Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-14 12:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Merge remote-tracking branch 'origin/topic/bbannier/spicy'

Browse source 
* origin/topic/bbannier/spicy:
  Add NEWS item for new requirements due to default-enabled Spicy support.
  Include headers in binary dir before other headers.
  Increase memory in CI.
  Add tests for bundled Spicy infrastructure.
  Include spicy in build.
  Add `bare_mode` bif.
  Change test so included plugins can load notice framework.
  Do not log function arguments in test.
This commit is contained in:
Tim Wojtulewicz 2022-05-17 08:50:15 -07:00
commit aaaca5d5a6
56 changed files with 635 additions and 65 deletions
Download patch file Download diff file Expand all files Collapse all files

3
testing/btest/Baseline/bifs.bare_mode/output Normal file
View file

@ -0,0 +1,3 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
F
T

2
testing/btest/Baseline/broker.remote_event/recv.recv.out
View file

@ -10,4 +10,4 @@ is_remote should be T, and is, T
receiver got ping: my-message, 4
is_remote should be T, and is, T
receiver got ping: my-message, 5
[num_peers=1, num_stores=0, num_pending_queries=0, num_events_incoming=5, num_events_outgoing=4, num_logs_incoming=0, num_logs_outgoing=1, num_ids_incoming=0, num_ids_outgoing=0]
[num_peers=1, num_stores=0, num_pending_queries=0, num_events_incoming=5, num_events_outgoing=4, num_logs_incoming=0, num_logs_outgoing=2, num_ids_incoming=0, num_ids_outgoing=0]

2
testing/btest/Baseline/broker.remote_event_any/recv.recv.out
View file

@ -10,4 +10,4 @@ is_remote should be T, and is, T
receiver got ping: my-message, 4
is_remote should be T, and is, T
receiver got ping: my-message, 5
[num_peers=1, num_stores=0, num_pending_queries=0, num_events_incoming=5, num_events_outgoing=4, num_logs_incoming=0, num_logs_outgoing=1, num_ids_incoming=0, num_ids_outgoing=0]
[num_peers=1, num_stores=0, num_pending_queries=0, num_events_incoming=5, num_events_outgoing=4, num_logs_incoming=0, num_logs_outgoing=2, num_ids_incoming=0, num_ids_outgoing=0]

2
testing/btest/Baseline/broker.remote_event_ssl_auth/recv.recv.out
View file

@ -5,4 +5,4 @@ receiver got ping: my-message, 2
receiver got ping: my-message, 3
receiver got ping: my-message, 4
receiver got ping: my-message, 5
[num_peers=1, num_stores=0, num_pending_queries=0, num_events_incoming=5, num_events_outgoing=4, num_logs_incoming=0, num_logs_outgoing=1, num_ids_incoming=0, num_ids_outgoing=0]
[num_peers=1, num_stores=0, num_pending_queries=0, num_events_incoming=5, num_events_outgoing=4, num_logs_incoming=0, num_logs_outgoing=2, num_ids_incoming=0, num_ids_outgoing=0]

1
testing/btest/Baseline/core.check-unused-event-handlers/.stderr
View file

@ -7,4 +7,5 @@ warning in <params>, line 1: event handler never invoked: SupervisorControl::des
warning in <params>, line 1: event handler never invoked: SupervisorControl::restart_request
warning in <params>, line 1: event handler never invoked: SupervisorControl::status_request
warning in <params>, line 1: event handler never invoked: SupervisorControl::stop_request
warning in <params>, line 1: event handler never invoked: spicy_analyzer_for_mime_type
warning in <params>, line 1: event handler never invoked: this_is_never_used

10
testing/btest/Baseline/coverage.bare-load-baseline/canonified_loaded_scripts.log
View file

@ -243,8 +243,18 @@ scripts/base/init-frameworks-and-bifs.zeek
build/scripts/base/bif/plugins/Zeek_AsciiWriter.ascii.bif.zeek
build/scripts/base/bif/plugins/Zeek_NoneWriter.none.bif.zeek
build/scripts/base/bif/plugins/Zeek_SQLiteWriter.sqlite.bif.zeek
build/scripts/base/bif/plugins/Zeek_Spicy.consts.bif.zeek
build/scripts/base/bif/plugins/Zeek_Spicy.events.bif.zeek
build/scripts/base/bif/plugins/Zeek_Spicy.functions.bif.zeek
build/scripts/builtin-plugins/__preload__.zeek
build/scripts/builtin-plugins/Zeek_Spicy/__preload__.zeek
build/scripts/builtin-plugins/__load__.zeek
build/scripts/builtin-plugins/Zeek_Spicy/__load__.zeek
build/scripts/builtin-plugins/Zeek_Spicy/Zeek/Spicy/bare.zeek
scripts/base/misc/version.zeek
scripts/base/frameworks/reporter/__load__.zeek
scripts/base/frameworks/reporter/main.zeek
scripts/base/utils/strings.zeek
scripts/policy/misc/loaded-scripts.zeek
scripts/base/utils/paths.zeek
#close XXXX-XX-XX-XX-XX-XX

7
testing/btest/Baseline/coverage.default-load-baseline/canonified_loaded_scripts.log
View file

@ -243,6 +243,9 @@ scripts/base/init-frameworks-and-bifs.zeek
build/scripts/base/bif/plugins/Zeek_AsciiWriter.ascii.bif.zeek
build/scripts/base/bif/plugins/Zeek_NoneWriter.none.bif.zeek
build/scripts/base/bif/plugins/Zeek_SQLiteWriter.sqlite.bif.zeek
build/scripts/base/bif/plugins/Zeek_Spicy.consts.bif.zeek
build/scripts/base/bif/plugins/Zeek_Spicy.events.bif.zeek
build/scripts/base/bif/plugins/Zeek_Spicy.functions.bif.zeek
scripts/base/init-default.zeek
scripts/base/utils/active-http.zeek
scripts/base/utils/exec.zeek
@ -443,6 +446,10 @@ scripts/base/init-default.zeek
scripts/base/misc/find-filtered-trace.zeek
scripts/base/misc/version.zeek
build/scripts/builtin-plugins/__preload__.zeek
build/scripts/builtin-plugins/Zeek_Spicy/__preload__.zeek
build/scripts/builtin-plugins/__load__.zeek
build/scripts/builtin-plugins/Zeek_Spicy/__load__.zeek
build/scripts/builtin-plugins/Zeek_Spicy/Zeek/Spicy/bare.zeek
build/scripts/builtin-plugins/Zeek_Spicy/Zeek/Spicy/default.zeek
scripts/policy/misc/loaded-scripts.zeek
#close XXXX-XX-XX-XX-XX-XX

