Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Merge branch 'fastpath' of ssh://git.bro-ids.org/bro into fastpath

Browse source
This commit is contained in:
Gregor Maier 2011-05-13 08:07:23 -07:00
commit cbf3390762
99 changed files with 933 additions and 1284 deletions
Download patch file Download diff file Expand all files Collapse all files

2
aux/broccoli

@ -1 +1 @@
Subproject commit 7c20b1a41016471eb03ee7a0fbfe1fb34bdc084a Subproject commit 54f3ff4e6627d4a44d1e014e8e581e4e9dfed8c3

2
aux/btest

@ -1 +1 @@
Subproject commit d0154a7e88cd1b6bccc11c042e451fcb9b5459bf Subproject commit f096c0e4088f2d92743e0c28077f086dff216cce

8
policy/conn.bro
View file

@ -18,6 +18,10 @@ global have_SMTP = F; # if true, we've loaded smtp.bro
# TODO: Do we have a nicer way of defining this prototype? # TODO: Do we have a nicer way of defining this prototype?
export { global FTP::is_ftp_data_conn: function(c: connection): bool; } export { global FTP::is_ftp_data_conn: function(c: connection): bool; }
# Whether to include connection state history in the logs generated
# by record_connection.
const record_state_history = F &redef;
# Whether to add 4 more columns to conn.log with # Whether to add 4 more columns to conn.log with
# orig_packet orig_ip_bytes resp_packets resp_ip_bytes # orig_packet orig_ip_bytes resp_packets resp_ip_bytes
# Requires use_conn_size_analyzer=T # Requires use_conn_size_analyzer=T
@ -311,6 +315,10 @@ function record_connection(f: file, c: connection)
conn_size(c$orig, trans), conn_size(c$resp, trans), conn_size(c$orig, trans), conn_size(c$resp, trans),
conn_state(c, trans), flags); conn_state(c, trans), flags);
if ( record_state_history )
log_msg = fmt("%s %s", log_msg,
c$history == "" ? "X" : c$history);
if ( use_conn_size_analyzer && report_conn_size_analyzer ) if ( use_conn_size_analyzer && report_conn_size_analyzer )
log_msg = fmt("%s %s %s", log_msg, log_msg = fmt("%s %s %s", log_msg,
conn_size_from_analyzer(c$orig), conn_size_from_analyzer(c$resp)); conn_size_from_analyzer(c$orig), conn_size_from_analyzer(c$resp));

9
policy/pcap.bro
View file

@ -58,8 +58,13 @@ function build_default_pcap_filter(): string
return cmd_line_bpf_filter; return cmd_line_bpf_filter;
if ( all_packets ) if ( all_packets )
{
# Return an "always true" filter. # Return an "always true" filter.
if ( bro_has_ipv6() )
return "ip or not ip"; return "ip or not ip";
else
return "not ip6";
}
## Build filter dynamically. ## Build filter dynamically.
@ -76,6 +81,10 @@ function build_default_pcap_filter(): string
# Finally, join them. # Finally, join them.
local filter = join_filters(cfilter, rfilter); local filter = join_filters(cfilter, rfilter);
# Exclude IPv6 if we don't support it.
if ( ! bro_has_ipv6() )
filter = fmt("(not ip6) and (%s)", filter);
return filter; return filter;
} }

6
src/POP3.cc
View file

@ -576,9 +576,11 @@ void POP3_Analyzer::ProcessReply(int length, const char* line)
if ( multiLine == true ) if ( multiLine == true )
{ {
bool terminator = bool terminator =
length > 1 && line[0] == '.' && line[0] == '.' &&
(length == 1 ||
(length > 1 &&
(line[1] == '\n' || (line[1] == '\n' ||
(length > 2 && line[1] == '\r' && line[2] == '\n')); (length > 2 && line[1] == '\r' && line[2] == '\n'))));
if ( terminator ) if ( terminator )
{ {

2
src/SerializationFormat.cc
View file

@ -21,6 +21,7 @@ void SerializationFormat::StartRead(char* data, uint32 arg_len)
input = data; input = data;
input_len = arg_len; input_len = arg_len;
input_pos = 0; input_pos = 0;
bytes_read = 0;
} }
void SerializationFormat::EndRead() void SerializationFormat::EndRead()
@ -44,7 +45,6 @@ void SerializationFormat::StartWrite()
output_pos = 0; output_pos = 0;
bytes_written = 0; bytes_written = 0;
bytes_read = 0;
} }
uint32 SerializationFormat::EndWrite(char** data) uint32 SerializationFormat::EndWrite(char** data)

4
src/Type.cc
View file

@ -848,8 +848,8 @@ void TypeDecl::DescribeReST(ODesc* d) const
} }
CommentedTypeDecl::CommentedTypeDecl(BroType* t, const char* i, CommentedTypeDecl::CommentedTypeDecl(BroType* t, const char* i,
attr_list* attrs, std::list<std::string>* cmnt_list) attr_list* attrs, bool in_record, std::list<std::string>* cmnt_list)
: TypeDecl(t, i, attrs) : TypeDecl(t, i, attrs, in_record)
{ {
comments = cmnt_list; comments = cmnt_list;
} }

2
src/Type.h
View file

@ -420,7 +420,7 @@ public:
class CommentedTypeDecl : public TypeDecl { class CommentedTypeDecl : public TypeDecl {
public: public:
CommentedTypeDecl(BroType* t, const char* i, attr_list* attrs = 0, CommentedTypeDecl(BroType* t, const char* i, attr_list* attrs = 0,
std::list<std::string>* cmnt_list = 0); bool in_record = false, std::list<std::string>* cmnt_list = 0);
virtual ~CommentedTypeDecl(); virtual ~CommentedTypeDecl();
void DescribeReST(ODesc* d) const; void DescribeReST(ODesc* d) const;

2
src/Val.cc
View file

@ -2866,7 +2866,7 @@ RecordVal::RecordVal(RecordType* t) : MutableVal(t)
else if ( tag == TYPE_TABLE ) else if ( tag == TYPE_TABLE )
def = new TableVal(type->AsTableType(), a); def = new TableVal(type->AsTableType(), a);
else if ( t->Tag() == TYPE_VECTOR ) else if ( tag == TYPE_VECTOR )
def = new VectorVal(type->AsVectorType()); def = new VectorVal(type->AsVectorType());
} }

21
src/bro.bif
View file

@ -3106,7 +3106,13 @@ function lookup_location%(a: addr%) : geo_location
} }
#else #else
static int missing_geoip_reported = 0;
if ( ! missing_geoip_reported )
{
builtin_run_time("Bro was not configured for GeoIP support"); builtin_run_time("Bro was not configured for GeoIP support");
missing_geoip_reported = 1;
}
#endif #endif
// We can get here even if we have GeoIP support if we weren't // We can get here even if we have GeoIP support if we weren't
@ -3164,7 +3170,13 @@ function lookup_asn%(a: addr%) : count
return new Val(atoi(gir+2), TYPE_COUNT); return new Val(atoi(gir+2), TYPE_COUNT);
} }
#else #else
static int missing_geoip_reported = 0;
if ( ! missing_geoip_reported )
{
builtin_run_time("Bro was not configured for GeoIP ASN support"); builtin_run_time("Bro was not configured for GeoIP ASN support");
missing_geoip_reported = 1;
}
#endif #endif
// We can get here even if we have GeoIP support, if we weren't // We can get here even if we have GeoIP support, if we weren't
@ -3327,3 +3339,12 @@ function entropy_test_finish%(index: any%): entropy_test_result
delete s; delete s;
return ent_result; return ent_result;
%} %}
function bro_has_ipv6%(%) : bool
%{
#ifdef BROv6
return new Val(1, TYPE_BOOL);
#else
return new Val(0, TYPE_BOOL);
#endif
%}

3
src/parse.y
View file

@ -936,6 +936,7 @@ type_decl:
if ( generate_documentation ) if ( generate_documentation )
{ {
// TypeDecl ctor deletes the attr list, so make a copy
attr_list* a = $5; attr_list* a = $5;
attr_list* a_copy = 0; attr_list* a_copy = 0;
@ -947,7 +948,7 @@ type_decl:
} }
last_fake_type_decl = new CommentedTypeDecl( last_fake_type_decl = new CommentedTypeDecl(
$4, $2, a_copy, concat_opt_docs($1, $7)); $4, $2, a_copy, (in_record > 0), concat_opt_docs($1, $7));
} }
$$ = new TypeDecl($4, $2, $5, (in_record > 0)); $$ = new TypeDecl($4, $2, $5, (in_record > 0));

2
testing/btest/Baseline/core.conn-id/counts
View file

@ -1 +1 @@
18 62

112
testing/btest/Baseline/core.conn-id/output
View file

@ -1,34 +1,78 @@
[orig_h=141.142.220.118, orig_p=48649/tcp, resp_h=208.80.152.118, resp_p=80/tcp], UWkUyAuUGXf [orig_h=141.142.220.202, orig_p=5353/udp, resp_h=224.0.0.251, resp_p=5353/udp], UWkUyAuUGXf
[orig_h=141.142.220.118, orig_p=48649/tcp, resp_h=208.80.152.118, resp_p=80/tcp], UWkUyAuUGXf [orig_h=141.142.220.202, orig_p=5353/udp, resp_h=224.0.0.251, resp_p=5353/udp], UWkUyAuUGXf
[orig_h=141.142.220.118, orig_p=48649/tcp, resp_h=208.80.152.118, resp_p=80/tcp], UWkUyAuUGXf [orig_h=141.142.220.50, orig_p=5353/udp, resp_h=224.0.0.251, resp_p=5353/udp], 56gKBmhBBB6
[orig_h=141.142.220.118, orig_p=48649/tcp, resp_h=208.80.152.118, resp_p=80/tcp], UWkUyAuUGXf [orig_h=141.142.220.50, orig_p=5353/udp, resp_h=224.0.0.251, resp_p=5353/udp], 56gKBmhBBB6
[orig_h=141.142.220.118, orig_p=49996/tcp, resp_h=208.80.152.3, resp_p=80/tcp], 56gKBmhBBB6 [orig_h=141.142.220.118, orig_p=35634/tcp, resp_h=208.80.152.2, resp_p=80/tcp], 50da4BEzauh
[orig_h=141.142.220.118, orig_p=49996/tcp, resp_h=208.80.152.3, resp_p=80/tcp], 56gKBmhBBB6 [orig_h=141.142.220.118, orig_p=35634/tcp, resp_h=208.80.152.2, resp_p=80/tcp], 50da4BEzauh
[orig_h=141.142.220.118, orig_p=49997/tcp, resp_h=208.80.152.3, resp_p=80/tcp], 50da4BEzauh [orig_h=141.142.220.118, orig_p=48649/tcp, resp_h=208.80.152.118, resp_p=80/tcp], WUjEZFOdSS
[orig_h=141.142.220.118, orig_p=49997/tcp, resp_h=208.80.152.3, resp_p=80/tcp], 50da4BEzauh [orig_h=141.142.220.118, orig_p=48649/tcp, resp_h=208.80.152.118, resp_p=80/tcp], WUjEZFOdSS
[orig_h=141.142.220.118, orig_p=49998/tcp, resp_h=208.80.152.3, resp_p=80/tcp], WUjEZFOdSS [orig_h=141.142.220.118, orig_p=48649/tcp, resp_h=208.80.152.118, resp_p=80/tcp], WUjEZFOdSS
[orig_h=141.142.220.118, orig_p=49998/tcp, resp_h=208.80.152.3, resp_p=80/tcp], WUjEZFOdSS [orig_h=141.142.220.118, orig_p=48649/tcp, resp_h=208.80.152.118, resp_p=80/tcp], WUjEZFOdSS
[orig_h=141.142.220.118, orig_p=49999/tcp, resp_h=208.80.152.3, resp_p=80/tcp], ecqdozAET6c [orig_h=141.142.220.118, orig_p=43927/udp, resp_h=141.142.2.2, resp_p=53/udp], ecqdozAET6c
[orig_h=141.142.220.118, orig_p=49999/tcp, resp_h=208.80.152.3, resp_p=80/tcp], ecqdozAET6c [orig_h=141.142.220.118, orig_p=43927/udp, resp_h=141.142.2.2, resp_p=53/udp], ecqdozAET6c
[orig_h=141.142.220.118, orig_p=50000/tcp, resp_h=208.80.152.3, resp_p=80/tcp], tdkrEYpj5ja [orig_h=141.142.220.118, orig_p=37676/udp, resp_h=141.142.2.2, resp_p=53/udp], tdkrEYpj5ja
[orig_h=141.142.220.118, orig_p=50000/tcp, resp_h=208.80.152.3, resp_p=80/tcp], tdkrEYpj5ja [orig_h=141.142.220.118, orig_p=37676/udp, resp_h=141.142.2.2, resp_p=53/udp], tdkrEYpj5ja
[orig_h=141.142.220.118, orig_p=50001/tcp, resp_h=208.80.152.3, resp_p=80/tcp], F5XgctwO3Vl [orig_h=141.142.220.118, orig_p=40526/udp, resp_h=141.142.2.2, resp_p=53/udp], F5XgctwO3Vl
[orig_h=141.142.220.118, orig_p=50001/tcp, resp_h=208.80.152.3, resp_p=80/tcp], F5XgctwO3Vl [orig_h=141.142.220.118, orig_p=40526/udp, resp_h=141.142.2.2, resp_p=53/udp], F5XgctwO3Vl
[orig_h=141.142.220.118, orig_p=35642/tcp, resp_h=208.80.152.2, resp_p=80/tcp], svqqNKN9CFj [orig_h=141.142.220.118, orig_p=49996/tcp, resp_h=208.80.152.3, resp_p=80/tcp], svqqNKN9CFj
[orig_h=141.142.220.118, orig_p=35642/tcp, resp_h=208.80.152.2, resp_p=80/tcp], svqqNKN9CFj [orig_h=141.142.220.118, orig_p=49996/tcp, resp_h=208.80.152.3, resp_p=80/tcp], svqqNKN9CFj
[orig_h=141.142.220.118, orig_p=49997/tcp, resp_h=208.80.152.3, resp_p=80/tcp], 50da4BEzauh [orig_h=141.142.220.118, orig_p=49997/tcp, resp_h=208.80.152.3, resp_p=80/tcp], UZkBBvjF0r8
[orig_h=141.142.220.118, orig_p=49997/tcp, resp_h=208.80.152.3, resp_p=80/tcp], 50da4BEzauh [orig_h=141.142.220.118, orig_p=49997/tcp, resp_h=208.80.152.3, resp_p=80/tcp], UZkBBvjF0r8
[orig_h=141.142.220.118, orig_p=49996/tcp, resp_h=208.80.152.3, resp_p=80/tcp], 56gKBmhBBB6 [orig_h=141.142.220.118, orig_p=32902/udp, resp_h=141.142.2.2, resp_p=53/udp], nSEQzFk1LZc
[orig_h=141.142.220.118, orig_p=49996/tcp, resp_h=208.80.152.3, resp_p=80/tcp], 56gKBmhBBB6 [orig_h=141.142.220.118, orig_p=32902/udp, resp_h=141.142.2.2, resp_p=53/udp], nSEQzFk1LZc
[orig_h=141.142.220.118, orig_p=49998/tcp, resp_h=208.80.152.3, resp_p=80/tcp], WUjEZFOdSS [orig_h=141.142.220.118, orig_p=59816/udp, resp_h=141.142.2.2, resp_p=53/udp], rmXOq6wncn1
[orig_h=141.142.220.118, orig_p=49998/tcp, resp_h=208.80.152.3, resp_p=80/tcp], WUjEZFOdSS [orig_h=141.142.220.118, orig_p=59816/udp, resp_h=141.142.2.2, resp_p=53/udp], rmXOq6wncn1
[orig_h=141.142.220.118, orig_p=50000/tcp, resp_h=208.80.152.3, resp_p=80/tcp], tdkrEYpj5ja [orig_h=141.142.220.118, orig_p=59714/udp, resp_h=141.142.2.2, resp_p=53/udp], 4YYJTjETe1i
[orig_h=141.142.220.118, orig_p=50000/tcp, resp_h=208.80.152.3, resp_p=80/tcp], tdkrEYpj5ja [orig_h=141.142.220.118, orig_p=59714/udp, resp_h=141.142.2.2, resp_p=53/udp], 4YYJTjETe1i
[orig_h=141.142.220.118, orig_p=49999/tcp, resp_h=208.80.152.3, resp_p=80/tcp], ecqdozAET6c [orig_h=141.142.220.118, orig_p=49998/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OldlyspNIr7
[orig_h=141.142.220.118, orig_p=49999/tcp, resp_h=208.80.152.3, resp_p=80/tcp], ecqdozAET6c [orig_h=141.142.220.118, orig_p=49998/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OldlyspNIr7
[orig_h=141.142.220.118, orig_p=50001/tcp, resp_h=208.80.152.3, resp_p=80/tcp], F5XgctwO3Vl [orig_h=141.142.220.118, orig_p=58206/udp, resp_h=141.142.2.2, resp_p=53/udp], R8BqVlcp23e
[orig_h=141.142.220.118, orig_p=50001/tcp, resp_h=208.80.152.3, resp_p=80/tcp], F5XgctwO3Vl [orig_h=141.142.220.118, orig_p=58206/udp, resp_h=141.142.2.2, resp_p=53/udp], R8BqVlcp23e
[orig_h=141.142.220.118, orig_p=35642/tcp, resp_h=208.80.152.2, resp_p=80/tcp], svqqNKN9CFj [orig_h=141.142.220.118, orig_p=38911/udp, resp_h=141.142.2.2, resp_p=53/udp], duYdXg7bTa3
[orig_h=141.142.220.118, orig_p=35642/tcp, resp_h=208.80.152.2, resp_p=80/tcp], svqqNKN9CFj [orig_h=141.142.220.118, orig_p=38911/udp, resp_h=141.142.2.2, resp_p=53/udp], duYdXg7bTa3
[orig_h=141.142.220.235, orig_p=6705/tcp, resp_h=173.192.163.128, resp_p=80/tcp], UZkBBvjF0r8 [orig_h=141.142.220.118, orig_p=59746/udp, resp_h=141.142.2.2, resp_p=53/udp], yzqaQTU9DXe
[orig_h=141.142.220.235, orig_p=6705/tcp, resp_h=173.192.163.128, resp_p=80/tcp], UZkBBvjF0r8 [orig_h=141.142.220.118, orig_p=59746/udp, resp_h=141.142.2.2, resp_p=53/udp], yzqaQTU9DXe
[orig_h=141.142.220.118, orig_p=49999/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OPM7xFSDNw3
[orig_h=141.142.220.118, orig_p=49999/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OPM7xFSDNw3
[orig_h=141.142.220.118, orig_p=50000/tcp, resp_h=208.80.152.3, resp_p=80/tcp], j5w2LueK8Ti
[orig_h=141.142.220.118, orig_p=50000/tcp, resp_h=208.80.152.3, resp_p=80/tcp], j5w2LueK8Ti
[orig_h=141.142.220.118, orig_p=45000/udp, resp_h=141.142.2.2, resp_p=53/udp], N6rbUGwigQ7
[orig_h=141.142.220.118, orig_p=45000/udp, resp_h=141.142.2.2, resp_p=53/udp], N6rbUGwigQ7
[orig_h=141.142.220.118, orig_p=48479/udp, resp_h=141.142.2.2, resp_p=53/udp], 8b9q7qPtzhd
[orig_h=141.142.220.118, orig_p=48479/udp, resp_h=141.142.2.2, resp_p=53/udp], 8b9q7qPtzhd
[orig_h=141.142.220.118, orig_p=48128/udp, resp_h=141.142.2.2, resp_p=53/udp], KOdlL7sC9z2
[orig_h=141.142.220.118, orig_p=48128/udp, resp_h=141.142.2.2, resp_p=53/udp], KOdlL7sC9z2
[orig_h=141.142.220.118, orig_p=50001/tcp, resp_h=208.80.152.3, resp_p=80/tcp], hvOo97vj60k
[orig_h=141.142.220.118, orig_p=50001/tcp, resp_h=208.80.152.3, resp_p=80/tcp], hvOo97vj60k
[orig_h=141.142.220.118, orig_p=56056/udp, resp_h=141.142.2.2, resp_p=53/udp], FHu81uYujA9
[orig_h=141.142.220.118, orig_p=56056/udp, resp_h=141.142.2.2, resp_p=53/udp], FHu81uYujA9
[orig_h=141.142.220.118, orig_p=55092/udp, resp_h=141.142.2.2, resp_p=53/udp], 2M1wDTa0C7a
[orig_h=141.142.220.118, orig_p=55092/udp, resp_h=141.142.2.2, resp_p=53/udp], 2M1wDTa0C7a
[orig_h=141.142.220.118, orig_p=35642/tcp, resp_h=208.80.152.2, resp_p=80/tcp], OKiJdtzKWPk
[orig_h=141.142.220.118, orig_p=35642/tcp, resp_h=208.80.152.2, resp_p=80/tcp], OKiJdtzKWPk
[orig_h=141.142.220.118, orig_p=49997/tcp, resp_h=208.80.152.3, resp_p=80/tcp], UZkBBvjF0r8
[orig_h=141.142.220.118, orig_p=49997/tcp, resp_h=208.80.152.3, resp_p=80/tcp], UZkBBvjF0r8
[orig_h=141.142.220.118, orig_p=49996/tcp, resp_h=208.80.152.3, resp_p=80/tcp], svqqNKN9CFj
[orig_h=141.142.220.118, orig_p=49996/tcp, resp_h=208.80.152.3, resp_p=80/tcp], svqqNKN9CFj
[orig_h=141.142.220.118, orig_p=49998/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OldlyspNIr7
[orig_h=141.142.220.118, orig_p=49998/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OldlyspNIr7
[orig_h=141.142.220.118, orig_p=50000/tcp, resp_h=208.80.152.3, resp_p=80/tcp], j5w2LueK8Ti
[orig_h=141.142.220.118, orig_p=50000/tcp, resp_h=208.80.152.3, resp_p=80/tcp], j5w2LueK8Ti
[orig_h=141.142.220.118, orig_p=49999/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OPM7xFSDNw3
[orig_h=141.142.220.118, orig_p=49999/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OPM7xFSDNw3
[orig_h=141.142.220.118, orig_p=50001/tcp, resp_h=208.80.152.3, resp_p=80/tcp], hvOo97vj60k
[orig_h=141.142.220.118, orig_p=50001/tcp, resp_h=208.80.152.3, resp_p=80/tcp], hvOo97vj60k
[orig_h=141.142.220.118, orig_p=35642/tcp, resp_h=208.80.152.2, resp_p=80/tcp], OKiJdtzKWPk
[orig_h=141.142.220.118, orig_p=35642/tcp, resp_h=208.80.152.2, resp_p=80/tcp], OKiJdtzKWPk
[orig_h=141.142.220.235, orig_p=6705/tcp, resp_h=173.192.163.128, resp_p=80/tcp], tpUWfNdSLE
[orig_h=141.142.220.235, orig_p=6705/tcp, resp_h=173.192.163.128, resp_p=80/tcp], tpUWfNdSLE
[orig_h=141.142.220.44, orig_p=5353/udp, resp_h=224.0.0.251, resp_p=5353/udp], ra1C6ZLut4b
[orig_h=141.142.220.44, orig_p=5353/udp, resp_h=224.0.0.251, resp_p=5353/udp], ra1C6ZLut4b
[orig_h=141.142.220.226, orig_p=137/udp, resp_h=141.142.220.255, resp_p=137/udp], UElDH5b9qA5
[orig_h=141.142.220.226, orig_p=137/udp, resp_h=141.142.220.255, resp_p=137/udp], UElDH5b9qA5
[orig_h=141.142.220.226, orig_p=55131/udp, resp_h=224.0.0.252, resp_p=5355/udp], sO3mBXBav1h
[orig_h=141.142.220.226, orig_p=55131/udp, resp_h=224.0.0.252, resp_p=5355/udp], sO3mBXBav1h
[orig_h=141.142.220.226, orig_p=55671/udp, resp_h=224.0.0.252, resp_p=5355/udp], xAQqZE8Wdp4
[orig_h=141.142.220.226, orig_p=55671/udp, resp_h=224.0.0.252, resp_p=5355/udp], xAQqZE8Wdp4
[orig_h=141.142.220.238, orig_p=56641/udp, resp_h=141.142.220.255, resp_p=137/udp], zVecVnfOlsf
[orig_h=141.142.220.238, orig_p=56641/udp, resp_h=141.142.220.255, resp_p=137/udp], zVecVnfOlsf

