Commit graph

180 commits

Author SHA1 Message Date
Daniel Thayer
3767d2bee2 Travis CI fewer failures and improved output messages
Improved readability of the output by adding more error checking
and better error and informational messages, and by moving the
unit test diag.log output to just before any external tests are run.

For pull request builds, skip the private tests instead of failing.

Prevent timeouts after 10 minutes of no output by not using the
btest "-b" option.

Decrease build time by not building unneeded components.
2018-06-22 01:01:40 -05:00
Daniel Thayer
b23029a09d Reduce number of btest threads running tests on Travis CI
On Travis CI, btest was using 32 threads when running with "-j".  Reducing
this to "-j 4" seems to make the tests run a bit faster overall and
somewhat reduces the number of test failures.
2018-04-20 09:30:06 -05:00
Daniel Thayer
8c91cafad8 Trim the Travis CI build log output
Remove some output from the Travis CI build log to make it easier
to read.

There is an issue with Travis CI when using encrypted environment
variables.  In this case, when btest calls the python function
sys.stdout.isatty() it returns False, which causes btest to output one
line for each test (passed or failed).  As a result, it is difficult to
see at a glance which tests failed.  Switching to btest brief output to
address this issue.
2018-04-05 14:12:24 -05:00
Daniel Thayer
aadcd5d2cc Fix the travis-job script to always run external tests
Run the external tests even when the Bro tests fail.
2018-03-22 19:36:40 -05:00
Robin Sommer
9271b2032d Merge remote-tracking branch 'origin/topic/dnthayer/travis-ci-updates'
I've moved .travis.job to testing/scripts/travis-job and adapted
.travis.yml accordingly.

* origin/topic/dnthayer/travis-ci-updates:
  Fix information leak in the update-traces script
  Add coverity scan and private testing to Travis CI
2018-03-22 14:26:21 -07:00
Daniel Thayer
8ae064006b Merge remote-tracking branch 'origin/master' into fastpath 2016-10-21 09:35:04 -05:00
Daniel Thayer
99cd34f57d Python 3 compatibility fix for coverage-calc script 2016-10-21 09:33:04 -05:00
Daniel Thayer
e780ebb17a Fix httpd.py test script for Py3 compatibility
With these changes the script still works on Python 2.6/2.7.
2016-10-06 15:45:11 -05:00
Johanna Amann
0d706bcccd add certificate to external list for debian 8.
The OpenSSL on debian 8 refuses to validate one connection; everyone
else can. The easiest fix is to add the CA certificate to the root list.
Once debian has a newer version of OpenSSL, we should be able to remove
it again.
2016-08-15 16:47:44 -07:00
Robin Sommer
aee312b5d2 Adding usage guard to canonifier script. 2015-12-18 12:59:26 -08:00
Johanna Amann
77c79bd010 Load static CA list for validation tests too.
This fixes test failures in some cases (and should protect against future test failures).
2015-10-02 15:12:32 -04:00
Johanna Amann
630e9f22d2 Merge remote-tracking branch 'origin/master' into topic/dnthayer/ticket1467 2015-10-02 11:31:00 -07:00
Daniel Thayer
b1d1d90de4 Fix a bug in diff-remove-x509-names canonifier
The last field in a log was being ignored, due to an off-by-one
error in a "for" loop.  Also simplified the script by combining
two patterns into one.
2015-09-20 00:21:04 -05:00
Daniel Thayer
a7aa393aef Improve a few test canonifiers 2015-09-19 18:08:31 -05:00
Daniel Thayer
6f1e07f6d5 Fixed some test canonifiers to read only from stdin
Fixed some test canonifier scripts to read from stdin instead of
from a filename specified as a cmd-line argument.  This is needed
in order to be able to reliably use them in a pipeline with other
test canonifiers.

Also removed some unused test canonifier scripts.
2015-09-18 17:30:26 -05:00
Daniel Thayer
4788e4e715 Fix some test canonifiers in scripts/policy/protocols/ssl 2015-08-22 21:56:55 -05:00
Daniel Thayer
f3fb2b2f52 Fix diff-canonifier-external to use basename of input file
Use basename of the input filename because sometimes it will have
directory components, such as for the baseline files.
2015-08-15 21:05:40 -05:00
Jon Siwek
8859c73bde Add/fix log fields in x509 diff canonifier. 2015-02-05 10:04:04 -06:00
Seth Hall
842dfd8b4a Merge remote-tracking branch 'origin/topic/seth/files-tracking' into topic/seth/files-reassembly-and-mime-updates
Conflicts:
	testing/btest/Baseline/scripts.base.frameworks.file-analysis.http.multipart/out
	testing/btest/Baseline/scripts.policy.misc.dump-events/all-events.log
2014-11-05 11:40:26 -05:00
Robin Sommer
4216a5eb1c Merge remote-tracking branch 'origin/topic/struck/BIT-1277'
* origin/topic/struck/BIT-1277:
  [ADD] Added the feature to return 0 content to the python http test server and added functionality for post requests
  [ADD] added baseline for the new active-http test and added a test to check for the content-length 0 fix.
  [ADD] added baseline for the new exec test and added a test to check for the empty files fix.
  [FIX] exec should write an empty string when file is empty instead of the filename
  [FIX] Add files to result table even if the files are empty

