Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Fix failing jenkins test (dump-events).

Browse source 
The problem is that with certain compilers, the order of the file hash
events is reversed (for at this moment unknown reasons).

This fix simply removes all MD5 events from the dump-events test, only
leaving the SHA1 events. This removes this condition during the test.
This commit is contained in:
Johanna Amann 2016-02-17 14:09:22 -08:00
parent 0ac6460e98
commit c38e962030
5 changed files with 43 additions and 40 deletions
Download patch file Download diff file Expand all files Collapse all files

4
CHANGES
View file

@ -1,4 +1,8 @@
2.4-284 | 2016-02-17 14:12:15 -0800
* Fix sometimes failing dump-events test. (Johanna Amann)
2.4-282 | 2016-02-13 10:48:21 -0800 2.4-282 | 2016-02-13 10:48:21 -0800
* Add missing break in in StartTLS case of IRC analyzer. Found by * Add missing break in in StartTLS case of IRC analyzer. Found by

2
VERSION
View file

@ -1 +1 @@
2.4-282 2.4-284

2
testing/btest/Baseline/scripts.policy.misc.dump-events/all-events-no-args.log
View file

@ -182,7 +182,6 @@
1437831799.764576 x509_extension 1437831799.764576 x509_extension
1437831799.764576 x509_ext_subject_alternative_name 1437831799.764576 x509_ext_subject_alternative_name
1437831799.764576 file_hash 1437831799.764576 file_hash
1437831799.764576 file_hash
1437831799.764576 file_state_remove 1437831799.764576 file_state_remove
1437831799.764576 file_new 1437831799.764576 file_new
1437831799.764576 file_over_new_connection 1437831799.764576 file_over_new_connection
@ -197,7 +196,6 @@
1437831799.764576 x509_extension 1437831799.764576 x509_extension
1437831799.764576 x509_extension 1437831799.764576 x509_extension
1437831799.764576 file_hash 1437831799.764576 file_hash
1437831799.764576 file_hash
1437831799.764576 file_state_remove 1437831799.764576 file_state_remove
1437831799.764576 ssl_handshake_message 1437831799.764576 ssl_handshake_message
1437831799.764576 ssl_handshake_message 1437831799.764576 ssl_handshake_message

56
testing/btest/Baseline/scripts.policy.misc.dump-events/all-events.log
View file

File diff suppressed because one or more lines are too long

19
testing/btest/scripts/policy/misc/dump-events.bro
View file

@ -1,7 +1,18 @@
# @TEST-EXEC: bro -r $TRACES/smtp.trace policy/misc/dump-events.bro >all-events.log # @TEST-EXEC: bro -r $TRACES/smtp.trace policy/misc/dump-events.bro %INPUT >all-events.log
# @TEST-EXEC: bro -r $TRACES/smtp.trace policy/misc/dump-events.bro DumpEvents::include_args=F >all-events-no-args.log # @TEST-EXEC: bro -r $TRACES/smtp.trace policy/misc/dump-events.bro %INPUT DumpEvents::include_args=F >all-events-no-args.log
# @TEST-EXEC: bro -r $TRACES/smtp.trace policy/misc/dump-events.bro DumpEvents::include=/smtp_/ >smtp-events.log # @TEST-EXEC: bro -r $TRACES/smtp.trace policy/misc/dump-events.bro %INPUT DumpEvents::include=/smtp_/ >smtp-events.log
# #
# @TEST-EXEC: btest-diff all-events.log # @TEST-EXEC: btest-diff all-events.log
# @TEST-EXEC: btest-diff all-events-no-args.log # @TEST-EXEC: btest-diff all-events-no-args.log
# @TEST-EXEC: btest-diff smtp-events.log # @TEST-EXEC: btest-diff smtp-events.log
# There is some kind of race condition between the MD5 and SHA1 events, which are added
# by the SSL parser. Just remove MD5, this is not important for this test.
event file_over_new_connection(f: fa_file, c: connection, is_orig: bool) &priority=-5
{
if ( ! c?$ssl )
return;
Files::remove_analyzer(f, Files::ANALYZER_MD5);
}