Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Adapt zeek-aux btests to zeek structure

Browse source 
This updates Baselines, changes paths to scripts and log files, adds TEST-DOC
annotations, and various other cleanups that make the zeek-aux tests more like
the rest of the zeek tests.
This commit is contained in:
Tim Wojtulewicz 2025-08-11 10:17:05 -07:00
parent 7887451a66
commit d7ba381d12
61 changed files with 311 additions and 326 deletions
Download patch file Download diff file Expand all files Collapse all files

3
.pre-commit-config.yaml
View file

@ -26,7 +26,7 @@ repos:
- "c" - "c"
- "c++" - "c++"
- "json" - "json"
exclude: '^(auxil/zeek-aux/plugin-support/skeleton/src/Plugin.*)' exclude: '^(auxil/zeek-aux/plugin-support/skeleton/src/Plugin.*|testing/btest/Baseline/zeek-aux.update-changes.replace-version-in-c-header/header.h)'
- repo: https://github.com/maxwinterstein/shfmt-py - repo: https://github.com/maxwinterstein/shfmt-py
rev: v3.12.0.1 rev: v3.12.0.1
@ -40,6 +40,7 @@ repos:
- id: ruff-check - id: ruff-check
args: ["--fix"] args: ["--fix"]
- id: ruff-format - id: ruff-format
exclude: '^(testing/btest/Baseline/zeek-aux.update-changes.replace-version-in-.*/.*)$'
- repo: https://github.com/cheshirekow/cmake-format-precommit - repo: https://github.com/cheshirekow/cmake-format-precommit
rev: v0.6.13 rev: v0.6.13

10
testing/btest/Baseline/zeek-aux.zeek-cut.time-conversion/both-2
View file

@ -1,6 +1,6 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. ### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
2012-02-21T08:52:55-0800 CjhGID4nQcgTWjvg4c 141.142.220.235 37604 199.233.217.249 56666 tcp ftp-data 0.112432 0 342 SF - 0 ShAdfFa 4 216 4 562 (empty) 2012-02-21T16:52:55+0000 CjhGID4nQcgTWjvg4c 141.142.220.235 37604 199.233.217.249 56666 tcp ftp-data 0.112432 0 342 SF - 0 ShAdfFa 4 216 4 562 (empty)
2012-02-21T08:52:59-0800 CCvvfg3TEfuqmmG4bh 141.142.220.235 59378 199.233.217.249 56667 tcp ftp-data 0.111218 0 77 SF - 0 ShAdfFa 4 216 4 297 (empty) 2012-02-21T16:52:59+0000 CCvvfg3TEfuqmmG4bh 141.142.220.235 59378 199.233.217.249 56667 tcp ftp-data 0.111218 0 77 SF - 0 ShAdfFa 4 216 4 297 (empty)
2012-02-21T08:53:14-0800 CsRx2w45OKnoww6xl4 199.233.217.249 61920 141.142.220.235 33582 tcp ftp-data 0.056211 342 0 SF - 0 ShADaFf 5 614 3 164 (empty) 2012-02-21T16:53:14+0000 CsRx2w45OKnoww6xl4 199.233.217.249 61920 141.142.220.235 33582 tcp ftp-data 0.056211 342 0 SF - 0 ShADaFf 5 614 3 164 (empty)
2012-02-21T08:53:17-0800 CRJuHdVW0XPVINV8a 199.233.217.249 61918 141.142.220.235 37835 tcp ftp-data 0.056005 77 0 SF - 0 ShADaFf 5 349 3 164 (empty) 2012-02-21T16:53:17+0000 CRJuHdVW0XPVINV8a 199.233.217.249 61918 141.142.220.235 37835 tcp ftp-data 0.056005 77 0 SF - 0 ShADaFf 5 349 3 164 (empty)
2012-02-21T08:52:41-0800 CXWv6p3arKYeMETxOg 141.142.220.235 50003 199.233.217.249 21 tcp ftp 38.055625 180 3146 SF - 0 ShAdDfFa 38 2164 25 4458 (empty) 2012-02-21T16:52:41+0000 CXWv6p3arKYeMETxOg 141.142.220.235 50003 199.233.217.249 21 tcp ftp 38.055625 180 3146 SF - 0 ShAdDfFa 38 2164 25 4458 (empty)

20
testing/btest/Baseline/zeek-aux.zeek-cut.time-conversion/different-col-order
View file

@ -1,11 +1,11 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. ### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
2012-02-21T08:52:55-0800 CjhGID4nQcgTWjvg4c 141.142.220.235 37604 199.233.217.249 56666 tcp ftp-data 0.112432 0 342 SF - 0 ShAdfFa 4 216 4 562 (empty) 2012-02-21T16:52:55+0000 CjhGID4nQcgTWjvg4c 141.142.220.235 37604 199.233.217.249 56666 tcp ftp-data 0.112432 0 342 SF - 0 ShAdfFa 4 216 4 562 (empty)
2012-02-21T08:52:59-0800 CCvvfg3TEfuqmmG4bh 141.142.220.235 59378 199.233.217.249 56667 tcp ftp-data 0.111218 0 77 SF - 0 ShAdfFa 4 216 4 297 (empty) 2012-02-21T16:52:59+0000 CCvvfg3TEfuqmmG4bh 141.142.220.235 59378 199.233.217.249 56667 tcp ftp-data 0.111218 0 77 SF - 0 ShAdfFa 4 216 4 297 (empty)
2012-02-21T08:53:14-0800 CsRx2w45OKnoww6xl4 199.233.217.249 61920 141.142.220.235 33582 tcp ftp-data 0.056211 342 0 SF - 0 ShADaFf 5 614 3 164 (empty) 2012-02-21T16:53:14+0000 CsRx2w45OKnoww6xl4 199.233.217.249 61920 141.142.220.235 33582 tcp ftp-data 0.056211 342 0 SF - 0 ShADaFf 5 614 3 164 (empty)
2012-02-21T08:53:17-0800 CRJuHdVW0XPVINV8a 199.233.217.249 61918 141.142.220.235 37835 tcp ftp-data 0.056005 77 0 SF - 0 ShADaFf 5 349 3 164 (empty) 2012-02-21T16:53:17+0000 CRJuHdVW0XPVINV8a 199.233.217.249 61918 141.142.220.235 37835 tcp ftp-data 0.056005 77 0 SF - 0 ShADaFf 5 349 3 164 (empty)
2012-02-21T08:52:41-0800 CXWv6p3arKYeMETxOg 141.142.220.235 50003 199.233.217.249 21 tcp ftp 38.055625 180 3146 SF - 0 ShAdDfFa 38 2164 25 4458 (empty) 2012-02-21T16:52:41+0000 CXWv6p3arKYeMETxOg 141.142.220.235 50003 199.233.217.249 21 tcp ftp 38.055625 180 3146 SF - 0 ShAdDfFa 38 2164 25 4458 (empty)
CjhGID4nQcgTWjvg4c 141.142.220.235 37604 199.233.217.249 56666 tcp ftp-data 0.112432 0 342 SF - 0 ShAdfFa 4 216 4 562 (empty) 2012-02-21T08:52:55-0800 CjhGID4nQcgTWjvg4c 141.142.220.235 37604 199.233.217.249 56666 tcp ftp-data 0.112432 0 342 SF - 0 ShAdfFa 4 216 4 562 (empty) 2012-02-21T16:52:55+0000
CCvvfg3TEfuqmmG4bh 141.142.220.235 59378 199.233.217.249 56667 tcp ftp-data 0.111218 0 77 SF - 0 ShAdfFa 4 216 4 297 (empty) 2012-02-21T08:52:59-0800 CCvvfg3TEfuqmmG4bh 141.142.220.235 59378 199.233.217.249 56667 tcp ftp-data 0.111218 0 77 SF - 0 ShAdfFa 4 216 4 297 (empty) 2012-02-21T16:52:59+0000
CsRx2w45OKnoww6xl4 199.233.217.249 61920 141.142.220.235 33582 tcp ftp-data 0.056211 342 0 SF - 0 ShADaFf 5 614 3 164 (empty) 2012-02-21T08:53:14-0800 CsRx2w45OKnoww6xl4 199.233.217.249 61920 141.142.220.235 33582 tcp ftp-data 0.056211 342 0 SF - 0 ShADaFf 5 614 3 164 (empty) 2012-02-21T16:53:14+0000
CRJuHdVW0XPVINV8a 199.233.217.249 61918 141.142.220.235 37835 tcp ftp-data 0.056005 77 0 SF - 0 ShADaFf 5 349 3 164 (empty) 2012-02-21T08:53:17-0800 CRJuHdVW0XPVINV8a 199.233.217.249 61918 141.142.220.235 37835 tcp ftp-data 0.056005 77 0 SF - 0 ShADaFf 5 349 3 164 (empty) 2012-02-21T16:53:17+0000
CXWv6p3arKYeMETxOg 141.142.220.235 50003 199.233.217.249 21 tcp ftp 38.055625 180 3146 SF - 0 ShAdDfFa 38 2164 25 4458 (empty) 2012-02-21T08:52:41-0800 CXWv6p3arKYeMETxOg 141.142.220.235 50003 199.233.217.249 21 tcp ftp 38.055625 180 3146 SF - 0 ShAdDfFa 38 2164 25 4458 (empty) 2012-02-21T16:52:41+0000

10
testing/btest/Baseline/zeek-aux.zeek-cut.time-conversion/local
View file

@ -1,6 +1,6 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. ### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
2012-02-21T08:52:55-0800 CjhGID4nQcgTWjvg4c 141.142.220.235 37604 199.233.217.249 56666 tcp ftp-data 0.112432 0 342 SF - 0 ShAdfFa 4 216 4 562 (empty) 2012-02-21T16:52:55+0000 CjhGID4nQcgTWjvg4c 141.142.220.235 37604 199.233.217.249 56666 tcp ftp-data 0.112432 0 342 SF - 0 ShAdfFa 4 216 4 562 (empty)
2012-02-21T08:52:59-0800 CCvvfg3TEfuqmmG4bh 141.142.220.235 59378 199.233.217.249 56667 tcp ftp-data 0.111218 0 77 SF - 0 ShAdfFa 4 216 4 297 (empty) 2012-02-21T16:52:59+0000 CCvvfg3TEfuqmmG4bh 141.142.220.235 59378 199.233.217.249 56667 tcp ftp-data 0.111218 0 77 SF - 0 ShAdfFa 4 216 4 297 (empty)
2012-02-21T08:53:14-0800 CsRx2w45OKnoww6xl4 199.233.217.249 61920 141.142.220.235 33582 tcp ftp-data 0.056211 342 0 SF - 0 ShADaFf 5 614 3 164 (empty) 2012-02-21T16:53:14+0000 CsRx2w45OKnoww6xl4 199.233.217.249 61920 141.142.220.235 33582 tcp ftp-data 0.056211 342 0 SF - 0 ShADaFf 5 614 3 164 (empty)
2012-02-21T08:53:17-0800 CRJuHdVW0XPVINV8a 199.233.217.249 61918 141.142.220.235 37835 tcp ftp-data 0.056005 77 0 SF - 0 ShADaFf 5 349 3 164 (empty) 2012-02-21T16:53:17+0000 CRJuHdVW0XPVINV8a 199.233.217.249 61918 141.142.220.235 37835 tcp ftp-data 0.056005 77 0 SF - 0 ShADaFf 5 349 3 164 (empty)
2012-02-21T08:52:41-0800 CXWv6p3arKYeMETxOg 141.142.220.235 50003 199.233.217.249 21 tcp ftp 38.055625 180 3146 SF - 0 ShAdDfFa 38 2164 25 4458 (empty) 2012-02-21T16:52:41+0000 CXWv6p3arKYeMETxOg 141.142.220.235 50003 199.233.217.249 21 tcp ftp 38.055625 180 3146 SF - 0 ShAdDfFa 38 2164 25 4458 (empty)

8
testing/btest/Baseline/zeek-aux.zeek-cut.time-conversion/multiple-times
View file

@ -1,5 +1,5 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. ### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
2012-02-21T08:52:55-0800 tcp 2012-02-21T08:53:05-0800 2012-02-21T16:52:55+0000 tcp 2012-02-21T16:53:05+0000
2012-02-21T08:52:59-0800 udp 2012-02-21T08:52:59-0800 2012-02-21T16:52:59+0000 udp 2012-02-21T16:52:59+0000
2012-02-21T08:53:14-0800 tcp 2012-02-21T08:53:24-0800 2012-02-21T16:53:14+0000 tcp 2012-02-21T16:53:24+0000
2012-02-21T08:53:24-0800 tcp 2012-02-21T08:54:15-0800 2012-02-21T16:53:24+0000 tcp 2012-02-21T16:54:15+0000

10
testing/btest/Baseline/zeek-aux.zeek-cut.time-conversion/time-last-col
View file

