mirror of
https://github.com/zeek/zeek.git
synced 2025-10-14 04:28:20 +00:00
Merge remote-tracking branch 'origin/master' into topic/johanna/ocsp
This commit is contained in:
Johanna Amann
commit
da9b5425e4
157 changed files with 1830 additions and 1130 deletions
|
|
@ -4,3 +4,11 @@ bro
|
|||
bro
|
||||
bro
|
||||
bro
|
||||
bro
|
||||
bro
|
||||
bro
|
||||
bro
|
||||
bro
|
||||
bro
|
||||
bro
|
||||
bro
|
||||
|
|
|
|||
12
testing/btest/Baseline/bifs.decode_base64_conn/weird.log
Normal file
12
testing/btest/Baseline/bifs.decode_base64_conn/weird.log
Normal file
|
|
@ -0,0 +1,12 @@
|
|||
#separator \x09
|
||||
#set_separator ,
|
||||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path weird
|
||||
#open 2015-08-31-03-09-20
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
|
||||
#types time string addr port addr port string string bool string
|
||||
1254722767.875996 CjhGID4nQcgTWjvg4c 10.10.1.4 1470 74.53.140.153 25 base64_illegal_encoding incomplete base64 group, padding with 12 bits of 0 F bro
|
||||
1437831787.861602 CPbrpk1qSsw6ESzHV4 192.168.133.100 49648 192.168.133.102 25 base64_illegal_encoding incomplete base64 group, padding with 12 bits of 0 F bro
|
||||
1437831799.610433 C7XEbhP654jzLoe3a 192.168.133.100 49655 17.167.150.73 443 base64_illegal_encoding incomplete base64 group, padding with 12 bits of 0 F bro
|
||||
#close 2015-08-31-03-09-20
|
||||
|
|
@ -1,5 +1,9 @@
|
|||
YnJv
|
||||
YnJv
|
||||
YnJv
|
||||
}n-v
|
||||
YnJv
|
||||
YnJv
|
||||
}n-v
|
||||
cGFkZGluZw==
|
||||
cGFkZGluZzE=
|
||||
|
|
|
|||
|
|
@ -4,3 +4,4 @@ mytest
|
|||
this__is__another__test
|
||||
thisisanothertest
|
||||
Test
|
||||
...hi..there
|
||||
|
|
|
|||
|
|
@ -23,10 +23,10 @@ net_weird, truncated_IP
|
|||
net_weird, truncated_IP
|
||||
net_weird, truncated_IP
|
||||
net_weird, truncated_IP
|
||||
rexmit_inconsistency, [orig_h=63.193.213.194, orig_p=2564/tcp, resp_h=128.3.97.175, resp_p=80/tcp], nlkmlpjfjjnoomfnqmdqgrdsgpefslhjrdjghsshrmosrkosidknnieiggpmnggelfhlkflfqojpjrsmeqghklmjlkdskjollmensjiqosemknoehellhlsspjfjpddfgqkemghskqosrksmkpsdomfoghllfokilshsisgpjhjoosidirlnmespjhdogdidoemejrnjjrookfrmiqllllqhlqfgolfqssfjrhrjhgfkpdnigiilrmnespjspeqjfedjhrkisjdhoofqdfeqnmihrelmildkngirkqorjslhmglripdojfedjjngjnpikoliqhdipgpshenekqiphmrsqmemghklodqnqoeggfkdqngrfollhjmddjreeghdqflohgrhqhelqsmdghgihpifpnikrddpmdfejhrhgfdfdlepmmhlhrnrslepqgmkopmdfogpoljeepqoemisfeksdeddiplnkfjddjioqhojlnmlirehidipdhqlddssssgpgikieeldsmfrkidpldsngdkidkoshkrofnonrrehghlmgmqshkedgpkpgjjkoneigsfjdlgjsngepfkndqoefqmsssrgegspromqepdpdeglmmegjljlmljeeorhhfmrohjeregpfshqjsqkekrihjdpfdjflgspepqjrqfemsjffmjfkhejdkrokmgdrhojgmgjpldjeiphroeheipolfmshoglkfnllfnhlflhlpddjflekhiqilefjpfqepdrrdokkjiekmelkhdpjlqjdlnfjemqdrksirdnjlrhrdijgqjhdqlidpfdisgrmnlfnsdlishlpfkshhglpdiqhpgmhpjdrpednjljfsqknsiqpfeqhlphgqdphflglpmqfkkhdjeodkelinkfpmfedidhphldmqjqggrljlhriehqqemeimkjhoqnsrdgengmgjokpeiijgrseppeoiflngggomdfjkndpqedhgnkiqlodkpjfkqoifidjmrdhhmglledkomllhpehdfjfdspmklkjdnhkdgpgqephfdfdrfplmepoegsekmrnikknelnprdpslmfkhghhooknieksjjhdeelidikndedijqqhfmphdondndpehmfoqelqigdpgioeljhedhfoeqlinriemqjigerkphgepqmiiidqlhriqioimpglonlsgomeloipndiihqqfiekkeriokrsjlmsjqiehqsrqkhdjlddjrrllirqkidqiggdrjpjirssgqepnqmhigfsqlekiqdddllnsjmroiofkieqnghddpjnhdjkfloilheljofddrkherkrieeoijrlfghiikmhpfdhekdjloejlmpperkgrhomedpfOOOOOOOOOOOOOOOOOOOOOOOOOOOO, nlkmlpjfjjnoomfnqmdqgrdsgpefslhjrdjghsshrmosrkosidknnieiggpmnggelfhlkflfqojpjrsmeqghklmjlkdskjollmensjiqosemknoehellhlsspjfjpddfgqkemghskqosrksmkpsdomfoghllfokilshsisgpjhjoosidirlnmespjhdogdidoemejrnjjrookfrmiqllllqhlqfgolfqssfjrhrjhgfkpdnigiilrmnespjspeqjfedjhrkisjdhoofqdfeqnmihrelmildkngirkqorjslhmglripdojfedjjngjnpikoliqhdipgpshenekqiphmrsqmemghklodqnqoeggfkdqngrfollhjmddjreeghdqflohgrhqhelqsmdghgihpifpnikrddpmdfejhrhgfdfdlepmmhlhrnrslepqgmkopmdfogpoljeepqoemisfeksdeddiplnkfjddjioqhojlnmlirehidipdhqlddssssgpgikieeldsmfrkidpldsngdkidkoshkrofnonrrehghlmgmqshkedgpkpgjjkoneigsfjdlgjsngepfkndqoefqmsssrgegspromqepdpdeglmmegjljlmljeeorhhfmrohjeregpfshqjsqkekrihjdpfdjflgspepqjrqfemsjffmjfkhejdkrokmgdrhojgmgjpldjeiphroeheipolfmshoglkfnllfnhlflhlpddjflekhiqilefjpfqepdrrdokkjiekmelkhdpjlqjdlnfjemqdrksirdnjlrhrdijgqjhdqlidpfdisgrmnlfnsdlishlpfkshhglpdiqhpgmhpjdrpednjljfsqknsiqpfeqhlphgqdphflglpmqfkkhdjeodkelinkfpmfedidhphldmqjqggrljlhriehqqemeimkjhoqnsrdgengmgjokpeiijgrseppeoiflngggomdfjkndpqedhgnkiqlodkpjfkqoifidjmrdhhmglledkomllhpehdfjfdspmklkjdnhkdgpgqephfdfdrfplmepoegsekmrnikknelnprdpslmfkhghhooknieksjjhdeelidikndedijqqhfmphdondndpehmfoqelqigdpgioeljhedhfoeqlinriemqjigerkphgepqmiiidqlhriqioimpglonlsgomeloipndiihqqfiekkeriokrsjlmsjqiehqsrqkhdjlddjrrllirqkidqiggdrjpjirssgqepnqmhigfsqlekiqdddllnsjmroiofkieqnghddpjnhdjkfloilheljofddrkherkrieeoijrlfghiikmhpfdhekdjloejlmpperkgrhomedpfqkrodjdmrqfpiodgphidfliidlhd
|
||||
rexmit_inconsistency, [orig_h=63.193.213.194, orig_p=2564/tcp, resp_h=128.3.97.175, resp_p=80/tcp], dgphrodofqhq, orgmmpelofil
|
||||
rexmit_inconsistency, [orig_h=63.193.213.194, orig_p=2564/tcp, resp_h=128.3.97.175, resp_p=80/tcp], lenhfdqhqfgs, dfpqssidkpdg
|
||||
rexmit_inconsistency, [orig_h=63.193.213.194, orig_p=2564/tcp, resp_h=128.3.97.175, resp_p=80/tcp], nlkmlpjfjjnoomfnqmdqgrdsgpefslhjrdjghsshrmosrkosidknnieiggpmnggelfhlkflfqojpjrsmeqghklmjlkdskjollmensjiqosemknoehellhlsspjfjpddfgqkemghskqosrksmkpsdomfoghllfokilshsisgpjhjoosidirlnmespjhdogdidoemejrnjjrookfrmiqllllqhlqfgolfqssfjrhrjhgfkpdnigiilrmnespjspeqjfedjhrkisjdhoofqdfeqnmihrelmildkngirkqorjslhmglripdojfedjjngjnpikoliqhdipgpshenekqiphmrsqmemghklodqnqoeggfkdqngrfollhjmddjreeghdqflohgrhqhelqsmdghgihpifpnikrddpmdfejhrhgfdfdlepmmhlhrnrslepqgmkopmdfogpoljeepqoemisfeksdeddiplnkfjddjioqhojlnmlirehidipdhqlddssssgpgikieeldsmfrkidpldsngdkidkoshkrofnonrrehghlmgmqshkedgpkpgjjkoneigsfjdlgjsngepfkndqoefqmsssrgegspromqepdpdeglmmegjljlmljeeorhhfmrohjeregpfshqjsqkekrihjdpfdjflgspepqjrqfemsjffmjfkhejdkrokmgdrhojgmgjpldjeiphroeheipolfmshoglkfnllfnhlflhlpddjflekhiqilefjpfqepdrrdokkjiekmelkhdpjlqjdlnfjemqdrksirdnjlrhrdijgqjhdqlidpfdisgrmnlfnsdlishlpfkshhglpdiqhpgmhpjdrpednjljfsqknsiqpfeqhlphgqdphflglpmqfkkhdjeodkelinkfpmfedidhphldmqjqggrljlhriehqqemeimkjhoqnsrdgengmgjokpeiijgrseppeoiflngggomdfjkndpqedhgnkiqlodkpjfkqoifidjmrdhhmglledkomllhpehdfjfdspmklkjdnhkdgpgqephfdfdrfplmepoegsekmrnikknelnprdpslmfkhghhooknieksjjhdeelidikndedijqqhfmphdondndpehmfoqelqigdpgioeljhedhfoeqlinriemqjigerkphgepqmiiidqlhriqioimpglonlsgomeloipndiihqqfiekkeriokrsjlmsjqiehqsrqkhdjlddjrrllirqkidqiggdrjpjirssgqepnqmhigfsqlekiqdddllnsjmroiofkieqnghddpjnhdjkfloilheljofddrkherkrieeoijrlfghiikmhpfdhekdjloejlmpperkgrhomedpfOOOOOOOOOOOOOOOOOOOOOOOOOOOO, nlkmlpjfjjnoomfnqmdqgrdsgpefslhjrdjghsshrmosrkosidknnieiggpmnggelfhlkflfqojpjrsmeqghklmjlkdskjollmensjiqosemknoehellhlsspjfjpddfgqkemghskqosrksmkpsdomfoghllfokilshsisgpjhjoosidirlnmespjhdogdidoemejrnjjrookfrmiqllllqhlqfgolfqssfjrhrjhgfkpdnigiilrmnespjspeqjfedjhrkisjdhoofqdfeqnmihrelmildkngirkqorjslhmglripdojfedjjngjnpikoliqhdipgpshenekqiphmrsqmemghklodqnqoeggfkdqngrfollhjmddjreeghdqflohgrhqhelqsmdghgihpifpnikrddpmdfejhrhgfdfdlepmmhlhrnrslepqgmkopmdfogpoljeepqoemisfeksdeddiplnkfjddjioqhojlnmlirehidipdhqlddssssgpgikieeldsmfrkidpldsngdkidkoshkrofnonrrehghlmgmqshkedgpkpgjjkoneigsfjdlgjsngepfkndqoefqmsssrgegspromqepdpdeglmmegjljlmljeeorhhfmrohjeregpfshqjsqkekrihjdpfdjflgspepqjrqfemsjffmjfkhejdkrokmgdrhojgmgjpldjeiphroeheipolfmshoglkfnllfnhlflhlpddjflekhiqilefjpfqepdrrdokkjiekmelkhdpjlqjdlnfjemqdrksirdnjlrhrdijgqjhdqlidpfdisgrmnlfnsdlishlpfkshhglpdiqhpgmhpjdrpednjljfsqknsiqpfeqhlphgqdphflglpmqfkkhdjeodkelinkfpmfedidhphldmqjqggrljlhriehqqemeimkjhoqnsrdgengmgjokpeiijgrseppeoiflngggomdfjkndpqedhgnkiqlodkpjfkqoifidjmrdhhmglledkomllhpehdfjfdspmklkjdnhkdgpgqephfdfdrfplmepoegsekmrnikknelnprdpslmfkhghhooknieksjjhdeelidikndedijqqhfmphdondndpehmfoqelqigdpgioeljhedhfoeqlinriemqjigerkphgepqmiiidqlhriqioimpglonlsgomeloipndiihqqfiekkeriokrsjlmsjqiehqsrqkhdjlddjrrllirqkidqiggdrjpjirssgqepnqmhigfsqlekiqdddllnsjmroiofkieqnghddpjnhdjkfloilheljofddrkherkrieeoijrlfghiikmhpfdhekdjloejlmpperkgrhomedpfqkrodjdmrqfpiodgphidfliislrr
