Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Add btests for ip_proto policy files

Browse source
This commit is contained in:
Tim Wojtulewicz 2024-11-13 16:11:04 -07:00
parent 2125a1f558
commit fbaf438a1d
3 changed files with 25 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

2
testing/btest/Baseline/scripts.policy.protocols.conn.ip-proto-name-logging/out Normal file
View file

@ -0,0 +1,2 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
unknown-ip-proto-500

8
testing/btest/scripts/policy/protocols/conn/disable-unknown-ip-proto-support.zeek Normal file
View file

@ -0,0 +1,8 @@
# @TEST-DOC: Test the policy for removing the unknown IP protocol field and connections from conn.log
# @TEST-EXEC: zeek -r $TRACES/cisco-fabric-path.pcap %INPUT
# @TEST-EXEC: test $(head -1 conn.log | jq 'has("ip_proto")') = "false"
# @TEST-EXEC-FAIL: cat conn.log | jq .proto | sort | uniq | grep unknown_transport
@load policy/protocols/conn/disable-unknown-ip-proto-support
redef LogAscii::use_json = T;

15
testing/btest/scripts/policy/protocols/conn/ip-proto-name-logging.zeek Normal file
View file

@ -0,0 +1,15 @@
# @TEST-DOC: Tests the ip-proto-name-logging policy file
# @TEST-EXEC: zeek -r $TRACES/cisco-fabric-path.pcap %INPUT > out
# @TEST-EXEC-FAIL: cat conn.log | jq 'has("ip_proto_name")' | grep "false"
# @TEST-EXEC: cat conn.log | jq .ip_proto_name | sort | uniq | grep private-encryption
# @TEST-EXEC: btest-diff out
@load policy/protocols/conn/ip-proto-name-logging
redef LogAscii::use_json = T;
event zeek_init() {
# Test printing out an unknown value from the protocol_names table
print IP::protocol_names[500];
}