@ -1,6 +1,6 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. ### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
CjhGID4nQcgTWjvg4c 141.142.220.235 37604 199.233.217.249 56666 tcp ftp-data 0.112432 0 342 SF - 0 ShAdfFa 4 216 4 562 (empty) 2012-02-21T08:52:55-0800 CjhGID4nQcgTWjvg4c 141.142.220.235 37604 199.233.217.249 56666 tcp ftp-data 0.112432 0 342 SF - 0 ShAdfFa 4 216 4 562 (empty) 2012-02-21T16:52:55+0000
CCvvfg3TEfuqmmG4bh 141.142.220.235 59378 199.233.217.249 56667 tcp ftp-data 0.111218 0 77 SF - 0 ShAdfFa 4 216 4 297 (empty) 2012-02-21T08:52:59-0800 CCvvfg3TEfuqmmG4bh 141.142.220.235 59378 199.233.217.249 56667 tcp ftp-data 0.111218 0 77 SF - 0 ShAdfFa 4 216 4 297 (empty) 2012-02-21T16:52:59+0000
CsRx2w45OKnoww6xl4 199.233.217.249 61920 141.142.220.235 33582 tcp ftp-data 0.056211 342 0 SF - 0 ShADaFf 5 614 3 164 (empty) 2012-02-21T08:53:14-0800 CsRx2w45OKnoww6xl4 199.233.217.249 61920 141.142.220.235 33582 tcp ftp-data 0.056211 342 0 SF - 0 ShADaFf 5 614 3 164 (empty) 2012-02-21T16:53:14+0000
CRJuHdVW0XPVINV8a 199.233.217.249 61918 141.142.220.235 37835 tcp ftp-data 0.056005 77 0 SF - 0 ShADaFf 5 349 3 164 (empty) 2012-02-21T08:53:17-0800 CRJuHdVW0XPVINV8a 199.233.217.249 61918 141.142.220.235 37835 tcp ftp-data 0.056005 77 0 SF - 0 ShADaFf 5 349 3 164 (empty) 2012-02-21T16:53:17+0000
CXWv6p3arKYeMETxOg 141.142.220.235 50003 199.233.217.249 21 tcp ftp 38.055625 180 3146 SF - 0 ShAdDfFa 38 2164 25 4458 (empty) 2012-02-21T08:52:41-0800 CXWv6p3arKYeMETxOg 141.142.220.235 50003 199.233.217.249 21 tcp ftp 38.055625 180 3146 SF - 0 ShAdDfFa 38 2164 25 4458 (empty) 2012-02-21T16:52:41+0000

10
testing/btest/Baseline/zeek-aux.zeek-cut.time-fmt-env/env-local
View file

@ -1,6 +1,6 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. ### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
0852_120221 CjhGID4nQcgTWjvg4c 141.142.220.235 37604 199.233.217.249 56666 tcp ftp-data 0.112432 0 342 SF - 0 ShAdfFa 4 216 4 562 (empty) 1652_120221 CjhGID4nQcgTWjvg4c 141.142.220.235 37604 199.233.217.249 56666 tcp ftp-data 0.112432 0 342 SF - 0 ShAdfFa 4 216 4 562 (empty)
0852_120221 CCvvfg3TEfuqmmG4bh 141.142.220.235 59378 199.233.217.249 56667 tcp ftp-data 0.111218 0 77 SF - 0 ShAdfFa 4 216 4 297 (empty) 1652_120221 CCvvfg3TEfuqmmG4bh 141.142.220.235 59378 199.233.217.249 56667 tcp ftp-data 0.111218 0 77 SF - 0 ShAdfFa 4 216 4 297 (empty)
0853_120221 CsRx2w45OKnoww6xl4 199.233.217.249 61920 141.142.220.235 33582 tcp ftp-data 0.056211 342 0 SF - 0 ShADaFf 5 614 3 164 (empty) 1653_120221 CsRx2w45OKnoww6xl4 199.233.217.249 61920 141.142.220.235 33582 tcp ftp-data 0.056211 342 0 SF - 0 ShADaFf 5 614 3 164 (empty)
0853_120221 CRJuHdVW0XPVINV8a 199.233.217.249 61918 141.142.220.235 37835 tcp ftp-data 0.056005 77 0 SF - 0 ShADaFf 5 349 3 164 (empty) 1653_120221 CRJuHdVW0XPVINV8a 199.233.217.249 61918 141.142.220.235 37835 tcp ftp-data 0.056005 77 0 SF - 0 ShADaFf 5 349 3 164 (empty)
0852_120221 CXWv6p3arKYeMETxOg 141.142.220.235 50003 199.233.217.249 21 tcp ftp 38.055625 180 3146 SF - 0 ShAdDfFa 38 2164 25 4458 (empty) 1652_120221 CXWv6p3arKYeMETxOg 141.142.220.235 50003 199.233.217.249 21 tcp ftp 38.055625 180 3146 SF - 0 ShAdDfFa 38 2164 25 4458 (empty)

10
testing/btest/Baseline/zeek-aux.zeek-cut.time-fmt-env/env-local-fmt
View file

@ -1,6 +1,6 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. ### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
08 52 12 02 21 CjhGID4nQcgTWjvg4c 141.142.220.235 37604 199.233.217.249 56666 tcp ftp-data 0.112432 0 342 SF - 0 ShAdfFa 4 216 4 562 (empty) 16 52 12 02 21 CjhGID4nQcgTWjvg4c 141.142.220.235 37604 199.233.217.249 56666 tcp ftp-data 0.112432 0 342 SF - 0 ShAdfFa 4 216 4 562 (empty)
08 52 12 02 21 CCvvfg3TEfuqmmG4bh 141.142.220.235 59378 199.233.217.249 56667 tcp ftp-data 0.111218 0 77 SF - 0 ShAdfFa 4 216 4 297 (empty) 16 52 12 02 21 CCvvfg3TEfuqmmG4bh 141.142.220.235 59378 199.233.217.249 56667 tcp ftp-data 0.111218 0 77 SF - 0 ShAdfFa 4 216 4 297 (empty)
08 53 12 02 21 CsRx2w45OKnoww6xl4 199.233.217.249 61920 141.142.220.235 33582 tcp ftp-data 0.056211 342 0 SF - 0 ShADaFf 5 614 3 164 (empty) 16 53 12 02 21 CsRx2w45OKnoww6xl4 199.233.217.249 61920 141.142.220.235 33582 tcp ftp-data 0.056211 342 0 SF - 0 ShADaFf 5 614 3 164 (empty)
08 53 12 02 21 CRJuHdVW0XPVINV8a 199.233.217.249 61918 141.142.220.235 37835 tcp ftp-data 0.056005 77 0 SF - 0 ShADaFf 5 349 3 164 (empty) 16 53 12 02 21 CRJuHdVW0XPVINV8a 199.233.217.249 61918 141.142.220.235 37835 tcp ftp-data 0.056005 77 0 SF - 0 ShADaFf 5 349 3 164 (empty)
08 52 12 02 21 CXWv6p3arKYeMETxOg 141.142.220.235 50003 199.233.217.249 21 tcp ftp 38.055625 180 3146 SF - 0 ShAdDfFa 38 2164 25 4458 (empty) 16 52 12 02 21 CXWv6p3arKYeMETxOg 141.142.220.235 50003 199.233.217.249 21 tcp ftp 38.055625 180 3146 SF - 0 ShAdDfFa 38 2164 25 4458 (empty)

10
testing/btest/Baseline/zeek-aux.zeek-cut.time-fmt/local-fmt
View file

@ -1,6 +1,6 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. ### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
08 52 12 02 21 CjhGID4nQcgTWjvg4c 141.142.220.235 37604 199.233.217.249 56666 tcp ftp-data 0.112432 0 342 SF - 0 ShAdfFa 4 216 4 562 (empty) 16 52 12 02 21 CjhGID4nQcgTWjvg4c 141.142.220.235 37604 199.233.217.249 56666 tcp ftp-data 0.112432 0 342 SF - 0 ShAdfFa 4 216 4 562 (empty)
08 52 12 02 21 CCvvfg3TEfuqmmG4bh 141.142.220.235 59378 199.233.217.249 56667 tcp ftp-data 0.111218 0 77 SF - 0 ShAdfFa 4 216 4 297 (empty) 16 52 12 02 21 CCvvfg3TEfuqmmG4bh 141.142.220.235 59378 199.233.217.249 56667 tcp ftp-data 0.111218 0 77 SF - 0 ShAdfFa 4 216 4 297 (empty)
08 53 12 02 21 CsRx2w45OKnoww6xl4 199.233.217.249 61920 141.142.220.235 33582 tcp ftp-data 0.056211 342 0 SF - 0 ShADaFf 5 614 3 164 (empty) 16 53 12 02 21 CsRx2w45OKnoww6xl4 199.233.217.249 61920 141.142.220.235 33582 tcp ftp-data 0.056211 342 0 SF - 0 ShADaFf 5 614 3 164 (empty)
08 53 12 02 21 CRJuHdVW0XPVINV8a 199.233.217.249 61918 141.142.220.235 37835 tcp ftp-data 0.056005 77 0 SF - 0 ShADaFf 5 349 3 164 (empty) 16 53 12 02 21 CRJuHdVW0XPVINV8a 199.233.217.249 61918 141.142.220.235 37835 tcp ftp-data 0.056005 77 0 SF - 0 ShADaFf 5 349 3 164 (empty)
08 52 12 02 21 CXWv6p3arKYeMETxOg 141.142.220.235 50003 199.233.217.249 21 tcp ftp 38.055625 180 3146 SF - 0 ShAdDfFa 38 2164 25 4458 (empty) 16 52 12 02 21 CXWv6p3arKYeMETxOg 141.142.220.235 50003 199.233.217.249 21 tcp ftp 38.055625 180 3146 SF - 0 ShAdDfFa 38 2164 25 4458 (empty)

10
testing/btest/Baseline/zeek-aux.zeek-cut.time-fmt/utc-fmt-local
View file

@ -1,6 +1,6 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. ### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
08 52 12 02 21 CjhGID4nQcgTWjvg4c 141.142.220.235 37604 199.233.217.249 56666 tcp ftp-data 0.112432 0 342 SF - 0 ShAdfFa 4 216 4 562 (empty) 16 52 12 02 21 CjhGID4nQcgTWjvg4c 141.142.220.235 37604 199.233.217.249 56666 tcp ftp-data 0.112432 0 342 SF - 0 ShAdfFa 4 216 4 562 (empty)
08 52 12 02 21 CCvvfg3TEfuqmmG4bh 141.142.220.235 59378 199.233.217.249 56667 tcp ftp-data 0.111218 0 77 SF - 0 ShAdfFa 4 216 4 297 (empty) 16 52 12 02 21 CCvvfg3TEfuqmmG4bh 141.142.220.235 59378 199.233.217.249 56667 tcp ftp-data 0.111218 0 77 SF - 0 ShAdfFa 4 216 4 297 (empty)
08 53 12 02 21 CsRx2w45OKnoww6xl4 199.233.217.249 61920 141.142.220.235 33582 tcp ftp-data 0.056211 342 0 SF - 0 ShADaFf 5 614 3 164 (empty) 16 53 12 02 21 CsRx2w45OKnoww6xl4 199.233.217.249 61920 141.142.220.235 33582 tcp ftp-data 0.056211 342 0 SF - 0 ShADaFf 5 614 3 164 (empty)
08 53 12 02 21 CRJuHdVW0XPVINV8a 199.233.217.249 61918 141.142.220.235 37835 tcp ftp-data 0.056005 77 0 SF - 0 ShADaFf 5 349 3 164 (empty) 16 53 12 02 21 CRJuHdVW0XPVINV8a 199.233.217.249 61918 141.142.220.235 37835 tcp ftp-data 0.056005 77 0 SF - 0 ShADaFf 5 349 3 164 (empty)
08 52 12 02 21 CXWv6p3arKYeMETxOg 141.142.220.235 50003 199.233.217.249 21 tcp ftp 38.055625 180 3146 SF - 0 ShAdDfFa 38 2164 25 4458 (empty) 16 52 12 02 21 CXWv6p3arKYeMETxOg 141.142.220.235 50003 199.233.217.249 21 tcp ftp 38.055625 180 3146 SF - 0 ShAdDfFa 38 2164 25 4458 (empty)

