mirror of
https://github.com/zeek/zeek.git
synced 2025-10-15 21:18:20 +00:00
Merge branch 'master' into topic/jsiwek/faf-updates
Conflicts: testing/btest/Baseline/coverage.default-load-baseline/canonified_loaded_scripts.log
This commit is contained in:
Jon Siwek
commit
9bd7a65071
91 changed files with 14058 additions and 402 deletions
27
testing/btest/Baseline/bifs.bloomfilter/output
Normal file
27
testing/btest/Baseline/bifs.bloomfilter/output
Normal file
|
|
@ -0,0 +1,27 @@
|
|||
error: incompatible Bloom filter types
|
||||
error: incompatible Bloom filter types
|
||||
error: incompatible Bloom filter types
|
||||
error: incompatible Bloom filter types
|
||||
error: false-positive rate must take value between 0 and 1
|
||||
error: false-positive rate must take value between 0 and 1
|
||||
0
|
||||
1
|
||||
1
|
||||
0
|
||||
1
|
||||
1
|
||||
1
|
||||
1
|
||||
1
|
||||
1
|
||||
1
|
||||
1
|
||||
1
|
||||
2
|
||||
3
|
||||
3
|
||||
2
|
||||
3
|
||||
3
|
||||
3
|
||||
2
|
||||
|
|
@ -3,7 +3,7 @@
|
|||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path loaded_scripts
|
||||
#open 2013-07-25-19-59-47
|
||||
#open 2013-07-29-22-37-52
|
||||
#fields name
|
||||
#types string
|
||||
scripts/base/init-bare.bro
|
||||
|
|
@ -12,6 +12,7 @@ scripts/base/init-bare.bro
|
|||
build/scripts/base/bif/strings.bif.bro
|
||||
build/scripts/base/bif/bro.bif.bro
|
||||
build/scripts/base/bif/reporter.bif.bro
|
||||
build/scripts/base/bif/bloom-filter.bif.bro
|
||||
build/scripts/base/bif/event.bif.bro
|
||||
build/scripts/base/bif/plugins/__load__.bro
|
||||
build/scripts/base/bif/plugins/Bro_ARP.events.bif.bro
|
||||
|
|
@ -89,6 +90,7 @@ scripts/base/init-bare.bro
|
|||
build/scripts/base/bif/file_analysis.bif.bro
|
||||
scripts/base/utils/site.bro
|
||||
scripts/base/utils/patterns.bro
|
||||
build/scripts/base/bif/__load__.bro
|
||||
scripts/policy/misc/loaded-scripts.bro
|
||||
scripts/base/utils/paths.bro
|
||||
#close 2013-07-25-19-59-47
|
||||
#close 2013-07-29-22-37-52
|
||||
|
|
|
|||
|
|
@ -3,7 +3,7 @@
|
|||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path loaded_scripts
|
||||
#open 2013-07-29-20-08-38
|
||||
#open 2013-07-29-22-37-53
|
||||
#fields name
|
||||
#types string
|
||||
scripts/base/init-bare.bro
|
||||
|
|
@ -12,6 +12,7 @@ scripts/base/init-bare.bro
|
|||
build/scripts/base/bif/strings.bif.bro
|
||||
build/scripts/base/bif/bro.bif.bro
|
||||
build/scripts/base/bif/reporter.bif.bro
|
||||
build/scripts/base/bif/bloom-filter.bif.bro
|
||||
build/scripts/base/bif/event.bif.bro
|
||||
build/scripts/base/bif/plugins/__load__.bro
|
||||
build/scripts/base/bif/plugins/Bro_ARP.events.bif.bro
|
||||
|
|
@ -89,13 +90,19 @@ scripts/base/init-bare.bro
|
|||
build/scripts/base/bif/file_analysis.bif.bro
|
||||
scripts/base/utils/site.bro
|
||||
scripts/base/utils/patterns.bro
|
||||
build/scripts/base/bif/__load__.bro
|
||||
scripts/base/init-default.bro
|
||||
scripts/base/utils/active-http.bro
|
||||
scripts/base/utils/exec.bro
|
||||
scripts/base/utils/addrs.bro
|
||||
scripts/base/utils/conn-ids.bro
|
||||
scripts/base/utils/dir.bro
|
||||
scripts/base/frameworks/reporter/__load__.bro
|
||||
scripts/base/frameworks/reporter/main.bro
|
||||
scripts/base/utils/paths.bro
|
||||
scripts/base/utils/directions-and-hosts.bro
|
||||
scripts/base/utils/files.bro
|
||||
scripts/base/utils/numbers.bro
|
||||
scripts/base/utils/paths.bro
|
||||
scripts/base/utils/queue.bro
|
||||
scripts/base/utils/strings.bro
|
||||
scripts/base/utils/thresholds.bro
|
||||
|
|
@ -129,8 +136,6 @@ scripts/base/init-default.bro
|
|||
scripts/base/frameworks/intel/__load__.bro
|
||||
scripts/base/frameworks/intel/main.bro
|
||||
scripts/base/frameworks/intel/input.bro
|
||||
scripts/base/frameworks/reporter/__load__.bro
|
||||
scripts/base/frameworks/reporter/main.bro
|
||||
scripts/base/frameworks/sumstats/__load__.bro
|
||||
scripts/base/frameworks/sumstats/main.bro
|
||||
scripts/base/frameworks/sumstats/plugins/__load__.bro
