Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-17 05:58:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Analyzer failure logging: tweaks and test fixes

Browse source 
The main part of this commit are changes in tests. A lot of the tests
that previously relied on analyzer.log or dpd.log now use the new
analyzer-failed.log.

I verified all the changes and, as far as I can tell, everything
behaves as it should. This includes the external test baselines.

This change also enables logging of file and packet analyzer to
analyzer_failed.log and fixes some small behavior issues.

The analyzer_failed event is no longer raised when the removal of an
analyzer is vetoed.

If an analyzer is no longer active when an analyzer violation is raised,
currently the analyzer_failed event is raised. This can, e.g., happen
when an analyzer error happens at the very end of the connection. This
makes the behavior more similar to what happened in the past, and also
intuitively seems to make sense.

A bug introduced in the failed service logging was fixed.
This commit is contained in:
Johanna Amann 2025-04-10 11:13:33 +01:00
parent 8c814fa88c
commit af77a7a83b
143 changed files with 4523 additions and 4329 deletions
Download patch file Download diff file Expand all files Collapse all files

22
testing/btest/Baseline/scripts.base.protocols.ssh.half-duplex-server/analyzer.log → testing/btest/Baseline/scripts.base.protocols.ssh.half-duplex-server/analyzer_debug.log
View file

@ -3,28 +3,48 @@
#set_separator ,
#empty_field (empty)
#unset_field -
#path analyzer
#path analyzer_debug
#open XXXX-XX-XX-XX-XX-XX
#fields ts cause analyzer_kind analyzer_name uid fuid id.orig_h id.orig_p id.resp_h id.resp_p failure_reason failure_data
#types time string string string string string addr port addr port string string
XXXXXXXXXX.XXXXXX violation protocol SSH CHhAvVGS1DHFjwGM9 - 192.168.1.79 51880 131.159.21.1 22 Binpac exception: binpac exception: invalid index for case: SSH_Key_Exchange: 3 -
XXXXXXXXXX.XXXXXX disabled protocol SSH CHhAvVGS1DHFjwGM9 - 192.168.1.79 51880 131.159.21.1 22 - -
XXXXXXXXXX.XXXXXX violation protocol SSH ClEkJM2Vm5giqnMf4h - 192.168.2.1 57189 192.168.2.158 22 Binpac exception: binpac exception: invalid index for case: SSH_Key_Exchange: 3 -
XXXXXXXXXX.XXXXXX disabled protocol SSH ClEkJM2Vm5giqnMf4h - 192.168.2.1 57189 192.168.2.158 22 - -
XXXXXXXXXX.XXXXXX violation protocol SSH C4J4Th3PJpwUYZZ6gc - 192.168.2.1 57191 192.168.2.158 22 Binpac exception: binpac exception: invalid index for case: SSH_Key_Exchange: 3 -