BIT-1277 #merged
2014-10-24 11:43:09 -07:00
Christian Struck
de33490586 [ADD] Added the feature to return 0 content to the python http test server and added functionality for post requests 2014-10-22 16:05:06 -07:00
Seth Hall
cafd35e746 Updates the files event api and brings file reassembly up to master. 2014-09-26 00:40:37 -04:00
Jon Siwek
d342cde22c Improve error message when failing to activate a plugin.
Also fix a unit test helper script that checks plugin availability.
2014-09-16 10:09:46 -05:00
Robin Sommer
f4cbcb9b03 Converting log writers and input readers to plugins. 2014-07-20 19:17:58 +02:00
Jon Siwek
a0c06a957b Add SNMP datagram parsing support.
This supports parsing of SNMPv1 (RFC 1157), SNMPv2 (RFC 1901/3416), and
SNMPv2 (RFC 3412).  An event is raised for each SNMP PDU type, though
there's not currently any event handlers for them and not a default
snmp.log either.  However, simple presence of SNMP is currently visible
now in conn.log service field and known_services.log.
2014-02-18 14:41:32 -06:00
Jon Siwek
4014cdc277 Fix string slice notation, addresses BIT-1097.
Slice ranges were not correctly determined for negative indices and also
off by one in general (included one more element at the end of the
substring than what actually matched the index range).

It's now equivalent to Python slice notation.  Accessing a string at
a single index is also the same as Python except that an out-of-range
index returns an empty string instead of throwing an expection.
2013-12-03 14:39:21 -06:00
Robin Sommer
1164fdfb46 Removing location information from ssh.log in external tests. 2013-11-07 02:19:23 -08:00
Robin Sommer
ac66db286a Merge remote-tracking branch 'origin/topic/documentation'
I'm merging in the documentation branch to avoid that it keeps getting
out of sync. We still need to work on this a bit more, I'll summarize
in a mail.

* origin/topic/documentation: (68 commits)
  Going over initial parts of the scripting overview.
  Adding lines in scripting/index.txt. No other change.
  Updating submodule.
  Pass over the Using Bro section.
  Applying doc updates from BIT-1063. (Anthony Verez)
  Breaking lines in using/*.
  More doc reorg, and a light pass over the first 3 sections.
  Starting to put a new structure in place.
  Updating submodule(s).
  Updating submodule(s).
  Adding some temporary testing/demonstration to front page.
  Switching btest to topic/robin/parts branch.
  Basic cross-referencing UIDs between files, btests, and baselines.
  A truly embarassing number of spelling corrections.
  Using redirection with bro-cut.  Include initial btests for this document.
  Corrected a mis-typed RST include.
  Initial start for "Using Bro".
  Spelling corrections.
  Include Notice Policy shortcuts in the Scripting User Manual.
  Notice::policy hooks and tests.
  ...

Conflicts:
	src/3rdparty
2013-08-31 16:07:44 -07:00
Robin Sommer
b74bf10565 Going over initial parts of the scripting overview.
I made a light pass over the text. Switched the includes over to the
new btest-include and adapted the other TEXT-EXECs a bit.

Also includes more tweaking all over the Sphinx setup.
2013-08-30 16:23:17 -07:00
Jon Siwek
22bf3e1196 Increase UIDs to 96 bits w/ C/F prefix - BIT-1016
- The bit-length is adjustable via redef'ing bits_per_uid.

- Prefix 'C' is used for connection UIDS (including IP tunnels) and
  'F' for files.
2013-08-26 15:36:31 -05:00
Robin Sommer
399899c49b Pass over the Using Bro section.
I edited the text little bit, reorganized the structure somewhat and
extended some parts. I've also simplified the tests a bit, using some
of the BTest tweaks commited in parallel.
2013-08-22 16:04:45 -07:00
Robin Sommer
e2f8fdc3f6 Merge remote-tracking branch 'origin/topic/jsiwek/exec-module'
* origin/topic/jsiwek/exec-module:
  Exec module changes/fixes.
  Coverage test fixes and whitespace/doc tweaks.
  Update to make Dir::monitor watch inodes instead of file names.
  Updates to use new input framework mechanism to execute command line programs.
  Added Exec, Dir, and ActiveHTTP modules.