|
||||
|
|
@ -197,4 +202,4 @@ scripts/base/init-default.bro
|
|||
scripts/base/files/extract/main.bro
|
||||
scripts/base/misc/find-checksum-offloading.bro
|
||||
scripts/policy/misc/loaded-scripts.bro
|
||||
#close 2013-07-29-20-08-38
|
||||
#close 2013-07-29-22-37-53
|
||||
|
|
|
|||
|
|
@ -3,8 +3,8 @@
|
|||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path intel
|
||||
#open 2012-10-03-20-20-39
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p seen.host seen.str seen.str_type seen.where sources
|
||||
#types time string addr port addr port addr string enum enum table[string]
|
||||
1349295639.424940 - - - - - 123.123.123.123 - - Intel::IN_ANYWHERE worker-1
|
||||
#close 2012-10-03-20-20-49
|
||||
#open 2013-07-19-17-05-48
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p seen.indicator seen.indicator_type seen.where sources
|
||||
#types time string addr port addr port string enum enum table[string]
|
||||
1374253548.038580 - - - - - 123.123.123.123 Intel::ADDR Intel::IN_ANYWHERE worker-1
|
||||
#close 2013-07-19-17-05-57
|
||||
|
|
|
|||
|
|
@ -3,9 +3,9 @@
|
|||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path intel
|
||||
#open 2012-10-03-20-18-05
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p seen.host seen.str seen.str_type seen.where sources
|
||||
#types time string addr port addr port addr string enum enum table[string]
|
||||
1349295485.114156 - - - - - - e@mail.com Intel::EMAIL SOMEWHERE source1
|
||||
1349295485.114156 - - - - - 1.2.3.4 - - SOMEWHERE source1
|
||||
#close 2012-10-03-20-18-05
|
||||
#open 2013-07-19-17-04-26
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p seen.indicator seen.indicator_type seen.where sources
|
||||
#types time string addr port addr port string enum enum table[string]
|
||||
1374253466.857185 - - - - - e@mail.com Intel::EMAIL SOMEWHERE source1
|
||||
1374253466.857185 - - - - - 1.2.3.4 Intel::ADDR SOMEWHERE source1
|
||||
#close 2013-07-19-17-04-26
|
||||
|
|
|
|||
|
|
@ -3,11 +3,11 @@
|
|||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path intel
|
||||
#open 2012-10-10-15-05-23
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p seen.host seen.str seen.str_type seen.where sources
|
||||
#types time string addr port addr port addr string enum enum table[string]
|
||||
1349881523.548946 - - - - - 1.2.3.4 - - Intel::IN_A_TEST source1
|
||||
1349881523.548946 - - - - - - e@mail.com Intel::EMAIL Intel::IN_A_TEST source1
|
||||
1349881524.567896 - - - - - 1.2.3.4 - - Intel::IN_A_TEST source1
|
||||
1349881524.567896 - - - - - - e@mail.com Intel::EMAIL Intel::IN_A_TEST source1
|
||||
#close 2012-10-10-15-05-24
|
||||
#open 2013-07-19-17-06-57
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p seen.indicator seen.indicator_type seen.where sources
|
||||
#types time string addr port addr port string enum enum table[string]
|
||||
1374253617.312158 - - - - - 1.2.3.4 Intel::ADDR Intel::IN_A_TEST source1
|
||||
1374253617.312158 - - - - - e@mail.com Intel::EMAIL Intel::IN_A_TEST source1
|
||||
1374253618.332565 - - - - - 1.2.3.4 Intel::ADDR Intel::IN_A_TEST source1
|
||||
1374253618.332565 - - - - - e@mail.com Intel::EMAIL Intel::IN_A_TEST source1
|
||||
#close 2013-07-19-17-07-06
|
||||
|
|
|
|||
|
|
@ -32,10 +32,10 @@
|
|||
<field type="variable32" name="username" pack_unique="yes"/>
|
||||
<field type="variable32" name="password" pack_unique="yes"/>
|
||||
<field type="variable32" name="proxied" pack_unique="yes"/>
|
||||
<field type="variable32" name="mime_type" pack_unique="yes"/>
|
||||
<field type="variable32" name="md5" pack_unique="yes"/>
|
||||
<field type="variable32" name="extracted_request_files" pack_unique="yes"/>
|
||||
<field type="variable32" name="extracted_response_files" pack_unique="yes"/>
|
||||
<field type="variable32" name="orig_fuids" pack_unique="yes"/>
|
||||
<field type="variable32" name="orig_mime_types" pack_unique="yes"/>
|
||||
<field type="variable32" name="resp_fuids" pack_unique="yes"/>