75
testing/btest/Baseline/plugins.hooks/output
View file

@ -673,13 +673,17 @@
0.000000 MetaHookPost CallFunction(SumStats::register_observe_plugins, <frame>, ()) -> <no result>
0.000000 MetaHookPost CallFunction(Supervisor::__is_supervisor, <frame>, ()) -> <no result>
0.000000 MetaHookPost CallFunction(Supervisor::is_supervisor, <frame>, ()) -> <no result>
0.000000 MetaHookPost CallFunction(Version::parse, ..., ...) -> <no result>
0.000000 MetaHookPost CallFunction(__init_primary_bifs, <null>, ()) -> <no result>
0.000000 MetaHookPost CallFunction(__init_secondary_bifs, <null>, ()) -> <no result>
0.000000 MetaHookPost CallFunction(bare_mode, <null>, ()) -> <no result>
0.000000 MetaHookPost CallFunction(current_time, <frame>, ()) -> <no result>
0.000000 MetaHookPost CallFunction(filter_change_tracking, <null>, ()) -> <no result>
0.000000 MetaHookPost CallFunction(getenv, <null>, (CLUSTER_NODE)) -> <no result>
0.000000 MetaHookPost CallFunction(getenv, <null>, (ZEEK_DEFAULT_LISTEN_ADDRESS)) -> <no result>
0.000000 MetaHookPost CallFunction(global_options, <frame>, ()) -> <no result>
0.000000 MetaHookPost CallFunction(gsub, ..., ...) -> <no result>
0.000000 MetaHookPost CallFunction(lstrip, ..., ...) -> <no result>
0.000000 MetaHookPost CallFunction(network_time, <frame>, ()) -> <no result>
0.000000 MetaHookPost CallFunction(port_to_count, <frame>, (2123/udp)) -> <no result>
0.000000 MetaHookPost CallFunction(port_to_count, <frame>, (2152/udp)) -> <no result>
@ -690,12 +694,15 @@
0.000000 MetaHookPost CallFunction(reading_live_traffic, <frame>, ()) -> <no result>
0.000000 MetaHookPost CallFunction(reading_traces, <frame>, ()) -> <no result>
0.000000 MetaHookPost CallFunction(set_to_regex, <frame>, ({}, (^\.?|\.)(~~)$)) -> <no result>
0.000000 MetaHookPost CallFunction(split_string1, ..., ...) -> <no result>
0.000000 MetaHookPost CallFunction(string_to_pattern, <frame>, ((^\.?|\.)()$, F)) -> <no result>
0.000000 MetaHookPost CallFunction(sub, <frame>, ((^\.?|\.)(~~)$, <...>/, )) -> <no result>
0.000000 MetaHookPost CallFunction(to_count, ..., ...) -> <no result>
0.000000 MetaHookPost CallFunction(x509_set_certificate_cache, <frame>, ({})) -> <no result>
0.000000 MetaHookPost CallFunction(x509_set_certificate_cache_hit_callback, <frame>, (X509::x509_certificate_cache_replay{ <init> X509::i{ if (X509::f$info?$x509) return event x509_certificate(X509::f, X509::e$handle, X509::e$certificate)for ([X509::i] in X509::e$extensions_cache) { X509::ext = X509::e$extensions_cache[X509::i]if (X509::ext is X509::Extension) event x509_extension(X509::f, (X509::ext as X509::Extension))elseif (X509::ext is X509::BasicConstraints) event x509_ext_basic_constraints(X509::f, (X509::ext as X509::BasicConstraints))elseif (X509::ext is X509::SubjectAlternativeName) event x509_ext_subject_alternative_name(X509::f, (X509::ext as X509::SubjectAlternativeName))elseif (X509::ext is X509::SctInfo) { X509::s = (X509::ext as X509::SctInfo)event x509_ocsp_ext_signed_certificate_timestamp(X509::f, X509::s$version, X509::s$logid, X509::s$timestamp, X509::s$hash_alg, X509::s$sig_alg, X509::s$signature)}elseReporter::error(fmt(Encountered unknown extension while replaying certificate with fuid %s, X509::f$id))}}})) -> <no result>
0.000000 MetaHookPost CallFunction(zeek_args, <frame>, ()) -> <no result>
0.000000 MetaHookPost CallFunction(zeek_init, <null>, ()) -> <no result>
0.000000 MetaHookPost CallFunction(zeek_version, <null>, ()) -> <no result>
0.000000 MetaHookPost DrainEvents() -> <void>
0.000000 MetaHookPost LoadFile(0, ../main, <...>/main.zeek) -> -1
0.000000 MetaHookPost LoadFile(0, ../plugin, <...>/plugin.zeek) -> -1
@ -808,6 +815,9 @@
0.000000 MetaHookPost LoadFile(0, ./Zeek_SSL.events.bif.zeek, <...>/Zeek_SSL.events.bif.zeek) -> -1
0.000000 MetaHookPost LoadFile(0, ./Zeek_SSL.functions.bif.zeek, <...>/Zeek_SSL.functions.bif.zeek) -> -1
0.000000 MetaHookPost LoadFile(0, ./Zeek_SSL.types.bif.zeek, <...>/Zeek_SSL.types.bif.zeek) -> -1
0.000000 MetaHookPost LoadFile(0, ./Zeek_Spicy.consts.bif.zeek, <...>/Zeek_Spicy.consts.bif.zeek) -> -1
0.000000 MetaHookPost LoadFile(0, ./Zeek_Spicy.events.bif.zeek, <...>/Zeek_Spicy.events.bif.zeek) -> -1
0.000000 MetaHookPost LoadFile(0, ./Zeek_Spicy.functions.bif.zeek, <...>/Zeek_Spicy.functions.bif.zeek) -> -1
0.000000 MetaHookPost LoadFile(0, ./Zeek_Syslog.events.bif.zeek, <...>/Zeek_Syslog.events.bif.zeek) -> -1
0.000000 MetaHookPost LoadFile(0, ./Zeek_TCP.events.bif.zeek, <...>/Zeek_TCP.events.bif.zeek) -> -1
0.000000 MetaHookPost LoadFile(0, ./Zeek_TCP.functions.bif.zeek, <...>/Zeek_TCP.functions.bif.zeek) -> -1
@ -924,8 +934,12 @@
0.000000 MetaHookPost LoadFile(0, <...>/__load__.zeek, <...>/__load__.zeek) -> -1
0.000000 MetaHookPost LoadFile(0, <...>/__preload__.zeek, <...>/__preload__.zeek) -> -1
0.000000 MetaHookPost LoadFile(0, <...>/hooks.zeek, <...>/hooks.zeek) -> -1
0.000000 MetaHookPost LoadFile(0, Zeek<...>/bare.zeek, <...>/bare.zeek) -> -1
0.000000 MetaHookPost LoadFile(0, Zeek<...>/default.zeek, <...>/default.zeek) -> -1
0.000000 MetaHookPost LoadFile(0, Zeek_Spicy/__load__.zeek, <...>/__load__.zeek) -> -1
0.000000 MetaHookPost LoadFile(0, Zeek_Spicy/__preload__.zeek, <...>/__preload__.zeek) -> -1
0.000000 MetaHookPost LoadFile(0, base/bif, <...>/bif) -> -1
0.000000 MetaHookPost LoadFile(0, base/init-default, <...>/init-default.zeek) -> -1
0.000000 MetaHookPost LoadFile(0, base/init-default.zeek, <...>/init-default.zeek) -> -1