|
||||
rexmit_inconsistency, [orig_h=63.193.213.194, orig_p=2564/tcp, resp_h=128.3.97.175, resp_p=80/tcp], iokgedlsdkjkiefgmeqkfjoh, ggdeolssksemrhedoledddml
|
||||
rexmit_inconsistency, [orig_h=63.193.213.194, orig_p=2564/tcp, resp_h=128.3.97.175, resp_p=80/tcp], nlkmlpjfjjnoomfnqmdqgrdsgpefslhjrdjghsshrmosrkosidknnieiggpmnggelfhlkflfqojpjrsmeqghklmjlkdskjollmensjiqosemknoehellhlsspjfjpddfgqkemghskqosrksmkpsdomfoghllfokilshsisgpjhjoosidirlnmespjhdogdidoemejrnjjrookfrmiqllllqhlqfgolfqssfjrhrjhgfkpdnigiilrmnespjspeqjfedjhrkisjdhoofqdfeqnmihrelmildkngirkqorjslhmglripdojfedjjngjnpikoliqhdipgpshenekqiphmrsqmemghklodqnqoeggfkdqngrfollhjmddjreeghdqflohgrhqhelqsmdghgihpifpnikrddpmdfejhrhgfdfdlepmmhlhrnrslepqgmkopmdfogpoljeepqoemisfeksdeddiplnkfjddjioqhojlnmlirehidipdhqlddssssgpgikieeldsmfrkidpldsngdkidkoshkrofnonrrehghlmgmqshkedgpkpgjjkoneigsfjdlgjsngepfkndqoefqmsssrgegspromqepdpdeglmmegjljlmljeeorhhfmrohjeregpfshqjsqkekrihjdpfdjflgspepqjrqfemsjffmjfkhejdkrokmgdrhojgmgjpldjeiphroeheipolfmshoglkfnllfnhlflhlpddjflekhiqilefjpfqepdrrdokkjiekmelkhdpjlqjdlnfjemqdrksirdnjlrhrdijgqjhdqlidpfdisgrmnlfnsdlishlpfkshhglpdiqhpgmhpjdrpednjljfsqknsiqpfeqhlphgqdphflglpmqfkkhdjeodkelinkfpmfedidhphldmqjqggrljlhriehqqemeimkjhoqnsrdgengmgjokpeiijgrseppeoiflngggomdfjkndpqedhgnkiqlodkpjfkqoifidjmrdhhmglledkomllhpehdfjfdspmklkjdnhkdgpgqephfdfdrfplmepoegsekmrnikknelnprdpslmfkhghhooknieksjjhdeelidikndedijqqhfmphdondndpehmfoqelqigdpgioeljhedhfoeqlinriemqjigerkphgepqmiiidqlhriqioimpglonlsgomeloipndiihqqfiekkeriokrsjlmsjqiehqsrqkhdjlddjrrllirqkidqiggdrjpjirssgqepnqmhigfsqlekiqdddllnsjmroiofkieqnghddpjnhdjkfloilheljofddrkherkrieeoijrlfghiikmhpfdhekdjloejlmpperkgrhomedpfOOOOOOOOOOOOOOOOOOOOOOOOOOOO, nlkmlpjfjjnoomfnqmdqgrdsgpefslhjrdjghsshrmosrkosidknnieiggpmnggelfhlkflfqojpjrsmeqghklmjlkdskjollmensjiqosemknoehellhlsspjfjpddfgqkemghskqosrksmkpsdomfoghllfokilshsisgpjhjoosidirlnmespjhdogdidoemejrnjjrookfrmiqllllqhlqfgolfqssfjrhrjhgfkpdnigiilrmnespjspeqjfedjhrkisjdhoofqdfeqnmihrelmildkngirkqorjslhmglripdojfedjjngjnpikoliqhdipgpshenekqiphmrsqmemghklodqnqoeggfkdqngrfollhjmddjreeghdqflohgrhqhelqsmdghgihpifpnikrddpmdfejhrhgfdfdlepmmhlhrnrslepqgmkopmdfogpoljeepqoemisfeksdeddiplnkfjddjioqhojlnmlirehidipdhqlddssssgpgikieeldsmfrkidpldsngdkidkoshkrofnonrrehghlmgmqshkedgpkpgjjkoneigsfjdlgjsngepfkndqoefqmsssrgegspromqepdpdeglmmegjljlmljeeorhhfmrohjeregpfshqjsqkekrihjdpfdjflgspepqjrqfemsjffmjfkhejdkrokmgdrhojgmgjpldjeiphroeheipolfmshoglkfnllfnhlflhlpddjflekhiqilefjpfqepdrrdokkjiekmelkhdpjlqjdlnfjemqdrksirdnjlrhrdijgqjhdqlidpfdisgrmnlfnsdlishlpfkshhglpdiqhpgmhpjdrpednjljfsqknsiqpfeqhlphgqdphflglpmqfkkhdjeodkelinkfpmfedidhphldmqjqggrljlhriehqqemeimkjhoqnsrdgengmgjokpeiijgrseppeoiflngggomdfjkndpqedhgnkiqlodkpjfkqoifidjmrdhhmglledkomllhpehdfjfdspmklkjdnhkdgpgqephfdfdrfplmepoegsekmrnikknelnprdpslmfkhghhooknieksjjhdeelidikndedijqqhfmphdondndpehmfoqelqigdpgioeljhedhfoeqlinriemqjigerkphgepqmiiidqlhriqioimpglonlsgomeloipndiihqqfiekkeriokrsjlmsjqiehqsrqkhdjlddjrrllirqkidqiggdrjpjirssgqepnqmhigfsqlekiqdddllnsjmroiofkieqnghddpjnhdjkfloilheljofddrkherkrieeoijrlfghiikmhpfdhekdjloejlmpperkgrhomedpfqkrodjdmrqfpiodgphidfliidlhd, A
|
||||
rexmit_inconsistency, [orig_h=63.193.213.194, orig_p=2564/tcp, resp_h=128.3.97.175, resp_p=80/tcp], dgphrodofqhq, orgmmpelofil, A
|
||||
rexmit_inconsistency, [orig_h=63.193.213.194, orig_p=2564/tcp, resp_h=128.3.97.175, resp_p=80/tcp], lenhfdqhqfgs, dfpqssidkpdg, A
|
||||
rexmit_inconsistency, [orig_h=63.193.213.194, orig_p=2564/tcp, resp_h=128.3.97.175, resp_p=80/tcp], nlkmlpjfjjnoomfnqmdqgrdsgpefslhjrdjghsshrmosrkosidknnieiggpmnggelfhlkflfqojpjrsmeqghklmjlkdskjollmensjiqosemknoehellhlsspjfjpddfgqkemghskqosrksmkpsdomfoghllfokilshsisgpjhjoosidirlnmespjhdogdidoemejrnjjrookfrmiqllllqhlqfgolfqssfjrhrjhgfkpdnigiilrmnespjspeqjfedjhrkisjdhoofqdfeqnmihrelmildkngirkqorjslhmglripdojfedjjngjnpikoliqhdipgpshenekqiphmrsqmemghklodqnqoeggfkdqngrfollhjmddjreeghdqflohgrhqhelqsmdghgihpifpnikrddpmdfejhrhgfdfdlepmmhlhrnrslepqgmkopmdfogpoljeepqoemisfeksdeddiplnkfjddjioqhojlnmlirehidipdhqlddssssgpgikieeldsmfrkidpldsngdkidkoshkrofnonrrehghlmgmqshkedgpkpgjjkoneigsfjdlgjsngepfkndqoefqmsssrgegspromqepdpdeglmmegjljlmljeeorhhfmrohjeregpfshqjsqkekrihjdpfdjflgspepqjrqfemsjffmjfkhejdkrokmgdrhojgmgjpldjeiphroeheipolfmshoglkfnllfnhlflhlpddjflekhiqilefjpfqepdrrdokkjiekmelkhdpjlqjdlnfjemqdrksirdnjlrhrdijgqjhdqlidpfdisgrmnlfnsdlishlpfkshhglpdiqhpgmhpjdrpednjljfsqknsiqpfeqhlphgqdphflglpmqfkkhdjeodkelinkfpmfedidhphldmqjqggrljlhriehqqemeimkjhoqnsrdgengmgjokpeiijgrseppeoiflngggomdfjkndpqedhgnkiqlodkpjfkqoifidjmrdhhmglledkomllhpehdfjfdspmklkjdnhkdgpgqephfdfdrfplmepoegsekmrnikknelnprdpslmfkhghhooknieksjjhdeelidikndedijqqhfmphdondndpehmfoqelqigdpgioeljhedhfoeqlinriemqjigerkphgepqmiiidqlhriqioimpglonlsgomeloipndiihqqfiekkeriokrsjlmsjqiehqsrqkhdjlddjrrllirqkidqiggdrjpjirssgqepnqmhigfsqlekiqdddllnsjmroiofkieqnghddpjnhdjkfloilheljofddrkherkrieeoijrlfghiikmhpfdhekdjloejlmpperkgrhomedpfOOOOOOOOOOOOOOOOOOOOOOOOOOOO, nlkmlpjfjjnoomfnqmdqgrdsgpefslhjrdjghsshrmosrkosidknnieiggpmnggelfhlkflfqojpjrsmeqghklmjlkdskjollmensjiqosemknoehellhlsspjfjpddfgqkemghskqosrksmkpsdomfoghllfokilshsisgpjhjoosidirlnmespjhdogdidoemejrnjjrookfrmiqllllqhlqfgolfqssfjrhrjhgfkpdnigiilrmnespjspeqjfedjhrkisjdhoofqdfeqnmihrelmildkngirkqorjslhmglripdojfedjjngjnpikoliqhdipgpshenekqiphmrsqmemghklodqnqoeggfkdqngrfollhjmddjreeghdqflohgrhqhelqsmdghgihpifpnikrddpmdfejhrhgfdfdlepmmhlhrnrslepqgmkopmdfogpoljeepqoemisfeksdeddiplnkfjddjioqhojlnmlirehidipdhqlddssssgpgikieeldsmfrkidpldsngdkidkoshkrofnonrrehghlmgmqshkedgpkpgjjkoneigsfjdlgjsngepfkndqoefqmsssrgegspromqepdpdeglmmegjljlmljeeorhhfmrohjeregpfshqjsqkekrihjdpfdjflgspepqjrqfemsjffmjfkhejdkrokmgdrhojgmgjpldjeiphroeheipolfmshoglkfnllfnhlflhlpddjflekhiqilefjpfqepdrrdokkjiekmelkhdpjlqjdlnfjemqdrksirdnjlrhrdijgqjhdqlidpfdisgrmnlfnsdlishlpfkshhglpdiqhpgmhpjdrpednjljfsqknsiqpfeqhlphgqdphflglpmqfkkhdjeodkelinkfpmfedidhphldmqjqggrljlhriehqqemeimkjhoqnsrdgengmgjokpeiijgrseppeoiflngggomdfjkndpqedhgnkiqlodkpjfkqoifidjmrdhhmglledkomllhpehdfjfdspmklkjdnhkdgpgqephfdfdrfplmepoegsekmrnikknelnprdpslmfkhghhooknieksjjhdeelidikndedijqqhfmphdondndpehmfoqelqigdpgioeljhedhfoeqlinriemqjigerkphgepqmiiidqlhriqioimpglonlsgomeloipndiihqqfiekkeriokrsjlmsjqiehqsrqkhdjlddjrrllirqkidqiggdrjpjirssgqepnqmhigfsqlekiqdddllnsjmroiofkieqnghddpjnhdjkfloilheljofddrkherkrieeoijrlfghiikmhpfdhekdjloejlmpperkgrhomedpfqkrodjdmrqfpiodgphidfliislrr, A
|
||||
rexmit_inconsistency, [orig_h=63.193.213.194, orig_p=2564/tcp, resp_h=128.3.97.175, resp_p=80/tcp], iokgedlsdkjkiefgmeqkfjoh, ggdeolssksemrhedoledddml, A
|
||||
net_weird, truncated_IP
|
||||
rexmit_inconsistency, [orig_h=63.193.213.194, orig_p=2564/tcp, resp_h=128.3.97.175, resp_p=80/tcp], OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO HTTP/1.1\x0d\x0aHost: 127.0.0.1\x0d\x0aContent-Type: text/xml\x0d\x0aContent-length: 1\x0d\x0a\x0d\x0aO<?xml version="1.0"?>\x0d\x0a<g:searchrequest xmlns:g=, OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO HTTP/1.1\x0d\x0aHost: 127.0.0.1\x0d\x0aContent-Type: text/xml\x0d\x0aContent-length: 1\x0d\x0a\x0d\x0aO<?xml version="1.0"?igplqgeqsonkllfshdjplhjspmde
|
||||
rexmit_inconsistency, [orig_h=63.193.213.194, orig_p=2564/tcp, resp_h=128.3.97.175, resp_p=80/tcp], OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO HTTP/1.1\x0d\x0aHost: 127.0.0.1\x0d\x0aContent-Type: text/xml\x0d\x0aContent-length: 1\x0d\x0a\x0d\x0aO<?xml version="1.0"?>\x0d\x0a<g:searchrequest xmlns:g=, OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO HTTP/1.1\x0d\x0aHost: 127.0.0.1\x0d\x0aContent-Type: text/xml\x0d\x0aContent-length: 1\x0d\x0a\x0d\x0aO<?xml version="1.0"?igplqgeqsonkllfshdjplhjspmde, AP
|
||||
|
|
|
|||
|
|
@ -2,3 +2,4 @@
|
|||
1429652006.683290 c: [orig_h=178.200.100.200, orig_p=39976/tcp, resp_h=96.126.98.124, resp_p=80/tcp]
|
||||
1429652006.683290 t1: HTTP/1.1 200 OK\x0d\x0aContent-Length: 5\x0d\x0a\x0d\x0aBANG!