|
||||
<field type="variable32" name="resp_mime_types" pack_unique="yes"/>
|
||||
</ExtentType>
|
||||
<!-- ts : time -->
|
||||
<!-- uid : string -->
|
||||
|
|
@ -60,13 +60,13 @@
|
|||
<!-- username : string -->
|
||||
<!-- password : string -->
|
||||
<!-- proxied : table[string] -->
|
||||
<!-- mime_type : string -->
|
||||
<!-- md5 : string -->
|
||||
<!-- extracted_request_files : vector[string] -->
|
||||
<!-- extracted_response_files : vector[string] -->
|
||||
<!-- orig_fuids : vector[string] -->
|
||||
<!-- orig_mime_types : vector[string] -->
|
||||
<!-- resp_fuids : vector[string] -->
|
||||
<!-- resp_mime_types : vector[string] -->
|
||||
|
||||
# Extent, type='http'
|
||||
ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied mime_type md5 extracted_request_files extracted_response_files
|
||||
ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied orig_fuids orig_mime_types resp_fuids resp_mime_types
|
||||
1300475168.784020 j4u32Pc5bif 141.142.220.118 48649 208.80.152.118 80 1 GET bits.wikimedia.org /skins-1.5/monobook/main.css http://www.wikipedia.org/ Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.15) Gecko/20110303 Ubuntu/10.04 (lucid) Firefox/3.6.15 0 0 304 Not Modified 0
|
||||
1300475168.916018 VW0XPVINV8a 141.142.220.118 49997 208.80.152.3 80 1 GET upload.wikimedia.org /wikipedia/commons/6/63/Wikipedia-logo.png http://www.wikipedia.org/ Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.15) Gecko/20110303 Ubuntu/10.04 (lucid) Firefox/3.6.15 0 0 304 Not Modified 0
|
||||
1300475168.916183 3PKsZ2Uye21 141.142.220.118 49996 208.80.152.3 80 1 GET upload.wikimedia.org /wikipedia/commons/thumb/b/bb/Wikipedia_wordmark.svg/174px-Wikipedia_wordmark.svg.png http://www.wikipedia.org/ Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.15) Gecko/20110303 Ubuntu/10.04 (lucid) Firefox/3.6.15 0 0 304 Not Modified 0
|
||||
|
|
|
|||
|
|
@ -0,0 +1,10 @@
|
|||
#separator \x09
|
||||
#set_separator ,
|
||||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path dns
|
||||
#open 2013-07-25-20-29-44
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto trans_id query qclass qclass_name qtype qtype_name rcode rcode_name AA TC RD RA Z answers TTLs rejected
|
||||
#types time string addr port addr port enum count string count string count string count string bool bool bool bool count vector[string] vector[interval] bool
|
||||
1359565680.761790 UWkUyAuUGXf 192.168.6.10 53209 192.168.129.36 53 udp 41477 paypal.com 1 C_INTERNET 48 DNSKEY 0 NOERROR F F T F 1 - - F
|
||||
#close 2013-07-25-20-29-44
|
||||
|
|
@ -0,0 +1,5 @@
|
|||
[code=200, msg=OK^M, body=It works!, headers={
|
||||
[Server] = 1.0,
|
||||
[Content-type] = text/plain,
|
||||
[Date] = July 22, 2013
|
||||
}]
|
||||
10
testing/btest/Baseline/scripts.base.utils.dir/bro..stdout
Normal file
10
testing/btest/Baseline/scripts.base.utils.dir/bro..stdout
Normal file
|
|
@ -0,0 +1,10 @@
|
|||
new_file1, ../testdir/bye
|
||||
new_file1, ../testdir/hi
|
||||
new_file1, ../testdir/howsitgoing
|
||||
new_file2, ../testdir/bye
|
||||
new_file2, ../testdir/hi
|
||||
new_file2, ../testdir/howsitgoing
|
||||
new_file1, ../testdir/bye
|
||||
new_file1, ../testdir/newone
|
||||
new_file2, ../testdir/bye
|
||||
new_file2, ../testdir/newone
|
||||
|
|
@ -0,0 +1,7 @@
|
|||
test1, [exit_code=0, signal_exit=F, stdout=[done, exit, stop], stderr=<uninitialized>, files={
|
||||
[out1] = [insert text here, and here],
|
||||
[out2] = [insert more text here, and there]
|
||||
}]
|
||||
test2, [exit_code=1, signal_exit=F, stdout=[here's something on stdout, some more stdout, last stdout], stderr=[and some stderr, more stderr, last stderr], files=<uninitialized>]
|
||||
test3, [exit_code=9, signal_exit=F, stdout=[FML], stderr=<uninitialized>, files=<uninitialized>]
|
||||
test4, [exit_code=0, signal_exit=F, stdout=[hibye], stderr=<uninitialized>, files=<uninitialized>]
|
||||
|
|
@ -24,4 +24,11 @@ cleanup:
|
|||
update-doc-sources:
|
||||
../../doc/scripts/genDocSourcesList.sh ../../doc/scripts/DocSourcesList.cmake
|
||||
|
||||
# Updates the three coverage tests that usually need tweaking when
|
||||
# scripts get added/removed.
|
||||
update-coverage-tests: update-doc-sources
|
||||
btest -qU coverage.bare-load-baseline
|
||||
btest -qU coverage.default-load-baseline
|
||||
@echo "Use 'git diff' to check updates look right."
|
||||
|
||||
.PHONY: all btest-verbose brief btest-brief coverage cleanup
|
||||
|
|
|
|||
BIN
testing/btest/Traces/dns-dnskey.trace
Normal file
BIN
testing/btest/Traces/dns-dnskey.trace
Normal file
Binary file not shown.
83
testing/btest/bifs/bloomfilter.bro
Normal file
83
testing/btest/bifs/bloomfilter.bro
Normal file
|
|
@ -0,0 +1,83 @@
|
|||
# @TEST-EXEC: bro -b %INPUT >output 2>&1
|
||||
# @TEST-EXEC: btest-diff output
|
||||
|
||||
function test_basic_bloom_filter()
|
||||
{
|
||||
# Basic usage with counts.
|
||||
local bf_cnt = bloomfilter_basic_init(0.1, 1000);
|
||||
bloomfilter_add(bf_cnt, 42);
|
||||
bloomfilter_add(bf_cnt, 84);
|
||||
bloomfilter_add(bf_cnt, 168);
|
||||
print bloomfilter_lookup(bf_cnt, 0);
|
||||
print bloomfilter_lookup(bf_cnt, 42);
|
||||
print bloomfilter_lookup(bf_cnt, 168);
|
||||
print bloomfilter_lookup(bf_cnt, 336);
|
||||
bloomfilter_add(bf_cnt, 0.5); # Type mismatch
|
||||
bloomfilter_add(bf_cnt, "foo"); # Type mismatch
|
||||
|
||||
# Basic usage with strings.
|
||||
local bf_str = bloomfilter_basic_init(0.9, 10);
|
||||
bloomfilter_add(bf_str, "foo");
|
||||
bloomfilter_add(bf_str, "bar");
|
||||
print bloomfilter_lookup(bf_str, "foo");
|
||||
print bloomfilter_lookup(bf_str, "bar");
|
||||
print bloomfilter_lookup(bf_str, "b4z"); # FP
|
||||
print bloomfilter_lookup(bf_str, "quux"); # FP
|
||||
bloomfilter_add(bf_str, 0.5); # Type mismatch
|
||||
bloomfilter_add(bf_str, 100); # Type mismatch
|
||||
|
||||
# Edge cases.
|
||||
local bf_edge0 = bloomfilter_basic_init(0.000000000001, 1);
|
||||
local bf_edge1 = bloomfilter_basic_init(0.00000001, 100000000);
|
||||
local bf_edge2 = bloomfilter_basic_init(0.9999999, 1);
|
||||
local bf_edge3 = bloomfilter_basic_init(0.9999999, 100000000000);
