test-all-policy: Do not load iso-9660.zeek

Changing the default_file_bof_buffer_size has subtle impact on
MIME type detection and changed the zeek-testing baseline. Do
not load this new script via test-all-policy to avoid this.

The new test was mainly an aid to understand what is actually going on.
In short, if default_file_bof_buffer_size is larger than the file MIME
detection only runs when the buffer is full, or when the file is removed.
When a file transfer happens over multiple HTTP connections, only
some or one of the http.log entries will have a proper response MIME type.

PCAP extracted from 2009-M57-day11-18.trace.gz.

scripts/test-all-policy.zeek

@@ -72,7 +72,7 @@
 @load frameworks/notice/extend-email/hostnames.zeek
 @load files/x509/disable-certificate-events-known-certs.zeek
 @load frameworks/packet-filter/shunt.zeek
-@load frameworks/signatures/iso-9660.zeek
+# @load frameworks/signatures/iso-9660.zeek
 @load frameworks/software/version-changes.zeek
 @load frameworks/software/vulnerable.zeek
 # @load frameworks/spicy/record-spicy-batch.zeek

scripts/zeekygen/__load__.zeek

@@ -10,6 +10,7 @@
 @load frameworks/management/node/__load__.zeek
 @load frameworks/management/node/main.zeek
 @load frameworks/files/extract-all-files.zeek
+@load frameworks/signatures/iso-9660.zeek
 @load policy/misc/dump-events.zeek
 @load policy/protocols/conn/speculative-service.zeek
 

testing/btest/Baseline/scripts.base.files.mime.vnd.ms-cab-compressed-multi-conn/files.log.cut

@@ -0,0 +1,7 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+fuid	source	mime_type	filename
+FJYJFE2AmtoQavCYEh	HTTP	application/vnd.ms-cab-compressed	windows6.0-kb955430-x86-express_9c8a57958486102e94e591384dc69dd7e8d01169.cab
+FJYJFE2AmtoQavCYEh	HTTP	application/vnd.ms-cab-compressed	windows6.0-kb955430-x86-express_9c8a57958486102e94e591384dc69dd7e8d01169.cab
+FJYJFE2AmtoQavCYEh	HTTP	application/vnd.ms-cab-compressed	windows6.0-kb955430-x86-express_9c8a57958486102e94e591384dc69dd7e8d01169.cab
+FJYJFE2AmtoQavCYEh	HTTP	application/vnd.ms-cab-compressed	windows6.0-kb955430-x86-express_9c8a57958486102e94e591384dc69dd7e8d01169.cab
+FJYJFE2AmtoQavCYEh	HTTP	application/vnd.ms-cab-compressed	windows6.0-kb955430-x86-express_9c8a57958486102e94e591384dc69dd7e8d01169.cab

testing/btest/Baseline/scripts.base.files.mime.vnd.ms-cab-compressed-multi-conn/http.log.cut

@@ -0,0 +1,7 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+uid	method	host	status_code	resp_fuids	response_body_len	resp_mime_types
+CHhAvVGS1DHFjwGM9	GET	au.download.windowsupdate.com	206	FJYJFE2AmtoQavCYEh	5473	-
+ClEkJM2Vm5giqnMf4h	GET	au.download.windowsupdate.com	206	FJYJFE2AmtoQavCYEh	6622	-
+C4J4Th3PJpwUYZZ6gc	GET	au.download.windowsupdate.com	206	FJYJFE2AmtoQavCYEh	7551	-
+CtPZjS20MLrsMUOJi2	GET	au.download.windowsupdate.com	206	FJYJFE2AmtoQavCYEh	11791	-
+CUM0KZ3MLUfNB0cl11	GET	au.download.windowsupdate.com	206	FJYJFE2AmtoQavCYEh	8181	application/vnd.ms-cab-compressed

testing/btest/scripts/base/files/mime/vnd.ms-cab-compressed-multi-conn.zeek

@@ -0,0 +1,22 @@
+# @TEST-DOC: Increasing default_file_bof_buffer_size has subtle impact on mime_type detection and association for partial file transfers over HTTP. Test mainly to aid understanding.
+#
+# @TEST-EXEC: zeek -b -r $TRACES/http/vnd.ms-cab-compressed-multi-conn.pcap %INPUT
+# @TEST-EXEC: zeek-cut -m fuid source mime_type filename < files.log > files.log.cut
+# @TEST-EXEC: btest-diff files.log.cut
+# @TEST-EXEC: zeek-cut -m uid method host status_code resp_fuids response_body_len resp_mime_types < http.log > http.log.cut
+# @TEST-EXEC: btest-diff http.log.cut
+
+@load base/protocols/http
+@load base/frameworks/files
+
+# Increases default_file_bof_buffer_size, resulting in only one of the GET
+# of http.log having the application/vnd.ms-cab-compressed associated.
+@load policy/frameworks/signatures/iso-9660
+
+redef LogAscii::use_json = F;
+
+event file_over_new_connection(f: fa_file, c: connection, is_orig: bool)
+	{
+	if ( f$source == "HTTP" )
+		f$info$filename = split_string(c$http$uri, /\//)[-1];
+	}