XXXXXXXXXX.XXXXXX disabled protocol SSH C4J4Th3PJpwUYZZ6gc - 192.168.2.1 57191 192.168.2.158 22 - -
XXXXXXXXXX.XXXXXX violation protocol SSH CtPZjS20MLrsMUOJi2 - 192.168.2.1 56594 192.168.2.158 22 Binpac exception: binpac exception: invalid index for case: SSH_Key_Exchange: 3 -
XXXXXXXXXX.XXXXXX disabled protocol SSH CtPZjS20MLrsMUOJi2 - 192.168.2.1 56594 192.168.2.158 22 - -
XXXXXXXXXX.XXXXXX violation protocol SSH CUM0KZ3MLUfNB0cl11 - 192.168.2.1 56821 192.168.2.158 22 Binpac exception: binpac exception: invalid index for case: SSH_Key_Exchange: 3 -
XXXXXXXXXX.XXXXXX disabled protocol SSH CUM0KZ3MLUfNB0cl11 - 192.168.2.1 56821 192.168.2.158 22 - -
XXXXXXXXXX.XXXXXX violation protocol SSH CmES5u32sYpV7JYN - 192.168.2.1 56837 192.168.2.158 22 Binpac exception: binpac exception: invalid index for case: SSH_Key_Exchange: 3 -
XXXXXXXXXX.XXXXXX disabled protocol SSH CmES5u32sYpV7JYN - 192.168.2.1 56837 192.168.2.158 22 - -
XXXXXXXXXX.XXXXXX violation protocol SSH CP5puj4I8PtEU4qzYg - 192.168.2.1 56845 192.168.2.158 22 Binpac exception: binpac exception: invalid index for case: SSH_Key_Exchange: 3 -
XXXXXXXXXX.XXXXXX disabled protocol SSH CP5puj4I8PtEU4qzYg - 192.168.2.1 56845 192.168.2.158 22 - -
XXXXXXXXXX.XXXXXX violation protocol SSH C37jN32gN3y3AZzyf6 - 192.168.2.1 56875 192.168.2.158 22 Binpac exception: binpac exception: invalid index for case: SSH_Key_Exchange: 3 -
XXXXXXXXXX.XXXXXX disabled protocol SSH C37jN32gN3y3AZzyf6 - 192.168.2.1 56875 192.168.2.158 22 - -
XXXXXXXXXX.XXXXXX violation protocol SSH C3eiCBGOLw3VtHfOj - 192.168.2.1 56878 192.168.2.158 22 Binpac exception: binpac exception: invalid index for case: SSH_Key_Exchange: 3 -
XXXXXXXXXX.XXXXXX disabled protocol SSH C3eiCBGOLw3VtHfOj - 192.168.2.1 56878 192.168.2.158 22 - -
XXXXXXXXXX.XXXXXX violation protocol SSH CwjjYJ2WqgTbAqiHl6 - 192.168.2.1 56940 192.168.2.158 22 Binpac exception: binpac exception: invalid index for case: SSH_Key_Exchange: 3 -
XXXXXXXXXX.XXXXXX disabled protocol SSH CwjjYJ2WqgTbAqiHl6 - 192.168.2.1 56940 192.168.2.158 22 - -
XXXXXXXXXX.XXXXXX violation protocol SSH C0LAHyvtKSQHyJxIl - 192.168.2.1 57831 192.168.2.158 22 Binpac exception: binpac exception: invalid index for case: SSH_Key_Exchange: 3 -
XXXXXXXXXX.XXXXXX disabled protocol SSH C0LAHyvtKSQHyJxIl - 192.168.2.1 57831 192.168.2.158 22 - -