0.000000 MetaHookPost LoadFile(0, base/init-frameworks-and-bifs.zeek, <...>/init-frameworks-and-bifs.zeek) -> -1
0.000000 MetaHookPost LoadFile(0, base/packet-protocols, <...>/packet-protocols) -> -1
0.000000 MetaHookPost LoadFile(0, base<...>/CPP-load.bif, <...>/CPP-load.bif.zeek) -> -1
@ -1185,6 +1199,9 @@
0.000000 MetaHookPost LoadFileExtended(0, ./Zeek_SSL.events.bif.zeek, <...>/Zeek_SSL.events.bif.zeek) -> (-1, <no content>)
0.000000 MetaHookPost LoadFileExtended(0, ./Zeek_SSL.functions.bif.zeek, <...>/Zeek_SSL.functions.bif.zeek) -> (-1, <no content>)
0.000000 MetaHookPost LoadFileExtended(0, ./Zeek_SSL.types.bif.zeek, <...>/Zeek_SSL.types.bif.zeek) -> (-1, <no content>)
0.000000 MetaHookPost LoadFileExtended(0, ./Zeek_Spicy.consts.bif.zeek, <...>/Zeek_Spicy.consts.bif.zeek) -> (-1, <no content>)
0.000000 MetaHookPost LoadFileExtended(0, ./Zeek_Spicy.events.bif.zeek, <...>/Zeek_Spicy.events.bif.zeek) -> (-1, <no content>)
0.000000 MetaHookPost LoadFileExtended(0, ./Zeek_Spicy.functions.bif.zeek, <...>/Zeek_Spicy.functions.bif.zeek) -> (-1, <no content>)
0.000000 MetaHookPost LoadFileExtended(0, ./Zeek_Syslog.events.bif.zeek, <...>/Zeek_Syslog.events.bif.zeek) -> (-1, <no content>)
0.000000 MetaHookPost LoadFileExtended(0, ./Zeek_TCP.events.bif.zeek, <...>/Zeek_TCP.events.bif.zeek) -> (-1, <no content>)
0.000000 MetaHookPost LoadFileExtended(0, ./Zeek_TCP.functions.bif.zeek, <...>/Zeek_TCP.functions.bif.zeek) -> (-1, <no content>)
@ -1301,8 +1318,12 @@
0.000000 MetaHookPost LoadFileExtended(0, <...>/__load__.zeek, <...>/__load__.zeek) -> (-1, <no content>)
0.000000 MetaHookPost LoadFileExtended(0, <...>/__preload__.zeek, <...>/__preload__.zeek) -> (-1, <no content>)
0.000000 MetaHookPost LoadFileExtended(0, <...>/hooks.zeek, <...>/hooks.zeek) -> (-1, <no content>)
0.000000 MetaHookPost LoadFileExtended(0, Zeek<...>/bare.zeek, <...>/bare.zeek) -> (-1, <no content>)
0.000000 MetaHookPost LoadFileExtended(0, Zeek<...>/default.zeek, <...>/default.zeek) -> (-1, <no content>)
0.000000 MetaHookPost LoadFileExtended(0, Zeek_Spicy/__load__.zeek, <...>/__load__.zeek) -> (-1, <no content>)
0.000000 MetaHookPost LoadFileExtended(0, Zeek_Spicy/__preload__.zeek, <...>/__preload__.zeek) -> (-1, <no content>)
0.000000 MetaHookPost LoadFileExtended(0, base/bif, <...>/bif) -> (-1, <no content>)
0.000000 MetaHookPost LoadFileExtended(0, base/init-default, <...>/init-default.zeek) -> (-1, <no content>)
0.000000 MetaHookPost LoadFileExtended(0, base/init-default.zeek, <...>/init-default.zeek) -> (-1, <no content>)
0.000000 MetaHookPost LoadFileExtended(0, base/init-frameworks-and-bifs.zeek, <...>/init-frameworks-and-bifs.zeek) -> (-1, <no content>)
0.000000 MetaHookPost LoadFileExtended(0, base/packet-protocols, <...>/packet-protocols) -> (-1, <no content>)
0.000000 MetaHookPost LoadFileExtended(0, base<...>/CPP-load.bif, <...>/CPP-load.bif.zeek) -> (-1, <no content>)
@ -2130,13 +2151,17 @@
0.000000 MetaHookPre CallFunction(SumStats::register_observe_plugins, <frame>, ())
0.000000 MetaHookPre CallFunction(Supervisor::__is_supervisor, <frame>, ())
0.000000 MetaHookPre CallFunction(Supervisor::is_supervisor, <frame>, ())
0.000000 MetaHookPre CallFunction(Version::parse, ..., ...)
0.000000 MetaHookPre CallFunction(__init_primary_bifs, <null>, ())
0.000000 MetaHookPre CallFunction(__init_secondary_bifs, <null>, ())
0.000000 MetaHookPre CallFunction(bare_mode, <null>, ())
0.000000 MetaHookPre CallFunction(current_time, <frame>, ())
0.000000 MetaHookPre CallFunction(filter_change_tracking, <null>, ())
0.000000 MetaHookPre CallFunction(getenv, <null>, (CLUSTER_NODE))
0.000000 MetaHookPre CallFunction(getenv, <null>, (ZEEK_DEFAULT_LISTEN_ADDRESS))
0.000000 MetaHookPre CallFunction(global_options, <frame>, ())
0.000000 MetaHookPre CallFunction(gsub, ..., ...)
0.000000 MetaHookPre CallFunction(lstrip, ..., ...)
0.000000 MetaHookPre CallFunction(network_time, <frame>, ())
0.000000 MetaHookPre CallFunction(port_to_count, <frame>, (2123/udp))
0.000000 MetaHookPre CallFunction(port_to_count, <frame>, (2152/udp))
@ -2147,12 +2172,15 @@
0.000000 MetaHookPre CallFunction(reading_live_traffic, <frame>, ())
0.000000 MetaHookPre CallFunction(reading_traces, <frame>, ())
0.000000 MetaHookPre CallFunction(set_to_regex, <frame>, ({}, (^\.?|\.)(~~)$))
0.000000 MetaHookPre CallFunction(split_string1, ..., ...)
0.000000 MetaHookPre CallFunction(string_to_pattern, <frame>, ((^\.?|\.)()$, F))
0.000000 MetaHookPre CallFunction(sub, <frame>, ((^\.?|\.)(~~)$, <...>/, ))
0.000000 MetaHookPre CallFunction(to_count, ..., ...)
0.000000 MetaHookPre CallFunction(x509_set_certificate_cache, <frame>, ({}))
0.000000 MetaHookPre CallFunction(x509_set_certificate_cache_hit_callback, <frame>, (X509::x509_certificate_cache_replay{ <init> X509::i{ if (X509::f$info?$x509) return event x509_certificate(X509::f, X509::e$handle, X509::e$certificate)for ([X509::i] in X509::e$extensions_cache) { X509::ext = X509::e$extensions_cache[X509::i]if (X509::ext is X509::Extension) event x509_extension(X509::f, (X509::ext as X509::Extension))elseif (X509::ext is X509::BasicConstraints) event x509_ext_basic_constraints(X509::f, (X509::ext as X509::BasicConstraints))elseif (X509::ext is X509::SubjectAlternativeName) event x509_ext_subject_alternative_name(X509::f, (X509::ext as X509::SubjectAlternativeName))elseif (X509::ext is X509::SctInfo) { X509::s = (X509::ext as X509::SctInfo)event x509_ocsp_ext_signed_certificate_timestamp(X509::f, X509::s$version, X509::s$logid, X509::s$timestamp, X509::s$hash_alg, X509::s$sig_alg, X509::s$signature)}elseReporter::error(fmt(Encountered unknown extension while replaying certificate with fuid %s, X509::f$id))}}}))