116
testing/btest/Baseline/core.conn-id/output.cc
View file

@ -1,36 +1,80 @@
[orig_h=141.142.220.118, orig_p=48649/tcp, resp_h=208.80.152.118, resp_p=80/tcp], UWkUyAuUGXf [orig_h=141.142.220.202, orig_p=5353/udp, resp_h=224.0.0.251, resp_p=5353/udp], UWkUyAuUGXf
[orig_h=141.142.220.118, orig_p=48649/tcp, resp_h=208.80.152.118, resp_p=80/tcp], UWkUyAuUGXf [orig_h=141.142.220.202, orig_p=5353/udp, resp_h=224.0.0.251, resp_p=5353/udp], UWkUyAuUGXf
[orig_h=141.142.220.118, orig_p=48649/tcp, resp_h=208.80.152.118, resp_p=80/tcp], UWkUyAuUGXf [orig_h=141.142.220.50, orig_p=5353/udp, resp_h=224.0.0.251, resp_p=5353/udp], 56gKBmhBBB6
[orig_h=141.142.220.118, orig_p=48649/tcp, resp_h=208.80.152.118, resp_p=80/tcp], UWkUyAuUGXf [orig_h=141.142.220.50, orig_p=5353/udp, resp_h=224.0.0.251, resp_p=5353/udp], 56gKBmhBBB6
[orig_h=141.142.220.118, orig_p=49996/tcp, resp_h=208.80.152.3, resp_p=80/tcp], 56gKBmhBBB6 [orig_h=141.142.220.118, orig_p=35634/tcp, resp_h=208.80.152.2, resp_p=80/tcp], 50da4BEzauh
[orig_h=141.142.220.118, orig_p=49996/tcp, resp_h=208.80.152.3, resp_p=80/tcp], 56gKBmhBBB6 [orig_h=141.142.220.118, orig_p=35634/tcp, resp_h=208.80.152.2, resp_p=80/tcp], 50da4BEzauh
[orig_h=141.142.220.118, orig_p=49997/tcp, resp_h=208.80.152.3, resp_p=80/tcp], 50da4BEzauh [orig_h=141.142.220.118, orig_p=48649/tcp, resp_h=208.80.152.118, resp_p=80/tcp], WUjEZFOdSS
[orig_h=141.142.220.118, orig_p=49997/tcp, resp_h=208.80.152.3, resp_p=80/tcp], 50da4BEzauh [orig_h=141.142.220.118, orig_p=48649/tcp, resp_h=208.80.152.118, resp_p=80/tcp], WUjEZFOdSS
[orig_h=141.142.220.118, orig_p=49998/tcp, resp_h=208.80.152.3, resp_p=80/tcp], WUjEZFOdSS [orig_h=141.142.220.118, orig_p=48649/tcp, resp_h=208.80.152.118, resp_p=80/tcp], WUjEZFOdSS
[orig_h=141.142.220.118, orig_p=49998/tcp, resp_h=208.80.152.3, resp_p=80/tcp], WUjEZFOdSS [orig_h=141.142.220.118, orig_p=48649/tcp, resp_h=208.80.152.118, resp_p=80/tcp], WUjEZFOdSS
[orig_h=141.142.220.118, orig_p=49999/tcp, resp_h=208.80.152.3, resp_p=80/tcp], ecqdozAET6c [orig_h=141.142.220.118, orig_p=43927/udp, resp_h=141.142.2.2, resp_p=53/udp], ecqdozAET6c
[orig_h=141.142.220.118, orig_p=49999/tcp, resp_h=208.80.152.3, resp_p=80/tcp], ecqdozAET6c [orig_h=141.142.220.118, orig_p=43927/udp, resp_h=141.142.2.2, resp_p=53/udp], ecqdozAET6c
[orig_h=141.142.220.118, orig_p=50000/tcp, resp_h=208.80.152.3, resp_p=80/tcp], tdkrEYpj5ja [orig_h=141.142.220.118, orig_p=37676/udp, resp_h=141.142.2.2, resp_p=53/udp], tdkrEYpj5ja
[orig_h=141.142.220.118, orig_p=50000/tcp, resp_h=208.80.152.3, resp_p=80/tcp], tdkrEYpj5ja [orig_h=141.142.220.118, orig_p=37676/udp, resp_h=141.142.2.2, resp_p=53/udp], tdkrEYpj5ja
[orig_h=141.142.220.118, orig_p=50001/tcp, resp_h=208.80.152.3, resp_p=80/tcp], F5XgctwO3Vl [orig_h=141.142.220.118, orig_p=40526/udp, resp_h=141.142.2.2, resp_p=53/udp], F5XgctwO3Vl
[orig_h=141.142.220.118, orig_p=50001/tcp, resp_h=208.80.152.3, resp_p=80/tcp], F5XgctwO3Vl [orig_h=141.142.220.118, orig_p=40526/udp, resp_h=141.142.2.2, resp_p=53/udp], F5XgctwO3Vl
[orig_h=141.142.220.118, orig_p=35642/tcp, resp_h=208.80.152.2, resp_p=80/tcp], svqqNKN9CFj [orig_h=141.142.220.118, orig_p=49996/tcp, resp_h=208.80.152.3, resp_p=80/tcp], svqqNKN9CFj
[orig_h=141.142.220.118, orig_p=35642/tcp, resp_h=208.80.152.2, resp_p=80/tcp], svqqNKN9CFj [orig_h=141.142.220.118, orig_p=49996/tcp, resp_h=208.80.152.3, resp_p=80/tcp], svqqNKN9CFj
[orig_h=141.142.220.118, orig_p=49997/tcp, resp_h=208.80.152.3, resp_p=80/tcp], 50da4BEzauh [orig_h=141.142.220.118, orig_p=49997/tcp, resp_h=208.80.152.3, resp_p=80/tcp], UZkBBvjF0r8
[orig_h=141.142.220.118, orig_p=49997/tcp, resp_h=208.80.152.3, resp_p=80/tcp], 50da4BEzauh [orig_h=141.142.220.118, orig_p=49997/tcp, resp_h=208.80.152.3, resp_p=80/tcp], UZkBBvjF0r8
[orig_h=141.142.220.118, orig_p=49996/tcp, resp_h=208.80.152.3, resp_p=80/tcp], 56gKBmhBBB6 [orig_h=141.142.220.118, orig_p=32902/udp, resp_h=141.142.2.2, resp_p=53/udp], nSEQzFk1LZc
[orig_h=141.142.220.118, orig_p=49996/tcp, resp_h=208.80.152.3, resp_p=80/tcp], 56gKBmhBBB6 [orig_h=141.142.220.118, orig_p=32902/udp, resp_h=141.142.2.2, resp_p=53/udp], nSEQzFk1LZc
[orig_h=141.142.220.118, orig_p=49998/tcp, resp_h=208.80.152.3, resp_p=80/tcp], WUjEZFOdSS [orig_h=141.142.220.118, orig_p=59816/udp, resp_h=141.142.2.2, resp_p=53/udp], rmXOq6wncn1
[orig_h=141.142.220.118, orig_p=49998/tcp, resp_h=208.80.152.3, resp_p=80/tcp], WUjEZFOdSS [orig_h=141.142.220.118, orig_p=59816/udp, resp_h=141.142.2.2, resp_p=53/udp], rmXOq6wncn1
[orig_h=141.142.220.118, orig_p=50000/tcp, resp_h=208.80.152.3, resp_p=80/tcp], tdkrEYpj5ja [orig_h=141.142.220.118, orig_p=59714/udp, resp_h=141.142.2.2, resp_p=53/udp], 4YYJTjETe1i
[orig_h=141.142.220.118, orig_p=50000/tcp, resp_h=208.80.152.3, resp_p=80/tcp], tdkrEYpj5ja [orig_h=141.142.220.118, orig_p=59714/udp, resp_h=141.142.2.2, resp_p=53/udp], 4YYJTjETe1i
[orig_h=141.142.220.118, orig_p=49999/tcp, resp_h=208.80.152.3, resp_p=80/tcp], ecqdozAET6c [orig_h=141.142.220.118, orig_p=49998/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OldlyspNIr7
[orig_h=141.142.220.118, orig_p=49999/tcp, resp_h=208.80.152.3, resp_p=80/tcp], ecqdozAET6c [orig_h=141.142.220.118, orig_p=49998/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OldlyspNIr7
[orig_h=141.142.220.118, orig_p=50001/tcp, resp_h=208.80.152.3, resp_p=80/tcp], F5XgctwO3Vl [orig_h=141.142.220.118, orig_p=58206/udp, resp_h=141.142.2.2, resp_p=53/udp], R8BqVlcp23e
[orig_h=141.142.220.118, orig_p=50001/tcp, resp_h=208.80.152.3, resp_p=80/tcp], F5XgctwO3Vl [orig_h=141.142.220.118, orig_p=58206/udp, resp_h=141.142.2.2, resp_p=53/udp], R8BqVlcp23e
[orig_h=141.142.220.118, orig_p=35642/tcp, resp_h=208.80.152.2, resp_p=80/tcp], svqqNKN9CFj [orig_h=141.142.220.118, orig_p=38911/udp, resp_h=141.142.2.2, resp_p=53/udp], duYdXg7bTa3
[orig_h=141.142.220.118, orig_p=35642/tcp, resp_h=208.80.152.2, resp_p=80/tcp], svqqNKN9CFj [orig_h=141.142.220.118, orig_p=38911/udp, resp_h=141.142.2.2, resp_p=53/udp], duYdXg7bTa3
[orig_h=141.142.220.235, orig_p=6705/tcp, resp_h=173.192.163.128, resp_p=80/tcp], UZkBBvjF0r8 [orig_h=141.142.220.118, orig_p=59746/udp, resp_h=141.142.2.2, resp_p=53/udp], yzqaQTU9DXe
[orig_h=141.142.220.235, orig_p=6705/tcp, resp_h=173.192.163.128, resp_p=80/tcp], UZkBBvjF0r8 [orig_h=141.142.220.118, orig_p=59746/udp, resp_h=141.142.2.2, resp_p=53/udp], yzqaQTU9DXe
[orig_h=141.142.220.235, orig_p=6705/tcp, resp_h=173.192.163.128, resp_p=80/tcp], UZkBBvjF0r8 [orig_h=141.142.220.118, orig_p=49999/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OPM7xFSDNw3
[orig_h=141.142.220.235, orig_p=6705/tcp, resp_h=173.192.163.128, resp_p=80/tcp], UZkBBvjF0r8 [orig_h=141.142.220.118, orig_p=49999/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OPM7xFSDNw3
[orig_h=141.142.220.118, orig_p=50000/tcp, resp_h=208.80.152.3, resp_p=80/tcp], j5w2LueK8Ti
[orig_h=141.142.220.118, orig_p=50000/tcp, resp_h=208.80.152.3, resp_p=80/tcp], j5w2LueK8Ti
[orig_h=141.142.220.118, orig_p=45000/udp, resp_h=141.142.2.2, resp_p=53/udp], N6rbUGwigQ7
[orig_h=141.142.220.118, orig_p=45000/udp, resp_h=141.142.2.2, resp_p=53/udp], N6rbUGwigQ7
[orig_h=141.142.220.118, orig_p=48479/udp, resp_h=141.142.2.2, resp_p=53/udp], 8b9q7qPtzhd
[orig_h=141.142.220.118, orig_p=48479/udp, resp_h=141.142.2.2, resp_p=53/udp], 8b9q7qPtzhd
[orig_h=141.142.220.118, orig_p=48128/udp, resp_h=141.142.2.2, resp_p=53/udp], KOdlL7sC9z2
[orig_h=141.142.220.118, orig_p=48128/udp, resp_h=141.142.2.2, resp_p=53/udp], KOdlL7sC9z2
[orig_h=141.142.220.118, orig_p=50001/tcp, resp_h=208.80.152.3, resp_p=80/tcp], hvOo97vj60k
[orig_h=141.142.220.118, orig_p=50001/tcp, resp_h=208.80.152.3, resp_p=80/tcp], hvOo97vj60k
[orig_h=141.142.220.118, orig_p=56056/udp, resp_h=141.142.2.2, resp_p=53/udp], FHu81uYujA9
[orig_h=141.142.220.118, orig_p=56056/udp, resp_h=141.142.2.2, resp_p=53/udp], FHu81uYujA9
[orig_h=141.142.220.118, orig_p=55092/udp, resp_h=141.142.2.2, resp_p=53/udp], 2M1wDTa0C7a
[orig_h=141.142.220.118, orig_p=55092/udp, resp_h=141.142.2.2, resp_p=53/udp], 2M1wDTa0C7a
[orig_h=141.142.220.118, orig_p=35642/tcp, resp_h=208.80.152.2, resp_p=80/tcp], OKiJdtzKWPk
[orig_h=141.142.220.118, orig_p=35642/tcp, resp_h=208.80.152.2, resp_p=80/tcp], OKiJdtzKWPk
[orig_h=141.142.220.118, orig_p=49997/tcp, resp_h=208.80.152.3, resp_p=80/tcp], UZkBBvjF0r8
[orig_h=141.142.220.118, orig_p=49997/tcp, resp_h=208.80.152.3, resp_p=80/tcp], UZkBBvjF0r8
[orig_h=141.142.220.118, orig_p=49996/tcp, resp_h=208.80.152.3, resp_p=80/tcp], svqqNKN9CFj
[orig_h=141.142.220.118, orig_p=49996/tcp, resp_h=208.80.152.3, resp_p=80/tcp], svqqNKN9CFj
[orig_h=141.142.220.118, orig_p=49998/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OldlyspNIr7
[orig_h=141.142.220.118, orig_p=49998/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OldlyspNIr7
[orig_h=141.142.220.118, orig_p=50000/tcp, resp_h=208.80.152.3, resp_p=80/tcp], j5w2LueK8Ti
[orig_h=141.142.220.118, orig_p=50000/tcp, resp_h=208.80.152.3, resp_p=80/tcp], j5w2LueK8Ti
[orig_h=141.142.220.118, orig_p=49999/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OPM7xFSDNw3
[orig_h=141.142.220.118, orig_p=49999/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OPM7xFSDNw3
[orig_h=141.142.220.118, orig_p=50001/tcp, resp_h=208.80.152.3, resp_p=80/tcp], hvOo97vj60k
[orig_h=141.142.220.118, orig_p=50001/tcp, resp_h=208.80.152.3, resp_p=80/tcp], hvOo97vj60k
[orig_h=141.142.220.118, orig_p=35642/tcp, resp_h=208.80.152.2, resp_p=80/tcp], OKiJdtzKWPk
[orig_h=141.142.220.118, orig_p=35642/tcp, resp_h=208.80.152.2, resp_p=80/tcp], OKiJdtzKWPk
[orig_h=141.142.220.235, orig_p=6705/tcp, resp_h=173.192.163.128, resp_p=80/tcp], tpUWfNdSLE
[orig_h=141.142.220.235, orig_p=6705/tcp, resp_h=173.192.163.128, resp_p=80/tcp], tpUWfNdSLE
[orig_h=141.142.220.235, orig_p=6705/tcp, resp_h=173.192.163.128, resp_p=80/tcp], tpUWfNdSLE
[orig_h=141.142.220.235, orig_p=6705/tcp, resp_h=173.192.163.128, resp_p=80/tcp], tpUWfNdSLE
[orig_h=141.142.220.44, orig_p=5353/udp, resp_h=224.0.0.251, resp_p=5353/udp], ra1C6ZLut4b
[orig_h=141.142.220.44, orig_p=5353/udp, resp_h=224.0.0.251, resp_p=5353/udp], ra1C6ZLut4b
[orig_h=141.142.220.226, orig_p=137/udp, resp_h=141.142.220.255, resp_p=137/udp], UElDH5b9qA5
[orig_h=141.142.220.226, orig_p=137/udp, resp_h=141.142.220.255, resp_p=137/udp], UElDH5b9qA5
[orig_h=141.142.220.226, orig_p=55131/udp, resp_h=224.0.0.252, resp_p=5355/udp], sO3mBXBav1h
[orig_h=141.142.220.226, orig_p=55131/udp, resp_h=224.0.0.252, resp_p=5355/udp], sO3mBXBav1h
[orig_h=141.142.220.226, orig_p=55671/udp, resp_h=224.0.0.252, resp_p=5355/udp], xAQqZE8Wdp4
[orig_h=141.142.220.226, orig_p=55671/udp, resp_h=224.0.0.252, resp_p=5355/udp], xAQqZE8Wdp4
[orig_h=141.142.220.238, orig_p=56641/udp, resp_h=141.142.220.255, resp_p=137/udp], zVecVnfOlsf
[orig_h=141.142.220.238, orig_p=56641/udp, resp_h=141.142.220.255, resp_p=137/udp], zVecVnfOlsf

