Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Updating the packet filter tests to use new policy scripts.

Browse source
This commit is contained in:
Jon Siwek 2011-06-20 15:56:16 -05:00
parent ef79ab3562
commit fc66d88a04
6 changed files with 36 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

3
testing/btest/Baseline/core.print-bpf-filters-ipv4/conn.log
View file

@ -1 +1,2 @@
1128727435.450898 1.733303 141.42.64.125 125.190.109.199 http 56730 80 tcp 98 9417 SF X # ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig missed_bytes history notice_tags
1128727435.4509 UWkUyAuUGXf 141.42.64.125 56730 125.190.109.199 80 tcp - 1.73330307006836 98 9417 SF - 0 ShADdFaf -

12
testing/btest/Baseline/core.print-bpf-filters-ipv4/output
View file

@ -1,4 +1,8 @@
not ip6 # ts node filter init success
not ip6 1308602779.63662 - not ip6 F T
(not ip6) and (tcp[13] & 7 != 0) # ts node filter init success
port 42 1308602779.68967 - (tcp port 22) and (not ip6) F T
# ts node filter init success
1308602779.73049 - port 42 F T
# ts node filter init success
1308602779.77495 - port 56730 T T

3
testing/btest/Baseline/core.print-bpf-filters-ipv6/conn.log
View file

@ -1 +1,2 @@
1128727435.450898 1.733303 141.42.64.125 125.190.109.199 http 56730 80 tcp 98 9417 SF X # ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig missed_bytes history notice_tags
1128727435.4509 UWkUyAuUGXf 141.42.64.125 56730 125.190.109.199 80 tcp - 1.73330307006836 98 9417 SF - 0 ShADdFaf -

12
testing/btest/Baseline/core.print-bpf-filters-ipv6/output
View file

@ -1,4 +1,8 @@
ip or not ip # ts node filter init success
ip or not ip 1308603220.46822 - ip or not ip F T
tcp[13] & 7 != 0 # ts node filter init success
port 42 1308603220.51607 - tcp port 22 F T
# ts node filter init success
1308603220.55432 - port 42 F T
# ts node filter init success
1308603220.59452 - port 56730 T T

13
testing/btest/core/print-bpf-filters-ipv4.bro
View file

@ -1,9 +1,12 @@
# @TEST-REQUIRES: bro -e 'print bro_has_ipv6()' | grep -q F # @TEST-REQUIRES: bro -e 'print bro_has_ipv6()' | grep -q F
# #
# @TEST-EXEC: bro print-filter >output 2>&1 # @TEST-EXEC: bro -e '' >output
# @TEST-EXEC: bro tcp print-filter >>output # @TEST-EXEC: cat packetfilter.log >>output
# @TEST-EXEC: bro tcp print-filter all_packets=F >>output # @TEST-EXEC: bro PacketFilter::all_packets=F ssh >>output
# @TEST-EXEC: bro -f "port 42" print-filter >>output # @TEST-EXEC: cat packetfilter.log >>output
# @TEST-EXEC: bro -C -f "port 50343" -r $TRACES/mixed-vlan-mpls.trace tcp # @TEST-EXEC: bro -f "port 42" -e '' >>output
# @TEST-EXEC: cat packetfilter.log >>output
# @TEST-EXEC: bro -C -f "port 56730" -r $TRACES/mixed-vlan-mpls.trace conn >>output
# @TEST-EXEC: cat packetfilter.log >>output
# @TEST-EXEC: btest-diff output # @TEST-EXEC: btest-diff output
# @TEST-EXEC: btest-diff conn.log # @TEST-EXEC: btest-diff conn.log

13
testing/btest/core/print-bpf-filters-ipv6.bro
View file

@ -1,9 +1,12 @@
# @TEST-REQUIRES: bro -e 'print bro_has_ipv6()' | grep -q T # @TEST-REQUIRES: bro -e 'print bro_has_ipv6()' | grep -q T
# #
# @TEST-EXEC: bro print-filter >output 2>&1 # @TEST-EXEC: bro -e '' >output
# @TEST-EXEC: bro tcp print-filter >>output # @TEST-EXEC: cat packetfilter.log >>output
# @TEST-EXEC: bro tcp print-filter all_packets=F >>output # @TEST-EXEC: bro PacketFilter::all_packets=F ssh >>output
# @TEST-EXEC: bro -f "port 42" print-filter >>output # @TEST-EXEC: cat packetfilter.log >>output
# @TEST-EXEC: bro -C -f "port 50343" -r $TRACES/mixed-vlan-mpls.trace tcp # @TEST-EXEC: bro -f "port 42" -e '' >>output
# @TEST-EXEC: cat packetfilter.log >>output
# @TEST-EXEC: bro -C -f "port 56730" -r $TRACES/mixed-vlan-mpls.trace conn >>output
# @TEST-EXEC: cat packetfilter.log >>output
# @TEST-EXEC: btest-diff output # @TEST-EXEC: btest-diff output
# @TEST-EXEC: btest-diff conn.log # @TEST-EXEC: btest-diff conn.log