BIT-1046 #merged.

Conflicts:
	magic
	testing/btest/Baseline/coverage.default-load-baseline/canonified_loaded_scripts.log
2013-07-29 15:53:59 -07:00
Jon Siwek
939619889d File analysis fixes and test updates.
- Several places were just using old variable names or not loading
  scripts correctly after they'd been renamed/moved.

- Revert/adjust a change in how HTTP file handles are generated that
  broke partial content responses.

- Turn some libmagic builtin checks back on; seems some are actually
  useful (e.g. text detection seems to be a builtin).  The rule going
  forward probably will be only to turn off a builtin if we confirm it
  causes issues.

- Removed some tests that are redundant or not necessary anymore because
  the generic file analysis tests cover them.

- A couple FTP tests still fail that I think need an actual solution via
  script changes.
2013-07-25 16:51:16 -05:00
Jon Siwek
ac6b12b5d4 Merge branch 'master' into topic/jsiwek/faf-updates
Conflicts:
	magic
2013-07-25 10:02:26 -05:00
Jon Siwek
73eb87a41e Exec module changes/fixes.
- Give Dir::monitor() a param for the polling interval, so different
  dirs can be monitored at different frequencies.

- Fix race in Exec::run() when reading extra output files produced by
  a process -- it was possible for Exec::run() to return before all
  extra output files had been fully read.

- Add test cases.
2013-07-23 14:16:39 -05:00
Seth Hall
f098b17429 A few test updates. 2013-07-23 11:18:49 -04:00
Robin Sommer
efd343af8d Extending external canonifier to remove fractional values from
capture_loss.log.
2013-07-17 21:57:17 -07:00
Jon Siwek
73155c321b Add an is_orig parameter to file_over_new_connection event. 2013-07-09 15:58:28 -05:00
Seth Hall
58d133e764 Merge remote-tracking branch 'origin/master' into topic/seth/faf-updates
Conflicts:
	scripts/base/frameworks/files/main.bro
	scripts/base/init-bare.bro
	scripts/base/protocols/ftp/file-analysis.bro
	scripts/base/protocols/http/file-analysis.bro
	scripts/base/protocols/irc/file-analysis.bro
	scripts/base/protocols/smtp/file-analysis.bro
	src/const.bif
	src/event.bif
	src/file_analysis/Analyzer.h
	src/file_analysis/file_analysis.bif
2013-07-05 02:13:27 -04:00
Seth Hall
df2841458d Large overhaul in name and appearance for file analysis. 2013-07-05 02:00:14 -04:00
Jon Siwek
f2574636b6 Merge branch 'master' into topic/jsiwek/faf-cleanup
Conflicts:
	scripts/base/protocols/ftp/file-analysis.bro
	scripts/base/protocols/http/file-analysis.bro
	scripts/base/protocols/irc/file-analysis.bro
	scripts/base/protocols/smtp/file-analysis.bro
	src/file_analysis/File.cc
	src/file_analysis/File.h
	src/file_analysis/Manager.cc
	src/file_analysis/Manager.h
	testing/btest/Baseline/scripts.base.frameworks.file-analysis.logging/file_analysis.log
	testing/btest/Baseline/scripts.base.protocols.ftp.ftp-extract/ftp-item-0.dat
	testing/btest/Baseline/scripts.base.protocols.ftp.ftp-extract/ftp-item-1.dat
	testing/btest/Baseline/scripts.base.protocols.ftp.ftp-extract/ftp-item-2.dat
	testing/btest/Baseline/scripts.base.protocols.ftp.ftp-extract/ftp-item-3.dat
	testing/btest/Baseline/scripts.base.protocols.ftp.ftp-extract/ftp-item-BTsa70Ua9x7-1.dat
	testing/btest/Baseline/scripts.base.protocols.ftp.ftp-extract/ftp-item-BTsa70Ua9x7.dat
	testing/btest/Baseline/scripts.base.protocols.ftp.ftp-extract/ftp-item-Rqjkzoroau4-0.dat
	testing/btest/Baseline/scripts.base.protocols.ftp.ftp-extract/ftp-item-Rqjkzoroau4.dat
	testing/btest/Baseline/scripts.base.protocols.ftp.ftp-extract/ftp-item-VLQvJybrm38-2.dat
	testing/btest/Baseline/scripts.base.protocols.ftp.ftp-extract/ftp-item-VLQvJybrm38.dat
	testing/btest/Baseline/scripts.base.protocols.ftp.ftp-extract/ftp-item-zrfwSs9K1yk-3.dat
	testing/btest/Baseline/scripts.base.protocols.ftp.ftp-extract/ftp-item-zrfwSs9K1yk.dat
	testing/btest/Baseline/scripts.base.protocols.ftp.ftp-extract/ftp.log
	testing/btest/Baseline/scripts.base.protocols.http.http-extract-files/http-item-BFymS6bFgT3-0.dat
	testing/btest/Baseline/scripts.base.protocols.http.http-extract-files/http-item-BFymS6bFgT3.dat
	testing/btest/Baseline/scripts.base.protocols.http.http-extract-files/http-item.dat
	testing/btest/Baseline/scripts.base.protocols.http.http-extract-files/http.log
	testing/btest/Baseline/scripts.base.protocols.irc.dcc-extract/irc-dcc-item-wqKMAamJVSb-0.dat
	testing/btest/Baseline/scripts.base.protocols.irc.dcc-extract/irc-dcc-item-wqKMAamJVSb.dat
	testing/btest/Baseline/scripts.base.protocols.irc.dcc-extract/irc-dcc-item.dat
	testing/btest/Baseline/scripts.base.protocols.irc.dcc-extract/irc.log
	testing/btest/Baseline/scripts.base.protocols.smtp.mime-extract/smtp-entity-0.dat
	testing/btest/Baseline/scripts.base.protocols.smtp.mime-extract/smtp-entity-1.dat
	testing/btest/Baseline/scripts.base.protocols.smtp.mime-extract/smtp-entity-Ltd7QO7jEv3-1.dat
	testing/btest/Baseline/scripts.base.protocols.smtp.mime-extract/smtp-entity-Ltd7QO7jEv3.dat
	testing/btest/Baseline/scripts.base.protocols.smtp.mime-extract/smtp-entity-cwR7l6Zctxb-0.dat
	testing/btest/Baseline/scripts.base.protocols.smtp.mime-extract/smtp-entity-cwR7l6Zctxb.dat
	testing/btest/Baseline/scripts.base.protocols.smtp.mime-extract/smtp_entities.log
	testing/btest/scripts/base/protocols/ftp/ftp-extract.bro
	testing/btest/scripts/base/protocols/http/http-extract-files.bro
	testing/btest/scripts/base/protocols/irc/dcc-extract.test
	testing/btest/scripts/base/protocols/smtp/mime-extract.test
2013-06-07 15:44:36 -05:00
Robin Sommer
74e99a27db Ignoring file ids in external tests.
They can change occasionally, and we likewise ignore uids already.
2013-06-04 21:23:50 -07:00
Jon Siwek
037d582b0e FileAnalysis: add custom libmagic database.
- It's derived from the magic database of libmagic 5.14, but with most
  everything not related to mime types removed.