|
||||
|
||||
# Invalid parameters.
|
||||
local bf_bug0 = bloomfilter_basic_init(-0.5, 42);
|
||||
local bf_bug1 = bloomfilter_basic_init(1.1, 42);
|
||||
|
||||
# Merging
|
||||
local bf_cnt2 = bloomfilter_basic_init(0.1, 1000);
|
||||
bloomfilter_add(bf_cnt2, 42);
|
||||
bloomfilter_add(bf_cnt, 100);
|
||||
local bf_merged = bloomfilter_merge(bf_cnt, bf_cnt2);
|
||||
print bloomfilter_lookup(bf_merged, 42);
|
||||
print bloomfilter_lookup(bf_merged, 84);
|
||||
print bloomfilter_lookup(bf_merged, 100);
|
||||
print bloomfilter_lookup(bf_merged, 168);
|
||||
}
|
||||
|
||||
function test_counting_bloom_filter()
|
||||
{
|
||||
local bf = bloomfilter_counting_init(3, 32, 3);
|
||||
bloomfilter_add(bf, "foo");
|
||||
print bloomfilter_lookup(bf, "foo"); # 1
|
||||
bloomfilter_add(bf, "foo");
|
||||
print bloomfilter_lookup(bf, "foo"); # 2
|
||||
bloomfilter_add(bf, "foo");
|
||||
print bloomfilter_lookup(bf, "foo"); # 3
|
||||
bloomfilter_add(bf, "foo");
|
||||
print bloomfilter_lookup(bf, "foo"); # still 3
|
||||
|
||||
|
||||
bloomfilter_add(bf, "bar");
|
||||
bloomfilter_add(bf, "bar");
|
||||
print bloomfilter_lookup(bf, "bar"); # 2
|
||||
print bloomfilter_lookup(bf, "foo"); # still 3
|
||||
|
||||
# Merging
|
||||
local bf2 = bloomfilter_counting_init(3, 32, 3);
|
||||
bloomfilter_add(bf2, "baz");
|
||||
bloomfilter_add(bf2, "baz");
|
||||
bloomfilter_add(bf2, "bar");
|
||||
local bf_merged = bloomfilter_merge(bf, bf2);
|
||||
print bloomfilter_lookup(bf_merged, "foo");
|
||||
print bloomfilter_lookup(bf_merged, "bar");
|
||||
print bloomfilter_lookup(bf_merged, "baz");
|
||||
}
|
||||
|
||||
event bro_init()
|
||||
{
|
||||
test_basic_bloom_filter();
|
||||
test_counting_bloom_filter();
|
||||
}
|
||||
|
|
@ -10,5 +10,8 @@
|
|||
#
|
||||
# @TEST-EXEC: test -d $DIST/scripts
|
||||
# @TEST-EXEC: for script in `find $DIST/scripts/ -name \*\.bro -not -path '*/site/*'`; do echo "=== $script" >>allerrors; if echo "$script" | egrep -q 'communication/listen|controllee'; then rm -rf load_attempt .bgprocs; btest-bg-run load_attempt bro -b $script; btest-bg-wait -k 2; cat load_attempt/.stderr >>allerrors; else bro -b $script 2>>allerrors; fi done || exit 0
|
||||
# @TEST-EXEC: cat allerrors | grep -v "received termination signal" | grep -v '===' | sort | uniq > unique_errors
|
||||
# @TEST-EXEC: cat allerrors | grep -v "received termination signal" | fgrep -v -f %INPUT | grep -v '===' | sort | uniq > unique_errors
|
||||
# @TEST-EXEC: btest-diff unique_errors
|
||||
|
||||
# White-list of tests to exclude because of cyclic load dependencies.
|
||||
scripts/base/protocols/ftp/utils.bro
|
||||
|
|
|
|||
|
|
@ -12,6 +12,9 @@ global sha1_handle: opaque of sha1 &persistent &synchronized;
|
|||
global sha256_handle: opaque of sha256 &persistent &synchronized;
|
||||
global entropy_handle: opaque of entropy &persistent &synchronized;
|
||||
|
||||
global bloomfilter_elements: set[string] &persistent &synchronized;
|
||||
global bloomfilter_handle: opaque of bloomfilter &persistent &synchronized;
|
||||
|
||||
event bro_done()
|
||||
{
|
||||
local out = open("output.log");
|
||||
|
|
@ -36,6 +39,9 @@ event bro_done()
|
|||
print out, entropy_test_finish(entropy_handle);
|
||||
else
|
||||
print out, "entropy_test_add() failed";
|
||||
|
||||
for ( e in bloomfilter_elements )
|
||||
print bloomfilter_lookup(bloomfilter_handle, e);
|
||||
}
|
||||
|
||||
@TEST-END-FILE
|
||||
|
|
@ -47,6 +53,9 @@ global sha1_handle: opaque of sha1 &persistent &synchronized;
|
|||
global sha256_handle: opaque of sha256 &persistent &synchronized;
|
||||
global entropy_handle: opaque of entropy &persistent &synchronized;
|
||||
|
||||
global bloomfilter_elements = { "foo", "bar", "baz" } &persistent &synchronized;
|
||||
global bloomfilter_handle: opaque of bloomfilter &persistent &synchronized;
|
||||
|
||||
event bro_init()
|
||||
{
|
||||
local out = open("expected.log");
|
||||
|
|
@ -72,6 +81,10 @@ event bro_init()
|
|||
entropy_handle = entropy_test_init();
|
||||
if ( ! entropy_test_add(entropy_handle, "f") )
|
||||
print out, "entropy_test_add() failed";
|
||||
|
||||
bloomfilter_handle = bloomfilter_basic_init(0.1, 100);
|
||||
for ( e in bloomfilter_elements )
|
||||
bloomfilter_add(bloomfilter_handle, e);
|
||||
}
|
||||
|
||||
@TEST-END-FILE
|
||||
|
|
|
|||
|
|
@ -28,7 +28,7 @@ event remote_connection_handshake_done(p: event_peer)