10
testing/btest/Baseline/zeek-aux.zeek-cut.time-fmt/utc-local-fmt
View file

@ -1,6 +1,6 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. ### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
08 52 12 02 21 CjhGID4nQcgTWjvg4c 141.142.220.235 37604 199.233.217.249 56666 tcp ftp-data 0.112432 0 342 SF - 0 ShAdfFa 4 216 4 562 (empty) 16 52 12 02 21 CjhGID4nQcgTWjvg4c 141.142.220.235 37604 199.233.217.249 56666 tcp ftp-data 0.112432 0 342 SF - 0 ShAdfFa 4 216 4 562 (empty)
08 52 12 02 21 CCvvfg3TEfuqmmG4bh 141.142.220.235 59378 199.233.217.249 56667 tcp ftp-data 0.111218 0 77 SF - 0 ShAdfFa 4 216 4 297 (empty) 16 52 12 02 21 CCvvfg3TEfuqmmG4bh 141.142.220.235 59378 199.233.217.249 56667 tcp ftp-data 0.111218 0 77 SF - 0 ShAdfFa 4 216 4 297 (empty)
08 53 12 02 21 CsRx2w45OKnoww6xl4 199.233.217.249 61920 141.142.220.235 33582 tcp ftp-data 0.056211 342 0 SF - 0 ShADaFf 5 614 3 164 (empty) 16 53 12 02 21 CsRx2w45OKnoww6xl4 199.233.217.249 61920 141.142.220.235 33582 tcp ftp-data 0.056211 342 0 SF - 0 ShADaFf 5 614 3 164 (empty)
08 53 12 02 21 CRJuHdVW0XPVINV8a 199.233.217.249 61918 141.142.220.235 37835 tcp ftp-data 0.056005 77 0 SF - 0 ShADaFf 5 349 3 164 (empty) 16 53 12 02 21 CRJuHdVW0XPVINV8a 199.233.217.249 61918 141.142.220.235 37835 tcp ftp-data 0.056005 77 0 SF - 0 ShADaFf 5 349 3 164 (empty)
08 52 12 02 21 CXWv6p3arKYeMETxOg 141.142.220.235 50003 199.233.217.249 21 tcp ftp 38.055625 180 3146 SF - 0 ShAdDfFa 38 2164 25 4458 (empty) 16 52 12 02 21 CXWv6p3arKYeMETxOg 141.142.220.235 50003 199.233.217.249 21 tcp ftp 38.055625 180 3146 SF - 0 ShAdDfFa 38 2164 25 4458 (empty)

20
testing/btest/Baseline/zeek-aux.zeek-cut.time-header/different-col-order
View file

@ -7,11 +7,11 @@
#open 2014-04-01-23-15-49 #open 2014-04-01-23-15-49
#fields proto ts id.orig_h #fields proto ts id.orig_h
#types enum string addr #types enum string addr
tcp 2012-02-21T08:52:55-0800 141.142.220.235 tcp 2012-02-21T16:52:55+0000 141.142.220.235
tcp 2012-02-21T08:52:59-0800 141.142.220.235 tcp 2012-02-21T16:52:59+0000 141.142.220.235
tcp 2012-02-21T08:53:14-0800 199.233.217.249 tcp 2012-02-21T16:53:14+0000 199.233.217.249
tcp 2012-02-21T08:53:17-0800 199.233.217.249 tcp 2012-02-21T16:53:17+0000 199.233.217.249
tcp 2012-02-21T08:52:41-0800 141.142.220.235 tcp 2012-02-21T16:52:41+0000 141.142.220.235
#close 2014-04-01-23-15-49 #close 2014-04-01-23-15-49
#separator \x09 #separator \x09
#set_separator , #set_separator ,
@ -21,9 +21,9 @@ tcp 2012-02-21T08:52:41-0800 141.142.220.235
#open 2014-04-01-23-15-49 #open 2014-04-01-23-15-49
#fields proto ts id.orig_h #fields proto ts id.orig_h
#types enum string addr #types enum string addr
tcp 2012-02-21T08:52:55-0800 141.142.220.235 tcp 2012-02-21T16:52:55+0000 141.142.220.235
tcp 2012-02-21T08:52:59-0800 141.142.220.235 tcp 2012-02-21T16:52:59+0000 141.142.220.235
tcp 2012-02-21T08:53:14-0800 199.233.217.249 tcp 2012-02-21T16:53:14+0000 199.233.217.249
tcp 2012-02-21T08:53:17-0800 199.233.217.249 tcp 2012-02-21T16:53:17+0000 199.233.217.249
tcp 2012-02-21T08:52:41-0800 141.142.220.235 tcp 2012-02-21T16:52:41+0000 141.142.220.235
#close 2014-04-01-23-15-49 #close 2014-04-01-23-15-49

20
testing/btest/Baseline/zeek-aux.zeek-cut.time-header/different-field-separator
View file

@ -7,11 +7,11 @@
#open 2014-04-01-23-15-49 #open 2014-04-01-23-15-49
#fields proto ts id.orig_h #fields proto ts id.orig_h
#types enum string addr #types enum string addr
tcp 2012-02-21T08:52:55-0800 141.142.220.235 tcp 2012-02-21T16:52:55+0000 141.142.220.235
tcp 2012-02-21T08:52:59-0800 141.142.220.235 tcp 2012-02-21T16:52:59+0000 141.142.220.235
tcp 2012-02-21T08:53:14-0800 199.233.217.249 tcp 2012-02-21T16:53:14+0000 199.233.217.249
tcp 2012-02-21T08:53:17-0800 199.233.217.249 tcp 2012-02-21T16:53:17+0000 199.233.217.249
tcp 2012-02-21T08:52:41-0800 141.142.220.235 tcp 2012-02-21T16:52:41+0000 141.142.220.235
#close 2014-04-01-23-15-49 #close 2014-04-01-23-15-49
#separator , #separator ,
#set_separator,, #set_separator,,
@ -21,9 +21,9 @@ tcp 2012-02-21T08:52:41-0800 141.142.220.235
#open,2014-06-30-16-10-54 #open,2014-06-30-16-10-54
#fields,proto,ts,id.orig_h #fields,proto,ts,id.orig_h
#types,enum,string,addr #types,enum,string,addr
tcp,2012-02-21T08:52:55-0800,141.142.220.235 tcp,2012-02-21T16:52:55+0000,141.142.220.235
tcp,2012-02-21T08:52:59-0800,141.142.220.235 tcp,2012-02-21T16:52:59+0000,141.142.220.235
tcp,2012-02-21T08:53:14-0800,199.233.217.249 tcp,2012-02-21T16:53:14+0000,199.233.217.249
tcp,2012-02-21T08:52:41-0800,141.142.220.235 tcp,2012-02-21T16:52:41+0000,141.142.220.235
tcp,2012-02-21T08:53:17-0800,199.233.217.249 tcp,2012-02-21T16:53:17+0000,199.233.217.249
#close,2014-06-30-16-10-55 #close,2014-06-30-16-10-55

10
testing/btest/Baseline/zeek-aux.zeek-cut.time-header/missing-ts-one-file
View file

@ -7,11 +7,11 @@
#open 2014-04-01-23-15-49 #open 2014-04-01-23-15-49
#fields ts id.orig_h #fields ts id.orig_h
#types string addr #types string addr
2012-02-21T08:52:55-0800 141.142.220.235 2012-02-21T16:52:55+0000 141.142.220.235
2012-02-21T08:52:59-0800 141.142.220.235 2012-02-21T16:52:59+0000 141.142.220.235
2012-02-21T08:53:14-0800 199.233.217.249 2012-02-21T16:53:14+0000 199.233.217.249
2012-02-21T08:53:17-0800 199.233.217.249 2012-02-21T16:53:17+0000 199.233.217.249
2012-02-21T08:52:41-0800 141.142.220.235 2012-02-21T16:52:41+0000 141.142.220.235
#close 2014-04-01-23-15-49 #close 2014-04-01-23-15-49
#separator \x09 #separator \x09
#set_separator , #set_separator ,

8
testing/btest/Baseline/zeek-aux.zeek-cut.time-header/multiple-times
View file

@ -7,8 +7,8 @@
#open 2014-04-01-23-16-29 #open 2014-04-01-23-16-29
#fields proto ts2 ts1 #fields proto ts2 ts1
#types enum string string #types enum string string
tcp 2012-02-21T08:53:05-0800 2012-02-21T08:52:55-0800 tcp 2012-02-21T16:53:05+0000 2012-02-21T16:52:55+0000
udp 2012-02-21T08:52:59-0800 2012-02-21T08:52:59-0800 udp 2012-02-21T16:52:59+0000 2012-02-21T16:52:59+0000
tcp 2012-02-21T08:53:24-0800 2012-02-21T08:53:14-0800 tcp 2012-02-21T16:53:24+0000 2012-02-21T16:53:14+0000
tcp 2012-02-21T08:54:15-0800 2012-02-21T08:53:24-0800 tcp 2012-02-21T16:54:15+0000 2012-02-21T16:53:24+0000
#close 2014-04-01-23-16-29 #close 2014-04-01-23-16-29

10
testing/btest/Baseline/zeek-aux.zeek-cut.time-header/nondefault-separator
View file

@ -7,9 +7,9 @@
#open,2014-06-30-16-10-54 #open,2014-06-30-16-10-54
#fields,proto,ts,id.orig_h #fields,proto,ts,id.orig_h
#types,enum,string,addr #types,enum,string,addr
tcp,2012-02-21T08:52:55-0800,141.142.220.235 tcp,2012-02-21T16:52:55+0000,141.142.220.235
tcp,2012-02-21T08:52:59-0800,141.142.220.235 tcp,2012-02-21T16:52:59+0000,141.142.220.235
tcp,2012-02-21T08:53:14-0800,199.233.217.249 tcp,2012-02-21T16:53:14+0000,199.233.217.249
tcp,2012-02-21T08:52:41-0800,141.142.220.235 tcp,2012-02-21T16:52:41+0000,141.142.220.235
tcp,2012-02-21T08:53:17-0800,199.233.217.249 tcp,2012-02-21T16:53:17+0000,199.233.217.249
#close,2014-06-30-16-10-55 #close,2014-06-30-16-10-55

10
testing/btest/Baseline/zeek-aux.zeek-cut.time-header/ts-twice
View file

@ -7,9 +7,9 @@
#open 2014-04-01-23-15-49 #open 2014-04-01-23-15-49
#fields ts id.orig_h ts #fields ts id.orig_h ts
#types string addr string #types string addr string
2012-02-21T08:52:55-0800 141.142.220.235 2012-02-21T08:52:55-0800 2012-02-21T16:52:55+0000 141.142.220.235 2012-02-21T16:52:55+0000
2012-02-21T08:52:59-0800 141.142.220.235 2012-02-21T08:52:59-0800 2012-02-21T16:52:59+0000 141.142.220.235 2012-02-21T16:52:59+0000
2012-02-21T08:53:14-0800 199.233.217.249 2012-02-21T08:53:14-0800 2012-02-21T16:53:14+0000 199.233.217.249 2012-02-21T16:53:14+0000
2012-02-21T08:53:17-0800 199.233.217.249 2012-02-21T08:53:17-0800 2012-02-21T16:53:17+0000 199.233.217.249 2012-02-21T16:53:17+0000
2012-02-21T08:52:41-0800 141.142.220.235 2012-02-21T08:52:41-0800 2012-02-21T16:52:41+0000 141.142.220.235 2012-02-21T16:52:41+0000
#close 2014-04-01-23-15-49 #close 2014-04-01-23-15-49

3
testing/btest/btest.cfg
View file

@ -21,7 +21,7 @@ TZ=UTC
LC_ALL=C LC_ALL=C
BTEST_PATH=%(testbase)s/../../auxil/btest BTEST_PATH=%(testbase)s/../../auxil/btest
BTEST_BG_RUN_SLEEP=0 BTEST_BG_RUN_SLEEP=0
PATH=%(testbase)s/../../%(build_dir)s/src%(pathsep)s%(testbase)s/../scripts%(pathsep)s%(testbase)s/../../auxil/btest%(pathsep)s%(testbase)s/../../%(build_dir)s/auxil/zeek-aux/zeek-cut%(pathsep)s%(testbase)s/../../%(build_dir)s/auxil/spicy/bin%(pathsep)s%(testbase)s/../../%(build_dir)s/src/spicy/spicyz%(pathsep)s%(testbase)s/../../auxil/btest/sphinx%(pathsep)s%(default_path)s%(pathsep)s/sbin PATH=%(testbase)s/../../%(build_dir)s/src%(pathsep)s%(testbase)s/../scripts%(pathsep)s%(testbase)s/../../auxil/btest%(pathsep)s%(testbase)s/../../%(build_dir)s/auxil/zeek-aux/zeek-cut%(pathsep)s%(testbase)s/../../%(build_dir)s/auxil/spicy/bin%(pathsep)s%(testbase)s/../../%(build_dir)s/src/spicy/spicyz%(pathsep)s%(testbase)s/../../auxil/btest/sphinx%(pathsep)s%(default_path)s%(pathsep)s/sbin%(pathsep)s%(testbase)s/../../%(build_dir)s/auxil/zeek-aux/zeek-archiver%(pathsep)s
TRACES=%(testbase)s/Traces TRACES=%(testbase)s/Traces
FILES=%(testbase)s/Files FILES=%(testbase)s/Files
SCRIPTS=%(testbase)s/../scripts SCRIPTS=%(testbase)s/../scripts
@ -43,6 +43,7 @@ SPICY_PATH=`bash -c %(testbase)s/../../%(build_dir)s/spicy-path`
HILTI_CXX_INCLUDE_DIRS=`bash -c %(testbase)s/../../%(build_dir)s/hilti-cxx-include-dirs` HILTI_CXX_INCLUDE_DIRS=`bash -c %(testbase)s/../../%(build_dir)s/hilti-cxx-include-dirs`
ZEEK_SPICY_MODULE_PATH=/does/not/exist ZEEK_SPICY_MODULE_PATH=/does/not/exist
ZEEK_SPICY_LIBRARY_PATH=%(testbase)s/../../scripts/spicy ZEEK_SPICY_LIBRARY_PATH=%(testbase)s/../../scripts/spicy
ZEEK_AUX_LOGS=%(testbase)s/Files/zeek-aux-logs
[environment-cpp] [environment-cpp]
ZEEK_USE_CPP=1 ZEEK_USE_CPP=1