XXXXXXXXXX.XXXXXX violation protocol SSH CFLRIC3zaTU1loLGxh - 192.168.2.1 59246 192.168.2.158 22 Binpac exception: binpac exception: invalid index for case: SSH_Key_Exchange: 3 -
XXXXXXXXXX.XXXXXX disabled protocol SSH CFLRIC3zaTU1loLGxh - 192.168.2.1 59246 192.168.2.158 22 - -
XXXXXXXXXX.XXXXXX violation protocol SSH C9rXSW3KSpTYvPrlI1 - 192.168.1.32 41164 128.2.10.238 22 Binpac exception: binpac exception: invalid index for case: SSH_Key_Exchange: 3 -
XXXXXXXXXX.XXXXXX disabled protocol SSH C9rXSW3KSpTYvPrlI1 - 192.168.1.32 41164 128.2.10.238 22 - -
XXXXXXXXXX.XXXXXX violation protocol SSH Ck51lg1bScffFj34Ri - 192.168.1.32 33910 128.2.13.133 22 Binpac exception: binpac exception: invalid index for case: SSH_Key_Exchange: 3 -
XXXXXXXXXX.XXXXXX disabled protocol SSH Ck51lg1bScffFj34Ri - 192.168.1.32 33910 128.2.13.133 22 - -
XXXXXXXXXX.XXXXXX violation protocol SSH C9mvWx3ezztgzcexV7 - 192.168.1.32 41268 128.2.10.238 22 Binpac exception: binpac exception: invalid index for case: SSH_Key_Exchange: 3 -
XXXXXXXXXX.XXXXXX disabled protocol SSH C9mvWx3ezztgzcexV7 - 192.168.1.32 41268 128.2.10.238 22 - -
XXXXXXXXXX.XXXXXX violation protocol SSH CNnMIj2QSd84NKf7U3 - 192.168.1.31 52294 192.168.1.32 22 Binpac exception: binpac exception: invalid index for case: SSH_Key_Exchange: 3 -
XXXXXXXXXX.XXXXXX disabled protocol SSH CNnMIj2QSd84NKf7U3 - 192.168.1.31 52294 192.168.1.32 22 - -
XXXXXXXXXX.XXXXXX violation protocol SSH C7fIlMZDuRiqjpYbb - 192.168.1.31 51489 192.168.1.32 22 Binpac exception: binpac exception: invalid index for case: SSH_Key_Exchange: 3 -
XXXXXXXXXX.XXXXXX disabled protocol SSH C7fIlMZDuRiqjpYbb - 192.168.1.31 51489 192.168.1.32 22 - -
XXXXXXXXXX.XXXXXX violation protocol SSH CykQaM33ztNt0csB9a - 192.168.1.32 58641 131.103.20.168 22 Binpac exception: binpac exception: invalid index for case: SSH_Key_Exchange: 3 -
XXXXXXXXXX.XXXXXX disabled protocol SSH CykQaM33ztNt0csB9a - 192.168.1.32 58641 131.103.20.168 22 - -
XXXXXXXXXX.XXXXXX violation protocol SSH CtxTCR2Yer0FR1tIBg - 192.168.1.32 58646 131.103.20.168 22 Binpac exception: binpac exception: invalid index for case: SSH_Key_Exchange: 3 -
XXXXXXXXXX.XXXXXX disabled protocol SSH CtxTCR2Yer0FR1tIBg - 192.168.1.32 58646 131.103.20.168 22 - -
XXXXXXXXXX.XXXXXX violation protocol SSH CpmdRlaUoJLN3uIRa - 192.168.1.32 58649 131.103.20.168 22 Binpac exception: binpac exception: invalid index for case: SSH_Key_Exchange: 3 -
XXXXXXXXXX.XXXXXX disabled protocol SSH CpmdRlaUoJLN3uIRa - 192.168.1.32 58649 131.103.20.168 22 - -
#close XXXX-XX-XX-XX-XX-XX