112
testing/btest/Baseline/core.conn-id/output.cc2
View file

@ -1,34 +1,78 @@
[orig_h=141.142.220.118, orig_p=48649/tcp, resp_h=208.80.152.118, resp_p=80/tcp], UWkUyAuUGXf [orig_h=141.142.220.202, orig_p=5353/udp, resp_h=224.0.0.251, resp_p=5353/udp], UWkUyAuUGXf
[orig_h=141.142.220.118, orig_p=48649/tcp, resp_h=208.80.152.118, resp_p=80/tcp], UWkUyAuUGXf [orig_h=141.142.220.202, orig_p=5353/udp, resp_h=224.0.0.251, resp_p=5353/udp], UWkUyAuUGXf
[orig_h=141.142.220.118, orig_p=48649/tcp, resp_h=208.80.152.118, resp_p=80/tcp], UWkUyAuUGXf [orig_h=141.142.220.50, orig_p=5353/udp, resp_h=224.0.0.251, resp_p=5353/udp], 56gKBmhBBB6
[orig_h=141.142.220.118, orig_p=48649/tcp, resp_h=208.80.152.118, resp_p=80/tcp], UWkUyAuUGXf [orig_h=141.142.220.50, orig_p=5353/udp, resp_h=224.0.0.251, resp_p=5353/udp], 56gKBmhBBB6
[orig_h=141.142.220.118, orig_p=49996/tcp, resp_h=208.80.152.3, resp_p=80/tcp], 56gKBmhBBB6 [orig_h=141.142.220.118, orig_p=35634/tcp, resp_h=208.80.152.2, resp_p=80/tcp], 50da4BEzauh
[orig_h=141.142.220.118, orig_p=49996/tcp, resp_h=208.80.152.3, resp_p=80/tcp], 56gKBmhBBB6 [orig_h=141.142.220.118, orig_p=35634/tcp, resp_h=208.80.152.2, resp_p=80/tcp], 50da4BEzauh
[orig_h=141.142.220.118, orig_p=49997/tcp, resp_h=208.80.152.3, resp_p=80/tcp], 50da4BEzauh [orig_h=141.142.220.118, orig_p=48649/tcp, resp_h=208.80.152.118, resp_p=80/tcp], WUjEZFOdSS
[orig_h=141.142.220.118, orig_p=49997/tcp, resp_h=208.80.152.3, resp_p=80/tcp], 50da4BEzauh [orig_h=141.142.220.118, orig_p=48649/tcp, resp_h=208.80.152.118, resp_p=80/tcp], WUjEZFOdSS
[orig_h=141.142.220.118, orig_p=49998/tcp, resp_h=208.80.152.3, resp_p=80/tcp], WUjEZFOdSS [orig_h=141.142.220.118, orig_p=48649/tcp, resp_h=208.80.152.118, resp_p=80/tcp], WUjEZFOdSS
[orig_h=141.142.220.118, orig_p=49998/tcp, resp_h=208.80.152.3, resp_p=80/tcp], WUjEZFOdSS [orig_h=141.142.220.118, orig_p=48649/tcp, resp_h=208.80.152.118, resp_p=80/tcp], WUjEZFOdSS
[orig_h=141.142.220.118, orig_p=49999/tcp, resp_h=208.80.152.3, resp_p=80/tcp], ecqdozAET6c [orig_h=141.142.220.118, orig_p=43927/udp, resp_h=141.142.2.2, resp_p=53/udp], ecqdozAET6c
[orig_h=141.142.220.118, orig_p=49999/tcp, resp_h=208.80.152.3, resp_p=80/tcp], ecqdozAET6c [orig_h=141.142.220.118, orig_p=43927/udp, resp_h=141.142.2.2, resp_p=53/udp], ecqdozAET6c
[orig_h=141.142.220.118, orig_p=50000/tcp, resp_h=208.80.152.3, resp_p=80/tcp], tdkrEYpj5ja [orig_h=141.142.220.118, orig_p=37676/udp, resp_h=141.142.2.2, resp_p=53/udp], tdkrEYpj5ja
[orig_h=141.142.220.118, orig_p=50000/tcp, resp_h=208.80.152.3, resp_p=80/tcp], tdkrEYpj5ja [orig_h=141.142.220.118, orig_p=37676/udp, resp_h=141.142.2.2, resp_p=53/udp], tdkrEYpj5ja
[orig_h=141.142.220.118, orig_p=50001/tcp, resp_h=208.80.152.3, resp_p=80/tcp], F5XgctwO3Vl [orig_h=141.142.220.118, orig_p=40526/udp, resp_h=141.142.2.2, resp_p=53/udp], F5XgctwO3Vl
[orig_h=141.142.220.118, orig_p=50001/tcp, resp_h=208.80.152.3, resp_p=80/tcp], F5XgctwO3Vl [orig_h=141.142.220.118, orig_p=40526/udp, resp_h=141.142.2.2, resp_p=53/udp], F5XgctwO3Vl
[orig_h=141.142.220.118, orig_p=35642/tcp, resp_h=208.80.152.2, resp_p=80/tcp], svqqNKN9CFj [orig_h=141.142.220.118, orig_p=49996/tcp, resp_h=208.80.152.3, resp_p=80/tcp], svqqNKN9CFj
[orig_h=141.142.220.118, orig_p=35642/tcp, resp_h=208.80.152.2, resp_p=80/tcp], svqqNKN9CFj [orig_h=141.142.220.118, orig_p=49996/tcp, resp_h=208.80.152.3, resp_p=80/tcp], svqqNKN9CFj
[orig_h=141.142.220.118, orig_p=49997/tcp, resp_h=208.80.152.3, resp_p=80/tcp], 50da4BEzauh [orig_h=141.142.220.118, orig_p=49997/tcp, resp_h=208.80.152.3, resp_p=80/tcp], UZkBBvjF0r8
[orig_h=141.142.220.118, orig_p=49997/tcp, resp_h=208.80.152.3, resp_p=80/tcp], 50da4BEzauh [orig_h=141.142.220.118, orig_p=49997/tcp, resp_h=208.80.152.3, resp_p=80/tcp], UZkBBvjF0r8
[orig_h=141.142.220.118, orig_p=49996/tcp, resp_h=208.80.152.3, resp_p=80/tcp], 56gKBmhBBB6 [orig_h=141.142.220.118, orig_p=32902/udp, resp_h=141.142.2.2, resp_p=53/udp], nSEQzFk1LZc
[orig_h=141.142.220.118, orig_p=49996/tcp, resp_h=208.80.152.3, resp_p=80/tcp], 56gKBmhBBB6 [orig_h=141.142.220.118, orig_p=32902/udp, resp_h=141.142.2.2, resp_p=53/udp], nSEQzFk1LZc
[orig_h=141.142.220.118, orig_p=49998/tcp, resp_h=208.80.152.3, resp_p=80/tcp], WUjEZFOdSS [orig_h=141.142.220.118, orig_p=59816/udp, resp_h=141.142.2.2, resp_p=53/udp], rmXOq6wncn1
[orig_h=141.142.220.118, orig_p=49998/tcp, resp_h=208.80.152.3, resp_p=80/tcp], WUjEZFOdSS [orig_h=141.142.220.118, orig_p=59816/udp, resp_h=141.142.2.2, resp_p=53/udp], rmXOq6wncn1
[orig_h=141.142.220.118, orig_p=50000/tcp, resp_h=208.80.152.3, resp_p=80/tcp], tdkrEYpj5ja [orig_h=141.142.220.118, orig_p=59714/udp, resp_h=141.142.2.2, resp_p=53/udp], 4YYJTjETe1i
[orig_h=141.142.220.118, orig_p=50000/tcp, resp_h=208.80.152.3, resp_p=80/tcp], tdkrEYpj5ja [orig_h=141.142.220.118, orig_p=59714/udp, resp_h=141.142.2.2, resp_p=53/udp], 4YYJTjETe1i
[orig_h=141.142.220.118, orig_p=49999/tcp, resp_h=208.80.152.3, resp_p=80/tcp], ecqdozAET6c [orig_h=141.142.220.118, orig_p=49998/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OldlyspNIr7
[orig_h=141.142.220.118, orig_p=49999/tcp, resp_h=208.80.152.3, resp_p=80/tcp], ecqdozAET6c [orig_h=141.142.220.118, orig_p=49998/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OldlyspNIr7
[orig_h=141.142.220.118, orig_p=50001/tcp, resp_h=208.80.152.3, resp_p=80/tcp], F5XgctwO3Vl [orig_h=141.142.220.118, orig_p=58206/udp, resp_h=141.142.2.2, resp_p=53/udp], R8BqVlcp23e
[orig_h=141.142.220.118, orig_p=50001/tcp, resp_h=208.80.152.3, resp_p=80/tcp], F5XgctwO3Vl [orig_h=141.142.220.118, orig_p=58206/udp, resp_h=141.142.2.2, resp_p=53/udp], R8BqVlcp23e
[orig_h=141.142.220.118, orig_p=35642/tcp, resp_h=208.80.152.2, resp_p=80/tcp], svqqNKN9CFj [orig_h=141.142.220.118, orig_p=38911/udp, resp_h=141.142.2.2, resp_p=53/udp], duYdXg7bTa3
[orig_h=141.142.220.118, orig_p=35642/tcp, resp_h=208.80.152.2, resp_p=80/tcp], svqqNKN9CFj [orig_h=141.142.220.118, orig_p=38911/udp, resp_h=141.142.2.2, resp_p=53/udp], duYdXg7bTa3
[orig_h=141.142.220.235, orig_p=6705/tcp, resp_h=173.192.163.128, resp_p=80/tcp], UZkBBvjF0r8 [orig_h=141.142.220.118, orig_p=59746/udp, resp_h=141.142.2.2, resp_p=53/udp], yzqaQTU9DXe
[orig_h=141.142.220.235, orig_p=6705/tcp, resp_h=173.192.163.128, resp_p=80/tcp], UZkBBvjF0r8 [orig_h=141.142.220.118, orig_p=59746/udp, resp_h=141.142.2.2, resp_p=53/udp], yzqaQTU9DXe
[orig_h=141.142.220.118, orig_p=49999/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OPM7xFSDNw3
[orig_h=141.142.220.118, orig_p=49999/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OPM7xFSDNw3
[orig_h=141.142.220.118, orig_p=50000/tcp, resp_h=208.80.152.3, resp_p=80/tcp], j5w2LueK8Ti
[orig_h=141.142.220.118, orig_p=50000/tcp, resp_h=208.80.152.3, resp_p=80/tcp], j5w2LueK8Ti
[orig_h=141.142.220.118, orig_p=45000/udp, resp_h=141.142.2.2, resp_p=53/udp], N6rbUGwigQ7
[orig_h=141.142.220.118, orig_p=45000/udp, resp_h=141.142.2.2, resp_p=53/udp], N6rbUGwigQ7
[orig_h=141.142.220.118, orig_p=48479/udp, resp_h=141.142.2.2, resp_p=53/udp], 8b9q7qPtzhd
[orig_h=141.142.220.118, orig_p=48479/udp, resp_h=141.142.2.2, resp_p=53/udp], 8b9q7qPtzhd
[orig_h=141.142.220.118, orig_p=48128/udp, resp_h=141.142.2.2, resp_p=53/udp], KOdlL7sC9z2
[orig_h=141.142.220.118, orig_p=48128/udp, resp_h=141.142.2.2, resp_p=53/udp], KOdlL7sC9z2
[orig_h=141.142.220.118, orig_p=50001/tcp, resp_h=208.80.152.3, resp_p=80/tcp], hvOo97vj60k
[orig_h=141.142.220.118, orig_p=50001/tcp, resp_h=208.80.152.3, resp_p=80/tcp], hvOo97vj60k
[orig_h=141.142.220.118, orig_p=56056/udp, resp_h=141.142.2.2, resp_p=53/udp], FHu81uYujA9
[orig_h=141.142.220.118, orig_p=56056/udp, resp_h=141.142.2.2, resp_p=53/udp], FHu81uYujA9
[orig_h=141.142.220.118, orig_p=55092/udp, resp_h=141.142.2.2, resp_p=53/udp], 2M1wDTa0C7a
[orig_h=141.142.220.118, orig_p=55092/udp, resp_h=141.142.2.2, resp_p=53/udp], 2M1wDTa0C7a
[orig_h=141.142.220.118, orig_p=35642/tcp, resp_h=208.80.152.2, resp_p=80/tcp], OKiJdtzKWPk
[orig_h=141.142.220.118, orig_p=35642/tcp, resp_h=208.80.152.2, resp_p=80/tcp], OKiJdtzKWPk
[orig_h=141.142.220.118, orig_p=49997/tcp, resp_h=208.80.152.3, resp_p=80/tcp], UZkBBvjF0r8
[orig_h=141.142.220.118, orig_p=49997/tcp, resp_h=208.80.152.3, resp_p=80/tcp], UZkBBvjF0r8
[orig_h=141.142.220.118, orig_p=49996/tcp, resp_h=208.80.152.3, resp_p=80/tcp], svqqNKN9CFj
[orig_h=141.142.220.118, orig_p=49996/tcp, resp_h=208.80.152.3, resp_p=80/tcp], svqqNKN9CFj
[orig_h=141.142.220.118, orig_p=49998/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OldlyspNIr7
[orig_h=141.142.220.118, orig_p=49998/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OldlyspNIr7
[orig_h=141.142.220.118, orig_p=50000/tcp, resp_h=208.80.152.3, resp_p=80/tcp], j5w2LueK8Ti
[orig_h=141.142.220.118, orig_p=50000/tcp, resp_h=208.80.152.3, resp_p=80/tcp], j5w2LueK8Ti
[orig_h=141.142.220.118, orig_p=49999/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OPM7xFSDNw3
[orig_h=141.142.220.118, orig_p=49999/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OPM7xFSDNw3
[orig_h=141.142.220.118, orig_p=50001/tcp, resp_h=208.80.152.3, resp_p=80/tcp], hvOo97vj60k
[orig_h=141.142.220.118, orig_p=50001/tcp, resp_h=208.80.152.3, resp_p=80/tcp], hvOo97vj60k
[orig_h=141.142.220.118, orig_p=35642/tcp, resp_h=208.80.152.2, resp_p=80/tcp], OKiJdtzKWPk
[orig_h=141.142.220.118, orig_p=35642/tcp, resp_h=208.80.152.2, resp_p=80/tcp], OKiJdtzKWPk
[orig_h=141.142.220.235, orig_p=6705/tcp, resp_h=173.192.163.128, resp_p=80/tcp], tpUWfNdSLE
[orig_h=141.142.220.235, orig_p=6705/tcp, resp_h=173.192.163.128, resp_p=80/tcp], tpUWfNdSLE
[orig_h=141.142.220.44, orig_p=5353/udp, resp_h=224.0.0.251, resp_p=5353/udp], ra1C6ZLut4b
[orig_h=141.142.220.44, orig_p=5353/udp, resp_h=224.0.0.251, resp_p=5353/udp], ra1C6ZLut4b
[orig_h=141.142.220.226, orig_p=137/udp, resp_h=141.142.220.255, resp_p=137/udp], UElDH5b9qA5
[orig_h=141.142.220.226, orig_p=137/udp, resp_h=141.142.220.255, resp_p=137/udp], UElDH5b9qA5
[orig_h=141.142.220.226, orig_p=55131/udp, resp_h=224.0.0.252, resp_p=5355/udp], sO3mBXBav1h
[orig_h=141.142.220.226, orig_p=55131/udp, resp_h=224.0.0.252, resp_p=5355/udp], sO3mBXBav1h
[orig_h=141.142.220.226, orig_p=55671/udp, resp_h=224.0.0.252, resp_p=5355/udp], xAQqZE8Wdp4
[orig_h=141.142.220.226, orig_p=55671/udp, resp_h=224.0.0.252, resp_p=5355/udp], xAQqZE8Wdp4
[orig_h=141.142.220.238, orig_p=56641/udp, resp_h=141.142.220.255, resp_p=137/udp], zVecVnfOlsf
[orig_h=141.142.220.238, orig_p=56641/udp, resp_h=141.142.220.255, resp_p=137/udp], zVecVnfOlsf

