing_bytes overflow_bytes timedout parent_fuid md5 sha1 sha256 extracted
#types time string table[addr] table[addr] table[string] string count table[string] string string interval bool bool count count count count bool string string string string string #types time string table[addr] table[addr] table[string] string count table[string] string string interval bool bool count count count count bool string string string string string
1362692527.009721 G75mcAsU764 192.150.187.43 141.142.228.5 UWkUyAuUGXf HTTP 0 SHA256,DATA_EVENT,MD5,EXTRACT,SHA1 text/plain - 0.000054 - F 4705 4705 0 0 F - 397168fd09991a0e712254df7bc639ac 1dd7ac0398df6cbc0696445a91ec681facf4dc47 4e7c7ef0984119447e743e3ec77e1de52713e345cde03fe7df753a35849bed18 G75mcAsU764-file 1362692527.009721 G75mcAsU764 192.150.187.43 141.142.228.5 UWkUyAuUGXf HTTP 0 UNIFIED2,SHA256,DATA_EVENT,MD5,EXTRACT,SHA1 text/plain - 0.000054 - F 4705 4705 0 0 F - 397168fd09991a0e712254df7bc639ac 1dd7ac0398df6cbc0696445a91ec681facf4dc47 4e7c7ef0984119447e743e3ec77e1de52713e345cde03fe7df753a35849bed18 G75mcAsU764-file
#close 2013-07-25-16-57-31 #close 2013-08-12-19-07-37