|
||||
1429652006.683290 t2: HTTP/1.1 200 OK\x0d\x0aServer: nginx/1.4.4\x0d\x0aDate:
|
||||
1429652006.683290 tcp_flags: AP
|
||||
|
|
|
|||
23
testing/btest/Baseline/core.tcp.truncated-header/out
Normal file
23
testing/btest/Baseline/core.tcp.truncated-header/out
Normal file
|
|
@ -0,0 +1,23 @@
|
|||
1103139821.635001, [orig_h=128.3.26.249, orig_p=25/tcp, resp_h=201.186.157.67, resp_p=60827/tcp]
|
||||
1103139821.833528, [orig_h=128.3.26.249, orig_p=25/tcp, resp_h=201.186.157.67, resp_p=60827/tcp]
|
||||
1103139821.841126, [orig_h=128.3.26.249, orig_p=25/tcp, resp_h=201.186.157.67, resp_p=60827/tcp]
|
||||
1103139822.039902, [orig_h=128.3.26.249, orig_p=25/tcp, resp_h=201.186.157.67, resp_p=60827/tcp]
|
||||
1103139822.040151, [orig_h=128.3.26.249, orig_p=25/tcp, resp_h=201.186.157.67, resp_p=60827/tcp]
|
||||
1103139822.040254, [orig_h=128.3.26.249, orig_p=25/tcp, resp_h=201.186.157.67, resp_p=60827/tcp]
|
||||
1103139822.040878, [orig_h=128.3.26.249, orig_p=25/tcp, resp_h=201.186.157.67, resp_p=60827/tcp]
|
||||
1103139822.240529, [orig_h=128.3.26.249, orig_p=25/tcp, resp_h=201.186.157.67, resp_p=60827/tcp]
|
||||
1103139822.240632, [orig_h=128.3.26.249, orig_p=25/tcp, resp_h=201.186.157.67, resp_p=60827/tcp]
|
||||
1103139822.247627, [orig_h=128.3.26.249, orig_p=25/tcp, resp_h=201.186.157.67, resp_p=60827/tcp]
|
||||
1103139822.450278, [orig_h=128.3.26.249, orig_p=25/tcp, resp_h=201.186.157.67, resp_p=60827/tcp]
|
||||
1103139822.450381, [orig_h=128.3.26.249, orig_p=25/tcp, resp_h=201.186.157.67, resp_p=60827/tcp]
|
||||
1103139822.453253, [orig_h=128.3.26.249, orig_p=25/tcp, resp_h=201.186.157.67, resp_p=60827/tcp]
|
||||
1103139822.65178, [orig_h=128.3.26.249, orig_p=25/tcp, resp_h=201.186.157.67, resp_p=60827/tcp]
|
||||
1103139822.651883, [orig_h=128.3.26.249, orig_p=25/tcp, resp_h=201.186.157.67, resp_p=60827/tcp]
|
||||
1103139822.652756, [orig_h=128.3.26.249, orig_p=25/tcp, resp_h=201.186.157.67, resp_p=60827/tcp]
|
||||
1103139822.882264, [orig_h=128.3.26.249, orig_p=25/tcp, resp_h=201.186.157.67, resp_p=60827/tcp]
|
||||
1103139822.933982, [orig_h=128.3.26.249, orig_p=25/tcp, resp_h=201.186.157.67, resp_p=60827/tcp]
|
||||
1103139822.934084, [orig_h=128.3.26.249, orig_p=25/tcp, resp_h=201.186.157.67, resp_p=60827/tcp]
|
||||
1103139822.934209, [orig_h=128.3.26.249, orig_p=25/tcp, resp_h=201.186.157.67, resp_p=60827/tcp]
|
||||
1103139822.934214, [orig_h=128.3.26.249, orig_p=25/tcp, resp_h=201.186.157.67, resp_p=60827/tcp]
|
||||
1103139823.145731, [orig_h=128.3.26.249, orig_p=25/tcp, resp_h=201.186.157.67, resp_p=60827/tcp]
|
||||
1103139823.145958, [orig_h=128.3.26.249, orig_p=25/tcp, resp_h=201.186.157.67, resp_p=60827/tcp]
|
||||
|
|
@ -3,38 +3,48 @@
|
|||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path weird
|
||||
#open 2012-04-11-16-01-35
|
||||
#open 2015-08-31-21-35-27
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
|
||||
#types time string addr port addr port string string bool string
|
||||
1334160095.895421 - - - - - truncated_IP - F bro
|
||||
#close 2012-04-11-16-01-35
|
||||
#close 2015-08-31-21-35-27
|
||||
#separator \x09
|
||||
#set_separator ,
|
||||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path weird
|
||||
#open 2012-04-11-14-57-21
|
||||
#open 2015-08-31-21-35-27
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
|
||||
#types time string addr port addr port string string bool string
|
||||
1334156241.519125 - - - - - truncated_IP - F bro
|
||||
#close 2012-04-11-14-57-21
|
||||
#close 2015-08-31-21-35-27
|
||||
#separator \x09
|
||||
#set_separator ,
|
||||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path weird
|
||||
#open 2012-04-10-21-50-48
|
||||
#open 2015-08-31-21-35-28
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
|
||||
#types time string addr port addr port string string bool string
|
||||
1334094648.590126 - - - - - truncated_IP - F bro
|
||||
#close 2012-04-10-21-50-48
|
||||
#close 2015-08-31-21-35-28
|
||||
#separator \x09
|
||||
#set_separator ,
|
||||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path weird
|
||||
#open 2012-05-29-22-02-34
|
||||
#open 2015-08-31-21-35-30
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
|
||||
#types time string addr port addr port string string bool string
|
||||
1338328954.078361 - - - - - internally_truncated_header - F bro
|
||||
#close 2012-05-29-22-02-34
|
||||
#close 2015-08-31-21-35-30
|
||||
#separator \x09
|
||||
#set_separator ,
|
||||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path weird
|
||||
#open 2015-08-31-21-35-30
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
|
||||
#types time string addr port addr port string string bool string
|
||||
0.000000 - - - - - truncated_link_header - F bro
|
||||
#close 2015-08-31-21-35-30
|
||||
|
|
|
|||
16
testing/btest/Baseline/core.x509-generalizedtime/output
Normal file
16
testing/btest/Baseline/core.x509-generalizedtime/output
Normal file
|
|
@ -0,0 +1,16 @@
|
|||
----- x509_certificate ----
|
||||
serial: 03E8
|
||||
not_valid_before: 2015-09-01-13:33:37.000000000 (epoch: 1441114417.0)
|
||||
not_valid_after : 2025-09-01-13:33:37.000000000 (epoch: 1756733617.0)
|
||||
----- x509_certificate ----
|
||||
serial: 99FAA8037A4EB2FAEF84EB5E55D5B8C8
|
||||
not_valid_before: 2011-05-04-00:00:00.000000000 (epoch: 1304467200.0)
|
||||
not_valid_after : 2016-07-04-23:59:59.000000000 (epoch: 1467676799.0)
|
||||
----- x509_certificate ----
|
||||
serial: 1690C329B6780607511F05B0344846CB
|
||||
not_valid_before: 2010-04-16-00:00:00.000000000 (epoch: 1271376000.0)
|
||||
not_valid_after : 2020-05-30-10:48:38.000000000 (epoch: 1590835718.0)
|
||||
----- x509_certificate ----
|
||||
serial: 01
|
||||
not_valid_before: 2000-05-30-10:48:38.000000000 (epoch: 959683718.0)
|
||||
not_valid_after : 2020-05-30-10:48:38.000000000 (epoch: 1590835718.0)
|
||||
|
|
@ -3,7 +3,7 @@
|
|||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path loaded_scripts
|
||||
#open 2015-04-21-22-29-19
|
||||
#open 2015-08-31-04-50-43
|
||||
#fields name
|
||||
#types string
|
||||
scripts/base/init-bare.bro
|
||||
|
|
@ -46,7 +46,7 @@ scripts/base/init-bare.bro
|
|||
scripts/base/frameworks/files/magic/__load__.bro
|
||||
build/scripts/base/bif/__load__.bro
|
||||
build/scripts/base/bif/broxygen.bif.bro
|
||||
build/scripts/base/bif/pcap.bif.bro
|
||||
build/scripts/base/bif/functions.bif.bro
|
||||
build/scripts/base/bif/bloom-filter.bif.bro
|
||||
build/scripts/base/bif/cardinality-counter.bif.bro
|
||||
build/scripts/base/bif/top-k.bif.bro
|
||||
|
|
@ -128,4 +128,4 @@ scripts/base/init-bare.bro
|
|||
build/scripts/base/bif/plugins/Bro_SQLiteWriter.sqlite.bif.bro
|
||||
scripts/policy/misc/loaded-scripts.bro
|
||||
scripts/base/utils/paths.bro
|
||||
#close 2015-04-21-22-29-19
|
||||
#close 2015-08-31-04-50-43
|
||||
|
|
|
|||
|
|
@ -3,7 +3,7 @@
|
|||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path loaded_scripts
|
||||
#open 2015-04-21-22-29-27
|
||||
#open 2015-08-31-05-07-15
|
||||
#fields name
|
||||
#types string
|
||||
scripts/base/init-bare.bro
|
||||
|
|
@ -46,7 +46,7 @@ scripts/base/init-bare.bro
|
|||
scripts/base/frameworks/files/magic/__load__.bro
|
||||
build/scripts/base/bif/__load__.bro
|
||||
build/scripts/base/bif/broxygen.bif.bro
|
||||
build/scripts/base/bif/pcap.bif.bro
|
||||
build/scripts/base/bif/functions.bif.bro
|
||||
build/scripts/base/bif/bloom-filter.bif.bro
|
||||
build/scripts/base/bif/cardinality-counter.bif.bro
|
||||
build/scripts/base/bif/top-k.bif.bro
|
||||
|
|
@ -273,4 +273,4 @@ scripts/base/init-default.bro
|
|||
scripts/base/misc/find-checksum-offloading.bro
|
||||
scripts/base/misc/find-filtered-trace.bro
|
||||
scripts/policy/misc/loaded-scripts.bro
|
||||
#close 2015-04-21-22-29-27
|
||||
#close 2015-08-31-05-07-15
|
||||
|
|
|
|||
|
|
@ -2,7 +2,6 @@
|
|||
|
||||
connecting-connector.bro
|
||||
|
||||
|
||||
const broker_port: port = 9999/tcp &redef;
|
||||
redef exit_only_after_terminate = T;
|
||||
redef BrokerComm::endpoint_name = "connector";
|
||||
|
|
|
|||
|
|
@ -2,7 +2,6 @@
|
|||
|
||||
connecting-listener.bro
|
||||
|
||||
|
||||
const broker_port: port = 9999/tcp &redef;
|
||||
redef exit_only_after_terminate = T;
|
||||
redef BrokerComm::endpoint_name = "listener";
|
||||
|
|
|
|||
|
|
@ -2,7 +2,6 @@
|
|||
|
||||
events-listener.bro
|
||||
|
||||
|
||||
const broker_port: port = 9999/tcp &redef;
|
||||
redef exit_only_after_terminate = T;
|
||||
redef BrokerComm::endpoint_name = "listener";
|
||||
|
|
|
|||
|
|
@ -2,7 +2,6 @@
|
|||
|
||||
printing-listener.bro
|
||||
|
||||
|
||||
const broker_port: port = 9999/tcp &redef;
|
||||
redef exit_only_after_terminate = T;
|
||||
redef BrokerComm::endpoint_name = "listener";
|
||||
|
|
|
|||
|
|
@ -2,7 +2,6 @@
|
|||
|
||||
testlog.bro
|
||||
|
||||
|
||||
module Test;
|
||||
|
||||
export {
|
||||
|
|
|
|||
|
|
@ -8,7 +8,7 @@ type Service: record {
|
|||
rfc: count;
|
||||
};
|
||||
|
||||
function print_service(serv: Service): string
|
||||
function print_service(serv: Service)
|
||||
{
|
||||
print fmt("Service: %s(RFC%d)",serv$name, serv$rfc);
|
||||
|
||||
|
|
|
|||
|
|
@ -13,7 +13,7 @@ type System: record {
|
|||
services: set[Service];
|
||||
};
|
||||
|
||||
function print_service(serv: Service): string
|
||||
function print_service(serv: Service)
|
||||
{
|
||||
print fmt(" Service: %s(RFC%d)",serv$name, serv$rfc);
|
||||
|
||||
|
|
@ -21,7 +21,7 @@ function print_service(serv: Service): string
|
|||
print fmt(" port: %s", p);
|
||||
}
|
||||
|
||||
function print_system(sys: System): string
|
||||
function print_system(sys: System)
|
||||
{
|
||||
print fmt("System: %s", sys$name);
|
||||
|
||||
|
|
|
|||
|
|
@ -220,7 +220,7 @@
|
|||