0
testing/btest/Baseline/core.print-bpf-filters/conn.log → testing/btest/Baseline/core.print-bpf-filters-ipv4/conn.log
View file

4
testing/btest/Baseline/core.print-bpf-filters-ipv4/output Normal file
View file

@ -0,0 +1,4 @@
not ip6
not ip6
(not ip6) and (tcp[13] & 7 != 0)
port 42

1
testing/btest/Baseline/core.print-bpf-filters-ipv6/conn.log Normal file
View file

@ -0,0 +1 @@
1128727435.450898 1.733303 141.42.64.125 125.190.109.199 http 56730 80 tcp 98 9417 SF X

0
testing/btest/Baseline/core.print-bpf-filters/output → testing/btest/Baseline/core.print-bpf-filters-ipv6/output
View file

6
testing/btest/Baseline/language.cross-product-init/output Normal file
View file

@ -0,0 +1,6 @@
{
[bar, 1.2.0.0/19] ,
[foo, 5.6.0.0/21] ,
[bar, 5.6.0.0/21] ,
[foo, 1.2.0.0/19]
}

1
testing/btest/Baseline/language.enum-scope/output Normal file
View file

@ -0,0 +1 @@
c

3
testing/btest/Baseline/language.match-test/output Normal file
View file

@ -0,0 +1,3 @@
default
it's big
it's really big

1
testing/btest/Baseline/language.match-test2/output Normal file
View file

@ -0,0 +1 @@
2

8
testing/btest/Baseline/language.next-test/output Normal file
View file

@ -0,0 +1,8 @@
0
1
1
MIDDLE
0
0
1
THE END

1
testing/btest/Baseline/language.rare-events/output Normal file
View file

@ -0,0 +1 @@
1106953531.452525 DroppedPackets 2 packets dropped after filtering, 1109 received, 10000 on link

5
testing/btest/Baseline/language.rec-comp-init/output Normal file
View file

@ -0,0 +1,5 @@
[a={
}, b={
}, c=[]]

3
testing/btest/Baseline/language.rec-of-tbl/output Normal file
View file

@ -0,0 +1,3 @@
[a={
[5] = 3
}]

17
testing/btest/Baseline/language.sizeof/output Normal file
View file

@ -0,0 +1,17 @@
Address 1.2.3.4: 16909060
Boolean T: 1
Count 10: 10
Double -1.23: 1.230000
Enum ENUM3: 2
File 21.000000
Function add_interface: 2
Integer -10: 10
Interval -5.0 secs: 5.000000
Net 192.168.0: 65536.000000
Port 80/tcp: 65616
Record [i=10, j=<uninitialized>, k=<uninitialized>]: 3
Set: 3
String 'Hello': 5
Subnet 192.168.0.0/24: 256.000000
Table 2
Vector [Hello, , , , World]: 5

32
testing/btest/Baseline/language.smith-waterman-test/output Normal file
View file

@ -0,0 +1,32 @@
abcdefgh - ijklmnop:
AAAabcefghij - lmnopAAAqrst:
tok 1: AAA (0/5, T)
abcAAAefghij - lmnopAAAqrst:
tok 1: AAA (3/5, T)
abcefghijAAA - lmnopAAAqrst:
tok 1: AAA (9/5, T)
xxxAAAyyy - AAAaAAAbAAA:
tok 1: AAA (3/0, T)
tok 2: AAA (3/4, T)
tok 3: AAA (3/8, T)
AAAaAAAbAAA - xxxAAAyyy:
tok 1: AAA (0/3, T)
tok 2: AAA (4/3, T)
tok 3: AAA (8/3, T)
xxCDyABzCDyABzz - ABCD:
tok 1: CD (2/2, T)
tok 2: AB (5/0, T)
tok 3: CD (8/2, F)
tok 4: AB (11/0, T)
ABCD - xxCDyABzCDyABzz:
tok 1: CD (2/2, T)
tok 2: AB (0/5, T)
tok 3: CD (2/8, F)
tok 4: AB (0/11, T)
Cache-control: no-cache^M^JAccept: - Accept-: deflate^M^JAccept-: Accept-:
tok 1: Accept (27/0, T)
tok 2: e^M^JAccept (22/15, T)
tok 3: Accept (27/29, T)
xxAAxxAAxx - yyyyyAAyyyyy:
tok 1: AA (2/5, T)
tok 2: AA (6/5, T)

25
testing/btest/Baseline/language.strings/output Normal file
View file

@ -0,0 +1,25 @@
Input string: broisaveryneatids
String splitting
----------------
Splitting 'broisaveryneatids' at 6 points...
bro
is
a
very
neat
ids
Substrings
----------
3@0: bro
5@2: roisa
7@4: isavery
10@10: yneatids
Finding strings
---------------
isa: 4
very: 7
ids: 15
nono: 0

2
testing/btest/Baseline/language.wrong-delete-field/output
View file

@ -1 +1 @@
/da/home/robin/bro/master/testing/btest/.tmp/language.wrong-delete-field/wrong-delete-field.bro, line 11 (delete x$a): error, illegal delete statement /da/home/robin/bro/master/testing/btest/.tmp/language.wrong-delete-field/wrong-delete-field.bro, line 10 (delete x$a): error, illegal delete statement

135
testing/btest/Baseline/logging.rotate-custom/out
View file

@ -28,107 +28,56 @@
2nd test2-11-03-07_12.00.05.log test2.log 11-03-07_12.00.05 11-03-07_12.59.55 0 2nd test2-11-03-07_12.00.05.log test2.log 11-03-07_12.00.05 11-03-07_12.59.55 0
1st test-11-03-07_12.00.05.log test.log 11-03-07_12.00.05 11-03-07_12.59.55 1 1st test-11-03-07_12.00.05.log test.log 11-03-07_12.00.05 11-03-07_12.59.55 1
2nd test2-11-03-07_12.59.55.log test2.log 11-03-07_12.59.55 11-03-07_12.59.55 1 2nd test2-11-03-07_12.59.55.log test2.log 11-03-07_12.59.55 11-03-07_12.59.55 1
# t id.orig_h id.orig_p id.resp_h id.resp_p
1299466805.0 10.0.0.1 20 10.0.0.2 1024
1299470395.0 10.0.0.2 20 10.0.0.3 0
1299470405.0 10.0.0.1 20 10.0.0.2 1025
1299473995.0 10.0.0.2 20 10.0.0.3 1
1299474005.0 10.0.0.1 20 10.0.0.2 1026
1299477595.0 10.0.0.2 20 10.0.0.3 2
1299477605.0 10.0.0.1 20 10.0.0.2 1027
1299481195.0 10.0.0.2 20 10.0.0.3 3
1299481205.0 10.0.0.1 20 10.0.0.2 1028
1299484795.0 10.0.0.2 20 10.0.0.3 4
1299484805.0 10.0.0.1 20 10.0.0.2 1029
1299488395.0 10.0.0.2 20 10.0.0.3 5
1299488405.0 10.0.0.1 20 10.0.0.2 1030
1299491995.0 10.0.0.2 20 10.0.0.3 6
1299492005.0 10.0.0.1 20 10.0.0.2 1031
1299495595.0 10.0.0.2 20 10.0.0.3 7
1299495605.0 10.0.0.1 20 10.0.0.2 1032
1299499195.0 10.0.0.2 20 10.0.0.3 8
1299499205.0 10.0.0.1 20 10.0.0.2 1033
1299502795.0 10.0.0.2 20 10.0.0.3 9
> test-11-03-07_03.00.05.log > test-11-03-07_03.00.05.log
# t id.orig_h id.orig_p id.resp_h id.resp_p
1299466805.0 10.0.0.1 20 10.0.0.2 1024
1299470395.0 10.0.0.2 20 10.0.0.3 0
> test-11-03-07_04.00.05.log > test-11-03-07_04.00.05.log
# t id.orig_h id.orig_p id.resp_h id.resp_p
1299470405.0 10.0.0.1 20 10.0.0.2 1025
1299473995.0 10.0.0.2 20 10.0.0.3 1
> test-11-03-07_05.00.05.log > test-11-03-07_05.00.05.log
# t id.orig_h id.orig_p id.resp_h id.resp_p
1299474005.0 10.0.0.1 20 10.0.0.2 1026
1299477595.0 10.0.0.2 20 10.0.0.3 2
> test-11-03-07_06.00.05.log > test-11-03-07_06.00.05.log
# t id.orig_h id.orig_p id.resp_h id.resp_p
1299477605.0 10.0.0.1 20 10.0.0.2 1027
1299481195.0 10.0.0.2 20 10.0.0.3 3
> test-11-03-07_07.00.05.log > test-11-03-07_07.00.05.log
# t id.orig_h id.orig_p id.resp_h id.resp_p
1299481205.0 10.0.0.1 20 10.0.0.2 1028
1299484795.0 10.0.0.2 20 10.0.0.3 4
> test-11-03-07_08.00.05.log > test-11-03-07_08.00.05.log
# t id.orig_h id.orig_p id.resp_h id.resp_p
1299484805.0 10.0.0.1 20 10.0.0.2 1029
1299488395.0 10.0.0.2 20 10.0.0.3 5
> test-11-03-07_09.00.05.log > test-11-03-07_09.00.05.log
# t id.orig_h id.orig_p id.resp_h id.resp_p
1299488405.0 10.0.0.1 20 10.0.0.2 1030
1299491995.0 10.0.0.2 20 10.0.0.3 6
> test-11-03-07_10.00.05.log > test-11-03-07_10.00.05.log
# t id.orig_h id.orig_p id.resp_h id.resp_p
1299492005.0 10.0.0.1 20 10.0.0.2 1031
1299495595.0 10.0.0.2 20 10.0.0.3 7
> test-11-03-07_11.00.05.log > test-11-03-07_11.00.05.log
# t id.orig_h id.orig_p id.resp_h id.resp_p
1299495605.0 10.0.0.1 20 10.0.0.2 1032
1299499195.0 10.0.0.2 20 10.0.0.3 8
> test-11-03-07_12.00.05.log > test-11-03-07_12.00.05.log
# t id.orig_h id.orig_p id.resp_h id.resp_p
1299499205.0 10.0.0.1 20 10.0.0.2 1033
1299502795.0 10.0.0.2 20 10.0.0.3 9
> test2-11-03-07_03.00.05.log
# t id.orig_h id.orig_p id.resp_h id.resp_p
1299466805.0 10.0.0.1 20 10.0.0.2 1024
> test2-11-03-07_03.59.55.log
# t id.orig_h id.orig_p id.resp_h id.resp_p
1299470395.0 10.0.0.2 20 10.0.0.3 0
> test2-11-03-07_04.00.05.log
# t id.orig_h id.orig_p id.resp_h id.resp_p
1299470405.0 10.0.0.1 20 10.0.0.2 1025
> test2-11-03-07_04.59.55.log
# t id.orig_h id.orig_p id.resp_h id.resp_p
1299473995.0 10.0.0.2 20 10.0.0.3 1
> test2-11-03-07_05.00.05.log
# t id.orig_h id.orig_p id.resp_h id.resp_p
1299474005.0 10.0.0.1 20 10.0.0.2 1026
> test2-11-03-07_05.59.55.log
# t id.orig_h id.orig_p id.resp_h id.resp_p
1299477595.0 10.0.0.2 20 10.0.0.3 2
> test2-11-03-07_06.00.05.log
# t id.orig_h id.orig_p id.resp_h id.resp_p
1299477605.0 10.0.0.1 20 10.0.0.2 1027
> test2-11-03-07_06.59.55.log
# t id.orig_h id.orig_p id.resp_h id.resp_p
1299481195.0 10.0.0.2 20 10.0.0.3 3
> test2-11-03-07_07.00.05.log
# t id.orig_h id.orig_p id.resp_h id.resp_p
1299481205.0 10.0.0.1 20 10.0.0.2 1028
> test2-11-03-07_07.59.55.log
# t id.orig_h id.orig_p id.resp_h id.resp_p
1299484795.0 10.0.0.2 20 10.0.0.3 4
> test2-11-03-07_08.00.05.log
# t id.orig_h id.orig_p id.resp_h id.resp_p
1299484805.0 10.0.0.1 20 10.0.0.2 1029
> test2-11-03-07_08.59.55.log
# t id.orig_h id.orig_p id.resp_h id.resp_p
1299488395.0 10.0.0.2 20 10.0.0.3 5
> test2-11-03-07_09.00.05.log
# t id.orig_h id.orig_p id.resp_h id.resp_p
1299488405.0 10.0.0.1 20 10.0.0.2 1030
> test2-11-03-07_09.59.55.log
# t id.orig_h id.orig_p id.resp_h id.resp_p
1299491995.0 10.0.0.2 20 10.0.0.3 6
> test2-11-03-07_10.00.05.log
# t id.orig_h id.orig_p id.resp_h id.resp_p
1299492005.0 10.0.0.1 20 10.0.0.2 1031
> test2-11-03-07_10.59.55.log
# t id.orig_h id.orig_p id.resp_h id.resp_p
1299495595.0 10.0.0.2 20 10.0.0.3 7
> test2-11-03-07_11.00.05.log
# t id.orig_h id.orig_p id.resp_h id.resp_p
1299495605.0 10.0.0.1 20 10.0.0.2 1032
> test2-11-03-07_11.59.55.log
# t id.orig_h id.orig_p id.resp_h id.resp_p
1299499195.0 10.0.0.2 20 10.0.0.3 8
> test2-11-03-07_12.00.05.log
# t id.orig_h id.orig_p id.resp_h id.resp_p
1299499205.0 10.0.0.1 20 10.0.0.2 1033
> test2-11-03-07_12.59.55.log
# t id.orig_h id.orig_p id.resp_h id.resp_p
1299502795.0 10.0.0.2 20 10.0.0.3 9
> test2.log
# t id.orig_h id.orig_p id.resp_h id.resp_p
> test.log > test.log
# t id.orig_h id.orig_p id.resp_h id.resp_p > test2-11-03-07_03.00.05.log
> test2-11-03-07_03.59.55.log
> test2-11-03-07_04.00.05.log
> test2-11-03-07_04.59.55.log
> test2-11-03-07_05.00.05.log
> test2-11-03-07_05.59.55.log
> test2-11-03-07_06.00.05.log
> test2-11-03-07_06.59.55.log
> test2-11-03-07_07.00.05.log
> test2-11-03-07_07.59.55.log
> test2-11-03-07_08.00.05.log
> test2-11-03-07_08.59.55.log
> test2-11-03-07_09.00.05.log
> test2-11-03-07_09.59.55.log
> test2-11-03-07_10.00.05.log
> test2-11-03-07_10.59.55.log
> test2-11-03-07_11.00.05.log
> test2-11-03-07_11.59.55.log
> test2-11-03-07_12.00.05.log
> test2-11-03-07_12.59.55.log
> test2.log

14
testing/btest/Makefile Normal file
View file

@ -0,0 +1,14 @@
all:
# Showing all tests.
@btest
brief:
# Brief output showing only failed tests.
@btest -b
brief-debug:
# Verbose output for failed tests, also recorded in test.log.
@rm -f test.log
@btest -b -d -f test.log
@echo Output in test.log

5
testing/btest/Scripts/diff-remove-abspath Executable file
View file

@ -0,0 +1,5 @@
#! /usr/bin/env bash
#
# Replace absolute paths with the basename.
sed 's#/\([^/]\{1,\}/\)\{1,\}\([^/]\{1,\}\)#<...>/\2#g'

2
testing/btest/btest.cfg
View file

@ -9,7 +9,7 @@ IgnoreFiles = *.tmp *.swp #* *.trace
BROPATH=`bash -c %(testbase)s/../../build/bro-path-dev` BROPATH=`bash -c %(testbase)s/../../build/bro-path-dev`
BRO_SEED_FILE=%(testbase)s/random.seed BRO_SEED_FILE=%(testbase)s/random.seed
TZ=UTC TZ=UTC
LOCALE=C LC_ALL=C
PATH=%(testbase)s/../../build/src:%(testbase)s/../../aux/btest:%(default_path)s PATH=%(testbase)s/../../build/src:%(testbase)s/../../aux/btest:%(default_path)s
TEST_DIFF_CANONIFIER=%(testbase)s/Scripts/diff-canonifier TEST_DIFF_CANONIFIER=%(testbase)s/Scripts/diff-canonifier
TRACES=%(testbase)s/Traces TRACES=%(testbase)s/Traces

2
testing/btest/core/conn-id.bro
View file

@ -1,7 +1,7 @@
# #
# In "normal" test mode, connection uids should be determistic. # In "normal" test mode, connection uids should be determistic.
# #
# @TEST-EXEC: bro -C -r $TRACES/wikipedia.trace %INPUT tcp >output # @TEST-EXEC: bro -C -r $TRACES/wikipedia.trace %INPUT conn >output
# @TEST-EXEC: btest-diff output # @TEST-EXEC: btest-diff output
# #
# Without a seed, they should differ each time: # Without a seed, they should differ each time:

2
testing/btest/core/print-bpf-filters.bro → testing/btest/core/print-bpf-filters-ipv4.bro
View file

@ -1,3 +1,5 @@
# @TEST-REQUIRES: bro -e 'print bro_has_ipv6()' | grep -q F
#
# @TEST-EXEC: bro print-filter >output 2>&1 # @TEST-EXEC: bro print-filter >output 2>&1
# @TEST-EXEC: bro tcp print-filter >>output # @TEST-EXEC: bro tcp print-filter >>output
# @TEST-EXEC: bro tcp print-filter all_packets=F >>output # @TEST-EXEC: bro tcp print-filter all_packets=F >>output

