Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-14 20:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge branch 'master' into topic/vern/reaching-defs

Browse source
This commit is contained in:
Jon Siwek 2021-02-01 17:27:37 -08:00
commit cfe29c2488
420 changed files with 733 additions and 5894 deletions
Download patch file Download diff file Expand all files Collapse all files

4
testing/btest/scripts/base/frameworks/input/invalidnumbers.zeek
View file

@ -4,6 +4,8 @@
# @TEST-EXEC: sed 1d .stderr > .stderrwithoutfirstline
# @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-remove-abspath btest-diff .stderrwithoutfirstline
# Note the tab+space separator in the last line of the following is
# intentional. It verifies our whitespace handling.
@TEST-START-FILE input.log
#separator \x09
#fields i c
@ -11,7 +13,7 @@
12129223372036854775800 121218446744073709551612
9223372036854775801TEXTHERE 1Justtext
Justtext 1
9223372036854775800 -18446744073709551612
9223372036854775800 -18446744073709551612
@TEST-END-FILE
redef exit_only_after_terminate = T;

1
testing/btest/scripts/base/frameworks/input/port-embedded.zeek
View file

@ -9,6 +9,7 @@
1.2.3.5 52/udp
1.2.3.6 30/unknown
1.2.3.7 50/trash
1.2.3.8 -1/tcp
@TEST-END-FILE
redef exit_only_after_terminate = T;

18
testing/btest/scripts/base/frameworks/logging/pred.zeek
View file

@ -14,26 +14,32 @@ export {
type Log: record {
t: time;
id: conn_id; # Will be rolled out into individual columns.
status: string &optional;
status: string;
country: string &default="unknown";
} &log;
}
function fail(rec: Log): bool
hook success(rec: Log, id: Log::ID, filter: Log::Filter)
{
return rec$status != "success";
if ( rec$status != "success" )
break;
}
hook fail(rec: Log, id: Log::ID, filter: Log::Filter)
{
if ( rec$status == "success" )
break;
}
event zeek_init()
{
Log::create_stream(Test::LOG, [$columns=Log]);
Log::remove_default_filter(Test::LOG);
Log::add_filter(Test::LOG, [$name="f1", $path="test.success", $pred=function(rec: Log): bool { return rec$status == "success"; }]);
Log::add_filter(Test::LOG, [$name="f2", $path="test.failure", $pred=fail]);
Log::add_filter(Test::LOG, [$name="f1", $path="test.success", $policy=success]);
Log::add_filter(Test::LOG, [$name="f2", $path="test.failure", $policy=fail]);
local cid = [$orig_h=1.2.3.4, $orig_p=1234/tcp, $resp_h=2.3.4.5, $resp_p=80/tcp];
local r: Log = [$t=network_time(), $id=cid, $status="success"];
Log::write(Test::LOG, r);
Log::write(Test::LOG, [$t=network_time(), $id=cid, $status="failure", $country="US"]);
}

10
testing/btest/scripts/base/frameworks/logging/remove.zeek
View file

@ -15,15 +15,21 @@ export {
type Log: record {
t: time;
id: conn_id; # Will be rolled out into individual columns.
status: string &optional;
status: string;
country: string &default="unknown";
} &log;
}
hook fail_only(rec: Log, id: Log::ID, filter: Log::Filter)
{
if ( rec$status != "failure" )
break;
}
event zeek_init()
{
Log::create_stream(SSH::LOG, [$columns=Log]);
Log::add_filter(SSH::LOG, [$name="f1", $path="ssh.failure", $pred=function(rec: Log): bool { return rec$status == "failure"; }]);
Log::add_filter(SSH::LOG, [$name="f1", $path="ssh.failure", $policy=fail_only]);
local cid = [$orig_h=1.2.3.4, $orig_p=1234/tcp, $resp_h=2.3.4.5, $resp_p=80/tcp];

2
testing/btest/scripts/base/protocols/icmp/dnssl.zeek
View file

@ -3,7 +3,7 @@
@load base/protocols/conn
event icmp_router_advertisement(c: connection, icmp: icmp_conn, cur_hop_limit: count, managed: bool, other: bool, home_agent: bool,
event icmp_router_advertisement(c: connection, icmp: icmp_info, cur_hop_limit: count, managed: bool, other: bool, home_agent: bool,
pref: count, proxy: bool, rsv: count, router_lifetime: interval, reachable_time: interval,
retrans_timer: interval, options: icmp6_nd_options ){
for (i in options){