|
|||
# Insert the data once both workers are connected.
|
||||
if ( Cluster::local_node_type() == Cluster::MANAGER && Cluster::worker_count == 2 )
|
||||
{
|
||||
Intel::insert([$host=1.2.3.4,$meta=[$source="manager"]]);
|
||||
Intel::insert([$indicator="1.2.3.4", $indicator_type=Intel::ADDR, $meta=[$source="manager"]]);
|
||||
}
|
||||
}
|
||||
|
||||
|
|
@ -39,7 +39,7 @@ event Intel::cluster_new_item(item: Intel::Item)
|
|||
if ( ! is_remote_event() )
|
||||
return;
|
||||
|
||||
print fmt("cluster_new_item: %s inserted by %s (from peer: %s)", item$host, item$meta$source, get_event_peer()$descr);
|
||||
print fmt("cluster_new_item: %s inserted by %s (from peer: %s)", item$indicator, item$meta$source, get_event_peer()$descr);
|
||||
|
||||
if ( ! sent_data )
|
||||
{
|
||||
|
|
@ -47,9 +47,9 @@ event Intel::cluster_new_item(item: Intel::Item)
|
|||
# full cluster is constructed.
|
||||
sent_data = T;
|
||||
if ( Cluster::node == "worker-1" )
|
||||
Intel::insert([$host=123.123.123.123,$meta=[$source="worker-1"]]);
|
||||
Intel::insert([$indicator="123.123.123.123", $indicator_type=Intel::ADDR, $meta=[$source="worker-1"]]);
|
||||
if ( Cluster::node == "worker-2" )
|
||||
Intel::insert([$host=4.3.2.1,$meta=[$source="worker-2"]]);
|
||||
Intel::insert([$indicator="4.3.2.1", $indicator_type=Intel::ADDR, $meta=[$source="worker-2"]]);
|
||||
}
|
||||
|
||||
# We're forcing worker-2 to do a lookup when it has three intelligence items
|
||||
|
|
|
|||
|
|
@ -5,10 +5,10 @@
|
|||
# @TEST-EXEC: btest-diff broproc/intel.log
|
||||
|
||||
@TEST-START-FILE intel.dat
|
||||
#fields host net str str_type meta.source meta.desc meta.url
|
||||
1.2.3.4 - - - source1 this host is just plain baaad http://some-data-distributor.com/1234
|
||||
1.2.3.4 - - - source1 this host is just plain baaad http://some-data-distributor.com/1234
|
||||
- - e@mail.com Intel::EMAIL source1 Phishing email source http://some-data-distributor.com/100000
|
||||
#fields indicator indicator_type meta.source meta.desc meta.url
|
||||
1.2.3.4 Intel::ADDR source1 this host is just plain baaad http://some-data-distributor.com/1234
|
||||
1.2.3.4 Intel::ADDR source1 this host is just plain baaad http://some-data-distributor.com/1234
|
||||
e@mail.com Intel::EMAIL source1 Phishing email source http://some-data-distributor.com/100000
|
||||
@TEST-END-FILE
|
||||
|
||||
@load frameworks/communication/listen
|
||||
|
|
@ -18,8 +18,8 @@ redef enum Intel::Where += { SOMEWHERE };
|
|||
|
||||
event do_it()
|
||||
{
|
||||
Intel::seen([$str="e@mail.com",
|
||||
$str_type=Intel::EMAIL,
|
||||
Intel::seen([$indicator="e@mail.com",
|
||||
$indicator_type=Intel::EMAIL,
|
||||
$where=SOMEWHERE]);
|
||||
|
||||
Intel::seen([$host=1.2.3.4,
|
||||
|
|
|
|||
|
|
@ -19,10 +19,10 @@ redef Cluster::nodes = {
|
|||
@TEST-END-FILE
|
||||
|
||||
@TEST-START-FILE intel.dat
|
||||
#fields host net str str_type meta.source meta.desc meta.url
|
||||
1.2.3.4 - - - source1 this host is just plain baaad http://some-data-distributor.com/1234
|
||||
1.2.3.4 - - - source1 this host is just plain baaad http://some-data-distributor.com/1234
|
||||
- - e@mail.com Intel::EMAIL source1 Phishing email source http://some-data-distributor.com/100000
|
||||
#fields indicator indicator_type meta.source meta.desc meta.url
|
||||
1.2.3.4 Intel::ADDR source1 this host is just plain baaad http://some-data-distributor.com/1234
|
||||
1.2.3.4 Intel::ADDR source1 this host is just plain baaad http://some-data-distributor.com/1234
|
||||
e@mail.com Intel::EMAIL source1 Phishing email source http://some-data-distributor.com/100000
|
||||
@TEST-END-FILE
|
||||
|
||||
@load base/frameworks/control
|
||||
|
|
@ -41,7 +41,7 @@ redef enum Intel::Where += {
|
|||
event do_it()
|
||||
{
|
||||
Intel::seen([$host=1.2.3.4, $where=Intel::IN_A_TEST]);
|
||||
Intel::seen([$str="e@mail.com", $str_type=Intel::EMAIL, $where=Intel::IN_A_TEST]);
|
||||
Intel::seen([$indicator="e@mail.com", $indicator_type=Intel::EMAIL, $where=Intel::IN_A_TEST]);
|
||||
}
|
||||
|
||||
event bro_init()