9
testing/btest/core/print-bpf-filters-ipv6.bro Normal file
View file

@ -0,0 +1,9 @@
# @TEST-REQUIRES: bro -e 'print bro_has_ipv6()' | grep -q T
#
# @TEST-EXEC: bro print-filter >output 2>&1
# @TEST-EXEC: bro tcp print-filter >>output
# @TEST-EXEC: bro tcp print-filter all_packets=F >>output
# @TEST-EXEC: bro -f "port 42" print-filter >>output
# @TEST-EXEC: bro -C -f "port 50343" -r $TRACES/mixed-vlan-mpls.trace tcp
# @TEST-EXEC: btest-diff output
# @TEST-EXEC: btest-diff conn.log

9
testing/btest/doc/record-attr-check.bro Normal file
View file

@ -0,0 +1,9 @@
# @TEST-EXEC: bro --doc-scripts %INPUT
type Tag: enum {
SOMETHING
};
type R: record {
field1: set[Tag] &default=set();
};

10
testing/btest/language/cross-product-init.bro Normal file
View file

@ -0,0 +1,10 @@
# @TEST-EXEC: bro %INPUT >output 2>&1
# @TEST-EXEC: btest-diff output
global my_subs = { 1.2.3.4/19, 5.6.7.8/21 };
global x: set[string, subnet] &redef;
redef x += { [["foo", "bar"], my_subs] };
print x;

1
testing/btest/language/delete-field-set.bro
View file

@ -1,4 +1,3 @@
# @TEST-EXEC: bro %INPUT >output 2>&1 # @TEST-EXEC: bro %INPUT >output 2>&1
# @TEST-EXEC: btest-diff output # @TEST-EXEC: btest-diff output

1
testing/btest/language/delete-field.bro
View file

@ -1,4 +1,3 @@
# @TEST-EXEC: bro %INPUT >output 2>&1 # @TEST-EXEC: bro %INPUT >output 2>&1
# @TEST-EXEC: btest-diff output # @TEST-EXEC: btest-diff output

10
testing/btest/language/enum-scope.bro Normal file
View file

@ -0,0 +1,10 @@
# @TEST-EXEC: bro %INPUT >output 2>&1
# @TEST-EXEC: btest-diff output
type foo: enum { a, b } &redef;
module test;
redef enum foo += { c };
print c;

20
testing/btest/language/match-test.bro Normal file
View file

@ -0,0 +1,20 @@
# @TEST-EXEC: bro %INPUT >output 2>&1
# @TEST-EXEC: btest-diff output
global match_stuff = {
[$pred(a: count) = { return a > 5; },
$result = "it's big",
$priority = 2],
[$pred(a: count) = { return a > 15; },
$result = "it's really big",
$priority = 3],
[$pred(a: count) = { return T; },
$result = "default",
$priority = 0],
};
print match 0 using match_stuff;
print match 10 using match_stuff;
print match 20 using match_stuff;

51
testing/btest/language/match-test2.bro Normal file
View file

@ -0,0 +1,51 @@
# @TEST-EXEC: bro %INPUT >output 2>&1
# @TEST-EXEC: btest-diff output
type fakealert : record {
alert: string;
};
type match_rec : record {
result : count;
pred : function(rec : fakealert) : bool;
priority: count;
};
#global test_set : set[int] =
#{
#1, 2, 3
#};
global match_set : set[match_rec] =
{
[$result = 1, $pred(a: fakealert) = { return T; }, $priority = 8 ],
[$result = 2, $pred(a: fakealert) = { return T; }, $priority = 9 ]
};
global al : fakealert;
#global testset : set[fakealert] =
#{
# [$alert="hithere"]
#};
type nonalert: record {
alert : string;
pred : function(a : int) : int;
};
#global na : nonalert;
#na$alert = "5";
#al$alert = "hithere2";
#if (al in testset)
# print 1;
#else
# print 0;
al$alert = "hi";
print (match al using match_set);

36
testing/btest/language/next-test.bro Normal file
View file

@ -0,0 +1,36 @@
# @TEST-EXEC: bro %INPUT >output 2>&1
# @TEST-EXEC: btest-diff output
# This script tests "next" being called during the last iteration of a
# for loop
event bro_done()
{
local number_set: set[count];
local i: count;
add number_set[0];
add number_set[1];
for ( i in number_set )
{
print fmt ("%d", i);
if ( i == 0 )
next;
print fmt ("%d", i);
}
print fmt ("MIDDLE");
for ( i in number_set )
{
print fmt ("%d", i);
if ( i == 1 )
next;
print fmt ("%d", i);
}
print fmt ("THE END");
}

37
testing/btest/language/rare-events.bro Normal file
View file

@ -0,0 +1,37 @@
# @TEST-EXEC: bro %INPUT >output 2>&1
# @TEST-EXEC: btest-diff output
# This is a test script whose job is to generate rarely-seen events
# (i.e., events that test traces might not include) to ensure that they're
# handled properly.
# This is needed or else the output fails on the warning that
# Drop::restore_dropped_address is never defined.
redef check_for_unused_event_handlers = F;
@load netstats
function test_net_stats_update()
{
local t = current_time();
local s: net_stats;
s$pkts_recvd = 1234;
s$pkts_dropped = 123;
s$pkts_link = 9999;
event net_stats_update(t, s);
local s2: net_stats;
s2$pkts_recvd = 2341;
s2$pkts_dropped = 125;
s2$pkts_link = 19999;
event net_stats_update(t + 33 sec, s2);
}
event bro_init()
{
test_net_stats_update();
}

14
testing/btest/language/rec-comp-init.bro Normal file
View file

@ -0,0 +1,14 @@
# @TEST-EXEC: bro %INPUT >output 2>&1
# @TEST-EXEC: btest-diff output
# Make sure composit types in records are initialized.
type Foo: record {
a: set[count];
b: table[count] of string;
c: vector of string;
};
global f: Foo;
print f;

1
testing/btest/language/rec-nested-opt.bro
View file

@ -1,4 +1,3 @@
# @TEST-EXEC: bro %INPUT >output 2>&1 # @TEST-EXEC: bro %INPUT >output 2>&1
# @TEST-EXEC: btest-diff output # @TEST-EXEC: btest-diff output

16
testing/btest/language/rec-of-tbl.bro Normal file
View file

@ -0,0 +1,16 @@
# @TEST-EXEC: bro %INPUT >output 2>&1
# @TEST-EXEC: btest-diff output
type x: record {
a: table[int] of count;
};
global y: x;
global yy: table[int] of count;
y$a = yy;
y$a[+5] = 3;
print y;

1
testing/btest/language/rec-table-default.bro
View file

@ -1,4 +1,3 @@
# @TEST-EXEC: bro %INPUT >output 2>&1 # @TEST-EXEC: bro %INPUT >output 2>&1
# @TEST-EXEC: btest-diff output # @TEST-EXEC: btest-diff output

119
testing/btest/language/sizeof.bro Normal file
View file

@ -0,0 +1,119 @@
# @TEST-EXEC: bro %INPUT >output 2>&1
# @TEST-EXEC: btest-diff output
# Demo policy for the sizeof operator "|x|".
# ------------------------------------------
#
# This script creates various types and values and shows the result of the
# sizeof operator on these values.
#
# For any types not covered in this script, the sizeof operator's semantics
# are not defined and its application returns a count of 0. At the moment
# the only type where this should happen is string patterns.
type example_enum: enum { ENUM1, ENUM2, ENUM3 };
type example_record: record {
i: int &optional;
j: int &optional;
k: int &optional;
};
global a: addr = 1.2.3.4;
global b: bool = T;
global c: count = 10;
global d: double = -1.23;
global f: file = open_log_file("sizeof_demo");
global i: int = -10;
global iv: interval = -5sec;
global n: net = 192.168.;
global p: port = 80/tcp;
global r: example_record [ $i = 10 ];
global si: set[int];
global s: string = "Hello";
global sn: subnet = 192.168.0.0/24;
global t: table[string] of string;
global ti: time = current_time();
global v: vector of string;
# Additional initialization
#
print f, "12345678901234567890";
add si[1];
add si[10];
add si[100];
t["foo"] = "Hello";
t["bar"] = "World";
v[0] = "Hello";
v[4] = "World";
# Print out the sizes of the various vals:
#-----------------------------------------
# Size of addr: returns integer representation for IPv4, 0 for IPv6.
print fmt("Address %s: %d", a, |a|);
# Size of boolean: returns 1 or 0.
print fmt("Boolean %s: %d", b, |b|);
# Size of count: identity.
print fmt("Count %s: %d", c, |c|);
# Size of double: returns absolute value.
print fmt("Double %s: %f", d, |d|);
# Size of enum: returns numeric value of enum constant.
print fmt("Enum %s: %d", ENUM3, |ENUM3|);
# Size of file: returns current file size.
# Note that this is a double so that file sizes >> 4GB
# can be expressed.
print fmt("File %f", |f|);
# Size of function: returns number of arguments.
print fmt("Function add_interface: %d", |add_interface|);
# Size of integer: returns absolute value.
print fmt("Integer %s: %d", i, |i|);
# Size of interval: returns double representation of the interval
print fmt("Interval %s: %f", iv, |iv|);
# Size of net: returns size of class N network as a double
# (so that 2^32 can be expressed too).
print fmt("Net %s: %f", n, |n|);
# Size of port: returns port number as a count.
print fmt("Port %s: %d", p, |p|);
# Size of record: returns number of fields (assigned + unassigned)
print fmt("Record %s: %d", r, |r|);
# Size of set: returns number of elements in set.
# Don't print the set, as its order depends on the seeding of the hash
# fnction, and it's not worth the trouble to normalize it.
print fmt("Set: %d", |si|);
# Size of string: returns string length.
print fmt("String '%s': %d", s, |s|);
# Size of subnet: returns size of net as a double
# (so that 2^32 can be expressed too).
print fmt("Subnet %s: %f", sn, |sn|);
# Size of table: returns number of elements in table
print fmt("Table %d", |t|);
# Size of time: returns double representation of the time
# print fmt("Time %s: %f", ti, |ti|);
# Size of vector: returns largest assigned index.
# Note that this is not the number of assigned values.
# The following prints "5":
#
print fmt("Vector %s: %d", v, |v|);
close(f);

88
testing/btest/language/smith-waterman-test.bro Normal file
View file

@ -0,0 +1,88 @@
# @TEST-EXEC: bro %INPUT >output 2>&1
# @TEST-EXEC: btest-diff output
global params: sw_params = [ $min_strlen = 2, $sw_variant = 0 ];
global min: vector of count;
global mode: vector of count;
global c: count = 0;
# Alignment pairs:
global s1: string_vec;
global s2: string_vec;
# Single alignment, no matches:
s1[++c] = "abcdefgh";
s2[c] = "ijklmnop";
min[c] = 2;;
mode[c] = 0;
# Simple single match, beginning:
s1[++c] = "AAAabcefghij";
s2[c] = "lmnopAAAqrst";
min[c] = 2;;
mode[c] = 0;
# Simple single match, middle:
s1[++c] = "abcAAAefghij";
s2[c] = "lmnopAAAqrst";
min[c] = 2;;
mode[c] = 0;
# Simple single match, end:
s1[++c] = "abcefghijAAA";
s2[c] = "lmnopAAAqrst";
min[c] = 2;;
mode[c] = 0;
# Repeated alignment:
s1[++c] = "xxxAAAyyy";
s2[c] = "AAAaAAAbAAA";
min[c] = 2;;
mode[c] = 1;
# Repeated alignment, swapped input:
s1[++c] = "AAAaAAAbAAA";
s2[c] = "xxxAAAyyy";
min[c] = 2;;
mode[c] = 1;
# Repeated alignment, split:
s1[++c] = "xxCDyABzCDyABzz";
s2[c] = "ABCD";
min[c] = 2;;
mode[c] = 1;
# Repeated alignment, split, swapped:
s1[++c] = "ABCD";
s2[c] = "xxCDyABzCDyABzz";
min[c] = 2;;
mode[c] = 1;
# Used to cause problems
s1[++c] = "Cache-control: no-cache^M^JAccept:";
s2[c] = "Accept-: deflate^M^JAccept-: Accept-";
min[c] = 6;
mode[c] = 1;
# Repeated occurrences in shorter string
s1[++c] = "xxAAxxAAxx";
s2[c] = "yyyyyAAyyyyy";
min[c] = 2;
mode[c] = 1;
for ( i in s1 )
{
local ss: sw_substring_vec;
params$min_strlen = min[i];
params$sw_variant = mode[i];
ss = str_smith_waterman(s1[i], s2[i], params);
print fmt("%s - %s:", s1[i], s2[i]);
for ( j in ss )
print fmt("tok %d: %s (%d/%d, %s)",
j, ss[j]$str, ss[j]$aligns[1]$index,
ss[j]$aligns[2]$index, ss[j]$new);
}

48
testing/btest/language/strings.bro Normal file
View file

@ -0,0 +1,48 @@
# @TEST-EXEC: bro %INPUT >output 2>&1
# @TEST-EXEC: btest-diff output
# Demo policy for string functions
#
event bro_init()
{
local s1: string = "broisaveryneatids";
print fmt("Input string: %s", s1);
print fmt();
print fmt("String splitting");
print fmt("----------------");
local idx1: index_vec;
idx1[0] = 0; # We really need initializers for vectors ...
idx1[1] = 3;
idx1[2] = 5;
idx1[3] = 6;
idx1[4] = 10;
idx1[5] = 14;
print fmt("Splitting '%s' at %d points...", s1, |idx1|);
local res_split: string_vec = str_split(s1, idx1);
for ( i in res_split )
print res_split[i];
print fmt();
print fmt("Substrings");
print fmt("----------");
print fmt("3@0: %s", sub_bytes(s1, 0, 3));
print fmt("5@2: %s", sub_bytes(s1, 2, 5));
print fmt("7@4: %s", sub_bytes(s1, 4, 7));
print fmt("10@10: %s", sub_bytes(s1, 10, 10));
print fmt();
print fmt("Finding strings");
print fmt("---------------");
print fmt("isa: %d", strstr(s1, "isa"));
print fmt("very: %d", strstr(s1, "very"));
print fmt("ids: %d", strstr(s1, "ids"));
print fmt("nono: %d", strstr(s1, "nono"));
}

1
testing/btest/language/wrong-delete-field.bro
View file

@ -1,4 +1,3 @@
# @TEST-EXEC-FAIL: bro %INPUT >output 2>&1 # @TEST-EXEC-FAIL: bro %INPUT >output 2>&1
# @TEST-EXEC: btest-diff output # @TEST-EXEC: btest-diff output

2
testing/btest/logging/rotate-custom.bro
View file

@ -1,6 +1,6 @@
# #
# @TEST-EXEC: bro -r %DIR/rotation.trace %INPUT >out # @TEST-EXEC: bro -r %DIR/rotation.trace %INPUT >out
# @TEST-EXEC: for i in `ls test*.log | sort`; do printf '> %s\n' $i; cat $i; done >>out # @TEST-EXEC: for i in `ls test*.log | sort`; do printf '> %s\n' $i; cat $i; done | sort | uniq >>out
# @TEST-EXEC: btest-diff out # @TEST-EXEC: btest-diff out
module Test; module Test;

11
testing/istate/README
View file

@ -1,11 +0,0 @@
To run these tests, invoke:
./istate.py
To see differences leading to test failures, invoke:
./istate.py -s
Build a new test baseline using:
./istate.py -b

17
testing/istate/base/bro-ping/remote.log
View file

@ -1,17 +0,0 @@
xxxxxxxxxx.xxxxxx [info] [parent] pipe's socket buffer size is 8192, setting to 1048576
xxxxxxxxxx.xxxxxx [info] [parent] communication started, parent
xxxxxxxxxx.xxxxxx [info] [child] listening on 0.0.0.0:47758 (clear)
xxxxxxxxxx.xxxxxx [info] [child] [#10000/] accepted clear connection
xxxxxxxxxx.xxxxxx [info] [parent] [#10000/] added peer
xxxxxxxxxx.xxxxxx [info] [parent] [#10000/] peer connected
xxxxxxxxxx.xxxxxx [info] [parent] [#10000/] phase: version
xxxxxxxxxx.xxxxxx [info] [script] [#10000/] connection established
xxxxxxxxxx.xxxxxx [info] [script] [#10000/] requesting events matching /^?(ping)$?/
xxxxxxxxxx.xxxxxx [info] [script] [#10000/] accepting state
xxxxxxxxxx.xxxxxx [info] [script] [#10000/] requesting synchronized state
xxxxxxxxxx.xxxxxx [info] [parent] [#10000/] phase: handshake
xxxxxxxxxx.xxxxxx [info] [parent] [#10000/] registered for event pong
xxxxxxxxxx.xxxxxx [info] [parent] [#10000/] peer does not support 64bit PIDs; using compatibility mode
xxxxxxxxxx.xxxxxx [info] [parent] [#10000/] phase: sync (receiver)
xxxxxxxxxx.xxxxxx [info] [parent] [#10000/] phase: running
xxxxxxxxxx.xxxxxx [info] [parent] [#10000/] closing connection

3
testing/istate/base/bro-ping/stderr.log
View file

@ -1,3 +0,0 @@
xxxxxxxxxx.xxxxxx processing suspended
xxxxxxxxxx.xxxxxx processing continued
xxxxxxxxxx.xxxxxx received termination signal

0
testing/istate/base/bro-ping/stdout.log
View file

0
testing/istate/base/broccoli-ping/stderr.log
View file

5
testing/istate/base/broccoli-ping/stdout.log
View file

@ -1,5 +0,0 @@
pong event from 127.0.0.1: seq=0,
pong event from 127.0.0.1: seq=1,
pong event from 127.0.0.1: seq=2,
pong event from 127.0.0.1: seq=3,
pong event from 127.0.0.1: seq=4,

