Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

spicy-redis: Add some commands and touch up parsing

Browse source
This commit is contained in:
Evan Typanski 2024-11-06 13:43:44 -05:00
parent 22bda56af3
commit f0e9f46c7c
21 changed files with 200 additions and 114 deletions
Download patch file Download diff file Expand all files Collapse all files

12
testing/btest/Baseline/scripts.base.protocols.redis.almost-redis/redis.log Normal file
View file

@ -0,0 +1,12 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path redis
#open XXXX-XX-XX-XX-XX-XX
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p cmd.command cmd.key cmd.value response.err response.data
#types time string addr port addr port string string string bool string
XXXXXXXXXX.XXXXXX CtPZjS20MLrsMUOJi2 127.0.0.1 53099 127.0.0.1 6379 AUTH - - F OK
XXXXXXXXXX.XXXXXX CtPZjS20MLrsMUOJi2 127.0.0.1 53099 127.0.0.1 6379 PING - - F OK
#close XXXX-XX-XX-XX-XX-XX

10
testing/btest/Baseline/scripts.base.protocols.redis.auth/output Normal file
View file

@ -0,0 +1,10 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
AUTH
username: notauser
password: notapassword
AUTH
username: default
password: defaultpasswordinvalid
AUTH
username: noone
password: password

19
testing/btest/Baseline/scripts.base.protocols.redis.excessive-pipelining/redis.log
View file

@ -7,17 +7,10 @@
#open XXXX-XX-XX-XX-XX-XX
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p cmd.command cmd.key cmd.value response.err response.data
#types time string addr port addr port string string string bool string
XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h ::1 57156 ::1 6379 PING - - - -
XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h ::1 57156 ::1 6379 PING - - - -
XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h ::1 57156 ::1 6379 PING - - - -
XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h ::1 57156 ::1 6379 PING - - - -
XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h ::1 57156 ::1 6379 PING - - - -
XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h ::1 57156 ::1 6379 PING - - - -
XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h ::1 57156 ::1 6379 PING - - - -
XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h ::1 57156 ::1 6379 PING - - - -
XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h ::1 57156 ::1 6379 PING - - - -
XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h ::1 57156 ::1 6379 PING - - - -
XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h ::1 57156 ::1 6379 PING - - - -
XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h ::1 57156 ::1 6379 PING - - F PONG
XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h ::1 57156 ::1 6379 PING - - F PONG
XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h ::1 57156 ::1 6379 PING - - F PONG
XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h ::1 57156 ::1 6379 PING - - F PONG
XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h ::1 57156 ::1 6379 PING - - F PONG
XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h ::1 57156 ::1 6379 - - - F PONG
XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h ::1 57156 ::1 6379 - - - F PONG
@ -26,8 +19,4 @@ XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h ::1 57156 ::1 6379 - - - F PONG
XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h ::1 57156 ::1 6379 - - - F PONG
XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h ::1 57156 ::1 6379 - - - F PONG
XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h ::1 57156 ::1 6379 - - - F PONG
XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h ::1 57156 ::1 6379 - - - F PONG
XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h ::1 57156 ::1 6379 - - - F PONG
XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h ::1 57156 ::1 6379 - - - F PONG
XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h ::1 57156 ::1 6379 - - - F PONG
#close XXXX-XX-XX-XX-XX-XX

BIN
testing/btest/Traces/redis/almost-resp.trace Normal file
View file

Binary file not shown.

BIN
testing/btest/Traces/redis/auth.trace Normal file
View file

Binary file not shown.

8
testing/btest/scripts/base/protocols/redis/almost-redis.zeek Normal file
View file

@ -0,0 +1,8 @@
# @TEST-DOC: Test 2 commands that look like RESP, then server responses don't
#
# @TEST-EXEC: zeek -Cr $TRACES/redis/almost-resp.trace base/protocols/redis %INPUT >output
# @TEST-EXEC: btest-diff redis.log
#
# Really, the first 2 ARE Redis. The later ones should not be logged because we
# realized it's not Redis. The output from the server is:
# +OK\r\n+OK\r\nnot RESP\r\nStill not RESP\r\nNope\r\n

16
testing/btest/scripts/base/protocols/redis/auth.zeek Normal file
View file

@ -0,0 +1,16 @@
# @TEST-DOC: Test Zeek with AUTH commands
#
# @TEST-EXEC: zeek -Cr $TRACES/redis/auth.trace base/protocols/redis %INPUT >output
# @TEST-EXEC: btest-diff output
event Redis::auth_command(c: connection, is_orig: bool,
command: Redis::AuthCommand)
{
print "AUTH";
if ( command?$username )
print fmt("username: %s", command$username);
else
print "username: default";
print fmt("password: %s", command$password);
}

9
testing/btest/scripts/base/protocols/redis/bulk.zeek
View file

@ -7,7 +7,8 @@
# code directly to the server, but it's useful to see if that trace might come
# up with something different. See:
# https://redis.io/docs/latest/develop/use/patterns/bulk-loading/
event Redis::set_command(c: connection, is_orig: bool, command: Redis::SetCommand)
{
print fmt("SET: %s %s", command$key, command$value);
}
event Redis::set_command(c: connection, is_orig: bool,
command: Redis::SetCommand)
{
print fmt("SET: %s %s", command$key, command$value);
}

1
testing/btest/scripts/base/protocols/redis/client-reply-off-2conn.zeek
View file

@ -2,4 +2,3 @@
#
# @TEST-EXEC: zeek -Cr $TRACES/redis/reply-off-on-2conn.trace base/protocols/redis %INPUT >output
# @TEST-EXEC: btest-diff redis.log

