mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
0c875220e9
In the past, we used a default canonifier, which removes everything that looks like a timestamp from log files. The goal of this is to prevent logs from changing, e.g., due to local system times ending up in log files. This, however, also has the side-effect of removing information that is parsed from protocols which probably should be part of our tests. There is at least one test (1999 certificates) where the entire test output was essentially removed by the canonifier. GH-4521 was similarly masked by this. This commit changes the default canonifier, so that only the first timestamp in a line is removed. This should skip timestamps that are likely to change while keeping timestamps that are parsed from protocol information. A pass has been made over the tests, with some additional adjustments for cases which require the old canonifier. There are some cases in which we probably could go further and not remove timestamps at all - that, however, seems like a follow-up project.
33 lines
1.4 KiB
Text
33 lines
1.4 KiB
Text
# @TEST-REQUIRES: test "${ZEEK_ZAM}" != "1"
|
|
# @TEST-REQUIRES: have-spicy # This test logs loaded scripts, so disable it if Spicy and the associated plugin are unavailable.
|
|
# @TEST-REQUIRES: have-zeromq # This test logs loaded scripts, so disable it if ZeroMQ isn't available.
|
|
# @TEST-REQUIRES: ! have-spicy-ssl # Enabling Spicy SSL changes baselines and thus changes raised events. Skip in this case.
|
|
# @TEST-EXEC: ${DIST}/auxil/zeek-aux/plugin-support/init-plugin -u . Demo Hooks
|
|
# @TEST-EXEC: cp -r %DIR/hooks-plugin/* .
|
|
# @TEST-EXEC: ./configure --zeek-dist=${DIST} && make
|
|
# @TEST-EXEC: ZEEK_PLUGIN_ACTIVATE="Demo::Hooks" ZEEK_PLUGIN_PATH=`pwd` zeek -b -r $TRACES/http/get.trace %INPUT s1.sig 2>&1 | $SCRIPTS/diff-remove-abspath | sort | uniq >output
|
|
# @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-remove-timestamps btest-diff output
|
|
|
|
@load base/protocols/conn
|
|
@load base/protocols/http
|
|
|
|
@load-sigs s2
|
|
|
|
# @TEST-START-FILE s1.sig
|
|
# Just empty.
|
|
# @TEST-END-FILE
|
|
|
|
# @TEST-START-FILE s2.sig
|
|
# Just empty.
|
|
# @TEST-END-FILE
|
|
|
|
# The built-in JavaScript plugin's __load__.zeek file uses cat() in its
|
|
# __load__.zeek file, causing subtle baseline diffs as it is not enabled
|
|
# on all platforms. Provide a mock file that is picked up before the
|
|
# plugin's file due to `.` being first in ZEEKPATH. Sorry.
|
|
# @TEST-START-FILE Zeek_JavaScript/__load__.zeek
|
|
module JavaScript;
|
|
export {
|
|
global files: vector of string;
|
|
}
|
|
# @TEST-END-FILE
|