36
testing/istate/base/events-display/stdout.log
View file

@ -1,36 +0,0 @@
Event [xxxxxxxxxx.xxxxxx] bro_done()
Event [xxxxxxxxxx.xxxxxx] connection_established([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=0, state=4], resp=[size=0, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.182510137557983, service={}, addl="", hot=0, history="Sh"])
Event [xxxxxxxxxx.xxxxxx] connection_finished([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=5], resp=[size=9417, state=5], start_time=xxxxxxxxxx.xxxxxx, duration=1.73330307006836, service={}, addl="%events-send-1", hot=0, history="ShADdFaf"])
Event [xxxxxxxxxx.xxxxxx] connection_pending([id=[orig_h=141.42.64.125, orig_p=56729/tcp, resp_h=125.190.109.199, resp_p=12345/tcp], orig=[size=0, state=1], resp=[size=0, state=6], start_time=xxxxxxxxxx.xxxxxx, duration=0.182432889938354, service={}, addl="", hot=0, history="Sr"])
Event [xxxxxxxxxx.xxxxxx] connection_state_remove([id=[orig_h=141.42.64.125, orig_p=56729/tcp, resp_h=125.190.109.199, resp_p=12345/tcp], orig=[size=0, state=1], resp=[size=0, state=6], start_time=xxxxxxxxxx.xxxxxx, duration=0.182432889938354, service={}, addl="", hot=0, history="Sr"])
Event [xxxxxxxxxx.xxxxxx] connection_state_remove([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=5], resp=[size=9417, state=5], start_time=xxxxxxxxxx.xxxxxx, duration=1.73330307006836, service={}, addl="%events-send-1", hot=0, history="ShADdFaf"])
Event [xxxxxxxxxx.xxxxxx] http_begin_entity([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=0, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.183290958404541, service={}, addl="%events-send-1", hot=0, history="ShAD"]T)
Event [xxxxxxxxxx.xxxxxx] http_begin_entity([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=1448, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.367331027984619, service={}, addl="%events-send-1 %events-rcv-1", hot=0, history="ShADd"]F)
Event [xxxxxxxxxx.xxxxxx] http_content_type([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=0, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.183290958404541, service={}, addl="%events-send-1 %events-rcv-1", hot=0, history="ShAD"]T"TEXT""PLAIN")
Event [xxxxxxxxxx.xxxxxx] http_content_type([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=1448, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.367331027984619, service={}, addl="%events-send-1 %events-rcv-1", hot=0, history="ShADd"]F"TEXT""HTML")
Event [xxxxxxxxxx.xxxxxx] http_end_entity([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=0, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.183290958404541, service={}, addl="%events-send-1 %events-rcv-1", hot=0, history="ShAD"]T)
Event [xxxxxxxxxx.xxxxxx] http_end_entity([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=9417, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.73563814163208, service={}, addl="%events-send-1 %events-rcv-1", hot=0, history="ShADd"]F)
Event [xxxxxxxxxx.xxxxxx] http_entity_data([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=5792, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.551820039749146, service={}, addl="%events-send-1", hot=0, history="ShADd"]F4096"<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"^J"http://www.w3.org/TR/REC-html40/loose.dtd">^J<HEAD><TITLE>ICIR</TITLE></HEAD>^J<BODY bgcolor="#ffffff" text="#000000" link="#0000ff" vlink="#b20000">^J<img src=icir.gif alt="ICIR"><br>^J<p>^JICIR (The ICSI Center for Internet Research)^Jis a ^Jnon-profit^Jresearch institute at^J<a href="http://www.icsi.berkeley.edu">ICSI</a>^Jin ^J<a href="http://dir.yahoo.com/Regional/U_S__States/California/Cities/Berkeley/">Berkeley</a>, ^JCalifornia.<br>^JFor the three years from 1999 to 2001 we were named^JACIRI, the AT&T Center for Internet Research at ICSI, ^Jand were funded by <a href="http://www.att.com">AT&amp;T</a>.<br>^J^JThe goals of ICIR are to:^J<ul>^J<li>Pursue research on the Internet architecture and related networking issues,^J<li>^JParticipate actively in the research (<a href="http://www.acm.org/sigcomm/">SIGCOMM</a> and <a href="http://www.irtf.org/">IRTF</a>) and^Jstandards (<a href="http://www.ietf.org/">IETF</a>) communities,^J<li> Bridge the gap between the Internet research community and commercial ^Jinterests by providing a neutral forum where topics of mutual technical ^Jinterest can be addressed.^J</ul>^J<p>^J<!--^JICIR is now ^J<a href="jobs.html">^Jhiring</a> for both postdoctoral positions and summer interns.^J-->^J<hr>^J^J<DIV ALIGN="CENTER">^J^J<table width="100%" cellspacing=16 cellpadding=0>^J^J<tr>^J<td width="35%" valign=top>^J^J<h2>^JPeople^J</h2>^J<ul>^J<li>^J<a href="./shenker/">^JScott Shenker</a>, Group Leader<br> ^J<li><a href="http://www.icir.org/mallman/">Mark Allman</a>^J<li>^J<a href="./floyd/">Sally Floyd</a>^J<!--^J<li><a href="http://www.isi.edu/~govindan/">Ramesh Govindan</a>^J-->^J<li>^J<a href="./karp/papers.html">^JRichard Karp</a> ^J<!-- (also with the ^J<a href="http://www.icsi.berkeley.edu/Theory/">ICSI Theory Group</a>, ^J<a href="http://www.msri.org/">MSRI</a>, and^J<a href="http://www.cs.berkeley.edu/">UC Berkeley</a>) -->^J<li>^J<a href="./vern/">^JVern Paxson</a> ^J<li>^J<a href="http://www.icir.org/robin/">^JRobin Sommer</a>^J<li>^J<a href="http://www.cs.berkeley.edu/~nweaver/">^JNicholas Weaver</a>^J<li>^J<a href="http://www.icsi.berkeley.edu/~zhao/">^JJerry Zhao</a>^J<!-- </ul> &nbsp; &nbsp;<b>Group Members</b> <ul> -->^J<li><b><a href="pastvisitors.html">Past Group Members</a></b>,^J<br>including:^J<ul>^J<li>^J<a href="http://www.cs.ucl.ac.uk/staff/M.Handley/">^JMark Handley</a> (UCL)^J<li><a href="./kohler/">Eddie Kohler</a> (UCLA)^J</ul>^J<li><b>Affiliated <a href="http://www.xorp.org/">Xorp</a>^JResearchers</b>:^J <ul>^J <li><a href="./jcardona/">Javier Cardona</a>^J <li><a href="./atanu/">Atanu Ghosh</a> ^J <li><a href="./hodson/">Orion Hodson</a>^J <li><a href="./pavlin/">Pavlin Radoslavov</a> ^J <li><a href="http://www.iet.unipi.it/~luigi">Luigi Rizzo</a>^J <li><a href="http://people.freebsd.org/~bms/">Bruce Simpson</a>^J</ul>^J<li><b>Affiliated UCB Researchers</b>:^J <ul>^J <li><a href="http://www.cs.berkeley.edu/~christos/">Christos Papadimitriou</a>^J <li><a href="http://www.cs.berkeley.edu/~istoica/">Ion Stoica</a>^J </ul>^J<li><b>Visitors</b>:^J <ul>^J <li><a href="http://grid.sjtu.edu.cn/teachers/dengqn/dengqn.htm">Professor Quin-Ni Deng</a>^J<!--^J from Shanghai Jiaotong University^J-->^J <li>Teemu Koponen^J<!--^J , Helsinki Institute for Information Technology^J-->^J </ul>^J<!--^J<li><a href="pastvisitors.html">Other researchers</a>^J-->^J<a name=Visitors></a>^J<li><b>Interns:</b>^J<ul>^J<li>Juan Caballero^J<li><a href="http://www.stanford.edu/~casado/">Martin Casado</a>^J<li><a href="http://www.cs.rice.edu/~scrosby/">Scott Crosby</a>^J<li><a href="http://bnrg.cs.berkeley.edu/~wdc/">Weidong Cui</a>^J<li><a href="http://www.cs.berkeley.edu/~chema">Chema Gonzalez</a>^J<li>Halldor Isak Gylfason^J<li><a href="http://www.cl.cam.ac.uk/~cpk25/">Christian Kreibich</a>^J<li><a href="http://www.cs.ucsd.edu/~braghava">Barath Raghavan</a>^J<!--^J<li><a href="newinterns.html">New Interns:</a> ^J-->^J</ul>^J<li><b>Undergraduate Interns:</b>^J<ul>^J<li>Michael Hoisie^J<li>Arthur Wayne Liao^J<li>Christopher Portka^J</ul>^J<li><b><a href="pastvisitors.html">Past Visitors and Interns:</a></b>^J</ul>^J^J</td>^J<td width="30%" vali")
Event [xxxxxxxxxx.xxxxxx] http_entity_data([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=8688, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.552114009857178, service={}, addl="%events-send-1", hot=0, history="ShADd"]F4096"gn=top>^J^J<h2>^JPublications^J</h2>^J<ul>^J<li><a href="./rfcs.html">^JRFCs</a> with ICIR authors.^J<li>^J<a href="./internetdrafts.html">^JInternet drafts</a> with ICIR authors, 3/2004 ^J(or <a href="http://www.rfc-editor.org/idsearch.html">search</a>^Jthe current list).^J<!--^Jfor "Shenker OR Floyd OR Allman OR Paxson".^J(or the ^J<a^Jhref="^Jhttp://search.ietf.org:80/search/cgi-bin/BrokerQuery.pl.cgi?broker=internet-drafts&query=%28Author%3A+Shenker+OR+Floyd+OR+Handley+OR+Paxson+OR+Kohler%29&caseflag=on&wordflag=off&errorflag=0&maxlineflag=50&maxresultflag=1000&descflag=on&sort=by-NML&verbose=on&maxobjflag=25">current list</a>.)^J^Jhttp://search.ietf.org:80/search/cgi-bin/BrokerQuery.pl.cgi?broker=internet-drafts&query=(Shenker+OR+Floyd+OR+Handley+OR+Paxson+OR+Kohler)&descflag=on">current list</a>).^J-->^J<!--^Jfrom the ^J<a href="http://search.ietf.org/search/brokers/internet-drafts/query.html">^JInternet-Drafts Search Engine</a>).^J-->^J<li>Papers by ^J<a href="./shenker/papers.html">Scott Shenker</a>^J(<a^Jhref="http://citeseer.ist.psu.edu/cs?qb=dbnum%3D1%2Cqtype%3Dcitation:&q=Scott%20w/2%20Shenker%20or%20S%20w/2%20Shenker&co=Citations">RI</a>),^J^J<a href="./mallman/papers/">Mark Allman</a>^J(<a^Jhref="http://citeseer.ist.psu.edu/cs?qb=dbnum%3D1%2Cqtype%3Dcitation:&q=Mark%20w/2%20Allman%20or%20S%20w/2%20Allman&co=Citations">RI</a>),^J^J<a href="./floyd/papers.html">Sally Floyd</a>^J(<a^Jhref="http://citeseer.ist.psu.edu/cs?qb=dbnum%3D1%2Cqtype%3Dcitation:&q=Sally%20w/2%20Floyd%20or%20S%20w/2%20Floyd&co=Citations">RI</a>),^J^J<a href="./karp/papers.html">Richard Karp</a>^J(<a^Jhref="http://citeseer.ist.psu.edu/cs?qb=dbnum%3D1%2Cqtype%3Dcitation:&q=Richard%20w/2%20Karp%20or%20R%20w/2%20Karp&co=Citations">RI</a>),^J<a href="./kohler/pubs/">Eddie Kohler</a>^J(<a^Jhref="http://citeseer.ist.psu.edu/cs?qb=dbnum%3D1%2Cqtype%3Dcitation:&q=eddie%20w/2%20kohler%20or%20e%20w/2%20kohler&co=Citations">RI</a>),^J<a href="./vern/papers.html">Vern Paxson</a>^J(<a^Jhref="http://citeseer.ist.psu.edu/cs?qb=dbnum%3D1%2Cqtype%3Dcitation:&q=Vern%20w/2%20Paxson%20or%20V%20w/2%20Paxson&co=Citations">RI</a>).^J<li>The <a href="http://citeseer.ist.psu.edu/">^JResearchIndex</a> (RI) and the ^J<a href="http://citeseer.ist.psu.edu/cs">Search</a>^Jand ^J<a href="http://citeseer.ist.psu.edu/Networking/">^JNetworking</a> pages. ^J</ul>^J^J<h2>^JProjects ^J</h2>^J<ul>^J<li>^J<a href="./vern/bro-info.html">Bro</a>^J(detecting network intruders). ^J<li>The <a href="http://www.isi.edu/newarch/">NewArch</a> Project:^JFuture-Generation Internet Architecture.^J<LI>The <a href="http://www.isi.edu/nsnam/ns/">NS</a>^Jnetwork simulator.^J<li> <a href="./tbit/">TBIT</a>^J(TCP Behavior Identification Tool).^J<li> <a href="http://www.xorp.org/">Xorp</a>^J(Extensible Open Router Platform).^J<li>^J<a href="./funded_projects.html">^JOther Funded Projects</a>.^J<li>^J<a href="./research.html">^JAdditional Research Links</a>.^J</ul>^J^J^J</td>^J^J<td width="35%" valign=top>^J ^J<h2>Research</h2>^J&nbsp; &nbsp;<b>Transport and Congestion</b>^J<ul>^J<li>^J<a href="./kohler/dcp/">DCCP</a>^J(Datagram Congestion Control Protocol).^J<li>^J<a href="./floyd/ecn.html">ECN</a>^J(Explicit Congestion Notification).^J<li>^J<a href="http://www.ietf.org/html.charters/intserv-charter.html">^JIntegrated services</a>.^J<li>^J<a href="./floyd/red.html">RED</a> ^Jqueue management, and^J<a href="./red-pd/">RED-PD</a>.^J<li>^J<a href="./floyd/hstcp.html">HighSpeed TCP</a>.^J<li>^J<a^Jhref="http://www.ietf.cnri.reston.va.us/html.charters/OLD/tcpimpl-charter.html">^JTCP Implementation</a>.^J<li>^JReordering-Robust TCP ^J(<a href="./bkarp/RR-TCP/">RR-TCP</a>).^J<li>TCP^J<a href="./floyd/sacks.html">SACK</a> ^J(Selective Acknowledgment).^J<li>^J<a href="./tfrc/">TFRC</a> ^J(TCP-Friendly Rate Control).^J</ul>^J^J&nbsp; &nbsp;<b>Traffic and Topology</b>^J<ul>^J<LI>^J<a href="http://idmaps.eecs.umich.edu/">IDMaps</a> ^J(Internet Distance Mapping).^J<LI>The <a href="http://www.acm.org/sigcomm/ITA/">^JInternet Traffic Archive</a>.^J<li>^J<a href="http://www-net.cs.umass.edu/minc/">MINC</a>^J(Multicast-based Inference of Network-internal Characteristics).^J<li>^J<a href="http://www.psc.edu/networking/nimi/">NIMI</a>^J(N")
Event [xxxxxxxxxx.xxxxxx] http_entity_data([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=9417, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.73563814163208, service={}, addl="%events-send-1", hot=0, history="ShADd"]F938"ational Internet Measurement Infrastructure).^J</ul>^J^J<h2>^J<a href="./collaborators.html">^JCollaborators</a>^J</h2>^J^J<!--^J&nbsp; &nbsp;<b>Multicast and Multimedia</b>^J<ul>^J<LI><A href="/malloc/">MALLOC</a>^J(Multicast Address Allocation).^J<LI><a href="http://www.cs.columbia.edu/~hgs/sip/">SIP</a>^J(Session Initiation Protocol).^J<li> <a href="yoid"> Yoid</a> (host-based content distribution). ^J</ul>^J-->^J^J</td>^J^J</tr>^J</table>^J</DIV>^J^J<hr>^J<h2>Information for <a href="./abouticir.html">visitors</a> and <a href="/sysdocs/">local users</a>.</h2>^J<hr>^JLast modified: June 2004. <a href="./COPYRIGHTS">Copyright notice</a>.^J<a href="http://web.archive.org/web/*/http://www.aciri.org/">^JOlder versions</a> of this web page, in its ACIRI incarnation..^J<BR>^JFor more information about this server, mail <I>www@aciri.org</I>. ^J<BR>^JTo report <a href="scanning.html">unusual activity</a> by any of our hosts, mail <I>abuse@aciri.org</I>.^J</BODY>^J")
Event [xxxxxxxxxx.xxxxxx] http_header([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=0, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.183290958404541, service={}, addl="%events-send-1 %events-rcv-1", hot=0, history="ShAD"]T"ACCEPT""*/*")
Event [xxxxxxxxxx.xxxxxx] http_header([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=0, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.183290958404541, service={}, addl="%events-send-1 %events-rcv-1", hot=0, history="ShAD"]T"CONNECTION""Keep-Alive")
Event [xxxxxxxxxx.xxxxxx] http_header([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=0, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.183290958404541, service={}, addl="%events-send-1 %events-rcv-1", hot=0, history="ShAD"]T"HOST""www.icir.org")
Event [xxxxxxxxxx.xxxxxx] http_header([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=0, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.183290958404541, service={}, addl="%events-send-1 %events-rcv-1", hot=0, history="ShAD"]T"USER-AGENT""Wget/1.10")
Event [xxxxxxxxxx.xxxxxx] http_header([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=1448, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.367331027984619, service={}, addl="%events-send-1 %events-rcv-1", hot=0, history="ShADd"]F"ACCEPT-RANGES""bytes")
Event [xxxxxxxxxx.xxxxxx] http_header([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=1448, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.367331027984619, service={}, addl="%events-send-1 %events-rcv-1", hot=0, history="ShADd"]F"CONNECTION""Keep-Alive")
Event [xxxxxxxxxx.xxxxxx] http_header([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=1448, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.367331027984619, service={}, addl="%events-send-1 %events-rcv-1", hot=0, history="ShADd"]F"CONTENT-LENGTH""9130")
Event [xxxxxxxxxx.xxxxxx] http_header([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=1448, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.367331027984619, service={}, addl="%events-send-1 %events-rcv-1", hot=0, history="ShADd"]F"CONTENT-TYPE""text/html")
Event [xxxxxxxxxx.xxxxxx] http_header([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=1448, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.367331027984619, service={}, addl="%events-send-1 %events-rcv-1", hot=0, history="ShADd"]F"DATE""Fri, 07 Oct 2005 23:23:55 GMT")
Event [xxxxxxxxxx.xxxxxx] http_header([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=1448, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.367331027984619, service={}, addl="%events-send-1 %events-rcv-1", hot=0, history="ShADd"]F"ETAG"""2c96c-23aa-4346a0e5"")
Event [xxxxxxxxxx.xxxxxx] http_header([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=1448, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.367331027984619, service={}, addl="%events-send-1 %events-rcv-1", hot=0, history="ShADd"]F"KEEP-ALIVE""timeout=15, max=100")
Event [xxxxxxxxxx.xxxxxx] http_header([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=1448, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.367331027984619, service={}, addl="%events-send-1 %events-rcv-1", hot=0, history="ShADd"]F"LAST-MODIFIED""Fri, 07 Oct 2005 16:23:01 GMT")
Event [xxxxxxxxxx.xxxxxx] http_header([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=1448, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.367331027984619, service={}, addl="%events-send-1 %events-rcv-1", hot=0, history="ShADd"]F"SERVER""Apache/1.3.33 (Unix)")
Event [xxxxxxxxxx.xxxxxx] http_message_done([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=0, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.183290958404541, service={}, addl="%events-send-1 %events-rcv-1", hot=0, history="ShAD"]T[start=xxxxxxxxxx.xxxxxx, interrupted=F, finish_msg="message ends normally", body_length=0, content_gap_length=0, header_length=86])
Event [xxxxxxxxxx.xxxxxx] http_message_done([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=9417, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.73563814163208, service={}, addl="%events-send-1 %events-rcv-1", hot=0, history="ShADd"]F[start=xxxxxxxxxx.xxxxxx, interrupted=F, finish_msg="message ends normally", body_length=9130, content_gap_length=0, header_length=265])
Event [xxxxxxxxxx.xxxxxx] http_reply([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=1448, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.367331027984619, service={}, addl="%events-send-1", hot=0, history="ShADd"]"1.1"200"OK")
Event [xxxxxxxxxx.xxxxxx] http_request([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=0, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.183290958404541, service={}, addl="", hot=0, history="ShAD"]"GET""/""/""1.0")
Event [xxxxxxxxxx.xxxxxx] net_done(xxxxxxxxxx.xxxxxx)
Event [xxxxxxxxxx.xxxxxx] new_connection([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=0, state=0], resp=[size=0, state=0], start_time=xxxxxxxxxx.xxxxxx, duration=0.0, service={}, addl="", hot=0, history=""])
Event [xxxxxxxxxx.xxxxxx] new_connection([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=0, state=1], resp=[size=0, state=0], start_time=xxxxxxxxxx.xxxxxx, duration=0.0, service={}, addl="cc=1", hot=0, history=""])
Event [xxxxxxxxxx.xxxxxx] protocol_confirmation([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=0, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.183290958404541, service={}, addl="", hot=0, history="ShAD"]165)