0.000000 MetaHookPre CallFunction(zeek_args, <frame>, ())
0.000000 MetaHookPre CallFunction(zeek_init, <null>, ())
0.000000 MetaHookPre CallFunction(zeek_version, <null>, ())
0.000000 MetaHookPre DrainEvents()
0.000000 MetaHookPre LoadFile(0, ../main, <...>/main.zeek)
0.000000 MetaHookPre LoadFile(0, ../plugin, <...>/plugin.zeek)
@ -2265,6 +2293,9 @@
0.000000 MetaHookPre LoadFile(0, ./Zeek_SSL.events.bif.zeek, <...>/Zeek_SSL.events.bif.zeek)
0.000000 MetaHookPre LoadFile(0, ./Zeek_SSL.functions.bif.zeek, <...>/Zeek_SSL.functions.bif.zeek)
0.000000 MetaHookPre LoadFile(0, ./Zeek_SSL.types.bif.zeek, <...>/Zeek_SSL.types.bif.zeek)
0.000000 MetaHookPre LoadFile(0, ./Zeek_Spicy.consts.bif.zeek, <...>/Zeek_Spicy.consts.bif.zeek)
0.000000 MetaHookPre LoadFile(0, ./Zeek_Spicy.events.bif.zeek, <...>/Zeek_Spicy.events.bif.zeek)
0.000000 MetaHookPre LoadFile(0, ./Zeek_Spicy.functions.bif.zeek, <...>/Zeek_Spicy.functions.bif.zeek)
0.000000 MetaHookPre LoadFile(0, ./Zeek_Syslog.events.bif.zeek, <...>/Zeek_Syslog.events.bif.zeek)
0.000000 MetaHookPre LoadFile(0, ./Zeek_TCP.events.bif.zeek, <...>/Zeek_TCP.events.bif.zeek)
0.000000 MetaHookPre LoadFile(0, ./Zeek_TCP.functions.bif.zeek, <...>/Zeek_TCP.functions.bif.zeek)
@ -2381,8 +2412,12 @@
0.000000 MetaHookPre LoadFile(0, <...>/__load__.zeek, <...>/__load__.zeek)
0.000000 MetaHookPre LoadFile(0, <...>/__preload__.zeek, <...>/__preload__.zeek)
0.000000 MetaHookPre LoadFile(0, <...>/hooks.zeek, <...>/hooks.zeek)
0.000000 MetaHookPre LoadFile(0, Zeek<...>/bare.zeek, <...>/bare.zeek)
0.000000 MetaHookPre LoadFile(0, Zeek<...>/default.zeek, <...>/default.zeek)
0.000000 MetaHookPre LoadFile(0, Zeek_Spicy/__load__.zeek, <...>/__load__.zeek)
0.000000 MetaHookPre LoadFile(0, Zeek_Spicy/__preload__.zeek, <...>/__preload__.zeek)
0.000000 MetaHookPre LoadFile(0, base/bif, <...>/bif)
0.000000 MetaHookPre LoadFile(0, base/init-default, <...>/init-default.zeek)
0.000000 MetaHookPre LoadFile(0, base/init-default.zeek, <...>/init-default.zeek)
0.000000 MetaHookPre LoadFile(0, base/init-frameworks-and-bifs.zeek, <...>/init-frameworks-and-bifs.zeek)
0.000000 MetaHookPre LoadFile(0, base/packet-protocols, <...>/packet-protocols)
0.000000 MetaHookPre LoadFile(0, base<...>/CPP-load.bif, <...>/CPP-load.bif.zeek)
@ -2642,6 +2677,9 @@
0.000000 MetaHookPre LoadFileExtended(0, ./Zeek_SSL.events.bif.zeek, <...>/Zeek_SSL.events.bif.zeek)
0.000000 MetaHookPre LoadFileExtended(0, ./Zeek_SSL.functions.bif.zeek, <...>/Zeek_SSL.functions.bif.zeek)
0.000000 MetaHookPre LoadFileExtended(0, ./Zeek_SSL.types.bif.zeek, <...>/Zeek_SSL.types.bif.zeek)
0.000000 MetaHookPre LoadFileExtended(0, ./Zeek_Spicy.consts.bif.zeek, <...>/Zeek_Spicy.consts.bif.zeek)
0.000000 MetaHookPre LoadFileExtended(0, ./Zeek_Spicy.events.bif.zeek, <...>/Zeek_Spicy.events.bif.zeek)
0.000000 MetaHookPre LoadFileExtended(0, ./Zeek_Spicy.functions.bif.zeek, <...>/Zeek_Spicy.functions.bif.zeek)
0.000000 MetaHookPre LoadFileExtended(0, ./Zeek_Syslog.events.bif.zeek, <...>/Zeek_Syslog.events.bif.zeek)
0.000000 MetaHookPre LoadFileExtended(0, ./Zeek_TCP.events.bif.zeek, <...>/Zeek_TCP.events.bif.zeek)
0.000000 MetaHookPre LoadFileExtended(0, ./Zeek_TCP.functions.bif.zeek, <...>/Zeek_TCP.functions.bif.zeek)
@ -2758,8 +2796,12 @@
0.000000 MetaHookPre LoadFileExtended(0, <...>/__load__.zeek, <...>/__load__.zeek)
0.000000 MetaHookPre LoadFileExtended(0, <...>/__preload__.zeek, <...>/__preload__.zeek)
0.000000 MetaHookPre LoadFileExtended(0, <...>/hooks.zeek, <...>/hooks.zeek)
0.000000 MetaHookPre LoadFileExtended(0, Zeek<...>/bare.zeek, <...>/bare.zeek)
0.000000 MetaHookPre LoadFileExtended(0, Zeek<...>/default.zeek, <...>/default.zeek)
0.000000 MetaHookPre LoadFileExtended(0, Zeek_Spicy/__load__.zeek, <...>/__load__.zeek)
0.000000 MetaHookPre LoadFileExtended(0, Zeek_Spicy/__preload__.zeek, <...>/__preload__.zeek)
0.000000 MetaHookPre LoadFileExtended(0, base/bif, <...>/bif)
0.000000 MetaHookPre LoadFileExtended(0, base/init-default, <...>/init-default.zeek)
0.000000 MetaHookPre LoadFileExtended(0, base/init-default.zeek, <...>/init-default.zeek)
0.000000 MetaHookPre LoadFileExtended(0, base/init-frameworks-and-bifs.zeek, <...>/init-frameworks-and-bifs.zeek)
0.000000 MetaHookPre LoadFileExtended(0, base/packet-protocols, <...>/packet-protocols)
0.000000 MetaHookPre LoadFileExtended(0, base<...>/CPP-load.bif, <...>/CPP-load.bif.zeek)
@ -3586,13 +3628,17 @@
0.000000 | HookCallFunction SumStats::register_observe_plugins()
0.000000 | HookCallFunction Supervisor::__is_supervisor()
0.000000 | HookCallFunction Supervisor::is_supervisor()
0.000000 | HookCallFunction Version::parse(...)
0.000000 | HookCallFunction __init_primary_bifs()
0.000000 | HookCallFunction __init_secondary_bifs()
0.000000 | HookCallFunction bare_mode()
0.000000 | HookCallFunction current_time()
0.000000 | HookCallFunction filter_change_tracking()
0.000000 | HookCallFunction getenv(CLUSTER_NODE)
0.000000 | HookCallFunction getenv(ZEEK_DEFAULT_LISTEN_ADDRESS)
0.000000 | HookCallFunction global_options()
0.000000 | HookCallFunction gsub(...)
0.000000 | HookCallFunction lstrip(...)