4
testing/btest/zeek-aux/update-changes/changes-up-to-date.sh
View file

@ -1,6 +1,4 @@
# Test update-changes -c. On an absent repo, this should fail. When there have # @TEST-DOC: Test update-changes -c. On an absent repo, this should fail. When there have not been commits since the last CHANGES update, it should succeed, and after subsequent commits it should fail again.
# not been commits since the last CHANGES update, it should succeed, and after
# subsequent commits it should fail again.
# #
# @TEST-EXEC-FAIL: update-changes -c # @TEST-EXEC-FAIL: update-changes -c
# @TEST-EXEC: bash %INPUT # @TEST-EXEC: bash %INPUT

3
testing/btest/zeek-aux/update-changes/initialize-from-prompt.sh
View file

@ -1,5 +1,4 @@
# Test update-changes -I when no version information is present, and the user is # @TEST-DOC: Test update-changes -I when no version information is present, and the user is prompted to provide one.
# prompted to provide one.
# #
# @TEST-EXEC: bash %INPUT # @TEST-EXEC: bash %INPUT
# @TEST-EXEC: test -f CHANGES # @TEST-EXEC: test -f CHANGES

2
testing/btest/zeek-aux/update-changes/initialize-from-tag.sh
View file

@ -1,4 +1,4 @@
# Test update-changes -I when version information is available from git tags. # @TEST-DOC: Test update-changes -I when version information is available from git tags.
# #
# @TEST-EXEC: bash %INPUT # @TEST-EXEC: bash %INPUT
# @TEST-EXEC: test -f CHANGES # @TEST-EXEC: test -f CHANGES

3
testing/btest/zeek-aux/update-changes/initialize-from-version.sh
View file

@ -1,5 +1,4 @@
# Test update-changes -I when version information is in the VERSION file, which # @TEST-DOC: Test update-changes -I when version information is in the VERSION file, which update-changes wants confirmation for.
# update-changes wants confirmation for.
# #
# @TEST-EXEC: bash %INPUT # @TEST-EXEC: bash %INPUT
# @TEST-EXEC: test -f CHANGES # @TEST-EXEC: test -f CHANGES

7
testing/btest/zeek-aux/update-changes/replace-version-in-c-header.sh
View file

@ -1,15 +1,14 @@
# Verifies that update-changes correctly updates version strings in C header # @TEST-DOC: Verifies that update-changes correctly updates version strings in C header files, when .update-changes.cfg instructs it.
# files, when .update-changes.cfg instructs it.
# #
# @TEST-EXEC: bash %INPUT # @TEST-EXEC: bash %INPUT
# @TEST-EXEC: btest-diff header.h # @TEST-EXEC: btest-diff header.h
@TEST-START-FILE .update-changes.cfg # @TEST-START-FILE .update-changes.cfg
function new_version_hook() { function new_version_hook() {
local version=$1 local version=$1
replace_version_in_c_header header.h $version replace_version_in_c_header header.h $version
} }
@TEST-END-FILE # @TEST-END-FILE
git init git init

7
testing/btest/zeek-aux/update-changes/replace-version-in-python-package.sh
View file

@ -1,15 +1,14 @@
# Verifies that update-changes correctly updates __version__ values as given in # @TEST-DOC: Verifies that update-changes correctly updates __version__ values as given in package-level __init__.py files, when .update-changes.cfg instructs it.
# package-level __init__.py files, when .update-changes.cfg instructs it.
# #
# @TEST-EXEC: bash %INPUT # @TEST-EXEC: bash %INPUT
# @TEST-EXEC: btest-diff __init__.py # @TEST-EXEC: btest-diff __init__.py
@TEST-START-FILE .update-changes.cfg # @TEST-START-FILE .update-changes.cfg
function new_version_hook() { function new_version_hook() {
local version=$1 local version=$1
replace_version_in_python_package __init__.py $version replace_version_in_python_package __init__.py $version
} }
@TEST-END-FILE # @TEST-END-FILE
git init git init

7
testing/btest/zeek-aux/update-changes/replace-version-in-rst.sh
View file

@ -1,15 +1,14 @@
# Verifies that update-changes correctly updates version strings in # @TEST-DOC: Verifies that update-changes correctly updates version strings in ReST docs, when .update-changes.cfg instructs it.
# ReST docs, when .update-changes.cfg instructs it.
# #
# @TEST-EXEC: bash %INPUT # @TEST-EXEC: bash %INPUT
# @TEST-EXEC: btest-diff test.rst # @TEST-EXEC: btest-diff test.rst
@TEST-START-FILE .update-changes.cfg # @TEST-START-FILE .update-changes.cfg
function new_version_hook() { function new_version_hook() {
local version=$1 local version=$1
replace_version_in_rst test.rst $version replace_version_in_rst test.rst $version
} }
@TEST-END-FILE # @TEST-END-FILE
git init git init

7
testing/btest/zeek-aux/update-changes/replace-version-in-script.sh
View file

@ -1,15 +1,14 @@
# Verifies that update-changes correctly updates version strings in # @TEST-DOC: Verifies that update-changes correctly updates version strings in shell/Python/etc scripts, when .update-changes.cfg instructs it.
# shell/Python/etc scripts, when .update-changes.cfg instructs it.
# #
# @TEST-EXEC: bash %INPUT # @TEST-EXEC: bash %INPUT
# @TEST-EXEC: btest-diff test.pl # @TEST-EXEC: btest-diff test.pl
@TEST-START-FILE .update-changes.cfg # @TEST-START-FILE .update-changes.cfg
function new_version_hook() { function new_version_hook() {
local version=$1 local version=$1
replace_version_in_script test.pl $version replace_version_in_script test.pl $version
} }
@TEST-END-FILE # @TEST-END-FILE
git init git init

7
testing/btest/zeek-aux/update-changes/replace-version-in-setup-py.sh
View file

@ -1,15 +1,14 @@
# Verifies that update-changes correctly updates version strings in setup.py # @TEST-DOC: Verifies that update-changes correctly updates version strings in setup.py files to Python-style versions, when .update-changes.cfg instructs it.
# files to Python-style versions, when .update-changes.cfg instructs it.
# #
# @TEST-EXEC: bash %INPUT # @TEST-EXEC: bash %INPUT
# @TEST-EXEC: btest-diff setup.py # @TEST-EXEC: btest-diff setup.py
@TEST-START-FILE .update-changes.cfg # @TEST-START-FILE .update-changes.cfg
function new_version_hook() { function new_version_hook() {
local version=$1 local version=$1
replace_version_in_setup_py setup.py $version replace_version_in_setup_py setup.py $version
} }
@TEST-END-FILE # @TEST-END-FILE
git init git init

3
testing/btest/zeek-aux/update-changes/tag-dev-point-release-ahead-of-origin.sh
View file

@ -1,5 +1,4 @@
# Like tag-point-release-ahead-of-origin, but on top of a "-dev" git tag # @TEST-DOC: Like tag-point-release-ahead-of-origin, but on top of a "-dev" git tag to test the underlying -r regex.
# to test the underlying -r regex.
# #
# @TEST-EXEC: bash %INPUT # @TEST-EXEC: bash %INPUT
# @TEST-EXEC: cd clone && git describe --exact-match HEAD | grep -q v1.0.1 # @TEST-EXEC: cd clone && git describe --exact-match HEAD | grep -q v1.0.1

3
testing/btest/zeek-aux/update-changes/tag-point-release-ahead-of-origin.sh
View file

@ -1,5 +1,4 @@
# Test update-changes -r when the repo is cloned from an origin. With commits # @TEST-DOC: Test update-changes -r when the repo is cloned from an origin. With commits ahead of CHANGES, the release commit should be augmented onto the last.
# ahead of CHANGES, the release commit should be augmented onto the last.
# #
# @TEST-EXEC: bash %INPUT # @TEST-EXEC: bash %INPUT
# @TEST-EXEC: cd clone && git describe --exact-match HEAD | grep -q v1.0.1 # @TEST-EXEC: cd clone && git describe --exact-match HEAD | grep -q v1.0.1

3
testing/btest/zeek-aux/update-changes/tag-point-release-at-origin.sh
View file

@ -1,5 +1,4 @@
# Test update-changes -r when the repo is up to date with its origin. In that # @TEST-DOC: Test update-changes -r when the repo is up to date with its origin. In that case, the release commit should become a new one.
# case, the release commit should become a new one.
# #
# @TEST-EXEC: bash %INPUT # @TEST-EXEC: bash %INPUT
# @TEST-EXEC: cd clone && git describe --exact-match HEAD | grep -q v1.0.1 # @TEST-EXEC: cd clone && git describe --exact-match HEAD | grep -q v1.0.1

4
testing/btest/zeek-aux/update-changes/tag-release-ahead-of-origin-new-commit.sh
View file

@ -1,6 +1,4 @@
# Test update-changes -R when the repo is cloned from an origin. With commits # @TEST-DOC: Test update-changes -R when the repo is cloned from an origin. With commits ahead of CHANGES the release commit would be augmented onto the last, but this also uses -n to create a new one.
# ahead of CHANGES the release commit would be augmented onto the last, but
# this also uses -n to create a new one.
# #
# @TEST-EXEC: bash %INPUT # @TEST-EXEC: bash %INPUT
# @TEST-EXEC: cd clone && git describe --exact-match HEAD | grep -q v2.0.0 # @TEST-EXEC: cd clone && git describe --exact-match HEAD | grep -q v2.0.0

3
testing/btest/zeek-aux/update-changes/tag-release-ahead-of-origin.sh
View file

@ -1,5 +1,4 @@
# Test update-changes -R when the repo is cloned from an origin. With commits # @TEST-DOC: Test update-changes -R when the repo is cloned from an origin. With commits ahead of CHANGES the release commit should be augmented onto the last.
# ahead of CHANGES the release commit should be augmented onto the last.
# #
# @TEST-EXEC: bash %INPUT # @TEST-EXEC: bash %INPUT
# @TEST-EXEC: cd clone && git describe --exact-match HEAD | grep -q v2.0.0 # @TEST-EXEC: cd clone && git describe --exact-match HEAD | grep -q v2.0.0

3
testing/btest/zeek-aux/update-changes/tag-release-at-origin.sh
View file

@ -1,5 +1,4 @@
# Test update-changes -R when the repo is up to date with its origin. In that # @TEST-DOC: Test update-changes -R when the repo is up to date with its origin. In that case, the release commit should become a new one.
# case, the release commit should become a new one.
# #
# @TEST-EXEC: bash %INPUT # @TEST-EXEC: bash %INPUT
# @TEST-EXEC: cd clone && git describe --exact-match HEAD | grep -q v2.0.0 # @TEST-EXEC: cd clone && git describe --exact-match HEAD | grep -q v2.0.0

4
testing/btest/zeek-aux/zeek-archiver/command-injection-filenames.test
View file

@ -1,7 +1,7 @@
# Verify that commands injected via filenames do not execute. # @TEST-DOC: Verify that commands injected via filenames do not execute.
# @TEST-EXEC: bash %INPUT # @TEST-EXEC: bash %INPUT
. "$SCRIPTS/zeek-archiver-common.sh" . "${SCRIPTS}/zeek-aux/zeek-archiver-common.sh"
log_in='test;uptime;__2020-07-16-09-43-10__2020-07-16-09-43-10__.log' log_in='test;uptime;__2020-07-16-09-43-10__2020-07-16-09-43-10__.log'
log_out='test;uptime;.09:43:10-09:43:10.log' log_out='test;uptime;.09:43:10-09:43:10.log'

4
testing/btest/zeek-aux/zeek-archiver/custom-delimiter.test
View file

@ -1,7 +1,7 @@
# Use a custom delimiter in the resulting logs. # @TEST-DOC: Use a custom delimiter in the resulting logs.
# @TEST-EXEC: bash %INPUT # @TEST-EXEC: bash %INPUT
. "$SCRIPTS/zeek-archiver-common.sh" . "${SCRIPTS}/zeek-aux/zeek-archiver-common.sh"
log_in=test_2020-07-16-09-43-10_2020-07-16-09-43-10_.log log_in=test_2020-07-16-09-43-10_2020-07-16-09-43-10_.log
log_out=test.09:43:10-09:43:10.log log_out=test.09:43:10-09:43:10.log

4
testing/btest/zeek-aux/zeek-archiver/custom-timestamp.test
View file

@ -1,7 +1,7 @@
# Use a customized timestamp in output logs. # @TEST-DOC: Use a customized timestamp in output logs.
# @TEST-EXEC: bash %INPUT # @TEST-EXEC: bash %INPUT
. "$SCRIPTS/zeek-archiver-common.sh" . "${SCRIPTS}/zeek-aux/zeek-archiver-common.sh"
log_in=test__2020-07-16_09-43-10__2020-07-16_09-43-10__.log log_in=test__2020-07-16_09-43-10__2020-07-16_09-43-10__.log
log_out=test.09:43:10-09:43:10.log log_out=test.09:43:10-09:43:10.log

