Unit tests fail when installing packages using zkg

0x4A6F686E · September 4, 2023, 1:40pm

Hi,

I just compiled zeek v6.0.0 on Debian 12. Now I want to install various packages like zeek/corelight/zeek-spicy-ipsec and zeek/zeek/spicy-tftp using zkg. The installation of those packages fails because some unit tests fail.

Below is the output (I tried to find the root cause because zkg doesn’t say much besides the fact that the test failed). Something similar happens whith zeek-spicy-ipsec. Looks like some boolean values are filled in by the tests while they are not present in the files to compare with?

root@a5de4609722a:/usr/local/zeek/var/lib/zkg/testing/spicy-tftp/clones/spicy-tftp/testing# PATH=$(zkg config plugin_dir)/packages/spicy-plugin/bin:$PATH btest -d -j 2
[ 33%] TFTP.rrq ... failed
  % 'btest-diff conn.log' failed unexpectedly (exit code 1)
  % cat .diag
  == File ===============================
  #separator \x09
  #set_separator        ,
  #empty_field  (empty)
  #unset_field  -
  #path conn
  #open 2023-09-04-13-31-40
  #fields       ts      uid     id.orig_h       id.orig_p       id.resp_h       id.resp_p       proto   service duration        orig_bytes      resp_bytes      conn_state      local_orig      local_resp      missed_bytes    history orig_pkts       orig_ip_bytes   resp_pkts       resp_ip_bytes   tunnel_parents
  #types        time    string  addr    port    addr    port    enum    string  interval        count   count   string  bool    bool    count   string  count   count   count   count   set[string]
  1367411051.972852     CHhAvVGS1DHFjwGM9       192.168.0.253   50618   192.168.0.10    69      udp     spicy_tftp      -       -       -       S0      T       T       0       D       1       48      0       0       -
  1367411052.077243     ClEkJM2Vm5giqnMf4h      192.168.0.10    3445    192.168.0.253   50618   udp     spicy_tftp_data 0.181558        24795   196     SF      T       T       0       Dd      49      26167   49      1568    -
  #close        2023-09-04-13-31-40
  == Diff ===============================
  --- /dev/fd/63        2023-09-04 13:31:40.275483778 +0000
  +++ /dev/fd/62        2023-09-04 13:31:40.279483784 +0000
  @@ -8,5 +8,5 @@
   #fields      ts      uid     id.orig_h       id.orig_p       id.resp_h       id.resp_p       proto   service duration        orig_bytes      resp_bytes      conn_state      local_orig      local_resp      missed_bytes    history orig_pkts       orig_ip_bytes   resp_pkts       resp_ip_bytes   tunnel_parents
   #types       time    string  addr    port    addr    port    enum    string  interval        count   count   string  bool    bool    count   string  count   count   count   count   set[string]
   #close XXXX-XX-XX-XX-XX-XX
  -XXXXXXXXXX.XXXXXX    CHhAvVGS1DHFjwGM9       192.168.0.253   50618   192.168.0.10    69      udp     spicy_tftp      -       -       -       S0      -       -       0       D       1       48      0       0       -
  -XXXXXXXXXX.XXXXXX    ClEkJM2Vm5giqnMf4h      192.168.0.10    3445    192.168.0.253   50618   udp     spicy_tftp_data 0.181558        24795   196     SF      -       -       0       Dd      49      26167   49      1568    -
  +XXXXXXXXXX.XXXXXX    CHhAvVGS1DHFjwGM9       192.168.0.253   50618   192.168.0.10    69      udp     spicy_tftp      -       -       -       S0      T       T       0       D       1       48      0       0       -
  +XXXXXXXXXX.XXXXXX    ClEkJM2Vm5giqnMf4h      192.168.0.10    3445    192.168.0.253   50618   udp     spicy_tftp_data 0.181558        24795   196     SF      T       T       0       Dd      49      26167   49      1568    -
  =======================================