0.000000 | HookCallFunction network_time()
0.000000 | HookCallFunction port_to_count(2123/udp)
0.000000 | HookCallFunction port_to_count(2152/udp)
@ -3603,12 +3649,15 @@
0.000000 | HookCallFunction reading_live_traffic()
0.000000 | HookCallFunction reading_traces()
0.000000 | HookCallFunction set_to_regex({}, (^\.?|\.)(~~)$)
0.000000 | HookCallFunction split_string1(...)
0.000000 | HookCallFunction string_to_pattern((^\.?|\.)()$, F)
0.000000 | HookCallFunction sub((^\.?|\.)(~~)$, <...>/, )
0.000000 | HookCallFunction to_count(...)
0.000000 | HookCallFunction x509_set_certificate_cache({})
0.000000 | HookCallFunction x509_set_certificate_cache_hit_callback(X509::x509_certificate_cache_replay{ <init> X509::i{ if (X509::f$info?$x509) return event x509_certificate(X509::f, X509::e$handle, X509::e$certificate)for ([X509::i] in X509::e$extensions_cache) { X509::ext = X509::e$extensions_cache[X509::i]if (X509::ext is X509::Extension) event x509_extension(X509::f, (X509::ext as X509::Extension))elseif (X509::ext is X509::BasicConstraints) event x509_ext_basic_constraints(X509::f, (X509::ext as X509::BasicConstraints))elseif (X509::ext is X509::SubjectAlternativeName) event x509_ext_subject_alternative_name(X509::f, (X509::ext as X509::SubjectAlternativeName))elseif (X509::ext is X509::SctInfo) { X509::s = (X509::ext as X509::SctInfo)event x509_ocsp_ext_signed_certificate_timestamp(X509::f, X509::s$version, X509::s$logid, X509::s$timestamp, X509::s$hash_alg, X509::s$sig_alg, X509::s$signature)}elseReporter::error(fmt(Encountered unknown extension while replaying certificate with fuid %s, X509::f$id))}}})
0.000000 | HookCallFunction zeek_args()
0.000000 | HookCallFunction zeek_init()
0.000000 | HookCallFunction zeek_version()
0.000000 | HookDrainEvents
0.000000 | HookLoadFile ../main <...>/main.zeek
0.000000 | HookLoadFile ../plugin <...>/plugin.zeek
@ -3721,6 +3770,9 @@
0.000000 | HookLoadFile ./Zeek_SSL.events.bif.zeek <...>/Zeek_SSL.events.bif.zeek
0.000000 | HookLoadFile ./Zeek_SSL.functions.bif.zeek <...>/Zeek_SSL.functions.bif.zeek
0.000000 | HookLoadFile ./Zeek_SSL.types.bif.zeek <...>/Zeek_SSL.types.bif.zeek
0.000000 | HookLoadFile ./Zeek_Spicy.consts.bif.zeek <...>/Zeek_Spicy.consts.bif.zeek
0.000000 | HookLoadFile ./Zeek_Spicy.events.bif.zeek <...>/Zeek_Spicy.events.bif.zeek
0.000000 | HookLoadFile ./Zeek_Spicy.functions.bif.zeek <...>/Zeek_Spicy.functions.bif.zeek
0.000000 | HookLoadFile ./Zeek_Syslog.events.bif.zeek <...>/Zeek_Syslog.events.bif.zeek
0.000000 | HookLoadFile ./Zeek_TCP.events.bif.zeek <...>/Zeek_TCP.events.bif.zeek
0.000000 | HookLoadFile ./Zeek_TCP.functions.bif.zeek <...>/Zeek_TCP.functions.bif.zeek
@ -3849,8 +3901,12 @@
0.000000 | HookLoadFile <...>/__load__.zeek <...>/__load__.zeek
0.000000 | HookLoadFile <...>/__preload__.zeek <...>/__preload__.zeek
0.000000 | HookLoadFile <...>/hooks.zeek <...>/hooks.zeek
0.000000 | HookLoadFile Zeek<...>/bare.zeek <...>/bare.zeek
0.000000 | HookLoadFile Zeek<...>/default.zeek <...>/default.zeek
0.000000 | HookLoadFile Zeek_Spicy/__load__.zeek <...>/__load__.zeek
0.000000 | HookLoadFile Zeek_Spicy/__preload__.zeek <...>/__preload__.zeek
0.000000 | HookLoadFile base/bif <...>/bif
0.000000 | HookLoadFile base/init-default <...>/init-default.zeek
0.000000 | HookLoadFile base/init-default.zeek <...>/init-default.zeek
0.000000 | HookLoadFile base/init-frameworks-and-bifs.zeek <...>/init-frameworks-and-bifs.zeek
0.000000 | HookLoadFile base/packet-protocols <...>/packet-protocols
0.000000 | HookLoadFile base<...>/CPP-load.bif <...>/CPP-load.bif.zeek
@ -4098,6 +4154,9 @@
0.000000 | HookLoadFileExtended ./Zeek_SSL.events.bif.zeek <...>/Zeek_SSL.events.bif.zeek
0.000000 | HookLoadFileExtended ./Zeek_SSL.functions.bif.zeek <...>/Zeek_SSL.functions.bif.zeek
0.000000 | HookLoadFileExtended ./Zeek_SSL.types.bif.zeek <...>/Zeek_SSL.types.bif.zeek
0.000000 | HookLoadFileExtended ./Zeek_Spicy.consts.bif.zeek <...>/Zeek_Spicy.consts.bif.zeek
0.000000 | HookLoadFileExtended ./Zeek_Spicy.events.bif.zeek <...>/Zeek_Spicy.events.bif.zeek
0.000000 | HookLoadFileExtended ./Zeek_Spicy.functions.bif.zeek <...>/Zeek_Spicy.functions.bif.zeek
0.000000 | HookLoadFileExtended ./Zeek_Syslog.events.bif.zeek <...>/Zeek_Syslog.events.bif.zeek
0.000000 | HookLoadFileExtended ./Zeek_TCP.events.bif.zeek <...>/Zeek_TCP.events.bif.zeek
0.000000 | HookLoadFileExtended ./Zeek_TCP.functions.bif.zeek <...>/Zeek_TCP.functions.bif.zeek
@ -4226,8 +4285,12 @@
0.000000 | HookLoadFileExtended <...>/__load__.zeek <...>/__load__.zeek
0.000000 | HookLoadFileExtended <...>/__preload__.zeek <...>/__preload__.zeek
0.000000 | HookLoadFileExtended <...>/hooks.zeek <...>/hooks.zeek
0.000000 | HookLoadFileExtended Zeek<...>/bare.zeek <...>/bare.zeek
0.000000 | HookLoadFileExtended Zeek<...>/default.zeek <...>/default.zeek
0.000000 | HookLoadFileExtended Zeek_Spicy/__load__.zeek <...>/__load__.zeek
0.000000 | HookLoadFileExtended Zeek_Spicy/__preload__.zeek <...>/__preload__.zeek
0.000000 | HookLoadFileExtended base/bif <...>/bif
0.000000 | HookLoadFileExtended base/init-default <...>/init-default.zeek
0.000000 | HookLoadFileExtended base/init-default.zeek <...>/init-default.zeek
0.000000 | HookLoadFileExtended base/init-frameworks-and-bifs.zeek <...>/init-frameworks-and-bifs.zeek
0.000000 | HookLoadFileExtended base/packet-protocols <...>/packet-protocols
0.000000 | HookLoadFileExtended base<...>/CPP-load.bif <...>/CPP-load.bif.zeek