|
||||
|
|
|
|||
4
testing/btest/scripts/base/protocols/dns/dns-key.bro
Normal file
4
testing/btest/scripts/base/protocols/dns/dns-key.bro
Normal file
|
|
@ -0,0 +1,4 @@
|
|||
# Making sure DNSKEY gets logged as such.
|
||||
#
|
||||
# @TEST-EXEC: bro -r $TRACES/dns-dnskey.trace
|
||||
# @TEST-EXEC: btest-diff dns.log
|
||||
28
testing/btest/scripts/base/utils/active-http.test
Normal file
28
testing/btest/scripts/base/utils/active-http.test
Normal file
|
|
@ -0,0 +1,28 @@
|
|||
# @TEST-REQUIRES: which httpd
|
||||
# @TEST-REQUIRES: which python
|
||||
#
|
||||
# @TEST-EXEC: btest-bg-run httpd python $SCRIPTS/httpd.py --max 1
|
||||
# @TEST-EXEC: sleep 3
|
||||
# @TEST-EXEC: btest-bg-run bro bro -b %INPUT
|
||||
# @TEST-EXEC: btest-bg-wait 15
|
||||
# @TEST-EXEC: btest-diff bro/.stdout
|
||||
|
||||
@load base/utils/active-http
|
||||
|
||||
redef exit_only_after_terminate = T;
|
||||
|
||||
event bro_init()
|
||||
{
|
||||
local req = ActiveHTTP::Request($url="localhost:32123");
|
||||
|
||||
when ( local resp = ActiveHTTP::request(req) )
|
||||
{
|
||||
print resp;
|
||||
terminate();
|
||||
}
|
||||
timeout 1min
|
||||
{
|
||||
print "HTTP request timeout";
|
||||
terminate();
|
||||
}
|
||||
}
|
||||
58
testing/btest/scripts/base/utils/dir.test
Normal file
58
testing/btest/scripts/base/utils/dir.test
Normal file
|
|
@ -0,0 +1,58 @@
|
|||
# @TEST-EXEC: btest-bg-run bro bro -b ../dirtest.bro
|
||||
# @TEST-EXEC: btest-bg-wait 10
|
||||
# @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-sort btest-diff bro/.stdout
|
||||
|
||||
@TEST-START-FILE dirtest.bro
|
||||
|
||||
@load base/utils/dir
|
||||
|
||||
redef exit_only_after_terminate = T;
|
||||
|
||||
global c: count = 0;
|
||||
|
||||
function check_terminate_condition()
|
||||
{
|
||||
c += 1;
|
||||
|
||||
if ( c == 10 )
|
||||
terminate();
|
||||
}
|
||||
|
||||
function new_file1(fname: string)
|
||||
{
|
||||
print "new_file1", fname;
|
||||
check_terminate_condition();
|
||||
}
|
||||
|
||||
function new_file2(fname: string)
|
||||
{
|
||||
print "new_file2", fname;
|
||||
check_terminate_condition();
|
||||
}
|
||||
|
||||
event change_things()
|
||||
{
|
||||
system("touch ../testdir/newone");
|
||||
system("rm ../testdir/bye && touch ../testdir/bye");
|
||||
}
|
||||
|
||||
event bro_init()
|
||||
{
|
||||
Dir::monitor("../testdir", new_file1, .5sec);
|
||||
Dir::monitor("../testdir", new_file2, 1sec);
|
||||
schedule 1sec { change_things() };
|
||||
}
|
||||
|
||||
@TEST-END-FILE
|
||||
|
||||
@TEST-START-FILE testdir/hi
|
||||
123
|
||||
@TEST-END-FILE
|
||||
|
||||
@TEST-START-FILE testdir/howsitgoing
|
||||
abc
|
||||
@TEST-END-FILE
|
||||
|
||||
@TEST-START-FILE testdir/bye
|
||||
!@#
|
||||
@TEST-END-FILE
|
||||
74
testing/btest/scripts/base/utils/exec.test
Normal file
74
testing/btest/scripts/base/utils/exec.test
Normal file
|
|
@ -0,0 +1,74 @@
|
|||
# @TEST-EXEC: btest-bg-run bro bro -b ../exectest.bro
|
||||
# @TEST-EXEC: btest-bg-wait 10
|
||||
# @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-sort btest-diff bro/.stdout
|
||||
|
||||
@TEST-START-FILE exectest.bro
|
||||
|
||||
@load base/utils/exec
|
||||
|