0.000000 MetaHookPost CallFunction(Log::__create_stream, <frame>, (Weird::LOG, [columns=<no value description>, ev=Weird::log_weird, path=weird])) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::__create_stream, <frame>, (X509::LOG, [columns=<no value description>, ev=X509::log_x509, path=x509])) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::__create_stream, <frame>, (mysql::LOG, [columns=<no value description>, ev=MySQL::log_mysql, path=mysql])) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::__write, <frame>, (PacketFilter::LOG, [ts=1439244305.210087, node=bro, filter=ip or not ip, init=T, success=T])) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::__write, <frame>, (PacketFilter::LOG, [ts=1440997649.720991, node=bro, filter=ip or not ip, init=T, success=T])) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::add_default_filter, <frame>, (Cluster::LOG)) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::add_default_filter, <frame>, (Communication::LOG)) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::add_default_filter, <frame>, (Conn::LOG)) -> <no result>
|
||||
|
|
@ -326,11 +326,13 @@
|
|||
0.000000 MetaHookPost CallFunction(Log::create_stream, <frame>, (Weird::LOG, [columns=<no value description>, ev=Weird::log_weird, path=weird])) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::create_stream, <frame>, (X509::LOG, [columns=<no value description>, ev=X509::log_x509, path=x509])) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::create_stream, <frame>, (mysql::LOG, [columns=<no value description>, ev=MySQL::log_mysql, path=mysql])) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::write, <frame>, (PacketFilter::LOG, [ts=1439244305.210087, node=bro, filter=ip or not ip, init=T, success=T])) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::write, <frame>, (PacketFilter::LOG, [ts=1440997649.720991, node=bro, filter=ip or not ip, init=T, success=T])) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Notice::want_pp, <frame>, ()) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(PacketFilter::build, <frame>, ()) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(PacketFilter::combine_filters, <frame>, (ip or not ip, and, )) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(PacketFilter::install, <frame>, ()) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Pcap::install_pcap_filter, <frame>, (PacketFilter::DefaultPcapFilter)) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Pcap::precompile_pcap_filter, <frame>, (PacketFilter::DefaultPcapFilter, ip or not ip)) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(SumStats::add_observe_plugin_dependency, <frame>, (SumStats::STD_DEV, SumStats::VARIANCE)) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(SumStats::add_observe_plugin_dependency, <frame>, (SumStats::VARIANCE, SumStats::AVERAGE)) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(SumStats::register_observe_plugin, <frame>, (SumStats::AVERAGE, anonymous-function{ if (!SumStats::rv?$average) SumStats::rv$average = SumStats::valelseSumStats::rv$average += (SumStats::val - SumStats::rv$average) / (coerce SumStats::rv$num to double)})) -> <no result>
|
||||
|
|
@ -351,9 +353,7 @@
|
|||
0.000000 MetaHookPost CallFunction(current_time, <frame>, ()) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(filter_change_tracking, <null>, ()) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(getenv, <null>, (CLUSTER_NODE)) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(install_pcap_filter, <frame>, (PacketFilter::DefaultPcapFilter)) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(network_time, <frame>, ()) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(precompile_pcap_filter, <frame>, (PacketFilter::DefaultPcapFilter, ip or not ip)) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(reading_live_traffic, <frame>, ()) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(reading_traces, <frame>, ()) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(set_to_regex, <frame>, ({}, (^\.?|\.)(~~)$)) -> <no result>
|
||||
|
|
@ -453,6 +453,7 @@
|
|||
0.000000 MetaHookPost LoadFile(./exec) -> -1
|
||||
0.000000 MetaHookPost LoadFile(./file_analysis.bif.bro) -> -1
|
||||
0.000000 MetaHookPost LoadFile(./files) -> -1
|
||||
0.000000 MetaHookPost LoadFile(./functions.bif.bro) -> -1
|
||||
0.000000 MetaHookPost LoadFile(./gridftp) -> -1
|
||||
0.000000 MetaHookPost LoadFile(./hll_unique) -> -1
|
||||
0.000000 MetaHookPost LoadFile(./hooks.bif.bro) -> -1
|
||||
|
|
@ -473,7 +474,6 @@
|
|||
0.000000 MetaHookPost LoadFile(./netstats) -> -1
|
||||
0.000000 MetaHookPost LoadFile(./non-cluster) -> -1
|
||||
0.000000 MetaHookPost LoadFile(./patterns) -> -1
|
||||
0.000000 MetaHookPost LoadFile(./pcap.bif.bro) -> -1
|
||||
0.000000 MetaHookPost LoadFile(./plugins) -> -1
|
||||
0.000000 MetaHookPost LoadFile(./polling) -> -1
|
||||
0.000000 MetaHookPost LoadFile(./postprocessors) -> -1
|
||||
|
|
@ -812,7 +812,7 @@
|
|||
0.000000 MetaHookPre CallFunction(Log::__create_stream, <frame>, (Weird::LOG, [columns=<no value description>, ev=Weird::log_weird, path=weird]))
|
||||
0.000000 MetaHookPre CallFunction(Log::__create_stream, <frame>, (X509::LOG, [columns=<no value description>, ev=X509::log_x509, path=x509]))
|
||||
0.000000 MetaHookPre CallFunction(Log::__create_stream, <frame>, (mysql::LOG, [columns=<no value description>, ev=MySQL::log_mysql, path=mysql]))
|
||||
0.000000 MetaHookPre CallFunction(Log::__write, <frame>, (PacketFilter::LOG, [ts=1439244305.210087, node=bro, filter=ip or not ip, init=T, success=T]))
|
||||
0.000000 MetaHookPre CallFunction(Log::__write, <frame>, (PacketFilter::LOG, [ts=1440997649.720991, node=bro, filter=ip or not ip, init=T, success=T]))
|
||||
0.000000 MetaHookPre CallFunction(Log::add_default_filter, <frame>, (Cluster::LOG))
|
||||
0.000000 MetaHookPre CallFunction(Log::add_default_filter, <frame>, (Communication::LOG))
|
||||
0.000000 MetaHookPre CallFunction(Log::add_default_filter, <frame>, (Conn::LOG))
|
||||
|
|
@ -918,11 +918,13 @@
|
|||
0.000000 MetaHookPre CallFunction(Log::create_stream, <frame>, (Weird::LOG, [columns=<no value description>, ev=Weird::log_weird, path=weird]))
|
||||
0.000000 MetaHookPre CallFunction(Log::create_stream, <frame>, (X509::LOG, [columns=<no value description>, ev=X509::log_x509, path=x509]))
|
||||
0.000000 MetaHookPre CallFunction(Log::create_stream, <frame>, (mysql::LOG, [columns=<no value description>, ev=MySQL::log_mysql, path=mysql]))
|
||||
0.000000 MetaHookPre CallFunction(Log::write, <frame>, (PacketFilter::LOG, [ts=1439244305.210087, node=bro, filter=ip or not ip, init=T, success=T]))
|
||||
0.000000 MetaHookPre CallFunction(Log::write, <frame>, (PacketFilter::LOG, [ts=1440997649.720991, node=bro, filter=ip or not ip, init=T, success=T]))
|
||||
0.000000 MetaHookPre CallFunction(Notice::want_pp, <frame>, ())
|
||||
0.000000 MetaHookPre CallFunction(PacketFilter::build, <frame>, ())
|
||||
0.000000 MetaHookPre CallFunction(PacketFilter::combine_filters, <frame>, (ip or not ip, and, ))
|
||||
0.000000 MetaHookPre CallFunction(PacketFilter::install, <frame>, ())
|
||||
0.000000 MetaHookPre CallFunction(Pcap::install_pcap_filter, <frame>, (PacketFilter::DefaultPcapFilter))
|
||||
0.000000 MetaHookPre CallFunction(Pcap::precompile_pcap_filter, <frame>, (PacketFilter::DefaultPcapFilter, ip or not ip))
|
||||
0.000000 MetaHookPre CallFunction(SumStats::add_observe_plugin_dependency, <frame>, (SumStats::STD_DEV, SumStats::VARIANCE))
|
||||
0.000000 MetaHookPre CallFunction(SumStats::add_observe_plugin_dependency, <frame>, (SumStats::VARIANCE, SumStats::AVERAGE))
|
||||
0.000000 MetaHookPre CallFunction(SumStats::register_observe_plugin, <frame>, (SumStats::AVERAGE, anonymous-function{ if (!SumStats::rv?$average) SumStats::rv$average = SumStats::valelseSumStats::rv$average += (SumStats::val - SumStats::rv$average) / (coerce SumStats::rv$num to double)}))
|
||||
|
|
@ -943,9 +945,7 @@
|
|||
0.000000 MetaHookPre CallFunction(current_time, <frame>, ())
|
||||
0.000000 MetaHookPre CallFunction(filter_change_tracking, <null>, ())
|
||||
0.000000 MetaHookPre CallFunction(getenv, <null>, (CLUSTER_NODE))
|
||||
0.000000 MetaHookPre CallFunction(install_pcap_filter, <frame>, (PacketFilter::DefaultPcapFilter))
|
||||
0.000000 MetaHookPre CallFunction(network_time, <frame>, ())
|
||||
0.000000 MetaHookPre CallFunction(precompile_pcap_filter, <frame>, (PacketFilter::DefaultPcapFilter, ip or not ip))
|
||||
0.000000 MetaHookPre CallFunction(reading_live_traffic, <frame>, ())
|
||||
0.000000 MetaHookPre CallFunction(reading_traces, <frame>, ())
|
||||
0.000000 MetaHookPre CallFunction(set_to_regex, <frame>, ({}, (^\.?|\.)(~~)$))
|
||||
|
|
@ -1045,6 +1045,7 @@
|
|||
0.000000 MetaHookPre LoadFile(./exec)
|
||||
0.000000 MetaHookPre LoadFile(./file_analysis.bif.bro)
|
||||
0.000000 MetaHookPre LoadFile(./files)
|
||||
0.000000 MetaHookPre LoadFile(./functions.bif.bro)
|
||||
0.000000 MetaHookPre LoadFile(./gridftp)
|
||||
0.000000 MetaHookPre LoadFile(./hll_unique)
|
||||
0.000000 MetaHookPre LoadFile(./hooks.bif.bro)
|
||||
|
|
@ -1065,7 +1066,6 @@
|
|||
0.000000 MetaHookPre LoadFile(./netstats)
|
||||
0.000000 MetaHookPre LoadFile(./non-cluster)
|
||||
0.000000 MetaHookPre LoadFile(./patterns)
|
||||
0.000000 MetaHookPre LoadFile(./pcap.bif.bro)
|
||||
0.000000 MetaHookPre LoadFile(./plugins)
|
||||
0.000000 MetaHookPre LoadFile(./polling)
|
||||
0.000000 MetaHookPre LoadFile(./postprocessors)
|
||||
|
|
@ -1403,7 +1403,7 @@
|
|||
0.000000 | HookCallFunction Log::__create_stream(Weird::LOG, [columns=<no value description>, ev=Weird::log_weird, path=weird])
|
||||
0.000000 | HookCallFunction Log::__create_stream(X509::LOG, [columns=<no value description>, ev=X509::log_x509, path=x509])
|
||||
0.000000 | HookCallFunction Log::__create_stream(mysql::LOG, [columns=<no value description>, ev=MySQL::log_mysql, path=mysql])
|
||||
0.000000 | HookCallFunction Log::__write(PacketFilter::LOG, [ts=1439244305.210087, node=bro, filter=ip or not ip, init=T, success=T])
|
||||
0.000000 | HookCallFunction Log::__write(PacketFilter::LOG, [ts=1440997649.720991, node=bro, filter=ip or not ip, init=T, success=T])
|
||||
0.000000 | HookCallFunction Log::add_default_filter(Cluster::LOG)
|
||||
0.000000 | HookCallFunction Log::add_default_filter(Communication::LOG)
|
||||
0.000000 | HookCallFunction Log::add_default_filter(Conn::LOG)
|
||||
|
|
@ -1509,11 +1509,13 @@
|
|||
0.000000 | HookCallFunction Log::create_stream(Weird::LOG, [columns=<no value description>, ev=Weird::log_weird, path=weird])
|
||||