1
testing/btest/Baseline/scripts.base.frameworks.logging.field-extension-invalid/.stderr
View file

@ -1,2 +1,3 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
XXXXXXXXXX.XXXXXX warning: non-void function returning without a value: add_extension
XXXXXXXXXX.XXXXXX warning: non-void function returning without a value: add_extension

10
testing/btest/Baseline/spicy.spicy-dump/output Normal file
View file

@ -0,0 +1,10 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
test::X {
xs: [
11
22
33
44
55
]
}

5
testing/btest/Baseline/spicy.spicyz-aot/output Normal file
View file

@ -0,0 +1,5 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
8, [$data=[b"POST /post HTTP/1.1", b"User-Agent: curl/7.29.0", b"Host: httpbin.org", b"Accept: */*", b"Content-Length: 11", b"Content-Type: application/x-www-form-urlencoded", b"", b"hello world"]]
Event:, [POST /post HTTP/1.1, User-Agent: curl/7.29.0, Host: httpbin.org, Accept: */*, Content-Length: 11, Content-Type: application/x-www-form-urlencoded, , hello world]
8, [$data=[b"HTTP/1.1 200 OK", b"Server: gunicorn/0.16.1", b"Date: Tue, 19 Mar 2013 16:05:11 GMT", b"Content-Type: application/json", b"Content-Length: 366", b"Connection: close", b"", b"{\x0a \"origin\": \"10.142.133.148\",\x0a \"files\": {},\x0a \"form\": null,\x0a \"url\": \"http://httpbin.org/post\",\x0a \"args\": {},\x0a \"headers\": {\x0a \"Content-Length\": \"11\",\x0a \"Connection\": \"close\",\x0a \"Accept\": \"*/*\",\x0a \"User-Agent\": \"curl/7.29.0\",\x0a \"Host\": \"httpbin.org\",\x0a \"Content-Type\": \"application/x-www-form-urlencoded\"\x0a },\x0a \"json\": null,\x0a \"data\": \"hello world\"\x0a}"]]
Event:, [HTTP/1.1 200 OK, Server: gunicorn/0.16.1, Date: Tue, 19 Mar 2013 16:05:11 GMT, Content-Type: application/json, Content-Length: 366, Connection: close, , {\x0a "origin": "10.142.133.148",\x0a "files": {},\x0a "form": null,\x0a "url": "http://httpbin.org/post",\x0a "args": {},\x0a "headers": {\x0a "Content-Length": "11",\x0a "Connection": "close",\x0a "Accept": "*/*",\x0a "User-Agent": "curl/7.29.0",\x0a "Host": "httpbin.org",\x0a "Content-Type": "application/x-www-form-urlencoded"\x0a },\x0a "json": null,\x0a "data": "hello world"\x0a}]

5
testing/btest/Baseline/spicy.spicyz-jit/output Normal file
View file

@ -0,0 +1,5 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
8, [$data=[b"POST /post HTTP/1.1", b"User-Agent: curl/7.29.0", b"Host: httpbin.org", b"Accept: */*", b"Content-Length: 11", b"Content-Type: application/x-www-form-urlencoded", b"", b"hello world"]]
Event:, [POST /post HTTP/1.1, User-Agent: curl/7.29.0, Host: httpbin.org, Accept: */*, Content-Length: 11, Content-Type: application/x-www-form-urlencoded, , hello world]
8, [$data=[b"HTTP/1.1 200 OK", b"Server: gunicorn/0.16.1", b"Date: Tue, 19 Mar 2013 16:05:11 GMT", b"Content-Type: application/json", b"Content-Length: 366", b"Connection: close", b"", b"{\x0a \"origin\": \"10.142.133.148\",\x0a \"files\": {},\x0a \"form\": null,\x0a \"url\": \"http://httpbin.org/post\",\x0a \"args\": {},\x0a \"headers\": {\x0a \"Content-Length\": \"11\",\x0a \"Connection\": \"close\",\x0a \"Accept\": \"*/*\",\x0a \"User-Agent\": \"curl/7.29.0\",\x0a \"Host\": \"httpbin.org\",\x0a \"Content-Type\": \"application/x-www-form-urlencoded\"\x0a },\x0a \"json\": null,\x0a \"data\": \"hello world\"\x0a}"]]
Event:, [HTTP/1.1 200 OK, Server: gunicorn/0.16.1, Date: Tue, 19 Mar 2013 16:05:11 GMT, Content-Type: application/json, Content-Length: 366, Connection: close, , {\x0a "origin": "10.142.133.148",\x0a "files": {},\x0a "form": null,\x0a "url": "http://httpbin.org/post",\x0a "args": {},\x0a "headers": {\x0a "Content-Length": "11",\x0a "Connection": "close",\x0a "Accept": "*/*",\x0a "User-Agent": "curl/7.29.0",\x0a "Host": "httpbin.org",\x0a "Content-Type": "application/x-www-form-urlencoded"\x0a },\x0a "json": null,\x0a "data": "hello world"\x0a}]