4
testing/btest/zeek-aux/zeek-archiver/default.test
View file

@ -1,7 +1,7 @@
# Default behavior: compress the log. # @TEST-DOC: Default behavior: compress the log.
# @TEST-EXEC: bash %INPUT # @TEST-EXEC: bash %INPUT
. "$SCRIPTS/zeek-archiver-common.sh" . "${SCRIPTS}/zeek-aux/zeek-archiver-common.sh"
log_in=test__2020-07-16-09-43-10__2020-07-16-09-43-10__.log log_in=test__2020-07-16-09-43-10__2020-07-16-09-43-10__.log
log_out=test.09:43:10-09:43:10.log log_out=test.09:43:10-09:43:10.log

4
testing/btest/zeek-aux/zeek-archiver/disable-compression.test
View file

@ -1,7 +1,7 @@
# Don't compress the logs. # @TEST-DOC: Don't compress the logs.
# @TEST-EXEC: bash %INPUT # @TEST-EXEC: bash %INPUT
. "$SCRIPTS/zeek-archiver-common.sh" . "${SCRIPTS}/zeek-aux/zeek-archiver-common.sh"
log_in=test__2020-07-16-09-43-10__2020-07-16-09-43-10__.log log_in=test__2020-07-16-09-43-10__2020-07-16-09-43-10__.log
log_out=test.09:43:10-09:43:10.log log_out=test.09:43:10-09:43:10.log

4
testing/btest/zeek-aux/zeek-archiver/extra-compression-args.test
View file

@ -1,7 +1,7 @@
# Verify that passing extra parameters to the compression stage works. # @TEST-DOC: Verify that passing extra parameters to the compression stage works.
# @TEST-EXEC: bash %INPUT # @TEST-EXEC: bash %INPUT
. "$SCRIPTS/zeek-archiver-common.sh" . "${SCRIPTS}/zeek-aux/zeek-archiver-common.sh"
log_in=test__2020-07-16-09-43-10__2020-07-16-09-43-10__.log log_in=test__2020-07-16-09-43-10__2020-07-16-09-43-10__.log
log_out=test.09:43:10-09:43:10.log log_out=test.09:43:10-09:43:10.log

5
testing/btest/zeek-aux/zeek-archiver/failing-compress.test
View file

@ -1,8 +1,7 @@
# Verify the source file still exists and the destination wasn't created # @TEST-DOC: Verify the source file still exists and the destination wasn't created (or removed) when the compression command fails.
# (or removed) when the compression command fails.
# @TEST-EXEC: bash %INPUT # @TEST-EXEC: bash %INPUT
. "$SCRIPTS/zeek-archiver-common.sh" . "${SCRIPTS}/zeek-aux/zeek-archiver-common.sh"
log_in=test__2020-07-16-09-43-10__2020-07-16-09-43-10__.log log_in=test__2020-07-16-09-43-10__2020-07-16-09-43-10__.log
log_out=test.09:43:10-09:43:10.log log_out=test.09:43:10-09:43:10.log

4
testing/btest/zeek-aux/zeek-archiver/metadata-addl.test
View file

@ -1,7 +1,7 @@
# Verify log name metadata behavior: check that additional pid metadata gets dropped. # @TEST-DOC: Verify log name metadata behavior: check that additional pid metadata gets dropped.
# @TEST-EXEC: bash %INPUT # @TEST-EXEC: bash %INPUT
. "$SCRIPTS/zeek-archiver-common.sh" . "${SCRIPTS}/zeek-aux/zeek-archiver-common.sh"
log_in=test__2020-07-16-09-43-10__2020-07-16-09-43-10__log_suffix=logger-test,pid=4711__.log log_in=test__2020-07-16-09-43-10__2020-07-16-09-43-10__log_suffix=logger-test,pid=4711__.log
log_out=test.09:43:10-09:43:10-logger-test.log log_out=test.09:43:10-09:43:10-logger-test.log

4
testing/btest/zeek-aux/zeek-archiver/metadata-empty.test
View file

@ -1,7 +1,7 @@
# Verify log name metadata behavior: empty metadata is acceptable. # @TEST-DOC: Verify log name metadata behavior: empty metadata is acceptable.
# @TEST-EXEC: bash %INPUT # @TEST-EXEC: bash %INPUT
. "$SCRIPTS/zeek-archiver-common.sh" . "${SCRIPTS}/zeek-aux/zeek-archiver-common.sh"
log_in=test__2020-07-16-09-43-10__2020-07-16-09-43-10____.log log_in=test__2020-07-16-09-43-10__2020-07-16-09-43-10____.log
log_out=test.09:43:10-09:43:10.log log_out=test.09:43:10-09:43:10.log

9
testing/btest/zeek-aux/zeek-archiver/metadata-invalid.test
View file

@ -1,13 +1,14 @@
# Verify log name metadata behavior: invalid metadata causes skipping of archival. # @TEST-DOC: Verify log name metadata behavior: invalid metadata causes skipping of archival.
# @TEST-EXEC: bash %INPUT # @TEST-EXEC: bash %INPUT
@TEST-START-FILE run.sh # @TEST-START-FILE run.sh
. "$SCRIPTS/zeek-archiver-common.sh"
. "${SCRIPTS}/zeek-aux/zeek-archiver-common.sh"
echo hello > "$(queue_dir)/${log_in}" echo hello > "$(queue_dir)/${log_in}"
zeek-archiver -1 -v "$(queue_dir)" "$(archive_dir)" zeek-archiver -1 -v "$(queue_dir)" "$(archive_dir)"
test -f "$(queue_dir)/${log_in}" test -f "$(queue_dir)/${log_in}"
@TEST-END-FILE # @TEST-END-FILE
log_in=test__2020-07-16-09-43-10__2020-07-16-09-43-10__log_suffix,invalid=4711__.log log_in=test__2020-07-16-09-43-10__2020-07-16-09-43-10__log_suffix,invalid=4711__.log
. run.sh . run.sh

4
testing/btest/zeek-aux/zeek-archiver/metadata.test
View file

@ -1,7 +1,7 @@
# Verify log name metadata behavior: check that suffixes get applied correctly. # @TEST-DOC: Verify log name metadata behavior: check that suffixes get applied correctly.
# @TEST-EXEC: bash %INPUT # @TEST-EXEC: bash %INPUT
. "$SCRIPTS/zeek-archiver-common.sh" . "${SCRIPTS}/zeek-aux/zeek-archiver-common.sh"
log_in=test__2020-07-16-09-43-10__2020-07-16-09-43-10__log_suffix=logger-test__.log log_in=test__2020-07-16-09-43-10__2020-07-16-09-43-10__log_suffix=logger-test__.log
log_out=test.09:43:10-09:43:10-logger-test.log log_out=test.09:43:10-09:43:10-logger-test.log

4
testing/btest/zeek-aux/zeek-archiver/pre-compression-logs.test
View file

@ -1,7 +1,7 @@
# Detect pre-compressed logs. # @TEST-DOC: Detect pre-compressed logs.
# @TEST-EXEC: bash %INPUT # @TEST-EXEC: bash %INPUT
. "$SCRIPTS/zeek-archiver-common.sh" . "${SCRIPTS}/zeek-aux/zeek-archiver-common.sh"
log_in=test__2020-07-16-09-43-10__2020-07-16-09-43-10__.log log_in=test__2020-07-16-09-43-10__2020-07-16-09-43-10__.log
log_out=test.09:43:10-09:43:10.log log_out=test.09:43:10-09:43:10.log

4
testing/btest/zeek-aux/zeek-archiver/umask.test
View file

@ -1,7 +1,7 @@
# @TEST-DOC: Check file permissions with different umask settings. # @TEST-DOC: Check file permissions with different umask settings.
# @TEST-EXEC: bash %INPUT # @TEST-EXEC: bash %INPUT
. "$SCRIPTS/zeek-archiver-common.sh" . "${SCRIPTS}/zeek-aux/zeek-archiver-common.sh"
umask 0002 umask 0002
@ -19,7 +19,7 @@ test "${file_perms}" == "-rw-rw-r--" || exit 1
# @TEST-START-NEXT # @TEST-START-NEXT
. "$SCRIPTS/zeek-archiver-common.sh" . "${SCRIPTS}/zeek-aux/zeek-archiver-common.sh"
umask 0077 umask 0077

16
testing/btest/zeek-aux/zeek-cut/bad-logs.test
View file

@ -1,30 +1,30 @@
# Test zeek-cut with invalid log files. # @TEST-DOC: Test zeek-cut with invalid log files.
# #
# The "#separator" log header line is missing. # The "#separator" log header line is missing.
# @TEST-EXEC: grep -v '^#separator' $LOGS/conn.log | zeek-cut uid proto > missing-sep-header # @TEST-EXEC: grep -v '^#separator' ${ZEEK_AUX_LOGS}/conn.log | zeek-cut uid proto > missing-sep-header
# @TEST-EXEC: btest-diff missing-sep-header # @TEST-EXEC: btest-diff missing-sep-header
# The "#fields" log header line is missing (show header). # The "#fields" log header line is missing (show header).
# @TEST-EXEC-FAIL: grep -v '^#fields' $LOGS/conn.log | zeek-cut -C 2> missing-fields-header # @TEST-EXEC-FAIL: grep -v '^#fields' ${ZEEK_AUX_LOGS}/conn.log | zeek-cut -C 2> missing-fields-header
# @TEST-EXEC: btest-diff missing-fields-header # @TEST-EXEC: btest-diff missing-fields-header
# All log header lines are missing (show header). # All log header lines are missing (show header).
# @TEST-EXEC: grep -v '^#' $LOGS/conn.log | zeek-cut -c > no-header-show # @TEST-EXEC: grep -v '^#' ${ZEEK_AUX_LOGS}/conn.log | zeek-cut -c > no-header-show
# @TEST-EXEC: btest-diff no-header-show # @TEST-EXEC: btest-diff no-header-show
# All log header lines are missing (select column to show). # All log header lines are missing (select column to show).
# @TEST-EXEC: grep -v '^#' $LOGS/conn.log | zeek-cut uid > no-header-column # @TEST-EXEC: grep -v '^#' ${ZEEK_AUX_LOGS}/conn.log | zeek-cut uid > no-header-column
# @TEST-EXEC: btest-diff no-header-column # @TEST-EXEC: btest-diff no-header-column
# All log header lines are missing (select column to not show). # All log header lines are missing (select column to not show).
# @TEST-EXEC: grep -v '^#' $LOGS/conn.log | zeek-cut -n uid > no-header-not-column # @TEST-EXEC: grep -v '^#' ${ZEEK_AUX_LOGS}/conn.log | zeek-cut -n uid > no-header-not-column
# @TEST-EXEC: btest-diff no-header-not-column # @TEST-EXEC: btest-diff no-header-not-column
# Separator is missing # Separator is missing
# @TEST-EXEC-FAIL: cat $LOGS/missing-separator.log | zeek-cut 2> missing-separator # @TEST-EXEC-FAIL: cat ${ZEEK_AUX_LOGS}/missing-separator.log | zeek-cut 2> missing-separator
# @TEST-EXEC: btest-diff missing-separator # @TEST-EXEC: btest-diff missing-separator
# Separator is \x00 # Separator is \x00
# @TEST-EXEC-FAIL: cat $LOGS/null-separator.log | zeek-cut 2> null-separator # @TEST-EXEC-FAIL: cat ${ZEEK_AUX_LOGS}/null-separator.log | zeek-cut 2> null-separator
# @TEST-EXEC: btest-diff null-separator # @TEST-EXEC: btest-diff null-separator