0.000000 | HookCallFunction Log::create_stream(X509::LOG, [columns=<no value description>, ev=X509::log_x509, path=x509])
|
||||
0.000000 | HookCallFunction Log::create_stream(mysql::LOG, [columns=<no value description>, ev=MySQL::log_mysql, path=mysql])
|
||||
0.000000 | HookCallFunction Log::write(PacketFilter::LOG, [ts=1439244305.210087, node=bro, filter=ip or not ip, init=T, success=T])
|
||||
0.000000 | HookCallFunction Log::write(PacketFilter::LOG, [ts=1440997649.720991, node=bro, filter=ip or not ip, init=T, success=T])
|
||||
0.000000 | HookCallFunction Notice::want_pp()
|
||||
0.000000 | HookCallFunction PacketFilter::build()
|
||||
0.000000 | HookCallFunction PacketFilter::combine_filters(ip or not ip, and, )
|
||||
0.000000 | HookCallFunction PacketFilter::install()
|
||||
0.000000 | HookCallFunction Pcap::install_pcap_filter(PacketFilter::DefaultPcapFilter)
|
||||
0.000000 | HookCallFunction Pcap::precompile_pcap_filter(PacketFilter::DefaultPcapFilter, ip or not ip)
|
||||
0.000000 | HookCallFunction SumStats::add_observe_plugin_dependency(SumStats::STD_DEV, SumStats::VARIANCE)
|
||||
0.000000 | HookCallFunction SumStats::add_observe_plugin_dependency(SumStats::VARIANCE, SumStats::AVERAGE)
|
||||
0.000000 | HookCallFunction SumStats::register_observe_plugin(SumStats::AVERAGE, anonymous-function{ if (!SumStats::rv?$average) SumStats::rv$average = SumStats::valelseSumStats::rv$average += (SumStats::val - SumStats::rv$average) / (coerce SumStats::rv$num to double)})
|
||||
|
|
@ -1534,9 +1536,7 @@
|
|||
0.000000 | HookCallFunction current_time()
|
||||
0.000000 | HookCallFunction filter_change_tracking()
|
||||
0.000000 | HookCallFunction getenv(CLUSTER_NODE)
|
||||
0.000000 | HookCallFunction install_pcap_filter(PacketFilter::DefaultPcapFilter)
|
||||
0.000000 | HookCallFunction network_time()
|
||||
0.000000 | HookCallFunction precompile_pcap_filter(PacketFilter::DefaultPcapFilter, ip or not ip)
|
||||
0.000000 | HookCallFunction reading_live_traffic()
|
||||
0.000000 | HookCallFunction reading_traces()
|
||||
0.000000 | HookCallFunction set_to_regex({}, (^\.?|\.)(~~)$)
|
||||
|
|
|
|||
|
|
@ -1,2 +1,3 @@
|
|||
fkh:KH;fdkncv;ISEUp34:Fkdj;YVpIODhfDF
|
||||
F
|
||||
hi
|
||||
|
|
|
|||
|
|
@ -0,0 +1 @@
|
|||
{"msg":"Testing 1 2 3 "}
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
#separator \x09
|
||||
#set_separator ,
|
||||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path conn
|
||||
#open 2015-10-23-20-09-31
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents
|
||||
#types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string]
|
||||
1443732977.727740 CXWv6p3arKYeMETxOg ::1 52522 ::1 80 tcp ssl,http 0.691241 3644 55499 S1 - - 0 ShAaDd 29 5744 29 57599 (empty)
|
||||
#close 2015-10-23-20-09-32
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
#separator \x09
|
||||
#set_separator ,
|
||||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path http
|
||||
#open 2015-10-23-20-09-31
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied orig_fuids orig_mime_types resp_fuids resp_mime_types
|
||||
#types time string addr port addr port count string string string string string count count count string count string string set[enum] string string set[string] vector[string] vector[string] vector[string] vector[string]
|
||||
1443732977.728092 CXWv6p3arKYeMETxOg ::1 52522 ::1 80 1 CONNECT secure.newegg.com secure.newegg.com:443 - Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:41.0) Gecko/20100101 Firefox/41.0 0 0 200 Connection Established - - - (empty) - - PROXY-CONNECTION -> keep-alive - - - -
|
||||
#close 2015-10-23-20-09-32
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
#separator \x09
|
||||
#set_separator ,
|
||||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path tunnel
|
||||
#open 2015-10-23-20-09-55
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p tunnel_type action
|
||||
#types time string addr port addr port enum enum
|
||||
1443732977.848660 - ::1 0 ::1 80 Tunnel::HTTP Tunnel::DISCOVER
|
||||
#close 2015-10-23-20-09-55
|
||||
|
|
@ -3,9 +3,9 @@
|
|||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path sip
|
||||
#open 2015-04-30-03-33-33
|
||||
#open 2015-11-29-05-05-42
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method uri date request_from request_to response_from response_to reply_to call_id seq subject request_path response_path user_agent status_code status_msg warning request_body_len response_body_len content_type
|
||||
#types time string addr port addr port count string string string string string string string string string string string vector[string] vector[string] string count string string string string string
|
||||
#types time string addr port addr port count string string string string string string string string string string string vector[string] vector[string] string count string string count count string
|
||||
1120469572.844249 CXWv6p3arKYeMETxOg 192.168.1.2 5060 212.242.33.35 5060 0 REGISTER sip:sip.cybercity.dk - <sip:voi18063@sip.cybercity.dk> <sip:voi18063@sip.cybercity.dk> <sip:voi18063@sip.cybercity.dk> <sip:voi18063@sip.cybercity.dk>;tag=00-04092-1701af62-120c67172 - 578222729-4665d775@578222732-4665d772 68 REGISTER - SIP/2.0/UDP 192.168.1.2 SIP/2.0/UDP 192.168.1.2;received=80.230.219.70;rport=5060 Nero SIPPS IP Phone Version 2.0.51.16 401 Unauthorized - 0 0 -
|
||||
1120469590.259876 CXWv6p3arKYeMETxOg 192.168.1.2 5060 212.242.33.35 5060 0 REGISTER sip:sip.cybercity.dk - <sip:voi18063@sip.cybercity.dk> <sip:voi18063@sip.cybercity.dk> <sip:voi18063@sip.cybercity.dk> <sip:voi18063@sip.cybercity.dk> - 578222729-4665d775@578222732-4665d772 69 REGISTER - SIP/2.0/UDP 192.168.1.2 SIP/2.0/UDP 192.168.1.2;received=80.230.219.70;rport=5060 Nero SIPPS IP Phone Version 2.0.51.16 100 Trying - 0 0 -
|
||||
1120469590.259876 CXWv6p3arKYeMETxOg 192.168.1.2 5060 212.242.33.35 5060 0 REGISTER sip:sip.cybercity.dk - <sip:voi18063@sip.cybercity.dk> <sip:voi18063@sip.cybercity.dk> <sip:voi18063@sip.cybercity.dk> <sip:voi18063@sip.cybercity.dk>;tag=00-04085-1701af98-51a65b340 - 578222729-4665d775@578222732-4665d772 69 REGISTER - SIP/2.0/UDP 192.168.1.2 SIP/2.0/UDP 192.168.1.2;received=80.230.219.70;rport=5060,SIP/2.0/UDP 192.168.1.2;received=80.230.219.70;rport=5060 Nero SIPPS IP Phone Version 2.0.51.16 403 Wrong password - 0 0 -
|
||||
|
|
@ -37,8 +37,9 @@
|
|||
1120470900.060556 CIPOse170MGiRM1Qf4 192.168.1.2 5060 212.242.33.35 5060 0 ACK sip:0097239287044@sip.cybercity.dk - "arik" <sip:35104723@sip.cybercity.dk> <sip:0097239287044@sip.cybercity.dk>;tag=00-04083-1701ba17-57d493ef5 - - - 24487391-449bf2a0@192.168.1.2 2 ACK - SIP/2.0/UDP 192.168.1.2 (empty) - - - - 0 - -
|
||||
1120470966.443914 C7XEbhP654jzLoe3a 192.168.1.2 5060 212.242.33.35 5060 0 INVITE sip:35104724@sip.cybercity.dk - "arik" <sip:35104723@sip.cybercity.dk> <sip:35104724@sip.cybercity.dk> "arik" <sip:35104723@sip.cybercity.dk> <sip:35104724@sip.cybercity.dk>;tag=00-04079-1701ba6f-3e08e2f66 - 11894297-4432a9f8@192.168.1.2 1 INVITE - SIP/2.0/UDP 192.168.1.2:5060 SIP/2.0/UDP 192.168.1.2:5060;received=80.230.219.70;rport=5060 Nero SIPPS IP Phone Version 2.0.51.16 407 authentication required - 270 0 -
|
||||
1120470966.606422 C7XEbhP654jzLoe3a 192.168.1.2 5060 212.242.33.35 5060 0 INVITE sip:35104724@sip.cybercity.dk Mon, 04 Jul 2005 09:56:06 GMT "arik" <sip:35104723@sip.cybercity.dk> <sip:35104724@sip.cybercity.dk> "arik" <sip:35104723@sip.cybercity.dk> <sip:35104724@sip.cybercity.dk> - 11894297-4432a9f8@192.168.1.2 2 INVITE - SIP/2.0/UDP 192.168.1.2:5060,SIP/2.0/UDP 192.168.1.2 SIP/2.0/UDP 192.168.1.2;received=80.230.219.70;rport=5060 Nero SIPPS IP Phone Version 2.0.51.16 100 Trying - 270 0 -
|
||||
1120470966.606422 C7XEbhP654jzLoe3a 192.168.1.2 5060 212.242.33.35 5060 0 INVITE sip:35104724@sip.cybercity.dk Mon, 04 Jul 2005 09:56:06 GMT "arik" <sip:35104723@sip.cybercity.dk> <sip:35104724@sip.cybercity.dk> "arik" <sip:35104723@sip.cybercity.dk> <sip:35104724@sip.cybercity.dk>;tag=00-04075-1701baa2-2dfdf7c21 - 11894297-4432a9f8@192.168.1.2 2 INVITE - SIP/2.0/UDP 192.168.1.2:5060,SIP/2.0/UDP 192.168.1.2 SIP/2.0/UDP 192.168.1.2;received=80.230.219.70;rport=5060,SIP/2.0/UDP 192.168.1.2;received=80.230.219.70;rport=5060 Nero SIPPS IP Phone Version 2.0.51.16 183 In band info available - 270 199 application/sdp
|
||||
1120470966.606422 C7XEbhP654jzLoe3a 192.168.1.2 5060 212.242.33.35 5060 0 INVITE sip:35104724@sip.cybercity.dk Mon, 04 Jul 2005 09:56:06 GMT "arik" <sip:35104723@sip.cybercity.dk> <sip:35104724@sip.cybercity.dk> "arik" <sip:35104723@sip.cybercity.dk> <sip:35104724@sip.cybercity.dk>;tag=00-04075-1701baa2-2dfdf7c21 - 11894297-4432a9f8@192.168.1.2 2 INVITE - SIP/2.0/UDP 192.168.1.2:5060,SIP/2.0/UDP 192.168.1.2 SIP/2.0/UDP 192.168.1.2;received=80.230.219.70;rport=5060,SIP/2.0/UDP 192.168.1.2;received=80.230.219.70;rport=5060,SIP/2.0/UDP 192.168.1.2;received=80.230.219.70;rport=5060 Nero SIPPS IP Phone Version 2.0.51.16 480 Error - 270 0 application/sdp
|
||||
1120470984.353086 C7XEbhP654jzLoe3a 192.168.1.2 5060 212.242.33.35 5060 0 REGISTER sip:sip.cybercity.dk - <sip:35104723@sip.cybercity.dk> <sip:35104723@sip.cybercity.dk> <sip:35104723@sip.cybercity.dk> <sip:35104723@sip.cybercity.dk>;tag=00-04074-1701bac9-1daa0b4c5 - 29858147-465b0752@29858051-465b07b2 5 REGISTER - SIP/2.0/UDP 192.168.1.2,SIP/2.0/UDP 192.168.1.2 SIP/2.0/UDP 192.168.1.2;received=80.230.219.70;rport=5060 Nero SIPPS IP Phone Version 2.0.51.16 401 Unauthorized - 0 0 -
|
||||
1120471018.723316 C7XEbhP654jzLoe3a 192.168.1.2 5060 212.242.33.35 5060 0 REGISTER sip:sip.cybercity.dk - <sip:35104723@sip.cybercity.dk> <sip:35104723@sip.cybercity.dk> <sip:35104723@sip.cybercity.dk> <sip:35104723@sip.cybercity.dk> - 29858147-465b0752@29858051-465b07b2 6 REGISTER - SIP/2.0/UDP 192.168.1.2 SIP/2.0/UDP 192.168.1.2;received=80.230.219.70;rport=5060 Nero SIPPS IP Phone Version 2.0.51.16 100 Trying - 0 0 -
|
||||
1120471018.723316 C7XEbhP654jzLoe3a 192.168.1.2 5060 212.242.33.35 5060 0 REGISTER sip:sip.cybercity.dk - <sip:35104723@sip.cybercity.dk> <sip:35104723@sip.cybercity.dk> <sip:35104723@sip.cybercity.dk> <sip:35104723@sip.cybercity.dk>;tag=00-04087-1701bae7-76fb74995 - 29858147-465b0752@29858051-465b07b2 6 REGISTER - SIP/2.0/UDP 192.168.1.2 SIP/2.0/UDP 192.168.1.2;received=80.230.219.70;rport=5060,SIP/2.0/UDP 192.168.1.2;received=80.230.219.70;rport=5060 Nero SIPPS IP Phone Version 2.0.51.16 200 OK - 0 0 -