- The custom database is always used by default for mime detection, but
  the more verbose file type detection will fall back on the default
  libmagic installation's database.  The result is: mime type strings
  are now guaranteed to be consistent across platforms, but the verbose
  file type descriptions are not.

- The custom database gets installed in $prefix/share/bro/magic, and
  should even be extensible if files with new patterns are added inside
  the directory.

- The search path for the mime magic database can be controlled via
  BROMAGIC environment variable.

- Remove mime_desc field from ftp.log.

- Stop using the mime/file type canonifier with unit tests.

- libmagic >= 5.04 is now a requirement.
2013-04-12 11:58:19 -05:00
Jon Siwek
b8c98b8bf7 FileAnalysis: change terminology s/action/analyzer 2013-04-11 14:53:54 -05:00
Jon Siwek
e81f2ae7b0 FileAnalysis: libmagic tweaks.
Remove verbose file type detection and automatically strip out charset
from mime type.
2013-04-11 13:11:46 -05:00
Jon Siwek
e2fbee9054 FileAnalysis: add more params to some events. 2013-04-11 11:24:18 -05:00
Jon Siwek
d9321e2203 FileAnalysis: remove some file events.
The file_new event now takes over the function of file_type, file_bof,
and file_bof_buffer.
2013-04-10 14:34:23 -05:00
Jon Siwek
a2d9b47bcd FileAnalysis: finish switching hooks to events. 2013-04-10 11:13:43 -05:00
Jon Siwek
641154f8e8 FileAnalysis: checkpoint in middle of big reorganization.
- FileAnalysis::Info is now just a record used for logging, the fa_file
  record type is defined in init-bare.bro as the analogue to a
  connection record.

- Starting to transfer policy hook triggers and analyzer results to
  events.
2013-04-09 15:49:58 -05:00
Jon Siwek
e73a261262 FileAnalysis: fix file type canonification for file_analysis.log 2013-04-03 09:58:35 -05:00