2
testing/istate/base/events-rcv/conn.log
View file

@ -1,2 +0,0 @@
xxxxxxxxxx.xxxxxx 0.182433 141.42.64.125 125.190.109.199 other 56729 12345 tcp ? ? REJ X
xxxxxxxxxx.xxxxxx 1.733303 141.42.64.125 125.190.109.199 http 56730 80 tcp 98 9417 SF X %events-send-1

18
testing/istate/base/events-rcv/http.log
View file

@ -1,18 +0,0 @@
xxxxxxxxxx.xxxxxx %events-rcv-1 start 141.42.64.125:56730 > 125.190.109.199:80
xxxxxxxxxx.xxxxxx %events-rcv-1 > USER-AGENT: Wget/1.10
xxxxxxxxxx.xxxxxx %events-rcv-1 > ACCEPT: */*
xxxxxxxxxx.xxxxxx %events-rcv-1 > HOST: www.icir.org
xxxxxxxxxx.xxxxxx %events-rcv-1 > CONNECTION: Keep-Alive
xxxxxxxxxx.xxxxxx %events-rcv-1 < DATE: Fri, 07 Oct 2005 23:23:55 GMT
xxxxxxxxxx.xxxxxx %events-rcv-1 < SERVER: Apache/1.3.33 (Unix)
xxxxxxxxxx.xxxxxx %events-rcv-1 < LAST-MODIFIED: Fri, 07 Oct 2005 16:23:01 GMT
xxxxxxxxxx.xxxxxx %events-rcv-1 < ETAG: "2c96c-23aa-4346a0e5"
xxxxxxxxxx.xxxxxx %events-rcv-1 < ACCEPT-RANGES: bytes
xxxxxxxxxx.xxxxxx %events-rcv-1 < CONTENT-LENGTH: 9130
xxxxxxxxxx.xxxxxx %events-rcv-1 < KEEP-ALIVE: timeout=15, max=100
xxxxxxxxxx.xxxxxx %events-rcv-1 < CONNECTION: Keep-Alive
xxxxxxxxxx.xxxxxx %events-rcv-1 < CONTENT-TYPE: text/html
xxxxxxxxxx.xxxxxx %events-rcv-1 <= 4096 bytes: "<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML ..."
xxxxxxxxxx.xxxxxx %events-rcv-1 <= 4096 bytes: "gn=top>^J^J<h2>^JPublications^J</h2>^J<ul>^J<l..."
xxxxxxxxxx.xxxxxx %events-rcv-1 <= 938 bytes: "ational Internet Measurement Infrastruct..."
xxxxxxxxxx.xxxxxx %events-rcv-1 GET / (200 "OK" [9130] www.icir.org)

3
testing/istate/base/events-rcv/stderr.log
View file

@ -1,3 +0,0 @@
xxxxxxxxxx.xxxxxx processing suspended
xxxxxxxxxx.xxxxxx processing continued
xxxxxxxxxx.xxxxxx received termination signal

0
testing/istate/base/events-rcv/stdout.log
View file

3
testing/istate/base/events-send/conn.log
View file

@ -1,3 +0,0 @@
xxxxxxxxxx.xxxxxx 0.182433 141.42.64.125 125.190.109.199 other 56729 12345 tcp ? ? REJ X
xxxxxxxxxx.xxxxxx 1.733303 141.42.64.125 125.190.109.199 http 56730 80 tcp 98 9417 SF X %events-send-1
xxxxxxxxxx.xxxxxx ? 141.42.64.125 125.190.109.199 http 56730 80 tcp ? ? OTH X

18
testing/istate/base/events-send/http.log
View file

@ -1,18 +0,0 @@
xxxxxxxxxx.xxxxxx %events-send-1 start 141.42.64.125:56730 > 125.190.109.199:80
xxxxxxxxxx.xxxxxx %events-send-1 > USER-AGENT: Wget/1.10
xxxxxxxxxx.xxxxxx %events-send-1 > ACCEPT: */*
xxxxxxxxxx.xxxxxx %events-send-1 > HOST: www.icir.org
xxxxxxxxxx.xxxxxx %events-send-1 > CONNECTION: Keep-Alive
xxxxxxxxxx.xxxxxx %events-send-1 < DATE: Fri, 07 Oct 2005 23:23:55 GMT
xxxxxxxxxx.xxxxxx %events-send-1 < SERVER: Apache/1.3.33 (Unix)
xxxxxxxxxx.xxxxxx %events-send-1 < LAST-MODIFIED: Fri, 07 Oct 2005 16:23:01 GMT
xxxxxxxxxx.xxxxxx %events-send-1 < ETAG: "2c96c-23aa-4346a0e5"
xxxxxxxxxx.xxxxxx %events-send-1 < ACCEPT-RANGES: bytes
xxxxxxxxxx.xxxxxx %events-send-1 < CONTENT-LENGTH: 9130
xxxxxxxxxx.xxxxxx %events-send-1 < KEEP-ALIVE: timeout=15, max=100
xxxxxxxxxx.xxxxxx %events-send-1 < CONNECTION: Keep-Alive
xxxxxxxxxx.xxxxxx %events-send-1 < CONTENT-TYPE: text/html
xxxxxxxxxx.xxxxxx %events-send-1 <= 4096 bytes: "<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML ..."
xxxxxxxxxx.xxxxxx %events-send-1 <= 4096 bytes: "gn=top>^J^J<h2>^JPublications^J</h2>^J<ul>^J<l..."
xxxxxxxxxx.xxxxxx %events-send-1 <= 938 bytes: "ational Internet Measurement Infrastruct..."
xxxxxxxxxx.xxxxxx %events-send-1 GET / (200 "OK" [9130] www.icir.org)

0
testing/istate/base/events-send/stderr.log
View file

0
testing/istate/base/events-send/stdout.log
View file

0
testing/istate/base/persistence-read/stderr.log
View file

0
testing/istate/base/persistence-read/stdout.log
View file

33
testing/istate/base/persistence-read/vars.log
View file

@ -1,33 +0,0 @@
42
-42
Hallihallo
1.2.3.4
1.2.0.0/16
3.14
131.159
42.0 secs
{
[1] = qwerty,
[2] = uiop
}
file "test" of string
/^?(12345)$?/
{
3,
5,
4,
1,
2
}
{
[2, DEF] = 102,
[1, ABC] = 101,
[3, GHI] = 103
}
{
[12345] = /^?(12345)$?/,
[12346] = /^?(12345)$?/
}
42/udp
[1, 2, 3]
[a=yuyuyu, b=[a=rec1, b=100, c=1.24], c=[a=rec2, b=200, c=2.24], d=7.77]

0
testing/istate/base/persistence-write/stderr.log
View file

0
testing/istate/base/persistence-write/stdout.log
View file

33
testing/istate/base/persistence-write/vars.log
View file

@ -1,33 +0,0 @@
42
-42
Hallihallo
1.2.3.4
1.2.0.0/16
3.14
131.159
42.0 secs
{
[1] = qwerty,
[2] = uiop
}
file "test" of string
/^?(12345)$?/
{
3,
5,
4,
1,
2
}
{
[2, DEF] = 102,
[1, ABC] = 101,
[3, GHI] = 103
}
{
[12345] = /^?(12345)$?/,
[12346] = /^?(12345)$?/
}
42/udp
[1, 2, 3]
[a=yuyuyu, b=[a=rec1, b=100, c=1.24], c=[a=rec2, b=200, c=2.24], d=7.77]

14
testing/istate/base/python-bro/stdout.log
View file

@ -1,14 +0,0 @@
==== atomic
-10
2
xxxxxxxxxx.xxxxxx
2.0 mins
F
1.5
Servus
5555/tcp
6.7.6.5
0.0
192.168.0.0/16
==== record
42, 6.6.7.7

44
testing/istate/base/python-script/stdout.log
View file

@ -1,44 +0,0 @@
==== atomic a 1 ====
-4 -4
42 42
xxxxxxxxxx.xxxxxx xxxxxxxxxx.xxxxxx
60.0 60.0
True True
3.1400000000000001 3.14
'Hurz' Hurz
'12345/udp' 12345/udp
'1.2.3.4' 1.2.3.4
'X.X.X' X.X.X
'X.X.X' 22.33.44.0/24
==== atomic a 2 ====
-10 -10
2 2
xxxxxxxxxx.xxxxxx xxxxxxxxxx.xxxxxx
120.0 120.0
False False
1.5 1.5
'Servus' Servus
'5555/tcp' 5555/tcp
'6.7.6.5' 6.7.6.5
'X.X.X' X.X.X
'X.X.X' 192.168.0.0/16
==== atomic b 2 ====
-10 -10
<broccoli.count instance at > 2
<broccoli.time instance at > xxxxxxxxxx.xxxxxx
<broccoli.interval instance at > 120.0
False False
1.5 1.5
'Servus' Servus
<broccoli.port instance at > 5555/tcp
<broccoli.addr instance at > 6.7.6.5
<broccoli.net instance at > X.X.X
<broccoli.net instance at > 192.168.0.0/16
==== record 1 ====
<broccoli.record instance at >
42 42
'6.6.7.7' 6.6.7.7
==== record 2 ====
<broccoli.record instance at >
99 99
'3.4.5.1' 3.4.5.1

21
testing/istate/base/sync-rcv/remote.log
View file

@ -1,21 +0,0 @@
xxxxxxxxxx.xxxxxx [info] [parent] raised pipe's socket buffer size from 126K to 1024K
xxxxxxxxxx.xxxxxx [info] [parent] communication started, parent
xxxxxxxxxx.xxxxxx [info] [parent] [#1/127.0.0.1:47757] added peer
xxxxxxxxxx.xxxxxx [info] [child] [#1/127.0.0.1:47757] connected
xxxxxxxxxx.xxxxxx [info] [parent] [#1/127.0.0.1:47757] peer connected
xxxxxxxxxx.xxxxxx [info] [parent] [#1/127.0.0.1:47757] phase: version
xxxxxxxxxx.xxxxxx [info] [script] [#1/127.0.0.1:47757] connection established
xxxxxxxxxx.xxxxxx [info] [script] [#1/127.0.0.1:47757] requesting events matching /^?(.*)$?/
xxxxxxxxxx.xxxxxx [info] [script] [#1/127.0.0.1:47757] accepting state
xxxxxxxxxx.xxxxxx [info] [script] [#1/127.0.0.1:47757] requesting synchronized state
xxxxxxxxxx.xxxxxx [info] [parent] [#1/127.0.0.1:47757] phase: handshake
xxxxxxxxxx.xxxxxx [info] [parent] [#1/127.0.0.1:47757] peer_description is not set
xxxxxxxxxx.xxxxxx [info] [parent] [#1/127.0.0.1:47757] peer supports keep-in-cache; using that
xxxxxxxxxx.xxxxxx [info] [parent] [#1/127.0.0.1:47757] phase: sync (sender)
xxxxxxxxxx.xxxxxx [info] [parent] [#1/127.0.0.1:47757] starting to send full state
xxxxxxxxxx.xxxxxx [info] [parent] [#1/127.0.0.1:47757] done sending full state
xxxxxxxxxx.xxxxxx [info] [parent] [#1/127.0.0.1:47757] phase: running
xxxxxxxxxx.xxxxxx [info] [script] [#1/127.0.0.1:47757] connection closed
xxxxxxxxxx.xxxxxx [info] [parent] [#1/127.0.0.1:47757] peer disconnected
xxxxxxxxxx.xxxxxx [info] [child] [#1/127.0.0.1:47757] connection closed
xxxxxxxxxx.xxxxxx [info] [parent] [#1/127.0.0.1:47757] closing connection

1
testing/istate/base/sync-rcv/stderr.log
View file

@ -1 +0,0 @@
xxxxxxxxxx.xxxxxx received termination signal

0
testing/istate/base/sync-rcv/stdout.log
View file

34
testing/istate/base/sync-rcv/vars.log
View file

@ -1,34 +0,0 @@
421
1234567
Jodel
4.3.2.1
4.0.0.0/8
21.0
192.150.186
42.0 secs
{
[3] = asdfg1,
[1] = asdfg2
}
file "test2" of string
/^?(abbcdefgh)$?/
{
3,
5,
6,
4,
2
}
{
[4, JKL] = 104,
[2, DEF] = 103,
[3, GHI] = 103
}
{
[12345] = /^?(12345)$?/,
[6767] = /^?(QWERTZ)$?/,
[12346] = /^?(12345)$?/
}
6667/tcp
[2, 20, 3, 4]
[a=zxzxzx, b=[a=pop, b=43, c=9.999], c=[a=IOIOI, b=201, c=612.2], d=6.6666]

2
testing/istate/base/sync-send/stderr.log
View file

@ -1,2 +0,0 @@
xxxxxxxxxx.xxxxxx processing suspended
xxxxxxxxxx.xxxxxx processing continued

0
testing/istate/base/sync-send/stdout.log
View file

34
testing/istate/base/sync-send/vars.log
View file

@ -1,34 +0,0 @@
421
1234567
Jodel
4.3.2.1
4.0.0.0/8
21.0
192.150.186
42.0 secs
{
[3] = asdfg1,
[1] = asdfg2
}
file "test2" of string
/^?(abbcdefgh)$?/
{
3,
5,
6,
4,
2
}
{
[4, JKL] = 104,
[2, DEF] = 103,
[3, GHI] = 103
}
{
[12345] = /^?(12345)$?/,
[6767] = /^?(QWERTZ)$?/,
[12346] = /^?(12345)$?/
}
6667/tcp
[2, 20, 3, 4]
[a=zxzxzx, b=[a=pop, b=43, c=9.999], c=[a=IOIOI, b=201, c=612.2], d=6.6666]