34
testing/btest/zeek-aux/zeek-cut/columns.test
View file

@ -1,34 +1,34 @@
# Test zeek-cut with column names, but no other options. # @TEST-DOC: Test zeek-cut with column names, but no other options.
# #
# Select one column. # Select one column.
# @TEST-EXEC: cat $LOGS/conn.log | zeek-cut uid > one # @TEST-EXEC: cat ${ZEEK_AUX_LOGS}/conn.log | zeek-cut uid > one
# @TEST-EXEC: btest-diff one # @TEST-EXEC: TEST_DIFF_CANONIFIER= btest-diff one
# Log file has only one column. # Log file has only one column.
# @TEST-EXEC: cat $LOGS/onecolumn.log | zeek-cut id.orig_h > only # @TEST-EXEC: cat ${ZEEK_AUX_LOGS}/onecolumn.log | zeek-cut id.orig_h > only
# @TEST-EXEC: btest-diff only # @TEST-EXEC: TEST_DIFF_CANONIFIER= btest-diff only
# Swap the order of two columns. # Swap the order of two columns.
# @TEST-EXEC: cat $LOGS/conn.log | zeek-cut proto uid > swap-order # @TEST-EXEC: cat ${ZEEK_AUX_LOGS}/conn.log | zeek-cut proto uid > swap-order
# @TEST-EXEC: btest-diff swap-order # @TEST-EXEC: TEST_DIFF_CANONIFIER= btest-diff swap-order
# Specify all columns in the log file. # Specify all columns in the log file.
# @TEST-EXEC: cat $LOGS/test.log | zeek-cut ts uid id.orig_h id.orig_p id.resp_h > all # @TEST-EXEC: cat ${ZEEK_AUX_LOGS}/test.log | zeek-cut ts uid id.orig_h id.orig_p id.resp_h > all
# @TEST-EXEC: btest-diff all # @TEST-EXEC: TEST_DIFF_CANONIFIER= btest-diff all
# Log files use different field separators. # Log files use different field separators.
# @TEST-EXEC: cat $LOGS/conn.log $LOGS/conncomma.log | zeek-cut proto uid > nondefault-separator # @TEST-EXEC: cat ${ZEEK_AUX_LOGS}/conn.log ${ZEEK_AUX_LOGS}/conncomma.log | zeek-cut proto uid > nondefault-separator
# @TEST-EXEC: btest-diff nondefault-separator # @TEST-EXEC: TEST_DIFF_CANONIFIER= btest-diff nondefault-separator
# Column order changes between two log files. # Column order changes between two log files.
# @TEST-EXEC: cat $LOGS/conn.log $LOGS/conntimelast.log | zeek-cut ts uid > different-col-order # @TEST-EXEC: cat ${ZEEK_AUX_LOGS}/conn.log ${ZEEK_AUX_LOGS}/conntimelast.log | zeek-cut ts uid > different-col-order
# @TEST-EXEC: btest-diff different-col-order # @TEST-EXEC: TEST_DIFF_CANONIFIER= btest-diff different-col-order
# Specify a column name that exists only in the first log file. # Specify a column name that exists only in the first log file.
# @TEST-EXEC: cat $LOGS/conn.log $LOGS/test.log | zeek-cut uid proto > one-nonexistent-1 # @TEST-EXEC: cat ${ZEEK_AUX_LOGS}/conn.log ${ZEEK_AUX_LOGS}/test.log | zeek-cut uid proto > one-nonexistent-1
# @TEST-EXEC: btest-diff one-nonexistent-1 # @TEST-EXEC: TEST_DIFF_CANONIFIER= btest-diff one-nonexistent-1
# Specify a column name that exists only in the second log file. # Specify a column name that exists only in the second log file.
# @TEST-EXEC: cat $LOGS/test.log $LOGS/conn.log | zeek-cut uid proto > one-nonexistent-2 # @TEST-EXEC: cat ${ZEEK_AUX_LOGS}/test.log ${ZEEK_AUX_LOGS}/conn.log | zeek-cut uid proto > one-nonexistent-2
# @TEST-EXEC: btest-diff one-nonexistent-2 # @TEST-EXEC: TEST_DIFF_CANONIFIER= btest-diff one-nonexistent-2

2
testing/btest/zeek-aux/zeek-cut/help.test
View file

@ -1,4 +1,4 @@
# Test zeek-cut with -h option. # @TEST-DOC: Test zeek-cut with -h option.
# #
# @TEST-EXEC-FAIL: zeek-cut -h > show-help # @TEST-EXEC-FAIL: zeek-cut -h > show-help
# @TEST-EXEC: btest-diff show-help # @TEST-EXEC: btest-diff show-help

50
testing/btest/zeek-aux/zeek-cut/minimal-view.test
View file

@ -1,50 +1,50 @@
# Test zeek-cut with -m and -M options. # @TEST-DOC: Test zeek-cut with -m and -M options.
# #
# Show first header in minimal view for one log file. # Show first header in minimal view for one log file.
# @TEST-EXEC: cat $LOGS/conn.log | zeek-cut -m > one-all-nocols # @TEST-EXEC: cat ${ZEEK_AUX_LOGS}/conn.log | zeek-cut -m > one-all-nocols
# @TEST-EXEC: btest-diff one-all-nocols # @TEST-EXEC: TEST_DIFF_CANONIFIER= btest-diff one-all-nocols
# Show first header in minimal view for two log files. # Show first header in minimal view for two log files.
# @TEST-EXEC: cat $LOGS/conn.log $LOGS/test.log | zeek-cut -m uid ts > two-1st-withcols # @TEST-EXEC: cat ${ZEEK_AUX_LOGS}/conn.log ${ZEEK_AUX_LOGS}/test.log | zeek-cut -m uid ts > two-1st-withcols
# @TEST-EXEC: btest-diff two-1st-withcols # @TEST-EXEC: TEST_DIFF_CANONIFIER= btest-diff two-1st-withcols
# Show all headers in minimal view for two log files. # Show all headers in minimal view for two log files.
# @TEST-EXEC: cat $LOGS/conn.log $LOGS/test.log | zeek-cut -M uid ts > two-all-withcols # @TEST-EXEC: cat ${ZEEK_AUX_LOGS}/conn.log ${ZEEK_AUX_LOGS}/test.log | zeek-cut -M uid ts > two-all-withcols
# @TEST-EXEC: btest-diff two-all-withcols # @TEST-EXEC: TEST_DIFF_CANONIFIER= btest-diff two-all-withcols
# #
# Show first header in minimal view for two log files with custom field separator. # Show first header in minimal view for two log files with custom field separator.
# @TEST-EXEC: cat $LOGS/conn.log $LOGS/test.log | zeek-cut -F, -m uid ts > two-1st-withcols-custom-sep # @TEST-EXEC: cat ${ZEEK_AUX_LOGS}/conn.log ${ZEEK_AUX_LOGS}/test.log | zeek-cut -F, -m uid ts > two-1st-withcols-custom-sep
# @TEST-EXEC: btest-diff two-1st-withcols-custom-sep # @TEST-EXEC: TEST_DIFF_CANONIFIER= btest-diff two-1st-withcols-custom-sep
# Show all headers in minimal view for two log files with custom field separator. # Show all headers in minimal view for two log files with custom field separator.
# @TEST-EXEC: cat $LOGS/conn.log $LOGS/test.log | zeek-cut -F, -M uid ts > two-all-withcols-custom-sep # @TEST-EXEC: cat ${ZEEK_AUX_LOGS}/conn.log ${ZEEK_AUX_LOGS}/test.log | zeek-cut -F, -M uid ts > two-all-withcols-custom-sep
# @TEST-EXEC: btest-diff two-all-withcols-custom-sep # @TEST-EXEC: TEST_DIFF_CANONIFIER= btest-diff two-all-withcols-custom-sep
# Show all headers in minimal view for two logs (-M overrides -m). # Show all headers in minimal view for two logs (-M overrides -m).
# @TEST-EXEC: cat $LOGS/conn.log $LOGS/test.log | zeek-cut -m -M uid ts > both-m-opts-all # @TEST-EXEC: cat ${ZEEK_AUX_LOGS}/conn.log ${ZEEK_AUX_LOGS}/test.log | zeek-cut -m -M uid ts > both-m-opts-all
# @TEST-EXEC: btest-diff both-m-opts-all # @TEST-EXEC: TEST_DIFF_CANONIFIER= btest-diff both-m-opts-all
# Show first header in minimal view for two logs (-m overrides -M). # Show first header in minimal view for two logs (-m overrides -M).
# @TEST-EXEC: cat $LOGS/conn.log $LOGS/test.log | zeek-cut -M -m uid ts > both-m-opts-one # @TEST-EXEC: cat ${ZEEK_AUX_LOGS}/conn.log ${ZEEK_AUX_LOGS}/test.log | zeek-cut -M -m uid ts > both-m-opts-one
# @TEST-EXEC: btest-diff both-m-opts-one # @TEST-EXEC: TEST_DIFF_CANONIFIER= btest-diff both-m-opts-one
# Show first header in minimal view for two logs (-m overrides -C). # Show first header in minimal view for two logs (-m overrides -C).
# @TEST-EXEC: cat $LOGS/conn.log $LOGS/test.log | zeek-cut -C -m uid ts > both-c-m-opts-m # @TEST-EXEC: cat ${ZEEK_AUX_LOGS}/conn.log ${ZEEK_AUX_LOGS}/test.log | zeek-cut -C -m uid ts > both-c-m-opts-m
# @TEST-EXEC: btest-diff both-c-m-opts-m # @TEST-EXEC: TEST_DIFF_CANONIFIER= btest-diff both-c-m-opts-m
# Show all headers for two logs (-c overrides -M). # Show all headers for two logs (-c overrides -M).
# @TEST-EXEC: cat $LOGS/conn.log $LOGS/test.log | zeek-cut -M -c uid ts > both-m-c-opts-c # @TEST-EXEC: cat ${ZEEK_AUX_LOGS}/conn.log ${ZEEK_AUX_LOGS}/test.log | zeek-cut -M -c uid ts > both-m-c-opts-c
# @TEST-EXEC: btest-diff both-m-c-opts-c # @TEST-EXEC: TEST_DIFF_CANONIFIER= btest-diff both-m-c-opts-c
# Log files use different field separators. # Log files use different field separators.
# @TEST-EXEC: cat $LOGS/conn.log $LOGS/conncomma.log | zeek-cut -M proto uid > nondefault-separator # @TEST-EXEC: cat ${ZEEK_AUX_LOGS}/conn.log ${ZEEK_AUX_LOGS}/conncomma.log | zeek-cut -M proto uid > nondefault-separator
# @TEST-EXEC: btest-diff nondefault-separator # @TEST-EXEC: TEST_DIFF_CANONIFIER= btest-diff nondefault-separator
# Column order changes between two log files. # Column order changes between two log files.
# @TEST-EXEC: cat $LOGS/conn.log $LOGS/conntimelast.log | zeek-cut -M > different-col-order # @TEST-EXEC: cat ${ZEEK_AUX_LOGS}/conn.log ${ZEEK_AUX_LOGS}/conntimelast.log | zeek-cut -M > different-col-order
# @TEST-EXEC: btest-diff different-col-order # @TEST-EXEC: TEST_DIFF_CANONIFIER= btest-diff different-col-order
# Column order changes between two log files (and don't show all columns). # Column order changes between two log files (and don't show all columns).
# @TEST-EXEC: cat $LOGS/conn.log $LOGS/conntimelast.log | zeek-cut -M ts uid > different-col-order-some # @TEST-EXEC: cat ${ZEEK_AUX_LOGS}/conn.log ${ZEEK_AUX_LOGS}/conntimelast.log | zeek-cut -M ts uid > different-col-order-some
# @TEST-EXEC: btest-diff different-col-order-some # @TEST-EXEC: TEST_DIFF_CANONIFIER= btest-diff different-col-order-some

10
testing/btest/zeek-aux/zeek-cut/no-options.test
View file

@ -1,9 +1,9 @@
# Test zeek-cut without any command-line options. # @TEST-DOC: Test zeek-cut without any command-line options.
# #
# @TEST-EXEC: cat $LOGS/conn.log | zeek-cut > no-opts # @TEST-EXEC: cat ${ZEEK_AUX_LOGS}/conn.log | zeek-cut > no-opts
# @TEST-EXEC: btest-diff no-opts # @TEST-EXEC: TEST_DIFF_CANONIFIER= btest-diff no-opts
# Log file in "tsv" (tab-separated-values) format. # Log file in "tsv" (tab-separated-values) format.
# @TEST-EXEC: cat $LOGS/conn-tsv.log | zeek-cut > tsv # @TEST-EXEC: cat ${ZEEK_AUX_LOGS}/conn-tsv.log | zeek-cut > tsv
# @TEST-EXEC: btest-diff tsv # @TEST-EXEC: TEST_DIFF_CANONIFIER= btest-diff tsv