1
testing/btest/scripts/base/protocols/redis/client-reply-off.zeek
View file

@ -2,4 +2,3 @@
#
# @TEST-EXEC: zeek -Cr $TRACES/redis/reply-off-on.trace base/protocols/redis %INPUT >output
# @TEST-EXEC: btest-diff redis.log

1
testing/btest/scripts/base/protocols/redis/client-skip-while-off.zeek
View file

@ -2,4 +2,3 @@
#
# @TEST-EXEC: zeek -Cr $TRACES/redis/client-skip-while-off.trace base/protocols/redis %INPUT >output
# @TEST-EXEC: btest-diff redis.log

16
testing/btest/scripts/base/protocols/redis/django-cloud.zeek
View file

@ -4,12 +4,12 @@
# @TEST-EXEC: btest-diff output
# @TEST-EXEC: btest-diff redis.log
redef Redis::ports += {
10625/tcp,
};
redef Redis::ports += { 10625/tcp, };
event Redis::set_command(c: connection, is_orig: bool, command: Redis::SetCommand)
{
# Print the whole command because these have extra data that's worth capturing.
print fmt("SET: %s %s expires in %d milliseconds", command$key, command$value, command$px);
}
event Redis::set_command(c: connection, is_orig: bool,
command: Redis::SetCommand)
{
# Print the whole command because these have extra data that's worth capturing.
print fmt("SET: %s %s expires in %d milliseconds", command$key, command$value,
command$px);
}

12
testing/btest/scripts/base/protocols/redis/django.zeek
View file

@ -4,8 +4,10 @@
# @TEST-EXEC: btest-diff output
# @TEST-EXEC: btest-diff redis.log
event Redis::set_command(c: connection, is_orig: bool, command: Redis::SetCommand)
{
# Print the whole command because these have extra data that's worth capturing.
print fmt("SET: %s %s expires in %d milliseconds", command$key, command$value, command$px);
}
event Redis::set_command(c: connection, is_orig: bool,
command: Redis::SetCommand)
{
# Print the whole command because these have extra data that's worth capturing.
print fmt("SET: %s %s expires in %d milliseconds", command$key, command$value,
command$px);
}

18
testing/btest/scripts/base/protocols/redis/pipelined-with-commands.zeek
View file

@ -7,12 +7,14 @@
# Sometimes commands aren't serialized, like when pipelining. This still works! So we
# should handle this. This particular example has a few commands, amongst them a SET and
# a GET.
event Redis::set_command(c: connection, is_orig: bool, command: Redis::SetCommand)
{
print fmt("SET: %s %s", command$key, command$value);
}
event Redis::set_command(c: connection, is_orig: bool,
command: Redis::SetCommand)
{
print fmt("SET: %s %s", command$key, command$value);
}
event Redis::get_command(c: connection, is_orig: bool, command: Redis::GetCommand)
{
print fmt("GET: %s", command);
}
event Redis::get_command(c: connection, is_orig: bool,
command: Redis::GetCommand)
{
print fmt("GET: %s", command);
}

9
testing/btest/scripts/base/protocols/redis/set.zeek
View file

@ -3,7 +3,8 @@
# @TEST-EXEC: zeek -Cr $TRACES/redis/set.trace base/protocols/redis %INPUT >output
# @TEST-EXEC: btest-diff output
event Redis::set_command(c: connection, is_orig: bool, command: Redis::SetCommand)
{
print fmt("Key: %s Value: %s", command$key, command$value);
}
event Redis::set_command(c: connection, is_orig: bool,
command: Redis::SetCommand)
{
print fmt("Key: %s Value: %s", command$key, command$value);
}

11
testing/btest/scripts/base/protocols/redis/standalone.spicy
View file

@ -1,11 +0,0 @@
# @TEST-DOC: Test parsing behavior of RESP.
#
# @TEST-EXEC: spicyc ${DIST}/analyzer/resp.spicy ${DIST}/analyzer/redis.spicy -j -d -o redis.hlto
#
# TODO: A lot of tests are possible from the docs and having them would be nice.
# But, a lot of characters ($, -, etc.) cause problems with TEST_EXEC. ugh.
# @TEST-EXEC: printf "+OK\x0d\x0a" | spicy-dump -p RESP::Data redis.hlto >>output 2>&1
# @TEST-EXEC: printf ":1000\x0d\x0a" | spicy-dump -p RESP::Data redis.hlto >>output 2>&1
# @TEST-EXEC: printf ":-1000\x0d\x0a" | spicy-dump -p RESP::Data redis.hlto >>output 2>&1
# @TEST-EXEC: printf ":+1000\x0d\x0a" | spicy-dump -p RESP::Data redis.hlto >>output 2>&1
# @TEST-EXEC: TEST_DIFF_CANONIFIER= btest-diff output

18
testing/btest/scripts/base/protocols/redis/trace.zeek
View file

@ -4,12 +4,14 @@
# @TEST-EXEC: btest-diff output
# @TEST-EXEC: btest-diff redis.log
event Redis::set_command(c: connection, is_orig: bool, command: Redis::SetCommand)
{
print fmt("SET: %s %s", command$key, command$value);
}
event Redis::set_command(c: connection, is_orig: bool,
command: Redis::SetCommand)
{
print fmt("SET: %s %s", command$key, command$value);
}
event Redis::get_command(c: connection, is_orig: bool, command: Redis::GetCommand)
{
print fmt("GET: %s", command);
}
event Redis::get_command(c: connection, is_orig: bool,
command: Redis::GetCommand)
{
print fmt("GET: %s", command);
}