From c4302ec2804849193a2dc0a0fdeb500b4c380ef0 Mon Sep 17 00:00:00 2001 From: Arne Welzel Date: Wed, 30 Nov 2022 16:52:42 +0100 Subject: [PATCH] testing/http: http-11-request-then-cruft A client sends a "proper" HTTP/1.1 request and afterwards a few T /\n\n sequences. The latter ones aren't logged. --- .../dpd.log | 11 +++++++++++ .../http.log | 11 +++++++++++ .../weird.log | 12 ++++++++++++ .../Traces/http/http-11-request-then-cruft.pcap | Bin 0 -> 2226 bytes .../http/http-11-request-then-cruft.pcap | 7 +++++++ 5 files changed, 41 insertions(+) create mode 100644 testing/btest/Baseline/scripts.base.protocols.http.http-11-request-then-cruft/dpd.log create mode 100644 testing/btest/Baseline/scripts.base.protocols.http.http-11-request-then-cruft/http.log create mode 100644 testing/btest/Baseline/scripts.base.protocols.http.http-11-request-then-cruft/weird.log create mode 100644 testing/btest/Traces/http/http-11-request-then-cruft.pcap create mode 100644 testing/btest/scripts/base/protocols/http/http-11-request-then-cruft.pcap diff --git a/testing/btest/Baseline/scripts.base.protocols.http.http-11-request-then-cruft/dpd.log b/testing/btest/Baseline/scripts.base.protocols.http.http-11-request-then-cruft/dpd.log new file mode 100644 index 0000000000..2948f61836 --- /dev/null +++ b/testing/btest/Baseline/scripts.base.protocols.http.http-11-request-then-cruft/dpd.log @@ -0,0 +1,11 @@ +### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. +#separator \x09 +#set_separator , +#empty_field (empty) +#unset_field - +#path dpd +#open XXXX-XX-XX-XX-XX-XX +#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto analyzer failure_reason +#types time string addr port addr port enum string string +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.12.5 51792 192.0.78.212 80 tcp HTTP not a http request line +#close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/scripts.base.protocols.http.http-11-request-then-cruft/http.log b/testing/btest/Baseline/scripts.base.protocols.http.http-11-request-then-cruft/http.log new file mode 100644 index 0000000000..6a68dd9fe6 --- /dev/null +++ b/testing/btest/Baseline/scripts.base.protocols.http.http-11-request-then-cruft/http.log @@ -0,0 +1,11 @@ +### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. +#separator \x09 +#set_separator , +#empty_field (empty) +#unset_field - +#path http +#open XXXX-XX-XX-XX-XX-XX +#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer version user_agent origin request_body_len response_body_len status_code status_msg info_code info_msg tags username password proxied orig_fuids orig_filenames orig_mime_types resp_fuids resp_filenames resp_mime_types +#types time string addr port addr port count string string string string string string string count count count string count string set[enum] string string set[string] vector[string] vector[string] vector[string] vector[string] vector[string] vector[string] +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.12.5 51792 192.0.78.212 80 1 GET zeek.org / - 1.1 - - 0 162 301 Moved Permanently - - (empty) - - - - - - FAKHufE4EVGbXF6P - text/html +#close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/scripts.base.protocols.http.http-11-request-then-cruft/weird.log b/testing/btest/Baseline/scripts.base.protocols.http.http-11-request-then-cruft/weird.log new file mode 100644 index 0000000000..b64f58f771 --- /dev/null +++ b/testing/btest/Baseline/scripts.base.protocols.http.http-11-request-then-cruft/weird.log @@ -0,0 +1,12 @@ +### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. +#separator \x09 +#set_separator , +#empty_field (empty) +#unset_field - +#path weird +#open XXXX-XX-XX-XX-XX-XX +#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer source +#types time string addr port addr port string string bool string string +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.12.5 51792 192.0.78.212 80 HTTP_version_mismatch - F zeek HTTP +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.12.5 51792 192.0.78.212 80 bad_HTTP_request - F zeek HTTP +#close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Traces/http/http-11-request-then-cruft.pcap b/testing/btest/Traces/http/http-11-request-then-cruft.pcap new file mode 100644 index 0000000000000000000000000000000000000000..a9f38244768853d5e9b559cd2cabc7857e728fe3 GIT binary patch literal 2226 zcmbuAPi)gx9LIllTUI<=T42!9BE8edfz(OppVi7r33NpWkhMe_Q<;iM9!*AKm&Am2 z(zX&oIKW}IP1=Mghzf4ow9Aktb!C%S2kl|qVL}3FJ5}4zBq)MusQbO=hBmedAR;{_ z{_{Tm{C@tvm)UDykBLwXrO(0wfPe?H!>8l@^D^wl-)u~uy)bk+p#6EY@6Hdk&=LY|aH;lccVfWF=sQOK@XOjClb zL5Zn-cYI0BRjjXYofZ4XDMzsfvDn*MJw$)}#8&eS*TGw;#)eDnjiSue0uHs?yg*dj zK>&7{IZGuUP@)Ku z6bOY#uwC8SskV2JzP&M7+F=?NPWQ(~hVW*K4qHmn%A}Vr?4ib>l~hTvBg9V{G;XC# zLnTKj9rEkxRG!Mx9y6}nXOosSlv5R@)Imj-_WSj?NSVXV$wT^6gh zK!8N_1bLetJw|iZ3kIt5MFZ6yC=XOTZRRjbWpPOyKK`tnIIN#5A+9+ula10_DDAAy zw*bDv4ZcO3C|}%4Gk*&W5S_%gz$oh9_TK!I{kfiJ<4s349*&JG&6u!z-#6Qo6X%3V zyL@7GJ^a>lzb|aR>rFLJD6ZA* mE3V^yT@JtX+^<2HpLk?bY6g}l9=)33E+2WgY~U`R1N;ws*V~%_ literal 0 HcmV?d00001 diff --git a/testing/btest/scripts/base/protocols/http/http-11-request-then-cruft.pcap b/testing/btest/scripts/base/protocols/http/http-11-request-then-cruft.pcap new file mode 100644 index 0000000000..647e8cfa73 --- /dev/null +++ b/testing/btest/scripts/base/protocols/http/http-11-request-then-cruft.pcap @@ -0,0 +1,7 @@ +# @TEST-EXEC: zeek -b -r $TRACES/http/http-11-request-then-cruft.pcap %INPUT > output +# @TEST-EXEC: btest-diff http.log +# @TEST-EXEC: btest-diff weird.log +# @TEST-EXEC: btest-diff dpd.log + +@load base/protocols/http +@load base/frameworks/notice/weird