38
testing/btest/zeek-aux/zeek-cut/not-columns.test
View file

@ -1,38 +1,38 @@
# Test zeek-cut with the -n option. # @TEST-DOC: Test zeek-cut with the -n option.
# #
# Show all columns but one. # Show all columns but one.
# @TEST-EXEC: cat $LOGS/test.log | zeek-cut -n uid > not-one # @TEST-EXEC: cat ${ZEEK_AUX_LOGS}/test.log | zeek-cut -n uid > not-one
# @TEST-EXEC: btest-diff not-one # @TEST-EXEC: TEST_DIFF_CANONIFIER= btest-diff not-one
# Show all columns but two (and specify them in swapped order). # Show all columns but two (and specify them in swapped order).
# @TEST-EXEC: cat $LOGS/test.log | zeek-cut -n id.resp_h uid > not-two-swapped # @TEST-EXEC: cat ${ZEEK_AUX_LOGS}/test.log | zeek-cut -n id.resp_h uid > not-two-swapped
# @TEST-EXEC: btest-diff not-two-swapped # @TEST-EXEC: TEST_DIFF_CANONIFIER= btest-diff not-two-swapped
# Show all columns but one, but specify the same column twice. # Show all columns but one, but specify the same column twice.
# @TEST-EXEC: cat $LOGS/test.log | zeek-cut -n uid uid > not-one-twice # @TEST-EXEC: cat ${ZEEK_AUX_LOGS}/test.log | zeek-cut -n uid uid > not-one-twice
# @TEST-EXEC: btest-diff not-one-twice # @TEST-EXEC: TEST_DIFF_CANONIFIER= btest-diff not-one-twice
# Column order changes between two log files. # Column order changes between two log files.
# @TEST-EXEC: cat $LOGS/conn.log $LOGS/conntimelast.log | zeek-cut -n ts uid > different-col-order # @TEST-EXEC: cat ${ZEEK_AUX_LOGS}/conn.log ${ZEEK_AUX_LOGS}/conntimelast.log | zeek-cut -n ts uid > different-col-order
# @TEST-EXEC: btest-diff different-col-order # @TEST-EXEC: TEST_DIFF_CANONIFIER= btest-diff different-col-order
# Don't show any columns. # Don't show any columns.
# @TEST-EXEC: cat $LOGS/test.log | zeek-cut -n ts uid id.orig_h id.orig_p id.resp_h > not-all # @TEST-EXEC: cat ${ZEEK_AUX_LOGS}/test.log | zeek-cut -n ts uid id.orig_h id.orig_p id.resp_h > not-all
# @TEST-EXEC: btest-diff not-all # @TEST-EXEC: TEST_DIFF_CANONIFIER= btest-diff not-all
# Don't show the only column in the log. # Don't show the only column in the log.
# @TEST-EXEC: cat $LOGS/onecolumn.log | zeek-cut -n id.orig_h > not-only # @TEST-EXEC: cat ${ZEEK_AUX_LOGS}/onecolumn.log | zeek-cut -n id.orig_h > not-only
# @TEST-EXEC: btest-diff not-only # @TEST-EXEC: TEST_DIFF_CANONIFIER= btest-diff not-only
# Don't exclude any columns. # Don't exclude any columns.
# @TEST-EXEC: cat $LOGS/test.log | zeek-cut -n > not-none # @TEST-EXEC: cat ${ZEEK_AUX_LOGS}/test.log | zeek-cut -n > not-none
# @TEST-EXEC: btest-diff not-none # @TEST-EXEC: TEST_DIFF_CANONIFIER= btest-diff not-none
# Show all columns but one, and also specify a nonexistent column name. # Show all columns but one, and also specify a nonexistent column name.
# @TEST-EXEC: cat $LOGS/test.log | zeek-cut -n uid proto > not-one-nonexistent # @TEST-EXEC: cat ${ZEEK_AUX_LOGS}/test.log | zeek-cut -n uid proto > not-one-nonexistent
# @TEST-EXEC: btest-diff not-one-nonexistent # @TEST-EXEC: TEST_DIFF_CANONIFIER= btest-diff not-one-nonexistent
# Show that the -n option also affects the header. # Show that the -n option also affects the header.
# @TEST-EXEC: cat $LOGS/test.log | zeek-cut -c -n uid > not-one-show-header # @TEST-EXEC: cat ${ZEEK_AUX_LOGS}/test.log | zeek-cut -c -n uid > not-one-show-header
# @TEST-EXEC: btest-diff not-one-show-header # @TEST-EXEC: TEST_DIFF_CANONIFIER= btest-diff not-one-show-header

18
testing/btest/zeek-aux/zeek-cut/ofs.test
View file

@ -1,18 +1,18 @@
# Test zeek-cut with -F option. # @TEST-DOC: Test zeek-cut with -F option.
# #
# Use a different field separator on two columns. # Use a different field separator on two columns.
# @TEST-EXEC: cat $LOGS/conn.log | zeek-cut -F , uid ts > some-columns # @TEST-EXEC: cat ${ZEEK_AUX_LOGS}/conn.log | zeek-cut -F , uid ts > some-columns
# @TEST-EXEC: btest-diff some-columns # @TEST-EXEC: TEST_DIFF_CANONIFIER= btest-diff some-columns
# Show that -F option is used even when field separator in log files changes. # Show that -F option is used even when field separator in log files changes.
# @TEST-EXEC: cat $LOGS/conn.log $LOGS/conncomma.log | zeek-cut -F : proto uid > nondefault-separator # @TEST-EXEC: cat ${ZEEK_AUX_LOGS}/conn.log ${ZEEK_AUX_LOGS}/conncomma.log | zeek-cut -F : proto uid > nondefault-separator
# @TEST-EXEC: btest-diff nondefault-separator # @TEST-EXEC: TEST_DIFF_CANONIFIER= btest-diff nondefault-separator
# Field separator is not relevant because log has only one column. # Field separator is not relevant because log has only one column.
# @TEST-EXEC: cat $LOGS/onecolumn.log | zeek-cut -F , > only-column # @TEST-EXEC: cat ${ZEEK_AUX_LOGS}/onecolumn.log | zeek-cut -F , > only-column
# @TEST-EXEC: btest-diff only-column # @TEST-EXEC: TEST_DIFF_CANONIFIER= btest-diff only-column
# Show header and use a different field separator. # Show header and use a different field separator.
# @TEST-EXEC: cat $LOGS/conn.log | zeek-cut -F . -c > show-header # @TEST-EXEC: cat ${ZEEK_AUX_LOGS}/conn.log | zeek-cut -F . -c > show-header
# @TEST-EXEC: btest-diff show-header # @TEST-EXEC: TEST_DIFF_CANONIFIER= btest-diff show-header

38
testing/btest/zeek-aux/zeek-cut/show-header.test
View file

@ -1,38 +1,38 @@
# Test zeek-cut with -c and -C options. # @TEST-DOC: Test zeek-cut with -c and -C options.
# #
# Show first header for one log file. # Show first header for one log file.
# @TEST-EXEC: cat $LOGS/conn.log | zeek-cut -c > one-1st-nocols # @TEST-EXEC: cat ${ZEEK_AUX_LOGS}/conn.log | zeek-cut -c > one-1st-nocols
# @TEST-EXEC: btest-diff one-1st-nocols # @TEST-EXEC: TEST_DIFF_CANONIFIER= btest-diff one-1st-nocols
# Show all headers for one log file. # Show all headers for one log file.
# @TEST-EXEC: cat $LOGS/conn.log | zeek-cut -C > one-all-nocols # @TEST-EXEC: cat ${ZEEK_AUX_LOGS}/conn.log | zeek-cut -C > one-all-nocols
# @TEST-EXEC: btest-diff one-all-nocols # @TEST-EXEC: TEST_DIFF_CANONIFIER= btest-diff one-all-nocols
# Show first header for two log files. # Show first header for two log files.
# @TEST-EXEC: cat $LOGS/conn.log $LOGS/test.log | zeek-cut -c uid ts > two-1st-withcols # @TEST-EXEC: cat ${ZEEK_AUX_LOGS}/conn.log ${ZEEK_AUX_LOGS}/test.log | zeek-cut -c uid ts > two-1st-withcols
# @TEST-EXEC: btest-diff two-1st-withcols # @TEST-EXEC: TEST_DIFF_CANONIFIER= btest-diff two-1st-withcols
# Show all headers for two log files. # Show all headers for two log files.
# @TEST-EXEC: cat $LOGS/conn.log $LOGS/test.log | zeek-cut -C uid ts > two-all-withcols # @TEST-EXEC: cat ${ZEEK_AUX_LOGS}/conn.log ${ZEEK_AUX_LOGS}/test.log | zeek-cut -C uid ts > two-all-withcols
# @TEST-EXEC: btest-diff two-all-withcols # @TEST-EXEC: TEST_DIFF_CANONIFIER= btest-diff two-all-withcols
# Show all headers for two logs (-C overrides -c). # Show all headers for two logs (-C overrides -c).
# @TEST-EXEC: cat $LOGS/conn.log $LOGS/test.log | zeek-cut -c -C uid ts > both-c-opts-all # @TEST-EXEC: cat ${ZEEK_AUX_LOGS}/conn.log ${ZEEK_AUX_LOGS}/test.log | zeek-cut -c -C uid ts > both-c-opts-all
# @TEST-EXEC: btest-diff both-c-opts-all # @TEST-EXEC: TEST_DIFF_CANONIFIER= btest-diff both-c-opts-all
# Show first header for two logs (-c overrides -C). # Show first header for two logs (-c overrides -C).
# @TEST-EXEC: cat $LOGS/conn.log $LOGS/test.log | zeek-cut -C -c uid ts > both-c-opts-one # @TEST-EXEC: cat ${ZEEK_AUX_LOGS}/conn.log ${ZEEK_AUX_LOGS}/test.log | zeek-cut -C -c uid ts > both-c-opts-one
# @TEST-EXEC: btest-diff both-c-opts-one # @TEST-EXEC: TEST_DIFF_CANONIFIER= btest-diff both-c-opts-one
# Log files use different field separators. # Log files use different field separators.
# @TEST-EXEC: cat $LOGS/conn.log $LOGS/conncomma.log | zeek-cut -C proto uid > nondefault-separator # @TEST-EXEC: cat ${ZEEK_AUX_LOGS}/conn.log ${ZEEK_AUX_LOGS}/conncomma.log | zeek-cut -C proto uid > nondefault-separator
# @TEST-EXEC: btest-diff nondefault-separator # @TEST-EXEC: TEST_DIFF_CANONIFIER= btest-diff nondefault-separator
# Column order changes between two log files. # Column order changes between two log files.
# @TEST-EXEC: cat $LOGS/conn.log $LOGS/conntimelast.log | zeek-cut -C > different-col-order # @TEST-EXEC: cat ${ZEEK_AUX_LOGS}/conn.log ${ZEEK_AUX_LOGS}/conntimelast.log | zeek-cut -C > different-col-order
# @TEST-EXEC: btest-diff different-col-order # @TEST-EXEC: TEST_DIFF_CANONIFIER= btest-diff different-col-order
# Column order changes between two log files (and don't show all columns). # Column order changes between two log files (and don't show all columns).
# @TEST-EXEC: cat $LOGS/conn.log $LOGS/conntimelast.log | zeek-cut -C ts uid > different-col-order-some # @TEST-EXEC: cat ${ZEEK_AUX_LOGS}/conn.log ${ZEEK_AUX_LOGS}/conntimelast.log | zeek-cut -C ts uid > different-col-order-some
# @TEST-EXEC: btest-diff different-col-order-some # @TEST-EXEC: TEST_DIFF_CANONIFIER= btest-diff different-col-order-some

8
testing/btest/zeek-aux/zeek-cut/time-bad-logs.test
View file

@ -1,15 +1,15 @@
# Test zeek-cut time conversion with invalid log files. # @TEST-DOC: Test zeek-cut time conversion with invalid log files.
# #
# The "#types" log header line is missing. # The "#types" log header line is missing.
# @TEST-EXEC-FAIL: grep -v '^#types' $LOGS/conn.log | zeek-cut -d 2> missing-types-header # @TEST-EXEC-FAIL: grep -v '^#types' ${ZEEK_AUX_LOGS}/conn.log | zeek-cut -d 2> missing-types-header
# @TEST-EXEC: btest-diff missing-types-header # @TEST-EXEC: btest-diff missing-types-header
# All log header lines are missing. # All log header lines are missing.
# @TEST-EXEC: grep -v '^#' $LOGS/conn.log | zeek-cut -d > no-header-time # @TEST-EXEC: grep -v '^#' ${ZEEK_AUX_LOGS}/conn.log | zeek-cut -d > no-header-time
# @TEST-EXEC: btest-diff no-header-time # @TEST-EXEC: btest-diff no-header-time
# Time field is invalid or out of range # Time field is invalid or out of range
# @TEST-EXEC: cat $LOGS/invalid-time.log | zeek-cut -d > invalid-time-field 2> invalid-time-field.err # @TEST-EXEC: cat ${ZEEK_AUX_LOGS}/invalid-time.log | zeek-cut -d > invalid-time-field 2> invalid-time-field.err
# @TEST-EXEC: btest-diff invalid-time-field # @TEST-EXEC: btest-diff invalid-time-field
# @TEST-EXEC: btest-diff invalid-time-field.err # @TEST-EXEC: btest-diff invalid-time-field.err