8
testing/btest/bifs/bare_mode.zeek Normal file
View file

@ -0,0 +1,8 @@
# @TEST-EXEC: zeek %INPUT >>output
# @TEST-EXEC: zeek -b %INPUT >>output
# @TEST-EXEC: btest-diff output
event zeek_init()
{
print bare_mode();
}

2
testing/btest/broker/remote_event.zeek
View file

@ -1,5 +1,7 @@
# @TEST-GROUP: broker
#
# @TEST-REQUIRES: $SCRIPTS/have-spicy # The logging of Broker's `num_logs_outgoing` depends on whether the Spicy plugin is loaded or not.
#
# @TEST-PORT: BROKER_PORT
#
# @TEST-EXEC: btest-bg-run recv "zeek -b ../recv.zeek >recv.out"

2
testing/btest/broker/remote_event_any.zeek
View file

@ -1,5 +1,7 @@
# @TEST-GROUP: broker
#
# @TEST-REQUIRES: $SCRIPTS/have-spicy # The logging of Broker's `num_logs_outgoing` depends on whether the Spicy plugin is loaded or not.
#
# @TEST-PORT: BROKER_PORT
#
# @TEST-EXEC: btest-bg-run recv "zeek -b ../recv.zeek >recv.out"

2
testing/btest/broker/remote_event_ssl_auth.zeek
View file

@ -1,5 +1,7 @@
# @TEST-GROUP: broker
#
# @TEST-REQUIRES: $SCRIPTS/have-spicy # The logging of Broker's `num_logs_outgoing` depends on whether the Spicy plugin is loaded or not.
#
# @TEST-PORT: BROKER_PORT
#
# @TEST-EXEC: btest-bg-run recv "zeek -b ../recv.zeek >recv.out"

4
testing/btest/btest.cfg
View file

@ -1,5 +1,5 @@
[btest]
TestDirs = doc bifs language core scripts coverage signatures plugins broker supervisor telemetry
TestDirs = doc bifs language core scripts coverage signatures plugins broker spicy supervisor telemetry
TmpDir = %(testbase)s/.tmp
BaselineDir = %(testbase)s/Baseline
IgnoreDirs = .svn CVS .tmp
@ -32,6 +32,8 @@ ZEEK_DISABLE_ZEEKYGEN=1
ZEEK_ALLOW_INIT_ERRORS=1
ZEEK_SUPERVISOR_NO_SIGKILL=1
UBSAN_OPTIONS=print_stacktrace=1
SPICY_PATH=`bash -c %(testbase)s/../../build/spicy-path`
HILTI_CXX_INCLUDE_DIRS=`bash -c %(testbase)s/../../build/hilti-cxx-include-dirs`
[environment-AST-dup]
# Environment for testing AST duplication functionality, which is

1
testing/btest/core/check-unused-event-handlers.test
View file

@ -1,4 +1,5 @@
# This test should print a warning that the event handler is never invoked.
# @TEST-REQUIRES: $SCRIPTS/have-spicy # This test logs uninvoked event handlers, so disable it if Spicy and its plugin is unavailable.
# @TEST-EXEC: zeek -b %INPUT check_for_unused_event_handlers=T
# @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-sort btest-diff .stderr

1
testing/btest/coverage/bare-load-baseline.test
View file

@ -7,6 +7,7 @@
# prefix to make the test work everywhere. That's what the sed magic
# below does. Don't ask. :-)
# @TEST-REQUIRES: $SCRIPTS/have-spicy # This test logs loaded scripts, so disable it if Spicy and it associated plugin is unavailable.
# @TEST-EXEC: zeek -b misc/loaded-scripts
# @TEST-EXEC: test -e loaded_scripts.log
# @TEST-EXEC: cat loaded_scripts.log | egrep -v '#' | awk 'NR>0{print $1}' | sed -e ':a' -e '$!N' -e 's/^\(.*\).*\n\1.*/\1/' -e 'ta' >prefix

1
testing/btest/coverage/default-load-baseline.test
View file

@ -7,6 +7,7 @@
# prefix to make the test work everywhere. That's what the sed magic
# below does. Don't ask. :-)
# @TEST-REQUIRES: test -x ${BUILD}/auxil/spicy/spicy/bin/spicy-config
# @TEST-EXEC: zeek misc/loaded-scripts
# @TEST-EXEC: test -e loaded_scripts.log
# @TEST-EXEC: cat loaded_scripts.log | egrep -v '#' | sed 's/ //g' | sed -e ':a' -e '$!N' -e 's/^\(.*\).*\n\1.*/\1/' -e 'ta' >prefix

45
testing/btest/plugins/hooks-plugin/src/Plugin.cc
View file

@ -1,6 +1,8 @@
#include "Plugin.h"
#include <cstring>
#include <Func.h>
#include <Event.h>
#include <Conn.h>
@ -40,13 +42,36 @@ zeek::plugin::Configuration Plugin::Configure()
static void describe_hook_args(const zeek::plugin::HookArgumentList& args, zeek::ODesc* d)
{
bool first = true;
bool serialize_args = true;
for ( zeek::plugin::HookArgumentList::const_iterator i = args.begin(); i != args.end(); i++ )
{
if ( ! first )
d->Add(", ");
if ( first )
{
first = false;
i->Describe(d);
// For function calls we remove args for unstable arguments
// from parsing the version in `base/misc/version`.
if ( i->GetType() == zeek::plugin::HookArgument::FUNC &&
(::strcmp(d->Description(), "Version::parse") == 0 ||
::strcmp(d->Description(), "gsub") == 0 ||
::strcmp(d->Description(), "split_string1") == 0 ||
::strcmp(d->Description(), "lstrip") == 0 ||
::strcmp(d->Description(), "to_count") == 0))
serialize_args = false;
continue;
}
d->Add(", ");
if ( serialize_args )
i->Describe(d);
else
d->Add("...");
i->Describe(d);
first = false;
}
}
@ -70,8 +95,20 @@ std::pair<bool, zeek::ValPtr> Plugin::HookFunctionCall(const zeek::Func* func, z
{
zeek::ODesc d;
d.SetShort();
zeek::plugin::HookArgument(func).Describe(&d);
zeek::plugin::HookArgument(args).Describe(&d);
// For function calls we remove args for unstable arguments
// from parsing the version in `base/misc/version`.
if ( ::strcmp(d.Description(), "Version::parse") == 0 ||
::strcmp(d.Description(), "gsub") == 0 ||
::strcmp(d.Description(), "split_string1") == 0 ||
::strcmp(d.Description(), "lstrip") == 0 ||
::strcmp(d.Description(), "to_count") == 0)
d.Add("(...)");
else
zeek::plugin::HookArgument(args).Describe(&d);
fprintf(stderr, "%.6f %-15s %s\n", zeek::run_state::network_time, "| HookCallFunction",
d.Description());