|
||||
#close 2015-04-30-03-33-33
|
||||
#close 2015-11-29-05-05-42
|
||||
|
|
|
|||
|
|
@ -6,3 +6,5 @@ Client hello, 192.150.187.164, 194.127.84.106, 769
|
|||
Client hello, 192.150.187.164, 194.127.84.106, 769
|
||||
Start test run
|
||||
Client hello, 10.0.0.80, 68.233.76.12, 771
|
||||
Start test run
|
||||
Client hello, 192.168.6.217, 67.207.128.99, 771
|
||||
|
|
|
|||
|
|
@ -1,15 +0,0 @@
|
|||
#separator \x09
|
||||
#set_separator ,
|
||||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path ssl
|
||||
#open 2015-03-09-19-32-44
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p version cipher curve server_name resumed last_alert next_protocol established cert_chain_fuids client_cert_chain_fuids subject issuer client_subject client_issuer validation_status
|
||||
#types time string addr port addr port string string string string bool string string bool vector[string] vector[string] string string string string string
|
||||
1425929564.247511 CXWv6p3arKYeMETxOg 192.168.4.149 58529 128.32.169.140 443 TLSv10 TLS_RSA_WITH_RC4_128_MD5 - - F - - T FTzCuuqU5y7w85H89 (empty) CN=www.cviis.org,OU=Domain Control Validated CN=Starfield Secure Certificate Authority - G2,OU=http://certs.starfieldtech.com/repository/,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US - - unable to get local issuer certificate
|
||||
1425929565.270104 CXWv6p3arKYeMETxOg 192.168.4.149 58529 128.32.169.140 443 TLSv10 TLS_RSA_WITH_RC4_128_MD5 - - F - - T FXzQOu1ZSKSF7H8Ez6 (empty) CN=www.cviis.org,OU=Domain Control Validated CN=Starfield Secure Certificate Authority - G2,OU=http://certs.starfieldtech.com/repository/,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US - - unable to get local issuer certificate
|
||||
1425929566.843026 CjhGID4nQcgTWjvg4c 192.168.4.149 58530 72.167.102.91 443 TLSv12 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 secp256r1 - F - - T F5l2dVkZHiwiOWR67,Fkw2ETDXfIXIvatba,Fbgf8A3V6m8v33wTcj (empty) CN=valid.sfig2.catest.starfieldtech.com,O=Starfield Technologies\, LLC,L=Scottsdale,ST=Arizona,C=US,serialNumber=R-1724741-6,businessCategory=Private Organization,jurisdictionST=Arizona,jurisdictionC=US CN=Starfield Secure Certificate Authority - G2,OU=http://certs.starfieldtech.com/repository/,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US - - ok
|
||||
1425929571.372511 CCvvfg3TEfuqmmG4bh 192.168.4.149 58532 128.32.169.140 443 TLSv10 TLS_RSA_WITH_RC4_128_MD5 - - F - - T FhEtvg4pQ90832J56f (empty) CN=www.cviis.org,OU=Domain Control Validated CN=Starfield Secure Certificate Authority - G2,OU=http://certs.starfieldtech.com/repository/,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US - - ok
|
||||
1425929567.865619 CjhGID4nQcgTWjvg4c 192.168.4.149 58530 72.167.102.91 443 TLSv12 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 secp256r1 - F - - T Fyc6cQ2rMCAhpIGcM5,FoJ8j735m9ogDYopYj,FHaYhA3ykzVlKPnnsc (empty) CN=valid.sfig2.catest.starfieldtech.com,O=Starfield Technologies\, LLC,L=Scottsdale,ST=Arizona,C=US,serialNumber=R-1724741-6,businessCategory=Private Organization,jurisdictionST=Arizona,jurisdictionC=US CN=Starfield Secure Certificate Authority - G2,OU=http://certs.starfieldtech.com/repository/,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US - - ok
|
||||
1425929572.395104 CCvvfg3TEfuqmmG4bh 192.168.4.149 58532 128.32.169.140 443 TLSv10 TLS_RSA_WITH_RC4_128_MD5 - - F - - T FwZZ8034tgyXSponwg (empty) CN=www.cviis.org,OU=Domain Control Validated CN=Starfield Secure Certificate Authority - G2,OU=http://certs.starfieldtech.com/repository/,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US - - ok
|
||||
#close 2015-03-09-19-32-53
|
||||
BIN
testing/btest/Traces/http/connect-with-header.trace
Normal file
BIN
testing/btest/Traces/http/connect-with-header.trace
Normal file
Binary file not shown.
BIN
testing/btest/Traces/tcp/truncated-header.pcap
Normal file
BIN
testing/btest/Traces/tcp/truncated-header.pcap
Normal file
Binary file not shown.
BIN
testing/btest/Traces/tls/tls-early-alert.trace
Normal file
BIN
testing/btest/Traces/tls/tls-early-alert.trace
Normal file
Binary file not shown.
BIN
testing/btest/Traces/tls/x509-generalizedtime.pcap
Normal file
BIN
testing/btest/Traces/tls/x509-generalizedtime.pcap
Normal file
Binary file not shown.
BIN
testing/btest/Traces/trunc/trunc-hdr.pcap
Normal file
BIN
testing/btest/Traces/trunc/trunc-hdr.pcap
Normal file
Binary file not shown.
|
|
@ -6,9 +6,17 @@ global default_alphabet: string = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrs
|
|||
global my_alphabet: string = "!#$%&/(),-.:;<>@[]^ `_{|}~abcdefghijklmnopqrstuvwxyz0123456789+?";
|
||||
|
||||
print decode_base64("YnJv");
|
||||
print decode_base64("YnJv", default_alphabet);
|
||||
print decode_base64("YnJv", ""); # should use default alpabet
|
||||
print decode_base64("}n-v", my_alphabet);
|
||||
print decode_base64_custom("YnJv", default_alphabet);
|
||||
print decode_base64_custom("YnJv", ""); # should use default alpabet
|
||||
print decode_base64_custom("}n-v", my_alphabet);
|
||||
|
||||
print decode_base64("YnJv");
|
||||
print decode_base64("YnJv", default_alphabet);
|
||||
print decode_base64("YnJv", ""); # should use default alpabet
|
||||
print decode_base64("}n-v", my_alphabet);
|
||||
print decode_base64_custom("YnJv", default_alphabet);
|
||||
print decode_base64_custom("YnJv", ""); # should use default alpabet
|
||||
print decode_base64_custom("}n-v", my_alphabet);
|
||||
|
|
|
|||
8
testing/btest/bifs/decode_base64_conn.bro
Normal file
8
testing/btest/bifs/decode_base64_conn.bro
Normal file
|
|
@ -0,0 +1,8 @@
|
|||
# @TEST-EXEC: bro -r $TRACES/smtp.trace %INPUT >out
|
||||
# @TEST-EXEC: btest-diff weird.log
|
||||
|
||||
event connection_established(c: connection)
|
||||
{
|
||||
# This should be logged into weird.
|
||||
print decode_base64_conn(c$id, "kaputt");
|
||||
}
|
||||
|
|
@ -6,7 +6,12 @@ global default_alphabet: string = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrs
|
|||
global my_alphabet: string = "!#$%&/(),-.:;<>@[]^ `_{|}~abcdefghijklmnopqrstuvwxyz0123456789+?";
|
||||
|
||||
print encode_base64("bro");
|
||||
print encode_base64("bro", default_alphabet);
|
||||
print encode_base64("bro", ""); # should use default alpabet
|
||||
print encode_base64("bro", my_alphabet);
|
||||
|
||||
print encode_base64_custom("bro", default_alphabet);
|
||||
print encode_base64_custom("bro", ""); # should use default alpabet
|
||||
print encode_base64_custom("bro", my_alphabet);
|
||||
|
||||
print encode_base64("padding");
|
||||
|
|
|
|||
|
|
@ -10,6 +10,9 @@ event bro_init()
|
|||
local b: string_array = { [1] = "mytest" };
|
||||
local c: string_vec = vector( "this", "is", "another", "test" );
|
||||
local d: string_vec = vector( "Test" );
|
||||
local e: string_vec = vector();
|
||||
e[3] = "hi";
|
||||
e[5] = "there";
|
||||
|
||||
print join_string_array(" * ", a);
|
||||
print join_string_array("", a);
|
||||
|
|
@ -18,4 +21,5 @@ event bro_init()
|
|||
print join_string_vec(c, "__");
|
||||
print join_string_vec(c, "");
|
||||
print join_string_vec(d, "-");
|
||||
print join_string_vec(e, ".");
|
||||
}
|
||||
|
|
|
|||
|
|
@ -13,20 +13,20 @@ event new_packet(c: connection, p: pkt_hdr)
|
|||
print cnt, c$id;
|
||||
|
||||
if ( cnt == 1 )
|
||||
if ( ! install_pcap_filter(A) )
|
||||
if ( ! Pcap::install_pcap_filter(A) )
|
||||
print "error 3";
|
||||
|
||||
if ( cnt == 2 )
|
||||
if ( ! install_pcap_filter(B) )
|
||||
if ( ! Pcap::install_pcap_filter(B) )
|
||||
print "error 4";
|
||||
}
|
||||
|
||||
event bro_init()
|
||||
{
|
||||
if ( ! precompile_pcap_filter(A, "port 80") )
|
||||
if ( ! Pcap::precompile_pcap_filter(A, "port 80") )
|
||||
print "error 1";
|
||||
|
||||
if ( ! precompile_pcap_filter(B, "port 53") )
|
||||
if ( ! Pcap::precompile_pcap_filter(B, "port 53") )
|
||||
print "error 2";
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -9,8 +9,8 @@ redef enum PcapFilterID += { A };
|
|||
|
||||
event bro_init()
|
||||
{
|
||||
if ( ! precompile_pcap_filter(A, "kaputt, too") )
|
||||
print "error", pcap_error();
|
||||
if ( ! Pcap::precompile_pcap_filter(A, "kaputt, too") )
|
||||
print "error", Pcap::error();
|
||||
}
|
||||
|
||||
|
||||
|
|
|
|||
|
|
@ -7,8 +7,8 @@ redef enum PcapFilterID += { A };
|
|||
|
||||
event bro_init()
|
||||
{
|
||||
if ( ! precompile_pcap_filter(A, "kaputt, too") )
|
||||
print "error", pcap_error();
|
||||
if ( ! Pcap::precompile_pcap_filter(A, "kaputt, too") )
|
||||
print "error", Pcap::error();
|
||||
}
|
||||
|
||||
|
||||
|
|
|
|||
|
|
@ -20,7 +20,7 @@ event net_weird(name: string)
|
|||
print "net_weird", name;
|
||||
}
|
||||
|
||||
event rexmit_inconsistency(c: connection, t1: string, t2: string)
|
||||
event rexmit_inconsistency(c: connection, t1: string, t2: string, tcp_flags: string)
|
||||
{
|
||||
print "rexmit_inconsistency", c$id, t1, t2 ;
|
||||
print "rexmit_inconsistency", c$id, t1, t2, tcp_flags;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -3,10 +3,11 @@
|
|||
|
||||
# Quantum Insert like attack, overlapping TCP packet with different content
|
||||
redef tcp_max_old_segments = 10;
|
||||
event rexmit_inconsistency(c: connection, t1: string, t2: string)
|
||||
event rexmit_inconsistency(c: connection, t1: string, t2: string, tcp_flags: string)
|
||||
{
|
||||
print "----- rexmit_inconsistency -----";
|
||||
print fmt("%.6f c: %s", network_time(), c$id);
|
||||
print fmt("%.6f t1: %s", network_time(), t1);
|
||||
print fmt("%.6f t2: %s", network_time(), t2);
|
||||
print fmt("%.6f tcp_flags: %s", network_time(), tcp_flags);
|
||||
}
|
||||
|
|
|
|||
9
testing/btest/core/tcp/truncated-header.bro
Normal file
9
testing/btest/core/tcp/truncated-header.bro
Normal file
|
|
@ -0,0 +1,9 @@
|
|||
# @TEST-EXEC: bro -b -r $TRACES/tcp/truncated-header.pcap %INPUT >out
|
||||
# @TEST-EXEC: btest-diff out
|
||||
|
||||
event tcp_packet(c: connection, is_orig: bool, flags: string, seq: count, ack: count, len: count, payload: string)
