Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-03 23:28:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

policy: Import zeek-community-id scripts into protocols/conn frameworks/notice

Browse source 
Slightly adapted for indentation.
This commit is contained in:
Christian Kreibich 2023-04-21 19:24:02 +02:00 • committed by Arne Welzel
parent 99de7b7526
commit b90351b7e6
8 changed files with 111 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

31
testing/btest/scripts/policy/frameworks/notice/community-id.zeek Normal file
View file

@ -0,0 +1,31 @@
# This test verifies Community ID presence in the notice log, when
# that part of the package is loaded. The test creates one notice
# without connection state and one with, and verifies that the latter
# includes the Community ID value for it.
# @TEST-EXEC: zeek -b -r $TRACES/http/get.trace %INPUT
# @TEST-EXEC: zeek-cut id.orig_h id.orig_p id.resp_h id.resp_p proto community_id note msg < notice.log > notice.log.cut
# @TEST-EXEC: btest-diff notice.log.cut
@load protocols/conn/community-id-logging
@load frameworks/notice/community-id
redef enum Notice::Type += {
COMMUNITY_ID_INIT,
COMMUNITY_ID_CONN_ESTABLISHED,
};
event zeek_init()
{
# A notice without connection context
NOTICE([$note=COMMUNITY_ID_INIT,
$msg="Zeek initializing"]);
}
event connection_established(c: connection)
{
# A notice with connection context
NOTICE([$note=COMMUNITY_ID_CONN_ESTABLISHED,
$msg="Connection establishment",
$conn=c]);
}

5
testing/btest/scripts/policy/protocols/conn/community-id-logging.zeek Normal file
View file

@ -0,0 +1,5 @@
# @TEST-EXEC: zeek -b -r $TRACES/http/get.trace %INPUT
# @TEST-EXEC: zeek-cut id.orig_h id.orig_p id.resp_h id.resp_p proto service community_id < conn.log > conn.log.cut
# @TEST-EXEC: btest-diff conn.log.cut
@load protocols/conn/community-id-logging