||||
redef exit_only_after_terminate = T;
|
||||
|
||||
global c: count = 0;
|
||||
|
||||
function check_exit_condition()
|
||||
{
|
||||
c += 1;
|
||||
|
||||
if ( c == 4 )
|
||||
terminate();
|
||||
}
|
||||
|
||||
function test_cmd(label: string, cmd: Exec::Command)
|
||||
{
|
||||
when ( local result = Exec::run(cmd) )
|
||||
{
|
||||
print label, result;
|
||||
check_exit_condition();
|
||||
}
|
||||
}
|
||||
|
||||
event bro_init()
|
||||
{
|
||||
test_cmd("test1", [$cmd="bash ../somescript.sh",
|
||||
$read_files=set("out1", "out2")]);
|
||||
test_cmd("test2", [$cmd="bash ../nofiles.sh"]);
|
||||
test_cmd("test3", [$cmd="bash ../suicide.sh"]);
|
||||
test_cmd("test4", [$cmd="bash ../stdin.sh", $stdin="hibye"]);
|
||||
}
|
||||
|
||||
@TEST-END-FILE
|
||||
|
||||
@TEST-START-FILE somescript.sh
|
||||
#! /usr/bin/env bash
|
||||
echo "insert text here" > out1
|
||||
echo "and here" >> out1
|
||||
echo "insert more text here" > out2
|
||||
echo "and there" >> out2
|
||||
echo "done"
|
||||
echo "exit"
|
||||
echo "stop"
|
||||
@TEST-END-FILE
|
||||
|
||||
@TEST-START-FILE nofiles.sh
|
||||
#! /usr/bin/env bash
|
||||
echo "here's something on stdout"
|
||||
echo "some more stdout"
|
||||
echo "last stdout"
|
||||
echo "and some stderr" 1>&2
|
||||
echo "more stderr" 1>&2
|
||||
echo "last stderr" 1>&2
|
||||
exit 1
|
||||
@TEST-END-FILE
|
||||
|
||||
@TEST-START-FILE suicide.sh
|
||||
#! /usr/bin/env bash
|
||||
echo "FML"
|
||||
kill -9 $$
|
||||
echo "nope"
|
||||
@TEST-END-FILE
|
||||
|
||||
@TEST-START-FILE stdin.sh
|
||||
#! /usr/bin/env bash
|
||||
read -r line
|
||||
echo "$line"
|
||||
@TEST-END-FILE
|
||||
40
testing/scripts/httpd.py
Executable file
40
testing/scripts/httpd.py
Executable file
|
|
@ -0,0 +1,40 @@
|
|||
#! /usr/bin/env python
|
||||
|
||||
import BaseHTTPServer
|
||||
|
||||
class MyRequestHandler(BaseHTTPServer.BaseHTTPRequestHandler):
|
||||
|
||||
def do_GET(self):
|
||||
self.send_response(200)
|
||||
self.send_header("Content-type", "text/plain")
|
||||
self.end_headers()
|
||||
self.wfile.write("It works!")
|
||||
|
||||
def version_string(self):
|
||||
return "1.0"
|
||||
|
||||
def date_time_string(self):
|
||||
return "July 22, 2013"
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
from optparse import OptionParser
|
||||
p = OptionParser()
|
||||
p.add_option("-a", "--addr", type="string", default="localhost",
|
||||
help=("listen on given address (numeric IP or host name), "
|
||||
"an empty string (the default) means INADDR_ANY"))
|
||||
p.add_option("-p", "--port", type="int", default=32123,
|
||||
help="listen on given TCP port number")
|
||||
p.add_option("-m", "--max", type="int", default=-1,
|
||||
help="max number of requests to respond to, -1 means no max")
|
||||
options, args = p.parse_args()
|
||||
|
||||
httpd = BaseHTTPServer.HTTPServer((options.addr, options.port),
|
||||
MyRequestHandler)
|
||||
if options.max == -1:
|
||||
httpd.serve_forever()
|
||||
else:
|
||||
served_count = 0
|
||||
while served_count != options.max:
|
||||
httpd.handle_request()
|
||||
served_count += 1
|
||||
Loading…
Add table
Add a link
Reference in a new issue