|
||||
{
|
||||
# Just having this handler used to crash Bro on this trace.
|
||||
print network_time(), c$id;
|
||||
}
|
||||
|
||||
|
|
@ -19,4 +19,10 @@
|
|||
|
||||
# @TEST-EXEC: bro -r $TRACES/trunc/icmp-header-trunc.pcap
|
||||
# @TEST-EXEC: cat weird.log >> output
|
||||
|
||||
# Truncated packets where the captured length is less than the length required
|
||||
# for the packet header should also raise a Weird
|
||||
# @TEST-EXEC: bro -r $TRACES/trunc/trunc-hdr.pcap
|
||||
# @TEST-EXEC: cat weird.log >> output
|
||||
|
||||
# @TEST-EXEC: btest-diff output
|
||||
|
|
|
|||
10
testing/btest/core/x509-generalizedtime.bro
Normal file
10
testing/btest/core/x509-generalizedtime.bro
Normal file
|
|
@ -0,0 +1,10 @@
|
|||
# @TEST-EXEC: bro -C -r $TRACES/tls/x509-generalizedtime.pcap %INPUT >>output 2>&1
|
||||
# @TEST-EXEC: bro -C -r $TRACES/tls/tls1.2.trace %INPUT >>output 2>&1
|
||||
# @TEST-EXEC: btest-diff output
|
||||
event x509_certificate(f: fa_file, cert_ref: opaque of x509, cert: X509::Certificate)
|
||||
{
|
||||
print "----- x509_certificate ----";
|
||||
print fmt("serial: %s", cert$serial);
|
||||
print fmt("not_valid_before: %T (epoch: %s)", cert$not_valid_before, cert$not_valid_before);
|
||||
print fmt("not_valid_after : %T (epoch: %s)", cert$not_valid_after, cert$not_valid_after);
|
||||
}
|
||||
|
|
@ -2,7 +2,6 @@
|
|||
|
||||
connecting-connector.bro
|
||||
|
||||
|
||||
const broker_port: port = 9999/tcp &redef;
|
||||
redef exit_only_after_terminate = T;
|
||||
redef BrokerComm::endpoint_name = "connector";
|
||||
|
|
|
|||
|
|
@ -2,7 +2,6 @@
|
|||
|
||||
connecting-listener.bro
|
||||
|
||||
|
||||
const broker_port: port = 9999/tcp &redef;
|
||||
redef exit_only_after_terminate = T;
|
||||
redef BrokerComm::endpoint_name = "listener";
|
||||
|
|
|
|||
|
|
@ -2,7 +2,6 @@
|
|||
|
||||
events-listener.bro
|
||||
|
||||
|
||||
const broker_port: port = 9999/tcp &redef;
|
||||
redef exit_only_after_terminate = T;
|
||||
redef BrokerComm::endpoint_name = "listener";
|
||||
|
|
|
|||
|
|
@ -2,7 +2,6 @@
|
|||
|
||||
printing-listener.bro
|
||||
|
||||
|
||||
const broker_port: port = 9999/tcp &redef;
|
||||
redef exit_only_after_terminate = T;
|
||||
redef BrokerComm::endpoint_name = "listener";
|
||||
|
|
|
|||
|
|
@ -2,7 +2,6 @@
|
|||
|
||||
testlog.bro
|
||||
|
||||
|
||||
module Test;
|
||||
|
||||
export {
|
||||
|
|
|
|||
|
|
@ -8,7 +8,7 @@ type Service: record {
|
|||
rfc: count;
|
||||
};
|
||||
|
||||
function print_service(serv: Service): string
|
||||
function print_service(serv: Service)
|
||||
{
|
||||
print fmt("Service: %s(RFC%d)",serv$name, serv$rfc);
|
||||
|
||||
|
|
|
|||
|
|
@ -13,7 +13,7 @@ type System: record {
|
|||
services: set[Service];
|
||||
};
|
||||
|
||||
function print_service(serv: Service): string
|
||||
function print_service(serv: Service)
|
||||
{
|
||||
print fmt(" Service: %s(RFC%d)",serv$name, serv$rfc);
|
||||
|
||||
|
|
@ -21,7 +21,7 @@ function print_service(serv: Service): string
|
|||
print fmt(" port: %s", p);
|
||||
}
|
||||
|
||||
function print_system(sys: System): string
|
||||
function print_system(sys: System)
|
||||
{
|
||||
print fmt("System: %s", sys$name);
|
||||
|
||||
|
|
|
|||
|
|
@ -4,5 +4,5 @@
|
|||
# @TEST-EXEC: BRO_PLUGIN_PATH=`pwd` bro -NN Demo::Foo >>output
|
||||
# @TEST-EXEC: echo === >>output
|
||||
# @TEST-EXEC: BRO_PLUGIN_PATH=`pwd` bro -r $TRACES/socks.trace Log::default_writer=Log::WRITER_FOO %INPUT | sort >>output
|
||||
# @TEST-EXEC: TEST_DIFF_CANONIFIER=diff-remove-timestamps btest-diff output
|
||||
# @TEST-EXEC: btest-diff output
|
||||
|
||||
|
|
|
|||
|
|
@ -1,5 +1,8 @@
|
|||
# @TEST-EXEC: cp input.log input2.log
|
||||
# @TEST-EXEC: btest-bg-run bro bro -b %INPUT
|
||||
# @TEST-EXEC: btest-bg-wait 5
|
||||
# @TEST-EXEC: sleep 2
|
||||
# @TEST-EXEC: echo "hi" >> input2.log
|
||||
# @TEST-EXEC: btest-bg-wait 10
|
||||
# @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-sort btest-diff out
|
||||
|
||||
@TEST-START-FILE input.log
|
||||
|
|
@ -7,6 +10,7 @@ sdfkh:KH;fdkncv;ISEUp34:Fkdj;YVpIODhfDF
|
|||
@TEST-END-FILE
|
||||
|
||||
redef exit_only_after_terminate = T;
|
||||
@load base/frameworks/communication # keep network time running
|
||||
|
||||
global outfile: file;
|
||||
global try: count;
|
||||
|
|
@ -21,9 +25,8 @@ event line(description: Input::EventDescription, tpe: Input::Event, s: string)
|
|||
{
|
||||
print outfile, s;
|
||||
try = try + 1;
|
||||
if ( try == 2 )
|
||||
if ( try == 3 )
|
||||
{
|
||||
Input::remove("input");
|
||||
close(outfile);
|
||||
terminate();
|
||||
}
|
||||
|
|
@ -39,7 +42,11 @@ event bro_init()
|
|||
local config_strings_two: table[string] of string = {
|
||||
["offset"] = "-3", # 2 characters before end, last char is newline.
|
||||
};
|
||||
local config_strings_three: table[string] of string = {
|
||||
["offset"] = "-1", # End of file
|
||||
};
|
||||
|
||||
Input::add_event([$source="../input.log", $config=config_strings, $reader=Input::READER_RAW, $mode=Input::STREAM, $name="input", $fields=Val, $ev=line, $want_record=F]);
|
||||
Input::add_event([$source="../input.log", $config=config_strings_two, $reader=Input::READER_RAW, $mode=Input::STREAM, $name="input2", $fields=Val, $ev=line, $want_record=F]);
|
||||
Input::add_event([$source="../input2.log", $config=config_strings_three, $reader=Input::READER_RAW, $mode=Input::STREAM, $name="input3", $fields=Val, $ev=line, $want_record=F]);
|
||||
}
|
||||
|
|
|
|||
|
|
@ -0,0 +1,27 @@
|
|||
#
|
||||
# @TEST-EXEC: bro -b %INPUT
|
||||
# @TEST-EXEC: btest-diff testing.log
|
||||
|
||||
@load tuning/json-logs.bro
|
||||
|
||||
module testing;
|
||||
|
||||
export {
|
||||
redef enum Log::ID += { LOG };
|
||||
|
||||
type Info: record {
|
||||
ts: time &log &optional;
|
||||
msg: string &log &optional;
|
||||
};
|
||||
|
||||
global log_test: event(rec: Info);
|
||||
}
|
||||
|
||||
event bro_init() &priority=5
|
||||
{
|
||||
Log::create_stream(testing::LOG, [$columns=testing::Info, $ev=log_test]);
|
||||
local info: Info;
|
||||
info$msg = "Testing 1 2 3 ";
|
||||
Log::write(testing::LOG, info);
|
||||
}
|
||||
|
||||
|
|
@ -0,0 +1,12 @@
|
|||
# This tests that the HTTP analyzer handles HTTP CONNECT proxying correctly
|
||||
# when the server include a header line into its response.
|
||||
#
|
||||
# @TEST-EXEC: bro -C -r $TRACES/http/connect-with-header.trace %INPUT
|
||||
# @TEST-EXEC: btest-diff conn.log
|
||||
# @TEST-EXEC: btest-diff http.log
|
||||
# @TEST-EXEC: btest-diff tunnel.log
|
||||
|
||||
@load base/protocols/conn
|
||||
@load base/protocols/http
|
||||
@load base/protocols/tunnels
|
||||
@load base/frameworks/dpd
|
||||
|
|
@ -1,6 +1,7 @@
|
|||
# @TEST-EXEC: bro -C -b -r $TRACES/tls/ssl-v2.trace %INPUT
|
||||
# @TEST-EXEC: bro -b -r $TRACES/tls/ssl.v3.trace %INPUT
|
||||
# @TEST-EXEC: bro -b -r $TRACES/tls/tls1.2.trace %INPUT
|
||||
# @TEST-EXEC: bro -b -r $TRACES/tls/tls-early-alert.trace %INPUT
|
||||
# @TEST-EXEC: btest-diff .stdout
|
||||
|
||||
@load base/frameworks/dpd
|
||||
|
|
|
|||
|
|
@ -1,37 +0,0 @@
|
|||
# @TEST-SERIALIZE: comm
|
||||
#
|
||||
# @TEST-EXEC: btest-bg-run manager-1 "cp ../cluster-layout.bro . && CLUSTER_NODE=manager-1 bro %INPUT"
|
||||
# @TEST-EXEC: sleep 1
|
||||
# @TEST-EXEC: btest-bg-run proxy-1 "cp ../cluster-layout.bro . && CLUSTER_NODE=proxy-1 bro %INPUT"
|
||||
# @TEST-EXEC: btest-bg-run proxy-2 "cp ../cluster-layout.bro . && CLUSTER_NODE=proxy-2 bro %INPUT"
|
||||
# @TEST-EXEC: sleep 1
|
||||
# @TEST-EXEC: btest-bg-run worker-1 "cp ../cluster-layout.bro . && CLUSTER_NODE=worker-1 bro --pseudo-realtime -C -r $TRACES/tls/missing-intermediate.pcap %INPUT"
|
||||
# @TEST-EXEC: btest-bg-run worker-2 "cp ../cluster-layout.bro . && CLUSTER_NODE=worker-2 bro --pseudo-realtime -C -r $TRACES/tls/missing-intermediate.pcap %INPUT"
|
||||
# @TEST-EXEC: btest-bg-wait 20
|
||||
# @TEST-EXEC: cat manager-1/ssl*.log > ssl.log
|
||||
# @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-remove-file-ids btest-diff ssl.log
|
||||
#
|
||||
|
||||
redef Log::default_rotation_interval = 0secs;
|
||||
|
||||
@TEST-START-FILE cluster-layout.bro
|
||||
redef Cluster::nodes = {
|
||||
["manager-1"] = [$node_type=Cluster::MANAGER, $ip=127.0.0.1, $p=37757/tcp, $workers=set("worker-1", "worker-2")],
|
||||
["proxy-1"] = [$node_type=Cluster::PROXY, $ip=127.0.0.1, $p=37758/tcp, $manager="manager-1", $workers=set("worker-1", "worker-2")],
|
||||
["proxy-2"] = [$node_type=Cluster::PROXY, $ip=127.0.0.1, $p=37759/tcp, $manager="manager-1", $workers=set("worker-2")],
|
||||
["worker-1"] = [$node_type=Cluster::WORKER, $ip=127.0.0.1, $p=37760/tcp, $manager="manager-1", $proxy="proxy-1", $interface="eth0"],
|
||||
["worker-2"] = [$node_type=Cluster::WORKER, $ip=127.0.0.1, $p=37761/tcp, $manager="manager-1", $proxy="proxy-1", $interface="eth1"],
|
||||
};
|
||||
@TEST-END-FILE
|
||||
|
||||
event terminate_me() {
|
||||
terminate();
|
||||
}
|
||||
|
||||
event remote_connection_closed(p: event_peer) {
|
||||
schedule 1sec { terminate_me() };
|
||||
}
|
||||
|
||||
|
||||
@load base/frameworks/cluster
|
||||
@load protocols/ssl/validate-certs.bro
|
||||
|
|
@ -1,5 +1,5 @@
|
|||
# @TEST-EXEC: bro -C -r $TRACES/tls/missing-intermediate.pcap %INPUT
|
||||
# @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-remove-x509-names btest-diff ssl.log
|
||||
# @TEST-EXEC: bro -C -r $TRACES/tls/missing-intermediate.pcap $SCRIPTS/external-ca-list.bro %INPUT
|
||||
# @TEST-EXEC: TEST_DIFF_CANONIFIER="$SCRIPTS/diff-remove-x509-names | $SCRIPTS/diff-remove-timestamps" btest-diff ssl.log
|
||||
|
||||
@load protocols/ssl/validate-certs.bro
|
||||
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
# @TEST-EXEC: bro -r $TRACES/tls/tls-expired-cert.trace %INPUT
|
||||
# @TEST-EXEC: bro -r $TRACES/tls/tls-expired-cert.trace $SCRIPTS/external-ca-list.bro %INPUT
|
||||
# @TEST-EXEC: cat ssl.log > ssl-all.log
|
||||
# @TEST-EXEC: bro -C -r $TRACES/tls/missing-intermediate.pcap %INPUT
|
||||
# @TEST-EXEC: bro -C -r $TRACES/tls/missing-intermediate.pcap $SCRIPTS/external-ca-list.bro %INPUT
|
||||
# @TEST-EXEC: cat ssl.log >> ssl-all.log
|
||||
# @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-remove-x509-names btest-diff ssl-all.log
|
||||
# @TEST-EXEC: TEST_DIFF_CANONIFIER="$SCRIPTS/diff-remove-x509-names | $SCRIPTS/diff-remove-timestamps" btest-diff ssl-all.log
|
||||
|
||||
@load protocols/ssl/validate-certs.bro
|
||||
|
|
|
|||
|
|
@ -1,10 +1,10 @@
|
|||
# @TEST-EXEC: bro -C -r $TRACES/tls/ocsp-stapling.trace %INPUT
|
||||
# @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-remove-x509-names btest-diff ssl.log
|
||||
# @TEST-EXEC: bro -C -r $TRACES/tls/ocsp-stapling-twimg.trace %INPUT
|
||||
# @TEST-EXEC: bro $SCRIPTS/external-ca-list.bro -C -r $TRACES/tls/ocsp-stapling.trace %INPUT
|
||||
# @TEST-EXEC: TEST_DIFF_CANONIFIER="$SCRIPTS/diff-remove-x509-names | $SCRIPTS/diff-remove-timestamps" btest-diff ssl.log
|
||||
# @TEST-EXEC: bro $SCRIPTS/external-ca-list.bro -C -r $TRACES/tls/ocsp-stapling-twimg.trace %INPUT
|
||||
# @TEST-EXEC: mv ssl.log ssl-twimg.log
|
||||
# @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-remove-x509-names btest-diff ssl-twimg.log
|
||||
# @TEST-EXEC: bro -C -r $TRACES/tls/ocsp-stapling-digicert.trace %INPUT
|
||||
# @TEST-EXEC: TEST_DIFF_CANONIFIER="$SCRIPTS/diff-remove-x509-names | $SCRIPTS/diff-remove-timestamps" btest-diff ssl-twimg.log
|
||||
# @TEST-EXEC: bro $SCRIPTS/external-ca-list.bro -C -r $TRACES/tls/ocsp-stapling-digicert.trace %INPUT
|
||||
# @TEST-EXEC: mv ssl.log ssl-digicert.log
|
||||
# @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-remove-x509-names btest-diff ssl-digicert.log
|
||||
# @TEST-EXEC: TEST_DIFF_CANONIFIER="$SCRIPTS/diff-remove-x509-names | $SCRIPTS/diff-remove-timestamps" btest-diff ssl-digicert.log