6
testing/btest/plugins/hooks.zeek
View file

@ -1,13 +1,11 @@
# @TEST-REQUIRES: test "${ZEEK_ZAM}" != "1"
# @TEST-REQUIRES: ${SCRIPTS}/have-spicy # This test logs loaded scripts, so disable it if Spicy and the associated plugin are unavailable.
# @TEST-EXEC: ${DIST}/auxil/zeek-aux/plugin-support/init-plugin -u . Demo Hooks
# @TEST-EXEC: cp -r %DIR/hooks-plugin/* .
# @TEST-EXEC: ./configure --zeek-dist=${DIST} && make
# @TEST-EXEC: ZEEK_PLUGIN_ACTIVATE="Demo::Hooks" ZEEK_PLUGIN_PATH=`pwd` zeek -b -r $TRACES/http/get.trace %INPUT s1.sig 2>&1 | $SCRIPTS/diff-remove-abspath | sort | uniq >output
# @TEST-EXEC: ZEEK_PLUGIN_ACTIVATE="Demo::Hooks" ZEEK_PLUGIN_PATH=`pwd` zeek -r $TRACES/http/get.trace %INPUT s1.sig 2>&1 | $SCRIPTS/diff-remove-abspath | sort | uniq >output
# @TEST-EXEC: btest-diff output
@unload base/misc/version
@load base/init-default
@load-sigs s2
@TEST-START-FILE s1.sig

1
testing/btest/scripts/base/frameworks/logging/field-extension-invalid.zeek
View file

@ -1,3 +1,4 @@
# @TEST-REQUIRES: test -x ${BUILD}/auxil/spicy/spicy/bin/spicy-config
# @TEST-EXEC: zeek -b -r $TRACES/http/get.trace %INPUT
# @TEST-EXEC: btest-diff conn.log
# @TEST-EXEC: btest-diff .stderr

11
testing/btest/spicy/spicy-dump.spicy Normal file
View file

@ -0,0 +1,11 @@
# @TEST-DOC: Smoke test for a bundled Spicy.
#
# @TEST-REQUIRES: $SCRIPTS/have-spicy
# @TEST-EXEC: printf 12345 | ${BUILD}/auxil/spicy/spicy/bin/spicy-dump -d %INPUT >output 2>&1
# @TEST-EXEC: btest-diff output
module test;
public type X = unit {
xs: (bytes &size=1 &convert=$$.to_int()*11)[];
};

37
testing/btest/spicy/spicyz-aot.test Normal file
View file

@ -0,0 +1,37 @@
# @TEST-DOC: Smoke test for a custom ahead-of-time compiled Spicy analyzer hooked into Zeek.
#
# @TEST-REQUIRES: $SCRIPTS/have-spicy
# @TEST-EXEC: ${BUILD}/src/builtin-plugins/spicy-plugin/bin/spicyz test.spicy test.evt -o test.hlto
# @TEST-EXEC: zeek -NN test.hlto | grep -q ANALYZER_SPICY_TEST
# @TEST-EXEC: zeek -r ${TRACES}/http/post.trace test.zeek test.hlto "Spicy::enable_print = T;" >>output 2>&1
# @TEST-EXEC: btest-diff output
# @TEST-START-FILE test.spicy
module test;
import zeek;
public type Dummy = unit {
# Consume all data. We split data into lines and log the number of lines and the lines when done.
data: bytes &eod &convert=$$.split(b"\r\n");
on %done { print |self.data|, self; }
};
# @TEST-END-FILE
# @TEST-START-FILE test.evt
protocol analyzer spicy::Test over TCP:
parse with test::Dummy,
port 80/tcp;
on test::Dummy -> event test::dummy(self.data);
# @TEST-END-FILE
# @TEST-START-FILE test.zeek
module test;
event test::dummy(data: vector of string)
{
print "Event:", data;
}
# @TEST-END-FILE

37
testing/btest/spicy/spicyz-jit.test Normal file
View file

@ -0,0 +1,37 @@
# @TEST-DOC: Smoke test for a custom Spicy analyzer hooked into Zeek with JIT via Zeek itself.
#
# @TEST-REQUIRES: $SCRIPTS/have-spicy
# @TEST-EXEC: ${BUILD}/src/builtin-plugins/spicy-plugin/bin/spicyz test.spicy test.evt -o test.hlto
# @TEST-EXEC: zeek -NN test.hlto | grep -q ANALYZER_SPICY_TEST
# @TEST-EXEC: zeek -r ${TRACES}/http/post.trace test.zeek test.spicy test.evt "Spicy::enable_print = T;" >>output 2>&1
# @TEST-EXEC: btest-diff output
# @TEST-START-FILE test.spicy
module test;
import zeek;
public type Dummy = unit {
# Consume all data. We split data into lines and log the number of lines and the lines when done.
data: bytes &eod &convert=$$.split(b"\r\n");
on %done { print |self.data|, self; }
};
# @TEST-END-FILE
# @TEST-START-FILE test.evt
protocol analyzer spicy::Test over TCP:
parse with test::Dummy,
port 80/tcp;
on test::Dummy -> event test::dummy(self.data);
# @TEST-END-FILE
# @TEST-START-FILE test.zeek
module test;
event test::dummy(data: vector of string)
{
print "Event:", data;
}
# @TEST-END-FILE

2
testing/btest/supervisor/config-bare-mode.zeek
View file

@ -53,7 +53,7 @@ event zeek_init()
print node_output_file, "supervised node zeek_init()";
# This is only defined when we're loading init-default.zeek:
@ifdef ( Notice::Info )
@ifdef ( Conn::LOG )
print node_output_file, "default mode";
@else
print node_output_file, "bare mode";

6
testing/scripts/have-spicy Executable file
View file

@ -0,0 +1,6 @@
#!/bin/sh
if grep -q "DISABLE_SPICY:BOOL=true" "${BUILD}"/CMakeCache.txt; then
return 1
else
true
fi