  % cat .stderr

[ 66%] TFTP.wrq ... failed
  % 'btest-diff conn.log' failed unexpectedly (exit code 1)
  % cat .diag
  == File ===============================
  #separator \x09
  #set_separator        ,
  #empty_field  (empty)
  #unset_field  -
  #path conn
  #open 2023-09-04-13-31-40
  #fields       ts      uid     id.orig_h       id.orig_p       id.resp_h       id.resp_p       proto   service duration        orig_bytes      resp_bytes      conn_state      local_orig      local_resp      missed_bytes    history orig_pkts       orig_ip_bytes   resp_pkts       resp_ip_bytes   tunnel_parents
  #types        time    string  addr    port    addr    port    enum    string  interval        count   count   string  bool    bool    count   string  count   count   count   count   set[string]
  1367053679.452740     CHhAvVGS1DHFjwGM9       192.168.0.1     57509   192.168.0.13    69      udp     spicy_tftp      -       -       -       S0      T       T       0       D       1       48      0       0       -
  1367053679.510626     ClEkJM2Vm5giqnMf4h      192.168.0.13    2087    192.168.0.1     57509   udp     spicy_tftp_data 0.246451        200     24795   SF      T       T       0       Dd      50      1600    49      26167   -
  #close        2023-09-04-13-31-40
  == Diff ===============================
  --- /dev/fd/63        2023-09-04 13:31:40.779484530 +0000
  +++ /dev/fd/62        2023-09-04 13:31:40.779484530 +0000
  @@ -8,5 +8,5 @@
   #fields      ts      uid     id.orig_h       id.orig_p       id.resp_h       id.resp_p       proto   service duration        orig_bytes      resp_bytes      conn_state      local_orig      local_resp      missed_bytes    history orig_pkts       orig_ip_bytes   resp_pkts       resp_ip_bytes   tunnel_parents
   #types       time    string  addr    port    addr    port    enum    string  interval        count   count   string  bool    bool    count   string  count   count   count   count   set[string]
   #close XXXX-XX-XX-XX-XX-XX
  -XXXXXXXXXX.XXXXXX    CHhAvVGS1DHFjwGM9       192.168.0.1     57509   192.168.0.13    69      udp     spicy_tftp      -       -       -       S0      -       -       0       D       1       48      0       0       -
  -XXXXXXXXXX.XXXXXX    ClEkJM2Vm5giqnMf4h      192.168.0.13    2087    192.168.0.1     57509   udp     spicy_tftp_data 0.246451        200     24795   SF      -       -       0       Dd      50      1600    49      26167   -
  +XXXXXXXXXX.XXXXXX    CHhAvVGS1DHFjwGM9       192.168.0.1     57509   192.168.0.13    69      udp     spicy_tftp      -       -       -       S0      T       T       0       D       1       48      0       0       -
  +XXXXXXXXXX.XXXXXX    ClEkJM2Vm5giqnMf4h      192.168.0.13    2087    192.168.0.1     57509   udp     spicy_tftp_data 0.246451        200     24795   SF      T       T       0       Dd      50      1600    49      26167   -
  =======================================

  % cat .stderr

2 of 3 tests failed

Please note that other packages do install correctly like zeek/zeek/spicy-dns.

Am I missing something?

Thanks in advance,

John

Benjamin_Bannier · September 4, 2023, 2:05pm

Yes, with zeek-6.0 there was a change to what IPs Zeek considers a local IP by default. This is logged as part of conn.log, but not relevant to what is being tested here. One way to deal with that is to strip down the information in the log to what is interesting for the test like done e.g., in zeek/spicy-dns,

github.com

zeek/spicy-dns/blob/main/tests/analyzer/basic.zeek#L4


      
          # Copyright (c) 2021 by the Zeek Project. See LICENSE for details.
          
          # @TEST-EXEC: zeek -r ${TRACES}/dns53.pcap %INPUT
          # @TEST-EXEC: cat conn.log | zeek-cut uid service > conn.log.tmp && mv conn.log.tmp conn.log
          # @TEST-EXEC: btest-diff conn.log
          # @TEST-EXEC: btest-diff dns.log
          # @TEST-EXEC: if zeek-version 32000; then btest-diff .stdout; fi
          #
          # @TEST-DOC: Test DNS analyzer with small trace.
          
          @if ( Version::number >= 32000 )
          # Check the new signature of the event
          event dns_query_reply(c: connection, msg: dns_msg, query: string, qtype: count, qclass: count, original_query: string) {
             print query, original_query; # both are the same with our trace

I will fix this in zeek/spicy-tftp in a similar way and put out a release.

EDIT

I fixed this in zeek/spicy-tftp-0.0.5, and pinged Keith to look at corelight/zeek-spicy-ipsec.

0x4A6F686E · September 12, 2023, 3:44pm

Thanks! I just installed version spicy-tftp-0.0.5 without any problems.

Cheers, John

Topic		Replies	Views
Errors with Spicy 1.3.0 with Zeek 4.0.4 Zeek	1	106	May 6, 2022
zeek-long-connections fails to install with zeek 4.0.6 Zeek	2	165	May 6, 2022
zkg unbundle fails Zeek	6	351	May 6, 2022
A Note on Package Safety Considerations Announcements packages , advisory	0	203	March 5, 2024
Zeek broker and spicy script not working in 6.1.1 Zeek spicy	4	165	February 8, 2024

Unit tests fail when installing packages using zkg

EDIT

Related Topics