Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

policy: Import zeek-community-id scripts into protocols/conn frameworks/notice

Browse source 
Slightly adapted for indentation.
This commit is contained in:
Christian Kreibich 2023-04-21 19:24:02 +02:00 • committed by Arne Welzel
parent 99de7b7526
commit b90351b7e6
8 changed files with 111 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

3
testing/btest/Baseline/scripts.policy.frameworks.notice.community-id/notice.log.cut Normal file
View file

@ -0,0 +1,3 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
- - - - - - COMMUNITY_ID_INIT Zeek initializing
141.142.228.5 59856 192.150.187.43 80 tcp 1:yvyB8h+3dnggTZW0UEITWCst97w= COMMUNITY_ID_CONN_ESTABLISHED Connection establishment

2
testing/btest/Baseline/scripts.policy.protocols.conn.community-id-logging/conn.log.cut Normal file
View file

@ -0,0 +1,2 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
141.142.228.5 59856 192.150.187.43 80 tcp - 1:yvyB8h+3dnggTZW0UEITWCst97w=

31
testing/btest/scripts/policy/frameworks/notice/community-id.zeek Normal file
View file

@ -0,0 +1,31 @@
# This test verifies Community ID presence in the notice log, when
# that part of the package is loaded. The test creates one notice
# without connection state and one with, and verifies that the latter
# includes the Community ID value for it.
# @TEST-EXEC: zeek -b -r $TRACES/http/get.trace %INPUT
# @TEST-EXEC: zeek-cut id.orig_h id.orig_p id.resp_h id.resp_p proto community_id note msg < notice.log > notice.log.cut
# @TEST-EXEC: btest-diff notice.log.cut
@load protocols/conn/community-id-logging
@load frameworks/notice/community-id
redef enum Notice::Type += {
COMMUNITY_ID_INIT,
COMMUNITY_ID_CONN_ESTABLISHED,
};
event zeek_init()
{
# A notice without connection context
NOTICE([$note=COMMUNITY_ID_INIT,
$msg="Zeek initializing"]);
}
event connection_established(c: connection)
{
# A notice with connection context
NOTICE([$note=COMMUNITY_ID_CONN_ESTABLISHED,
$msg="Connection establishment",
$conn=c]);
}

5
testing/btest/scripts/policy/protocols/conn/community-id-logging.zeek Normal file
View file

@ -0,0 +1,5 @@
# @TEST-EXEC: zeek -b -r $TRACES/http/get.trace %INPUT
# @TEST-EXEC: zeek-cut id.orig_h id.orig_p id.resp_h id.resp_p proto service community_id < conn.log > conn.log.cut
# @TEST-EXEC: btest-diff conn.log.cut
@load protocols/conn/community-id-logging