Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-08 17:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge branch 'ntp-rewrite' of https://github.com/mauropalumbo75/zeek

Browse source 
* 'ntp-rewrite' of https://github.com/mauropalumbo75/zeek: (25 commits)
  update tests baseline
  Apply requested changes: - file dpd.sig and TODO comments for signature protocol detection removed - missing doc field filled in events.bif - rename OpCode and ReqCode fields into op_code and req_code respectively - removed unnecessary child method in NTP.h/.cc - main.zeek and ntp-protocol.pac reformatted
  minor changes in the documentation
  fix some initializations
  fix wrong assignment of control key_id/crypto_checksum
  code clean up
  add extension fields parsing
  add extended mac field with 20 byte digest (+4 byte key id)
  update tests and add a new one for key_id and mac
  fix auth field (key_id and mac) in standard and control msg
  remove old NTP record in init-bare.zeek
  fix key_id and digest (WIP)
  fix wrong Assign with reference_id
  add tests for ntp protocol (finished)
  add tests for ntp protocol (WIP)
  fix problem with time vals
  add ntp records to init-bare.zeek
  update ntp analyzer to val_mgr
  extend and refact script-side of NTP analyzer
  extend and refactor several fields
  ...
This commit is contained in:
Jon Siwek 2019-06-15 19:09:03 -07:00
commit e2dc0092f3
53 changed files with 1729 additions and 711 deletions
Download patch file Download diff file Expand all files Collapse all files

11
testing/btest/scripts/base/protocols/ntp/ntp-digest.test Normal file
View file

@ -0,0 +1,11 @@
# @TEST-EXEC: zeek -C -r $TRACES/ntp/NTP-digest.pcap %INPUT
# @TEST-EXEC: btest-diff ntp.log
# @TEST-EXEC: btest-diff .stdout
@load base/protocols/ntp
event ntp_message(c: connection, is_orig: bool, msg: NTP::Message)
{
print fmt("ntp_message %s -> %s:%d %s", c$id$orig_h, c$id$resp_h, c$id$resp_p, msg);
}

11
testing/btest/scripts/base/protocols/ntp/ntp.test Normal file
View file

@ -0,0 +1,11 @@
# @TEST-EXEC: zeek -C -r $TRACES/ntp/ntp.pcap %INPUT
# @TEST-EXEC: btest-diff ntp.log
# @TEST-EXEC: btest-diff .stdout
@load base/protocols/ntp
event ntp_message(c: connection, is_orig: bool, msg: NTP::Message)
{
print fmt("ntp_message %s -> %s:%d %s", c$id$orig_h, c$id$resp_h, c$id$resp_p, msg);
}

11
testing/btest/scripts/base/protocols/ntp/ntp2.test Normal file
View file

@ -0,0 +1,11 @@
# @TEST-EXEC: zeek -C -r $TRACES/ntp/ntp2.pcap %INPUT
# @TEST-EXEC: btest-diff ntp.log
# @TEST-EXEC: btest-diff .stdout
@load base/protocols/ntp
event ntp_message(c: connection, is_orig: bool, msg: NTP::Message)
{
print fmt("ntp_message %s -> %s:%d %s", c$id$orig_h, c$id$resp_h, c$id$resp_p, msg);
}

11
testing/btest/scripts/base/protocols/ntp/ntp3.test Normal file
View file

@ -0,0 +1,11 @@
# @TEST-EXEC: zeek -C -r $TRACES/ntp/NTP_sync.pcap %INPUT
# @TEST-EXEC: btest-diff ntp.log
# @TEST-EXEC: btest-diff .stdout
@load base/protocols/ntp
event ntp_message(c: connection, is_orig: bool, msg: NTP::Message)
{
print fmt("ntp_message %s -> %s:%d %s", c$id$orig_h, c$id$resp_h, c$id$resp_p, msg);
}

10
testing/btest/scripts/base/protocols/ntp/ntpmode67.test Normal file
View file

@ -0,0 +1,10 @@
# @TEST-EXEC: zeek -C -r $TRACES/ntp/ntpmode67.pcap %INPUT
# @TEST-EXEC: btest-diff .stdout
@load base/protocols/ntp
event ntp_message(c: connection, is_orig: bool, msg: NTP::Message)
{
print fmt("ntp_message %s -> %s:%d %s", c$id$orig_h, c$id$resp_h, c$id$resp_p, msg);
}