28
testing/btest/zeek-aux/zeek-cut/time-conversion.test
View file

@ -1,42 +1,42 @@
# Test zeek-cut with time conversion options (-d/-u). # @TEST-DOC: Test zeek-cut with time conversion options (-d/-u).
# #
# Test -d option. # Test -d option.
# @TEST-EXEC: cat $LOGS/conn.log | zeek-cut -d > local # @TEST-EXEC: cat ${ZEEK_AUX_LOGS}/conn.log | zeek-cut -d > local
# @TEST-EXEC: btest-diff local # @TEST-EXEC: btest-diff local
# Test -u option. # Test -u option.
# @TEST-EXEC: cat $LOGS/conn.log | zeek-cut -u > utc # @TEST-EXEC: cat ${ZEEK_AUX_LOGS}/conn.log | zeek-cut -u > utc
# @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-time-zone btest-diff utc # @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/zeek-aux/diff-time-zone btest-diff utc
# Test that -u can override -d. # Test that -u can override -d.
# @TEST-EXEC: cat $LOGS/conn.log | zeek-cut -d -u > both-1 # @TEST-EXEC: cat ${ZEEK_AUX_LOGS}/conn.log | zeek-cut -d -u > both-1
# @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-time-zone btest-diff both-1 # @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/zeek-aux/diff-time-zone btest-diff both-1
# Test that -d can override -u. # Test that -d can override -u.
# @TEST-EXEC: cat $LOGS/conn.log | zeek-cut -u -d > both-2 # @TEST-EXEC: cat ${ZEEK_AUX_LOGS}/conn.log | zeek-cut -u -d > both-2
# @TEST-EXEC: btest-diff both-2 # @TEST-EXEC: btest-diff both-2
# First time value is zero. # First time value is zero.
# @TEST-EXEC: cat $LOGS/zerotime.log | zeek-cut -u > zero # @TEST-EXEC: cat ${ZEEK_AUX_LOGS}/zerotime.log | zeek-cut -u > zero
# @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-time-zone btest-diff zero # @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/zeek-aux/diff-time-zone btest-diff zero
# File has timestamp, but not in the first column. # File has timestamp, but not in the first column.
# @TEST-EXEC: cat $LOGS/conntimelast.log | zeek-cut -d > time-last-col # @TEST-EXEC: cat ${ZEEK_AUX_LOGS}/conntimelast.log | zeek-cut -d > time-last-col
# @TEST-EXEC: btest-diff time-last-col # @TEST-EXEC: btest-diff time-last-col
# File has more than one time column, and some timestamps are duplicates. # File has more than one time column, and some timestamps are duplicates.
# @TEST-EXEC: cat $LOGS/multiple-times.log | zeek-cut -d > multiple-times # @TEST-EXEC: cat ${ZEEK_AUX_LOGS}/multiple-times.log | zeek-cut -d > multiple-times
# @TEST-EXEC: btest-diff multiple-times # @TEST-EXEC: btest-diff multiple-times
# Column order changes between two log files. # Column order changes between two log files.
# @TEST-EXEC: cat $LOGS/conn.log $LOGS/conntimelast.log | zeek-cut -d > different-col-order # @TEST-EXEC: cat ${ZEEK_AUX_LOGS}/conn.log ${ZEEK_AUX_LOGS}/conntimelast.log | zeek-cut -d > different-col-order
# @TEST-EXEC: btest-diff different-col-order # @TEST-EXEC: btest-diff different-col-order
# File has no timestamps. # File has no timestamps.
# @TEST-EXEC: cat $LOGS/onecolumn.log | zeek-cut -d > no-timestamps # @TEST-EXEC: cat ${ZEEK_AUX_LOGS}/onecolumn.log | zeek-cut -d > no-timestamps
# @TEST-EXEC: btest-diff no-timestamps # @TEST-EXEC: btest-diff no-timestamps
# Input is missing the log header lines. # Input is missing the log header lines.
# @TEST-EXEC: grep -v '^#' $LOGS/conn.log | zeek-cut -d > missing-header # @TEST-EXEC: grep -v '^#' ${ZEEK_AUX_LOGS}/conn.log | zeek-cut -d > missing-header
# @TEST-EXEC: btest-diff missing-header # @TEST-EXEC: btest-diff missing-header

10
testing/btest/zeek-aux/zeek-cut/time-fmt-env.test
View file

@ -1,18 +1,18 @@
# Test zeek-cut with ZEEK_CUT_TIMEFMT environment variable. # @TEST-DOC: Test zeek-cut with ZEEK_CUT_TIMEFMT environment variable.
# #
# Output local time with format from environment. # Output local time with format from environment.
# @TEST-EXEC: cat $LOGS/conn.log | ZEEK_CUT_TIMEFMT="%H%M_%y%m%d" zeek-cut -d > env-local # @TEST-EXEC: cat ${ZEEK_AUX_LOGS}/conn.log | ZEEK_CUT_TIMEFMT="%H%M_%y%m%d" zeek-cut -d > env-local
# @TEST-EXEC: btest-diff env-local # @TEST-EXEC: btest-diff env-local
# Output UTC with format from environment. # Output UTC with format from environment.
# @TEST-EXEC: cat $LOGS/conn.log | ZEEK_CUT_TIMEFMT="%H%M_%y%m%d" zeek-cut -u > env-utc # @TEST-EXEC: cat ${ZEEK_AUX_LOGS}/conn.log | ZEEK_CUT_TIMEFMT="%H%M_%y%m%d" zeek-cut -u > env-utc
# @TEST-EXEC: btest-diff env-utc # @TEST-EXEC: btest-diff env-utc
# The "-D" option overrides environment variable. # The "-D" option overrides environment variable.
# @TEST-EXEC: cat $LOGS/conn.log | ZEEK_CUT_TIMEFMT="%H%M_%y%m%d" zeek-cut -D "%H %M %y %m %d" > env-local-fmt # @TEST-EXEC: cat ${ZEEK_AUX_LOGS}/conn.log | ZEEK_CUT_TIMEFMT="%H%M_%y%m%d" zeek-cut -D "%H %M %y %m %d" > env-local-fmt
# @TEST-EXEC: btest-diff env-local-fmt # @TEST-EXEC: btest-diff env-local-fmt
# The "-U" option overrides environment variable. # The "-U" option overrides environment variable.
# @TEST-EXEC: cat $LOGS/conn.log | ZEEK_CUT_TIMEFMT="%H%M_%y%m%d" zeek-cut -U "%H %M %y %m %d" > env-utc-fmt # @TEST-EXEC: cat ${ZEEK_AUX_LOGS}/conn.log | ZEEK_CUT_TIMEFMT="%H%M_%y%m%d" zeek-cut -U "%H %M %y %m %d" > env-utc-fmt
# @TEST-EXEC: btest-diff env-utc-fmt # @TEST-EXEC: btest-diff env-utc-fmt

14
testing/btest/zeek-aux/zeek-cut/time-fmt.test
View file

@ -1,26 +1,26 @@
# Test zeek-cut with time conversion options (-D/-U). # @TEST-DOC: Test zeek-cut with time conversion options (-D/-U).
# #
# Test -D option. # Test -D option.
# @TEST-EXEC: cat $LOGS/conn.log | zeek-cut -D "%H %M %y %m %d" > local-fmt # @TEST-EXEC: cat ${ZEEK_AUX_LOGS}/conn.log | zeek-cut -D "%H %M %y %m %d" > local-fmt
# @TEST-EXEC: btest-diff local-fmt # @TEST-EXEC: btest-diff local-fmt
# Test -U option. # Test -U option.
# @TEST-EXEC: cat $LOGS/conn.log | zeek-cut -U "%H %M %y %m %d" > utc-fmt # @TEST-EXEC: cat ${ZEEK_AUX_LOGS}/conn.log | zeek-cut -U "%H %M %y %m %d" > utc-fmt
# @TEST-EXEC: btest-diff utc-fmt # @TEST-EXEC: btest-diff utc-fmt
# Output local time (-D overrides -u). # Output local time (-D overrides -u).
# @TEST-EXEC: cat $LOGS/conn.log | zeek-cut -u -D "%H %M %y %m %d" > utc-local-fmt # @TEST-EXEC: cat ${ZEEK_AUX_LOGS}/conn.log | zeek-cut -u -D "%H %M %y %m %d" > utc-local-fmt
# @TEST-EXEC: btest-diff utc-local-fmt # @TEST-EXEC: btest-diff utc-local-fmt
# Output UTC time, but with format string from -D. # Output UTC time, but with format string from -D.
# @TEST-EXEC: cat $LOGS/conn.log | zeek-cut -D "%H %M %y %m %d" -u > local-fmt-utc # @TEST-EXEC: cat ${ZEEK_AUX_LOGS}/conn.log | zeek-cut -D "%H %M %y %m %d" -u > local-fmt-utc
# @TEST-EXEC: btest-diff local-fmt-utc # @TEST-EXEC: btest-diff local-fmt-utc
# Output UTC time (-U overrides -d). # Output UTC time (-U overrides -d).
# @TEST-EXEC: cat $LOGS/conn.log | zeek-cut -d -U "%H %M %y %m %d" > local-utc-fmt # @TEST-EXEC: cat ${ZEEK_AUX_LOGS}/conn.log | zeek-cut -d -U "%H %M %y %m %d" > local-utc-fmt
# @TEST-EXEC: btest-diff local-utc-fmt # @TEST-EXEC: btest-diff local-utc-fmt
# Output local time, but with format string from -U. # Output local time, but with format string from -U.
# @TEST-EXEC: cat $LOGS/conn.log | zeek-cut -U "%H %M %y %m %d" -d > utc-fmt-local # @TEST-EXEC: cat ${ZEEK_AUX_LOGS}/conn.log | zeek-cut -U "%H %M %y %m %d" -d > utc-fmt-local
# @TEST-EXEC: btest-diff utc-fmt-local # @TEST-EXEC: btest-diff utc-fmt-local

30
testing/btest/zeek-aux/zeek-cut/time-header.test
View file

@ -1,30 +1,30 @@
# Test zeek-cut with both time conversion and show header options. # @TEST-DOC: Test zeek-cut with both time conversion and show header options.
# #
# Time format string does not affect the header timestamps. # Time format string does not affect the header timestamps.
# @TEST-EXEC: cat $LOGS/test.log | zeek-cut -C -U "%H %M %y %m %d" > utc-fmt # @TEST-EXEC: cat ${ZEEK_AUX_LOGS}/test.log | zeek-cut -C -U "%H %M %y %m %d" > utc-fmt
# @TEST-EXEC: btest-diff utc-fmt # @TEST-EXEC: TEST_DIFF_CANONIFIER= btest-diff utc-fmt
# Log file uses non-default field separator. # Log file uses non-default field separator.
# @TEST-EXEC: cat $LOGS/conncomma.log | zeek-cut -C -d proto ts id.orig_h > nondefault-separator # @TEST-EXEC: cat ${ZEEK_AUX_LOGS}/conncomma.log | zeek-cut -C -d proto ts id.orig_h > nondefault-separator
# @TEST-EXEC: btest-diff nondefault-separator # @TEST-EXEC: TEST_DIFF_CANONIFIER= btest-diff nondefault-separator
# Field separator changes between two log files. # Field separator changes between two log files.
# @TEST-EXEC: cat $LOGS/conn.log $LOGS/conncomma.log | zeek-cut -C -d proto ts id.orig_h > different-field-separator # @TEST-EXEC: cat ${ZEEK_AUX_LOGS}/conn.log ${ZEEK_AUX_LOGS}/conncomma.log | zeek-cut -C -d proto ts id.orig_h > different-field-separator
# @TEST-EXEC: btest-diff different-field-separator # @TEST-EXEC: TEST_DIFF_CANONIFIER= btest-diff different-field-separator
# Column order changes between two log files. # Column order changes between two log files.
# @TEST-EXEC: cat $LOGS/conn.log $LOGS/conntimelast.log | zeek-cut -C -d proto ts id.orig_h > different-col-order # @TEST-EXEC: cat ${ZEEK_AUX_LOGS}/conn.log ${ZEEK_AUX_LOGS}/conntimelast.log | zeek-cut -C -d proto ts id.orig_h > different-col-order
# @TEST-EXEC: btest-diff different-col-order # @TEST-EXEC: TEST_DIFF_CANONIFIER= btest-diff different-col-order
# One file has timestamps and one file does not. # One file has timestamps and one file does not.
# @TEST-EXEC: cat $LOGS/conn.log $LOGS/onecolumn.log | zeek-cut -C -d ts id.orig_h > missing-ts-one-file # @TEST-EXEC: cat ${ZEEK_AUX_LOGS}/conn.log ${ZEEK_AUX_LOGS}/onecolumn.log | zeek-cut -C -d ts id.orig_h > missing-ts-one-file
# @TEST-EXEC: btest-diff missing-ts-one-file # @TEST-EXEC: TEST_DIFF_CANONIFIER= btest-diff missing-ts-one-file
# Specify ts twice. # Specify ts twice.
# @TEST-EXEC: cat $LOGS/conn.log | zeek-cut -C -d ts id.orig_h ts > ts-twice # @TEST-EXEC: cat ${ZEEK_AUX_LOGS}/conn.log | zeek-cut -C -d ts id.orig_h ts > ts-twice
# @TEST-EXEC: btest-diff ts-twice # @TEST-EXEC: TEST_DIFF_CANONIFIER= btest-diff ts-twice
# File has more than one time column. # File has more than one time column.
# @TEST-EXEC: cat $LOGS/multiple-times.log | zeek-cut -C -d proto ts2 ts1 > multiple-times # @TEST-EXEC: cat ${ZEEK_AUX_LOGS}/multiple-times.log | zeek-cut -C -d proto ts2 ts1 > multiple-times
# @TEST-EXEC: btest-diff multiple-times # @TEST-EXEC: TEST_DIFF_CANONIFIER= btest-diff multiple-times

11
testing/btest/zeek-aux/zeek-cut/time-optional.test
View file

@ -1,10 +1,9 @@
# Test zeek-cut with time conversion when a time field is optional and no value # @TEST-DOC: Test zeek-cut with time conversion when a time field is optional and no value is set.
# is set.
# #
# @TEST-EXEC: cat $LOGS/time-optional.log | zeek-cut -u > out 2>&1 # @TEST-EXEC: cat ${ZEEK_AUX_LOGS}/time-optional.log | zeek-cut -u > out 2>&1
# @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-time-zone btest-diff out # @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/zeek-aux/diff-time-zone btest-diff out
# File has a non-default unset field string. # File has a non-default unset field string.
# @TEST-EXEC: cat $LOGS/unset-field.log | zeek-cut -u > out2 2>&1 # @TEST-EXEC: cat ${ZEEK_AUX_LOGS}/unset-field.log | zeek-cut -u > out2 2>&1
# @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-time-zone btest-diff out2 # @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/zeek-aux/diff-time-zone btest-diff out2