30
testing/btest/Baseline/scripts.base.protocols.ssh.half-duplex-server/analyzer_debuglog Normal file
View file

@ -0,0 +1,30 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path analyzer_failed
#open XXXX-XX-XX-XX-XX-XX
#fields ts analyzer_kind analyzer_name uid fuid id.orig_h id.orig_p id.resp_h id.resp_p failure_reason failure_data
#types time string string string string addr port addr port string string
XXXXXXXXXX.XXXXXX protocol SSH CHhAvVGS1DHFjwGM9 - 192.168.1.79 51880 131.159.21.1 22 Binpac exception: binpac exception: invalid index for case: SSH_Key_Exchange: 3 -
XXXXXXXXXX.XXXXXX protocol SSH ClEkJM2Vm5giqnMf4h - 192.168.2.1 57189 192.168.2.158 22 Binpac exception: binpac exception: invalid index for case: SSH_Key_Exchange: 3 -
XXXXXXXXXX.XXXXXX protocol SSH C4J4Th3PJpwUYZZ6gc - 192.168.2.1 57191 192.168.2.158 22 Binpac exception: binpac exception: invalid index for case: SSH_Key_Exchange: 3 -
XXXXXXXXXX.XXXXXX protocol SSH CtPZjS20MLrsMUOJi2 - 192.168.2.1 56594 192.168.2.158 22 Binpac exception: binpac exception: invalid index for case: SSH_Key_Exchange: 3 -
XXXXXXXXXX.XXXXXX protocol SSH CUM0KZ3MLUfNB0cl11 - 192.168.2.1 56821 192.168.2.158 22 Binpac exception: binpac exception: invalid index for case: SSH_Key_Exchange: 3 -
XXXXXXXXXX.XXXXXX protocol SSH CmES5u32sYpV7JYN - 192.168.2.1 56837 192.168.2.158 22 Binpac exception: binpac exception: invalid index for case: SSH_Key_Exchange: 3 -
XXXXXXXXXX.XXXXXX protocol SSH CP5puj4I8PtEU4qzYg - 192.168.2.1 56845 192.168.2.158 22 Binpac exception: binpac exception: invalid index for case: SSH_Key_Exchange: 3 -
XXXXXXXXXX.XXXXXX protocol SSH C37jN32gN3y3AZzyf6 - 192.168.2.1 56875 192.168.2.158 22 Binpac exception: binpac exception: invalid index for case: SSH_Key_Exchange: 3 -
XXXXXXXXXX.XXXXXX protocol SSH C3eiCBGOLw3VtHfOj - 192.168.2.1 56878 192.168.2.158 22 Binpac exception: binpac exception: invalid index for case: SSH_Key_Exchange: 3 -
XXXXXXXXXX.XXXXXX protocol SSH CwjjYJ2WqgTbAqiHl6 - 192.168.2.1 56940 192.168.2.158 22 Binpac exception: binpac exception: invalid index for case: SSH_Key_Exchange: 3 -
XXXXXXXXXX.XXXXXX protocol SSH C0LAHyvtKSQHyJxIl - 192.168.2.1 57831 192.168.2.158 22 Binpac exception: binpac exception: invalid index for case: SSH_Key_Exchange: 3 -
XXXXXXXXXX.XXXXXX protocol SSH CFLRIC3zaTU1loLGxh - 192.168.2.1 59246 192.168.2.158 22 Binpac exception: binpac exception: invalid index for case: SSH_Key_Exchange: 3 -
XXXXXXXXXX.XXXXXX protocol SSH C9rXSW3KSpTYvPrlI1 - 192.168.1.32 41164 128.2.10.238 22 Binpac exception: binpac exception: invalid index for case: SSH_Key_Exchange: 3 -
XXXXXXXXXX.XXXXXX protocol SSH Ck51lg1bScffFj34Ri - 192.168.1.32 33910 128.2.13.133 22 Binpac exception: binpac exception: invalid index for case: SSH_Key_Exchange: 3 -
XXXXXXXXXX.XXXXXX protocol SSH C9mvWx3ezztgzcexV7 - 192.168.1.32 41268 128.2.10.238 22 Binpac exception: binpac exception: invalid index for case: SSH_Key_Exchange: 3 -
XXXXXXXXXX.XXXXXX protocol SSH CNnMIj2QSd84NKf7U3 - 192.168.1.31 52294 192.168.1.32 22 Binpac exception: binpac exception: invalid index for case: SSH_Key_Exchange: 3 -
XXXXXXXXXX.XXXXXX protocol SSH C7fIlMZDuRiqjpYbb - 192.168.1.31 51489 192.168.1.32 22 Binpac exception: binpac exception: invalid index for case: SSH_Key_Exchange: 3 -
XXXXXXXXXX.XXXXXX protocol SSH CykQaM33ztNt0csB9a - 192.168.1.32 58641 131.103.20.168 22 Binpac exception: binpac exception: invalid index for case: SSH_Key_Exchange: 3 -
XXXXXXXXXX.XXXXXX protocol SSH CtxTCR2Yer0FR1tIBg - 192.168.1.32 58646 131.103.20.168 22 Binpac exception: binpac exception: invalid index for case: SSH_Key_Exchange: 3 -
XXXXXXXXXX.XXXXXX protocol SSH CpmdRlaUoJLN3uIRa - 192.168.1.32 58649 131.103.20.168 22 Binpac exception: binpac exception: invalid index for case: SSH_Key_Exchange: 3 -
#close XXXX-XX-XX-XX-XX-XX