174
testing/istate/istate.py
View file

@ -1,174 +0,0 @@
#! /usr/bin/env python
#
# Tests persistence.
#
# $Id: istate.py,v 1.1.2.4 2005/10/11 22:31:42 sommer Exp $
import time
import os
import os.path
import optparse
import sys
import subprocess
import tests
optparser = optparse.OptionParser( usage = "%prog [options]", version = "0.1" )
optparser.add_option( "-s", "--show-diff", action = "store_true", dest = "showdiff",
default = False, help = "show diffs of mismatches" )
optparser.add_option( "-b", "--new-base", action = "store_true", dest = "newbase",
default = False, help = "create new baseline" )
optparser.add_option( "-d", "--debug", action = "store_true", dest = "debug",
default = False, help = "enable debug output" )
optparser.add_option( "-t", "--set", action = "store", type = "string", dest = "set",
default = None, help = "only do given test set" )
( tests.Options, args ) = optparser.parse_args()
if len(args) != 0:
optparser.error( "Wrong number of arguments" )
##########################################
# Write persistent data and read it back.
##########################################
if tests.testSet("persistence"):
tests.spawnBro("persistence-write",
["-r", os.path.join(tests.Traces, "empty.trace"),
os.path.join(tests.Scripts, "vars-init.bro"),
os.path.join(tests.Scripts, "vars-print.bro")])
tests.waitProc("persistence-write")
tests.finishTest("persistence-write", ["stdout.log", "stderr.log", "vars.log"])
tests.spawnBro("persistence-read",
[os.path.join(tests.Scripts, "vars-declare.bro"),
os.path.join(tests.Scripts, "vars-print.bro")],
copy=[os.path.join(tests.workDir("persistence-write"), ".state")])
tests.waitProc("persistence-read")
tests.finishTest("persistence-read", ["stdout.log", "stderr.log", "vars.log"])
tests.compareFiles("persistence-write", "persistence-read", ["vars.log"])
##########################################
# Exchange events (clear-text).
#
# The used trace contains two connections separated by a silence of a
# couple of seconds. We start the processes so that the events for the
# *second* one (which is a full HTTP connection) are exchanged.
##########################################
if tests.testSet("events"):
tests.spawnBro("events-send",
["-r", os.path.join(tests.Scripts, os.path.join(tests.Traces, "web.trace")),
"--pseudo-realtime",
"-C",
os.path.join(tests.Scripts, "events-send.bro")])
time.sleep(2)
tests.spawnBro("events-rcv",
[os.path.join(tests.Scripts, "events-rcv.bro")])
tests.waitProc("events-send")
tests.killProc("events-rcv")
tests.finishTest("events-send", ["stdout.log", "stderr.log", "http.log", "conn.log"], ignoreTime=True)
tests.finishTest("events-rcv", ["stdout.log", "stderr.log", "http.log", "conn.log"], ignoreTime=True)
tests.spawnBro("events-display",
["-x", os.path.join(tests.workDir("events-rcv"), "events.bst")])
tests.waitProc("events-display")
tests.finishTest("events-display", ["stdout.log"], ignoreTime=True, sort=True, delete=['127.0.0.1:[0-9]*',"Event.*remote_.*"])
tests.compareFiles("events-send", "events-rcv", ["http.log"], ignoreTime=True, ignoreSessionID=True)
##########################################
# Exchange synchronized state
##########################################
if tests.testSet("sync"):
tests.spawnBro("sync-send",
[os.path.join(tests.Scripts, "vars-sync-send.bro")])
tests.spawnBro("sync-rcv",
[os.path.join(tests.Scripts, "vars-sync-rcv.bro")])
tests.waitProc("sync-send")
time.sleep(1)
tests.killProc("sync-rcv")
tests.finishTest("sync-send", ["stdout.log", "stderr.log", "vars.log"], ignoreTime=True)
tests.finishTest("sync-rcv", ["stdout.log", "stderr.log", "vars.log", "remote.log"], ignoreTime=True, delete=["pid.*pid.*", "temporarily unavailable \\[..\\]"])
tests.compareFiles("sync-send", "sync-rcv", ["vars.log"], ignoreTime=True)
# Old version
# tests.spawnBro("sync-send",
# ["-r", os.path.join(tests.Scripts, os.path.join(tests.Traces, "web.trace")),
# "--pseudo-realtime",
# "-C",
# os.path.join(tests.Scripts, "vars-sync-send.bro")])
##########################################
# Test Broccoli with bro-ping
##########################################
if tests.testSet("broccoli"):
broctest = os.path.join(tests.BroBase, "aux/broccoli/test")
broclib = os.path.join(tests.BroBase, "build/aux/broccoli/src/")
broping = os.path.join(tests.BroBase, "build/aux/broccoli/test/broping")
brocpy = os.path.join(tests.BroBase, "build/aux/broccoli/bindings/broccoli-python")
broccoli = True
# Test if Broccoli was compiled.
if not os.path.exists(broping):
print " Broccoli was not compiled, skipping tests."
broccoli = False
# Test if this is a IPv6 Bro.
if broccoli:
v6 = subprocess.call(["grep", "-q", "#define BROv6", os.path.join(tests.BroBase, "build/config.h")])
if v6 == 0:
print " Bro built with IPv6 support not compatible with Broccoli, skipping tests."
broccoli = False
if broccoli:
tests.spawnBro("bro-ping", [os.path.join(broctest, "broping-record.bro")])
time.sleep(1)
tests.spawnProc("broccoli-ping",
[broping,
"-r",
"-c", "5",
"127.0.0.1"])
tests.waitProc("broccoli-ping")
tests.killProc("bro-ping")
tests.finishTest("bro-ping", ["stdout.log", "stderr.log", "remote.log"],
ignoreTime=True, delete=["127.0.0.1:[0-9]*", "pid.*pid.*",
".*Resource temporarily unavailable.*", ".*connection closed.*",
".*peer disconnected.*"])
tests.finishTest("broccoli-ping", ["stdout.log", "stderr.log"],
delete=["time=.* s$"])
# Test if Python binding are installed.
sopath = subprocess.Popen(["find", brocpy, "-name", "_broccoli_intern.so"], stdout=subprocess.PIPE).communicate()[0]
if sopath != "":
os.environ["LD_LIBRARY_PATH"] = broclib
os.environ["DYLD_LIBRARY_PATH"] = broclib
os.environ["PYTHONPATH"] = os.path.dirname(sopath)
tests.spawnBro("python-bro", [os.path.join(brocpy, "tests/test.bro")])
time.sleep(1)
tests.spawnProc("python-script", [os.path.join(brocpy, "tests/test.py")])
tests.waitProc("python-script")
tests.killProc("python-bro")
tests.finishTest("python-bro", ["stdout.log"], ignoreTime=True)
tests.finishTest("python-script", ["stdout.log"], ignoreTime=True, delete=["0x[^>]*", ".[0-9]{2}"])
else:
print " Python bindings not built, skipping test."
print " (To build: cd %s && python setup.py build)" % brocpy

17
testing/istate/rndseed.dat
View file

@ -1,17 +0,0 @@
1971283154
1128552575
26676
875311974
790730425
1553617948
3593004090
2070230499
1420669195
754343139
2906181924
542878596
2459738795
924396623
743111462
3363354015
198575356

18
testing/istate/scripts/events-rcv.bro
View file

@ -1,18 +0,0 @@
# $Id: events-rcv.bro,v 1.1.2.1 2005/10/07 01:59:12 sommer Exp $
@load tcp
@load http-request
@load http-reply
@load http-header
@load http-body
@load http-abstract
@load capture-events
@load remote
redef peer_description = "events-rcv";
redef Remote::destinations += {
["foo"] = [$host = 127.0.0.1, $events = /.*/, $connect=T]
};

21
testing/istate/scripts/events-send.bro
View file

@ -1,21 +0,0 @@
# $Id: events-send.bro,v 1.1.2.1 2005/10/07 01:59:12 sommer Exp $
@load tcp
@load http-request
@load http-reply
@load http-header
@load http-body
@load http-abstract
@load listen-clear
@load capture-events
redef peer_description = "events-send";
# Make sure the HTTP connection really gets out.
# (We still miss one final connection event because we shutdown before
# it gets propagated but that's ok.)
redef tcp_close_delay = 0secs;

36
testing/istate/scripts/vars-declare.bro
View file

@ -1,36 +0,0 @@
# $Id: vars-declare.bro,v 1.1.2.2 2005/10/11 21:15:05 sommer Exp $
#
# Declares variables.
global foo1: count &persistent &synchronized;
global foo2: int &persistent &synchronized;
global foo3: string &persistent &synchronized;
global foo4: addr &persistent &synchronized;
global foo5: subnet &persistent &synchronized;
global foo6: double &persistent &synchronized;
global foo7: net &persistent &synchronized;
global foo8: interval &persistent &synchronized;
global foo9: table[count] of string &persistent &synchronized;
global foo10: file &persistent &synchronized;
global foo11: pattern &persistent &synchronized;
global foo12: set[count] &persistent &synchronized;
global foo13: table[count, string] of count &persistent &synchronized;
global foo14: table[count] of pattern &persistent &synchronized;
global foo15: port &persistent &synchronized;
global foo16: vector of count &persistent &synchronized;
type type1: record {
a: string;
b: count &default=42;
c: double &optional;
};
type type2: record {
a: string;
b: type1;
c: type1;
d: double;
};
global foo17: type2 &persistent &synchronized;

42
testing/istate/scripts/vars-init.bro
View file

@ -1,42 +0,0 @@
# $Id: vars-init.bro,v 1.1.2.2 2005/10/11 21:15:05 sommer Exp $
#
# Instantiates variables.
global foo1 = 42 &persistent &synchronized;
global foo2 = -42 &persistent &synchronized;
global foo3 = "Hallihallo" &persistent &synchronized;
global foo4 = 1.2.3.4 &persistent &synchronized;
global foo5 = 1.2.0.0/16 &persistent &synchronized;
global foo6 = 3.14 &persistent &synchronized;
global foo7 = 131.159. &persistent &synchronized;
global foo8 = 42 secs &persistent &synchronized;
global foo9 = { [1] = "qwerty", [2] = "uiop" } &persistent &synchronized;
global foo10 = open("test") &persistent &synchronized;
global foo11 = /12345/ &persistent &synchronized;
global foo12 = { 1,2,3,4,5 } &persistent &synchronized;
global foo13 = { [1,"ABC"] = 101, [2,"DEF"] = 102, [3,"GHI"] = 103 } &persistent &synchronized;
global foo14 = { [12345] = foo11, [12346] = foo11 } &persistent &synchronized;
global foo15 = 42/udp &persistent &synchronized;
global foo16: vector of count = [1,2,3] &persistent &synchronized;
type type1: record {
a: string;
b: count &default=42;
c: double &optional;
};
type type2: record {
a: string;
b: type1;
c: type1;
d: double;
};
global foo17: type2 = [
$a = "yuyuyu",
$b = [$a="rec1", $b=100, $c=1.24],
$c = [$a="rec2", $b=200, $c=2.24],
$d = 7.77
] &persistent &synchronized;

61
testing/istate/scripts/vars-modify.bro
View file

@ -1,61 +0,0 @@
# $Id: vars-modify.bro,v 1.1.2.2 2005/10/11 21:15:05 sommer Exp $
#
# Performs modifications on variables.
function modify()
{
foo1 = 420;
++foo1;
--foo2;
foo3 = "Jodel";
foo4 = 4.3.2.1;
foo5 = 4.0.0.0/8;
foo6 = 21;
foo7 = 192.150.186;
foo9[3] = "asdfg1";
foo9[1] = "asdfg2";
delete foo9[2];
foo10 = open("test2");
foo11 = /abbcdefgh/;
add foo12[6];
delete foo12[1];
foo13[4,"JKL"] = 104;
delete foo13[1,"ABC"];
++foo13[2,"DEF"];
foo14[6767] = /QWERTZ/;
foo15 = 6667/tcp;
foo16[4] = 4;
foo16[2] = 20;
++foo16[1];
local x: type1;
x$a = "pop";
++x$b;
x$c = 9.999;
foo17$a = "zxzxzx";
foo17$b = x;
foo17$c$a = "IOIOI";
++foo17$c$b;
foo17$c$c = 612.2;
foo17$d = 6.6666;
foo2 = 1234567;
}

29
testing/istate/scripts/vars-print.bro
View file

@ -1,29 +0,0 @@
# $Id: vars-print.bro,v 1.1.2.2 2005/10/11 21:15:05 sommer Exp $
#
# Print variables.
event bro_done()
{
local out = open("vars.log");
print out, foo1;
print out, foo2;
print out, foo3;
print out, foo4;
print out, foo5;
print out, foo6;
print out, foo7;
print out, foo8;
print out, foo9;
print out, foo10;
print out, foo11;
print out, foo12;
print out, foo13;
print out, foo14;
print out, foo15;
print out, foo16;
print out, foo17;
}

13
testing/istate/scripts/vars-sync-rcv.bro
View file

@ -1,13 +0,0 @@
# $Id: vars-sync-rcv.bro,v 1.1.2.1 2005/10/11 21:15:05 sommer Exp $
@load vars-init
@load vars-print
@load capture-events
@load remote
redef Remote::destinations += {
["foo"] = [$host = 127.0.0.1, $events = /.*/, $connect=T, $sync=T]
};

20
testing/istate/scripts/vars-sync-send.bro
View file

@ -1,20 +0,0 @@
# $Id: vars-sync-send.bro,v 1.1.2.1 2005/10/11 21:15:05 sommer Exp $
#
@load vars-init
@load vars-print
@load vars-modify
@load listen-clear
event remote_connection_handshake_done(p: event_peer)
{
modify();
terminate_communication();
}
redef Remote::destinations += {
["foo"] = [$host = 127.0.0.1, $sync=T]
};

300
testing/istate/tests.py
View file

@ -1,300 +0,0 @@
# $Id: tests.py,v 1.1.2.5 2005/10/11 22:31:42 sommer Exp $
#
# Various helper functions.
import sys
import os
import copy
import errno
import signal
import subprocess
# Path to our files.
Testing = os.path.abspath(".")
# Path to top-level Bro directory.
if os.path.exists("../../build/src/bro"):
BroBase = os.path.abspath("../..")
else:
error("cannot find build directory")
# Path where tmp files are created.
Tmp = os.path.join(Testing, "tmp")
# Path to seed file.
BroSeed = os.path.join(Testing, "rndseed.dat")
# Path to our test scripts.
Scripts = os.path.join(Testing, "scripts")
# Path to our test traces.
Traces = os.path.join(Testing, "traces")
# Where the base files to compare against are stored.
Base = os.path.join(os.getcwd(), "./base")
# Process ID of all processes we've spawned, indexed by textual tag *and* pid.
Running = {}
# Set to true when at least one check failed.
Failed = False
# getopt options
Options = None
def error(str):
print >>sys.stderr, "Error:", str
sys.exit(1)
def debug(str):
if Options.debug:
print >>sys.stderr, "Debug:", str
def log(str):
print >>sys.stderr, str
# Returns full path of given process' working directory.
def workDir(tag):
return os.path.join(Tmp, tag)
# Intializes work dir for given process.
def initWorkDir(tag):
try:
os.mkdir(Tmp)
except OSError, e:
if e.errno != errno.EEXIST:
raise
os.system("rm -rf " + workDir(tag))
os.mkdir(workDir(tag))
# Spawns process identified by the given tag. Enters process into RunningBro.
def spawnProc(tag, cmdline, copy=[]):
initWorkDir(tag)
os.chdir(workDir(tag))
for i in copy:
debug("Copying %s into workdir of %s" % (i, tag))
os.system("cp -r %s %s" % (i, workDir(tag)))
debug("Spawning '%s' as %s" % (" ".join(cmdline), tag))
saved_stdin = os.dup(0)
saved_stdout = os.dup(1)
saved_stderr = os.dup(2)
child_stdin = open("/dev/null", "r")
child_stdout = open("stdout.log", "w")
child_stderr = open("stderr.log", "w")
os.dup2(child_stdin.fileno(), 0)
os.dup2(child_stdout.fileno(), 1)
os.dup2(child_stderr.fileno(), 2)
pid = os.spawnvp(os.P_NOWAIT, cmdline[0], cmdline)
os.dup2(saved_stdin, 0)
os.dup2(saved_stdout, 1)
os.dup2(saved_stderr, 2)
Running[tag] = pid
Running[pid] = tag
# Spaws a Bro process.
def spawnBro(tag, args, copy=[]):
bropath = os.path.join(BroBase, "policy")
bropath += ":" + os.path.join(BroBase, "build/src")
os.putenv("BROPATH", bropath + ":" + Scripts)
os.unsetenv("BRO_LOG_SUFFIX")
args += ["--load-seeds", BroSeed, "-B", "state,comm"]
spawnProc(tag, [os.path.join(BroBase, "build/src/bro")] + args, copy=copy)
# Examines a process' exit code.
def parseExitCode(tag, result):
if os.WCOREDUMP(result):
error("process %s core dumped." % tag)
if os.WIFSIGNALED(result):
error("process %s got signal %d." % (tag, os.WTERMSIG(result)))
if not os.WIFEXITED(result):
error("process %s exited abnormally (%d)." % (tag, result))
result = os.WEXITSTATUS(result)
debug("process %s exited with %d" % (tag, result))
return result
# Waits for process to finish.
def waitProc(tag):
(pid, result) = os.waitpid(Running[tag], 0)
result = parseExitCode(tag, result)
if result != 0:
error("Execution of %s failed." % tag)
del Running[pid]
del Running[tag]
# Waits for all of our processes to terminte.
def waitProcs():
while Running:
(pid, result) = os.waitpid(0, 0)
parseExitCode(Running[pid], result)
del Running[Running[pid]]
del Running[pid]
# Kills the process and waits for its termination.
def killProc(tag):
pid = Running[tag]
debug("Killing %s..." % tag)
os.kill(pid, signal.SIGTERM)
(pid, result) = os.waitpid(pid, 0)
parseExitCode(tag, result)
del Running[pid]
del Running[tag]
# Cleans up temporary stuff
def cleanup():
os.system("rm -rf " + Tmp)
# Canonicalizes file content for diffing.
def canonicalizeFile(file, ignoreTime, ignoreSessionID, sort, delete):
cmd = []
if delete:
for i in delete:
cmd += ["sed 's/%s//g' | grep -v '^$'" % i]
if ignoreTime:
cmd += ["sed 's/[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]\.[0-9][0-9]\{0,6\}/xxxxxxxxxx.xxxxxx/g'"]
if ignoreSessionID:
# A session is either "%1" or "%my-peer-description-1"
cmd += ["sed 's/%\([^ ]*-\)\{0,1\}[0-9][0-9]*/%XXX/g'"]
if sort:
cmd += ["LC_ALL=c sort"]
if not cmd:
return
tmp = file + ".tmp"
cmd = "cat %s | %s >%s" % (file, " | ".join(cmd), tmp)
debug("Canonicalizing '%s'" % cmd)
os.system(cmd)
os.system("mv %s %s" % (tmp, file))
# Diffs the two files, If mismatch, prints "FAILED" and returns true.
def diff(file1, file2):
quiet = ">/dev/null"
if Options.showdiff:
quiet = ""
for f in (file1, file2):
if not os.path.exists(f):
print "FAILED (%s does not exist)" % f
return False
diff = "diff -u %s %s %s" % (file1, file2, quiet)
debug("Executing '%s'" % diff)
result = os.system(diff)
if os.WEXITSTATUS(result) != 0:
print "FAILED"
return False
return True
# Compares files of process against base version. Returns false if mismatch found.
def checkFiles(tag, files, ignoreTime, sort, delete):
base = os.path.join(Base, tag)
work = workDir(tag)
print " Checking %s..." % tag,
failed = False
for file in files:
oldfile = os.path.join(base, file)
newfile = os.path.join(work, file)
canonicalizeFile(newfile, ignoreTime, False, sort, delete)
if not diff(oldfile, newfile):
failed = True
break
if not failed:
print "ok"
else:
Failed = failed
# Compares files of two processes. Return false if mismatch found.
def compareFiles(tag1, tag2, files, ignoreTime=False, ignoreSessionID=False, sort=False, delete=None):
work1 = workDir(tag1)
work2 = workDir(tag2)
print " Comparing %s with %s..." % (tag1, tag2),
failed = False
for file in files:
file1 = os.path.join(work1, file)
file2 = os.path.join(work2, file)
canonicalizeFile(file1, ignoreTime, ignoreSessionID, sort, delete)
canonicalizeFile(file2, ignoreTime, ignoreSessionID, sort, delete)
if not diff(file1, file2):
failed = True
break
if not failed:
print "ok"
else:
Failed = failed
# Make the result of process new baseline.
def makeNewBase(tag, files, ignoreTime, sort, delete):
try:
os.mkdir(Base)
except OSError, e:
if e.errno != errno.EEXIST:
raise
base = os.path.join(Base, tag)
work = workDir(tag)
print " Copying files for %s..." % tag
try:
os.mkdir(base)
except OSError, e:
if e.errno != errno.EEXIST:
raise
# Delete all files but those belonging to CVS.
os.system("find %s -type f -not -path '*/CVS/*' -not -path '*/.svn/*' -exec rm '{}' ';'" % base)
for file in files:
oldfile = os.path.join(work, file)
newfile = os.path.join(base, file)
os.system("cp %s %s" % (oldfile, newfile))
canonicalizeFile(newfile, ignoreTime, False, sort, delete)
def testSet(set):
if Options.set and set != Options.set:
return False
print "Running set '%s' ..." % set
return True
# Either check given files or make it new baseline, depending on options.
def finishTest(tag, files, ignoreTime=False, sort=False, delete=None):
if Options.newbase:
makeNewBase(tag, files, ignoreTime, sort, delete)
else:
checkFiles(tag, files, ignoreTime, sort, delete)

BIN
testing/istate/traces/empty.trace
View file

Binary file not shown.

BIN
testing/istate/traces/web.trace
View file

Binary file not shown.