Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-13 03:58:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Add support for ircv3 tags

Browse source 
This also replaces the irc-dcc-send.trace file in our pcap library with
a cleaner one that includes ircv3 tags.
This commit is contained in:
Tim Wojtulewicz 2025-07-25 17:18:50 -07:00
parent 8aeaed69c5
commit a33f100880
11 changed files with 168 additions and 140 deletions
Download patch file Download diff file Expand all files Collapse all files

5
testing/btest/Baseline/scripts.base.protocols.irc.basic/conn.log
View file

@ -7,6 +7,7 @@
#open XXXX-XX-XX-XX-XX-XX
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents ip_proto
#types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] count
XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 192.168.1.77 57655 209.197.168.151 1024 tcp irc-dcc-data 2.256935 124 42208 SF T F 0 ShAdDaFf 28 1592 43 44452 - 6
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.1.77 57640 66.198.80.67 6667 tcp irc 178.237017 453 25404 S3 T F 0 ShADdTtaf 63 3761 52 28194 - 6
XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 10.0.0.22 43614 10.0.0.7 59130 tcp irc-dcc-data 0.162309 352 1320211 SF T T 0 ShAadDfF 127 6964 962 1370247 - 6
XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 10.0.0.22 38016 10.0.0.7 59214 tcp - 22.539051 22 10 SF T T 0 ShAaDdfF 7 394 8 438 - 6
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 10.0.0.7 59069 10.0.0.22 6667 tcp irc 169.871683 638 9679 SF T T 0 ShADadfF 43 2886 37 11611 - 6
#close XXXX-XX-XX-XX-XX-XX

8
testing/btest/Baseline/scripts.base.protocols.irc.basic/irc.log
View file

@ -7,8 +7,8 @@
#open XXXX-XX-XX-XX-XX-XX
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p nick user command value addl dcc_file_name dcc_file_size dcc_mime_type fuid
#types time string addr port addr port string string string string string string count string string
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.1.77 57640 66.198.80.67 6667 - - NICK bloed - - - - -
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.1.77 57640 66.198.80.67 6667 bloed - USER sdkfje sdkfje Montreal.QC.CA.Undernet.org dkdkrwq - - - -
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.1.77 57640 66.198.80.67 6667 bloed sdkfje JOIN #easymovies (empty) - - - -
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.1.77 57640 66.198.80.67 6667 bloed sdkfje DCC #easymovies (empty) ladyvampress-default(2011-07-07)-OS.zip 42208 application/zip F1tb2e2cHYry3wC3Q3
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 10.0.0.7 59069 10.0.0.22 6667 - - NICK tim2 - - - - -
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 10.0.0.7 59069 10.0.0.22 6667 tim2 - USER tim tim 10.0.0.22 TimWojtulewicz - - - -
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 10.0.0.7 59069 10.0.0.22 6667 tim2 tim JOIN #testing (empty) - - - -
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 10.0.0.7 59069 10.0.0.22 6667 tim2 tim DCC #testing (empty) ssh.trace 1320211 application/vnd.tcpdump.pcap FkshTS1b7DMiTGD6C3
#close XXXX-XX-XX-XX-XX-XX