|
||||
|
||||
@load protocols/ssl/validate-ocsp
|
||||
|
|
|
|||
158
testing/external/scripts/external-ca-list.bro
vendored
158
testing/external/scripts/external-ca-list.bro
vendored
File diff suppressed because one or more lines are too long
1
testing/external/scripts/external-ca-list.bro
vendored
Symbolic link
1
testing/external/scripts/external-ca-list.bro
vendored
Symbolic link
|
|
@ -0,0 +1 @@
|
|||
../../scripts/external-ca-list.bro
|
||||
|
|
@ -1,10 +0,0 @@
|
|||
#! /usr/bin/awk -f
|
||||
#
|
||||
# A diff canonifier that removes the priorities in notice_policy.log.
|
||||
|
||||
/^#/ && $2 == "notice_policy" { filter = 1; }
|
||||
|
||||
filter == 1 && /^[^#]/ { sub("^[0-9]*", "X"); }
|
||||
|
||||
{ print; }
|
||||
|
||||
|
|
@ -2,13 +2,15 @@
|
|||
#
|
||||
# Default canonifier used with the trace-based tests in testing/external/*.
|
||||
|
||||
filename=`basename $1`
|
||||
|
||||
addl="cat"
|
||||
|
||||
if [ "$1" == "capture_loss.log" ]; then
|
||||
if [ "$filename" == "capture_loss.log" ]; then
|
||||
addl="`dirname $0`/diff-remove-fractions"
|
||||
fi
|
||||
|
||||
if [ "$1" == "ssh.log" ]; then
|
||||
if [ "$filename" == "ssh.log" ]; then
|
||||
addl="`dirname $0`/diff-remove-fields remote_location"
|
||||
fi
|
||||
|
||||
|
|
@ -16,7 +18,6 @@ fi
|
|||
| `dirname $0`/diff-remove-uids \
|
||||
| `dirname $0`/diff-remove-file-ids \
|
||||
| `dirname $0`/diff-remove-x509-names \
|
||||
| `dirname $0`/diff-canon-notice-policy \
|
||||
| `dirname $0`/diff-sort \
|
||||
| eval $addl
|
||||
|
||||
|
|
|
|||
|
|
@ -4,8 +4,8 @@
|
|||
# prefix.
|
||||
|
||||
if [ $# != 1 ]; then
|
||||
echo "usage: `basename $0` <field prefix>"
|
||||
exit 1
|
||||
echo "usage: `basename $0` <field prefix>"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
awk -v "PREFIX=$1" '
|
||||
|
|
@ -18,17 +18,15 @@ BEGIN { FS="\t"; OFS="\t"; }
|
|||
if ( index($i, PREFIX) == 1 )
|
||||
rem[i-1] = 1;
|
||||
}
|
||||
print;
|
||||
next;
|
||||
}
|
||||
|
||||
/^[^#]/ {
|
||||
for ( i in rem )
|
||||
# Mark that it is set, but ignore content.
|
||||
$i = "+";
|
||||
}
|
||||
|
||||
{
|
||||
for ( i in rem )
|
||||
# Mark that it iss set, but ignore content.
|
||||
$i = "+";
|
||||
|
||||
print;
|
||||
}
|
||||
|
||||
'
|
||||
|
||||
|
|
|
|||
|
|
@ -1,7 +1,8 @@
|
|||
#! /usr/bin/awk -f
|
||||
#! /usr/bin/env bash
|
||||
#
|
||||
# A diff canonifier that removes all file IDs from files.log
|
||||
|
||||
awk '
|
||||
BEGIN {
|
||||
FS="\t";
|
||||
OFS="\t";
|
||||
|
|
@ -12,13 +13,15 @@ $1 == "#path" && $2 == "files" {
|
|||
process = 1;
|
||||
}
|
||||
|
||||
process && column1 > 0 && column2 > 0 {
|
||||
$column1 = "XXXXXXXXXXX";
|
||||
$column2 = "XXXXXXXXXXX";
|
||||
/^[^#]/ {
|
||||
if ( process && column1 > 0 && column2 > 0 ) {
|
||||
$column1 = "XXXXXXXXXXX";
|
||||
$column2 = "XXXXXXXXXXX";
|
||||
}
|
||||
}
|
||||
|
||||
/^#/ {
|
||||
for ( i = 0; i < NF; ++i ) {
|
||||
/^#fields/ {
|
||||
for ( i = 2; i <= NF; ++i ) {
|
||||
if ( $i == "fuid" )
|
||||
column1 = i - 1;
|
||||
|
||||
|
|
@ -28,6 +31,4 @@ process && column1 > 0 && column2 > 0 {
|
|||
}
|
||||
|
||||
{ print }
|
||||
|
||||
|
||||
|
||||
'
|
||||
|
|
|
|||
|
|
@ -1,29 +0,0 @@
|
|||
#! /usr/bin/awk -f
|
||||
#
|
||||
# A diff canonifier that removes all MIME types because libmagic output
|
||||
# can differ between installations.
|
||||
|
||||
BEGIN { FS="\t"; OFS="\t"; type_col = -1; desc_col = -1 }
|
||||
|
||||
/^#fields/ {
|
||||
for ( i = 2; i < NF; ++i )
|
||||
{
|
||||
if ( $i == "mime_type" )
|
||||
type_col = i-1;
|
||||
if ( $i == "mime_desc" )
|
||||
desc_col = i-1;
|
||||
}
|
||||
}
|
||||
|
||||
function remove_mime (n) {
|
||||
if ( n >= 0 && $n != "-" )
|
||||
# Mark that it's set, but ignore content.
|
||||
$n = "+"
|
||||
}
|
||||
|
||||
remove_mime(type_col)
|
||||
remove_mime(desc_col)
|
||||
|
||||
{
|
||||
print;
|
||||
}
|
||||
|
|
@ -1,21 +1,22 @@
|
|||
#! /usr/bin/awk -f
|
||||
#! /usr/bin/env bash
|
||||
#
|
||||
# A diff canonifier that removes all connection UIDs.
|
||||
|
||||
awk '
|
||||
BEGIN { FS="\t"; OFS="\t"; }
|
||||
|
||||
column > 0 {
|
||||
$column = "XXXXXXXXXXX";
|
||||
/^[^#]/ {
|
||||
if ( column > 0 ) {
|
||||
$column = "XXXXXXXXXXX";
|
||||
}
|
||||
}
|
||||
|
||||
/^#/ {
|
||||
for ( i = 0; i < NF; ++i ) {
|
||||
/^#fields/ {
|
||||
for ( i = 2; i <= NF; ++i ) {
|
||||
if ( $i == "uid" )
|
||||
column = i - 1;
|
||||
}
|
||||
}
|
||||
|
||||
{ print }
|
||||
|
||||
|
||||
|
||||
'
|
||||
|
|
|
|||
|
|
@ -1,72 +1,80 @@
|
|||
#! /usr/bin/awk -f
|
||||
#! /usr/bin/env bash
|
||||
#
|
||||
# A diff canonifier that removes all X.509 Distinguished Name subject fields
|
||||
# because that output can differ depending on installed OpenSSL version.
|
||||
|
||||
awk '
|
||||
BEGIN { FS="\t"; OFS="\t"; s_col = -1; i_col = -1; is_col = -1; cs_col = -1; ci_col = -1; cert_subj_col = -1; cert_issuer_col = -1 }
|
||||
|
||||
/^#fields/ {
|
||||
for ( i = 2; i < NF; ++i )
|
||||
/^#/ {
|
||||
if ( $1 == "#fields" )
|
||||
{
|
||||
if ( $i == "subject" )
|
||||
s_col = i-1;
|
||||
if ( $i == "issuer" )
|
||||
i_col = i-1;
|
||||
if ( $i == "issuer_subject" )
|
||||
is_col = i-1;
|
||||
if ( $i == "client_subject" )
|
||||
cs_col = i-1;
|
||||
if ( $i == "client_issuer" )
|
||||
ci_col = i-1;
|
||||
if ( $i == "certificate.subject" )
|
||||
cert_subj_col = i-1;
|
||||
if ( $i == "certificate.issuer" )
|
||||
cert_issuer_col = i-1;
|
||||
for ( i = 2; i <= NF; ++i )
|
||||
{
|
||||
if ( $i == "subject" )
|
||||
s_col = i-1;
|
||||
if ( $i == "issuer" )
|
||||
i_col = i-1;
|
||||
if ( $i == "issuer_subject" )
|
||||
is_col = i-1;
|
||||
if ( $i == "client_subject" )
|
||||
cs_col = i-1;
|
||||
if ( $i == "client_issuer" )
|
||||
ci_col = i-1;
|
||||
if ( $i == "certificate.subject" )
|
||||
cert_subj_col = i-1;
|
||||
if ( $i == "certificate.issuer" )
|
||||
cert_issuer_col = i-1;
|
||||
}
|
||||
}
|
||||
|
||||
print;
|
||||
next;
|
||||
}
|
||||
|
||||
s_col >= 0 {
|
||||
s_col > 0 {
|
||||
if ( $s_col != "-" )
|
||||
# Mark that it's set, but ignore content.
|
||||
# Mark that it is set, but ignore content.
|
||||
$s_col = "+";
|
||||
}
|
||||
|
||||
i_col >= 0 {
|
||||
i_col > 0 {
|
||||
if ( $i_col != "-" )
|
||||
# Mark that it's set, but ignore content.
|
||||
# Mark that it is set, but ignore content.
|
||||
$i_col = "+";
|
||||
}
|
||||
|
||||
is_col >= 0 {
|
||||
is_col > 0 {
|
||||
if ( $is_col != "-" )
|
||||
# Mark that it's set, but ignore content.
|
||||
# Mark that it is set, but ignore content.
|
||||
$is_col = "+";
|
||||
}
|
||||
|
||||
cs_col >= 0 {
|
||||
cs_col > 0 {
|
||||
if ( $cs_col != "-" )
|
||||
# Mark that it's set, but ignore content.
|
||||
# Mark that it is set, but ignore content.
|
||||
$cs_col = "+";
|
||||
}
|
||||
|
||||
ci_col >= 0 {
|
||||
ci_col > 0 {
|
||||
if ( $ci_col != "-" )
|
||||
# Mark that it's set, but ignore content.
|
||||
# Mark that it is set, but ignore content.
|
||||
$ci_col = "+";
|
||||
}
|
||||
|
||||
cert_subj_col >= 0 {
|
||||
cert_subj_col > 0 {
|
||||
if ( $cert_subj_col != "-" )
|
||||
# Mark that it's set, but ignore content.
|
||||
# Mark that it is set, but ignore content.
|
||||
$cert_subj_col = "+";
|
||||
}
|
||||
|
||||
cert_issuer_col >= 0 {
|
||||
cert_issuer_col > 0 {
|
||||
if ( $cert_issuer_col != "-" )
|
||||
# Mark that it's set, but ignore content.
|
||||
# Mark that it is set, but ignore content.
|
||||
$cert_issuer_col = "+";
|
||||
}
|
||||
|
||||
{
|
||||
print;
|
||||
}
|
||||
'
|
||||
|
|
|
|||
158
testing/scripts/external-ca-list.bro
Normal file
158
testing/scripts/external-ca-list.bro
Normal file
File diff suppressed because one or more lines are too long
Loading…
Add table
Add a link
Reference in a new issue