Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-13 12:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge remote-tracking branch 'origin/master' into topic/johanna/config

Browse source
This commit is contained in:
Johanna Amann 2018-01-29 14:25:38 -08:00
commit ac9fd000e0
144 changed files with 2768 additions and 2088 deletions
Download patch file Download diff file Expand all files Collapse all files

21
testing/btest/scripts/base/frameworks/file-analysis/bifs/file_exists_lookup_file.bro Normal file
View file

@ -0,0 +1,21 @@
# @TEST-EXEC: bro -r $TRACES/http/get.trace %INPUT 2>&1
# @TEST-EXEC: btest-diff .stdout
event bro_init()
{
print "This should fail but not crash";
print Files::lookup_file("asdf");
print "This should return F";
print Files::file_exists("asdf");
}
event file_sniff(f: fa_file, meta: fa_metadata)
{
print "lookup fid: " + f$id;
local looked_up_file = Files::lookup_file(f$id);
print "We should have found the file id: " + looked_up_file$id ;
print "This should return T";
print Files::file_exists(f$id);
}

2
testing/btest/scripts/base/frameworks/logging/adapt-filter.bro
View file

@ -27,7 +27,7 @@ event bro_init()
filter$path= "ssh-new-default";
Log::add_filter(SSH::LOG, filter);
local cid = [$orig_h=1.2.3.4, $orig_p=1234/tcp, $resp_h=2.3.4.5, $resp_p=80/tcp];
local cid = [$orig_h=1.2.3.4, $orig_p=1234/tcp, $resp_h=2.3.4.5, $resp_p=80/tcp];
Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="success"]);
Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="failure", $country="US"]);
}

3
testing/btest/scripts/base/frameworks/logging/disable-stream.bro
View file

@ -21,13 +21,12 @@ event bro_init()
Log::disable_stream(SSH::LOG);
local cid = [$orig_h=1.2.3.4, $orig_p=1234/tcp, $resp_h=2.3.4.5, $resp_p=80/tcp];
local cid = [$orig_h=1.2.3.4, $orig_p=1234/tcp, $resp_h=2.3.4.5, $resp_p=80/tcp];
Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="success"]);
Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="failure", $country="US"]);
Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="failure", $country="UK"]);
Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="success", $country="BR"]);
Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="failure", $country="MX"]);
}

33
testing/btest/scripts/base/frameworks/logging/enable-stream.bro Normal file
View file

@ -0,0 +1,33 @@
#
# @TEST-EXEC: bro -b %INPUT
# @TEST-EXEC: btest-diff ssh.log
module SSH;
export {
redef enum Log::ID += { LOG };
type Log: record {
t: time;
id: conn_id; # Will be rolled out into individual columns.
status: string &optional;
country: string &default="unknown";
} &log;
}
event bro_init()
{
Log::create_stream(SSH::LOG, [$columns=Log]);
Log::disable_stream(SSH::LOG);
local cid = [$orig_h=1.2.3.4, $orig_p=1234/tcp, $resp_h=2.3.4.5, $resp_p=80/tcp];
Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="success"]);
Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="failure", $country="US"]);
Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="failure", $country="UK"]);
Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="success", $country="BR"]);
Log::enable_stream(SSH::LOG);
Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="failure", $country="MX"]);
}

5
testing/btest/scripts/base/frameworks/logging/remove.bro
View file

@ -2,6 +2,7 @@
# @TEST-EXEC: bro -b -B logging %INPUT
# @TEST-EXEC: btest-diff ssh.log
# @TEST-EXEC: btest-diff ssh.failure.log
# @TEST-EXEC: btest-diff .stdout
module SSH;
@ -24,11 +25,12 @@ event bro_init()
Log::create_stream(SSH::LOG, [$columns=Log]);
Log::add_filter(SSH::LOG, [$name="f1", $path="ssh.failure", $pred=function(rec: Log): bool { return rec$status == "failure"; }]);
local cid = [$orig_h=1.2.3.4, $orig_p=1234/tcp, $resp_h=2.3.4.5, $resp_p=80/tcp];
local cid = [$orig_h=1.2.3.4, $orig_p=1234/tcp, $resp_h=2.3.4.5, $resp_p=80/tcp];
# Log something.
Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="failure", $country="US"]);
Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="failure", $country="UK"]);
print Log::get_filter_names(SSH::LOG);
Log::remove_filter(SSH::LOG, "f1");
Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="failure", $country="BR"]);
@ -37,5 +39,6 @@ event bro_init()
Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="failure", $country="MX"]);
Log::remove_filter(SSH::LOG, "doesn-not-exist");
print Log::get_filter_names(SSH::LOG);
}