179
testing/btest/Baseline/scripts.base.protocols.irc.basic/out
View file

@ -1,90 +1,93 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
irc_names_info, #easymovies, {
bloed,
gasman2,
jafafar,
dezmond411,
+gordon1`^,
|EasyMovie|,
+TrEeHoUsE,
+thenagualII,
mikejo1,
bouleemil,
skillZ,
zgdB8_VzO,
GordonCamero,
`Xenu,
fvlkni,
mo5,
tonysaunt,
Verge,
eag,
habzels,
+Max_Renn,
nofire,
Peebo,
macbeth420,
freeeman33,
cguide,
zEmm,
+Luccutis,
scum,
+`AngelnTx,
bga,
+Killazherb,
NeverServe,
ericdraven,
+Xedrethor,
katniss,
friida,
N2Oblivion,
kitts,
+ladyvampress,
wanker,
Picard,
mzazzali,
slickrick2,
+i-am-mojo,
aJerk,
starred,
WhatmeWor,
HagBard
irc_names_info, #testing, {
tim1,
tim2
}
irc_names_info, #easymovies, {
Latika,
TinCan,
Nachos,
dx3d51,
TooFast
}
irc_dcc_send_ack, 1400
irc_dcc_send_ack, 2800
irc_dcc_send_ack, 4200
irc_dcc_send_ack, 5600
irc_dcc_send_ack, 7000
irc_dcc_send_ack, 8400
irc_dcc_send_ack, 9800
irc_dcc_send_ack, 11200
irc_dcc_send_ack, 12288
irc_dcc_send_ack, 13688
irc_dcc_send_ack, 15088
irc_dcc_send_ack, 16384
irc_dcc_send_ack, 17784
irc_dcc_send_ack, 19184
irc_dcc_send_ack, 20480
irc_dcc_send_ack, 21880
irc_dcc_send_ack, 23280
irc_dcc_send_ack, 24576
irc_dcc_send_ack, 25976
irc_dcc_send_ack, 27376
irc_dcc_send_ack, 28672
irc_dcc_send_ack, 30072
irc_dcc_send_ack, 31472
irc_dcc_send_ack, 32768
irc_dcc_send_ack, 34168
irc_dcc_send_ack, 35568
irc_dcc_send_ack, 36864
irc_dcc_send_ack, 38264
irc_dcc_send_ack, 39664
irc_dcc_send_ack, 40960
irc_dcc_send_ack, 42208
irc_dcc_send_ack, 2048
irc_dcc_send_ack, 6656
irc_dcc_send_ack, 9728
irc_dcc_send_ack, 14336
irc_dcc_send_ack, 17232
irc_dcc_send_ack, 27368
irc_dcc_send_ack, 41848
irc_dcc_send_ack, 47640
irc_dcc_send_ack, 67912
irc_dcc_send_ack, 79496
irc_dcc_send_ack, 88184
irc_dcc_send_ack, 96872
irc_dcc_send_ack, 108456
irc_dcc_send_ack, 128728
irc_dcc_send_ack, 143208
irc_dcc_send_ack, 163480
irc_dcc_send_ack, 172168
irc_dcc_send_ack, 183752
irc_dcc_send_ack, 201216
irc_dcc_send_ack, 224384
irc_dcc_send_ack, 244656
irc_dcc_send_ack, 259136
irc_dcc_send_ack, 279408
irc_dcc_send_ack, 299680
irc_dcc_send_ack, 313856
irc_dcc_send_ack, 320000
irc_dcc_send_ack, 322984
irc_dcc_send_ack, 332200
irc_dcc_send_ack, 341504
irc_dcc_send_ack, 353792
irc_dcc_send_ack, 361472
irc_dcc_send_ack, 364368
irc_dcc_send_ack, 384640
irc_dcc_send_ack, 399120
irc_dcc_send_ack, 419392
irc_dcc_send_ack, 429528
irc_dcc_send_ack, 439664
irc_dcc_send_ack, 459936
irc_dcc_send_ack, 474416
irc_dcc_send_ack, 494688
irc_dcc_send_ack, 503376
irc_dcc_send_ack, 516408
irc_dcc_send_ack, 525096
irc_dcc_send_ack, 543920
irc_dcc_send_ack, 562744
irc_dcc_send_ack, 583016
irc_dcc_send_ack, 597496
irc_dcc_send_ack, 603288
irc_dcc_send_ack, 617768
irc_dcc_send_ack, 638040
irc_dcc_send_ack, 661208
irc_dcc_send_ack, 671344
irc_dcc_send_ack, 681480
irc_dcc_send_ack, 687272
irc_dcc_send_ack, 701752
irc_dcc_send_ack, 722024
irc_dcc_send_ack, 736504
irc_dcc_send_ack, 756776
irc_dcc_send_ack, 777048
irc_dcc_send_ack, 809816
irc_dcc_send_ack, 821936
irc_dcc_send_ack, 842208
irc_dcc_send_ack, 862480
irc_dcc_send_ack, 875512
irc_dcc_send_ack, 895784
irc_dcc_send_ack, 916056
irc_dcc_send_ack, 942120
irc_dcc_send_ack, 952256
irc_dcc_send_ack, 956600
irc_dcc_send_ack, 989368
irc_dcc_send_ack, 1022136
irc_dcc_send_ack, 1026104
irc_dcc_send_ack, 1046376
irc_dcc_send_ack, 1076784
irc_dcc_send_ack, 1097056
irc_dcc_send_ack, 1117328
irc_dcc_send_ack, 1136152
irc_dcc_send_ack, 1147736
irc_dcc_send_ack, 1176696
irc_dcc_send_ack, 1196968
irc_dcc_send_ack, 1207104
irc_dcc_send_ack, 1208552
irc_dcc_send_ack, 1228824
irc_dcc_send_ack, 1249096
irc_dcc_send_ack, 1270816
irc_dcc_send_ack, 1282400
irc_dcc_send_ack, 1302672
irc_dcc_send_ack, 1320211