mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 06:38:20 +00:00
0c875220e9
In the past, we used a default canonifier, which removes everything that looks like a timestamp from log files. The goal of this is to prevent logs from changing, e.g., due to local system times ending up in log files. This, however, also has the side-effect of removing information that is parsed from protocols which probably should be part of our tests. There is at least one test (1999 certificates) where the entire test output was essentially removed by the canonifier. GH-4521 was similarly masked by this. This commit changes the default canonifier, so that only the first timestamp in a line is removed. This should skip timestamps that are likely to change while keeping timestamps that are parsed from protocol information. A pass has been made over the tests, with some additional adjustments for cases which require the old canonifier. There are some cases in which we probably could go further and not remove timestamps at all - that, however, seems like a follow-up project.
13 lines
2.6 KiB
Text
13 lines
2.6 KiB
Text
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
|
|
#separator \x09
|
|
#set_separator ,
|
|
#empty_field (empty)
|
|
#unset_field -
|
|
#path x509
|
|
#open XXXX-XX-XX-XX-XX-XX
|
|
#fields ts fingerprint certificate.version certificate.serial certificate.subject certificate.issuer certificate.not_valid_before certificate.not_valid_after certificate.key_alg certificate.sig_alg certificate.key_type certificate.key_length certificate.exponent certificate.curve san.dns san.uri san.email san.ip basic_constraints.ca basic_constraints.path_len host_cert client_cert
|
|
#types time string count string string string time time string string string count string string vector[string] vector[string] vector[string] vector[addr] bool count bool bool
|
|
XXXXXXXXXX.XXXXXX 22a920a5ec03c819b569ed0fa8b7df258e3e7ea11fdd15b83b6fa45f3e863036 3 3D1DE44E346ECE68 CN=*.google.com,O=Google Inc,L=Mountain View,ST=California,C=US CN=Google Internet Authority G2,O=Google Inc,C=US 1509544136.000000 1516800660.000000 rsaEncryption sha256WithRSAEncryption rsa 2048 65537 - *.google.com,*.android.com,*.appengine.google.com,*.cloud.google.com,*.db833953.google.cn,*.g.co,*.gcp.gvt2.com,*.google-analytics.com,*.google.ca,*.google.cl,*.google.co.in,*.google.co.jp,*.google.co.uk,*.google.com.ar,*.google.com.au,*.google.com.br,*.google.com.co,*.google.com.mx,*.google.com.tr,*.google.com.vn,*.google.de,*.google.es,*.google.fr,*.google.hu,*.google.it,*.google.nl,*.google.pl,*.google.pt,*.googleadapis.com,*.googleapis.cn,*.googlecommerce.com,*.googlevideo.com,*.gstatic.cn,*.gstatic.com,*.gvt1.com,*.gvt2.com,*.metric.gstatic.com,*.urchin.com,*.url.google.com,*.youtube-nocookie.com,*.youtube.com,*.youtubeeducation.com,*.yt.be,*.ytimg.com,android.clients.google.com,android.com,developer.android.google.cn,developers.android.google.cn,g.co,goo.gl,google-analytics.com,google.com,googlecommerce.com,source.android.google.cn,urchin.com,www.goo.gl,youtu.be,youtube.com,youtubeeducation.com,yt.be - - - F - T F
|
|
XXXXXXXXXX.XXXXXX 9b759d41e3de30f9d2f902027d792b65d950a98bbb6d6d56be7f2528453bf8e9 3 0100212588B0FA59A777EF057B6627DF CN=Google Internet Authority G2,O=Google Inc,C=US CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US 1495452757.000000 1546300799.000000 rsaEncryption sha256WithRSAEncryption rsa 2048 65537 - - - - - T 0 F F
|
|
XXXXXXXXXX.XXXXXX 3c35cc963eb004451323d3275d05b353235053490d9cd83729a2faf5e7ca1cc0 3 12BBE6 CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US OU=Equifax Secure Certificate Authority,O=Equifax,C=US 1021953600.000000 1534824000.000000 rsaEncryption sha1WithRSAEncryption rsa 2048 65537 - - - - - T - F F
|
|
#close XXXX-XX-XX-XX-XX-XX
|