From 7f7e4d1e12582a69b8d55b7dfc9f8b3380e74a13 Mon Sep 17 00:00:00 2001
From: Jason Ertel <jason.ertel@securityonionsolutions.com>
Date: Thu, 8 Feb 2024 10:03:44 -0500
Subject: [PATCH] improve log field uniqueness

---
 .../test_resources/1/nonconforming-file.123four |   0
 .../test_resources/2/so-pcap.123broken          |   0
 .../test_resources/3/so-pcap.1575817346         | Bin 0 -> 14918 bytes
 .../test_resources/3/so-pcap.9900000000         |   0
 packet/test_resources/parser_resource.pcap      | Bin 0 -> 1552 bytes
 packet/test_resources/so-pcap.1575817346        | Bin 0 -> 14918 bytes
 6 files changed, 0 insertions(+), 0 deletions(-)
 create mode 100644 agent/modules/suriquery/test_resources/1/nonconforming-file.123four
 create mode 100644 agent/modules/suriquery/test_resources/2/so-pcap.123broken
 create mode 100644 agent/modules/suriquery/test_resources/3/so-pcap.1575817346
 create mode 100644 agent/modules/suriquery/test_resources/3/so-pcap.9900000000
 create mode 100644 packet/test_resources/parser_resource.pcap
 create mode 100644 packet/test_resources/so-pcap.1575817346

diff --git a/agent/modules/suriquery/test_resources/1/nonconforming-file.123four b/agent/modules/suriquery/test_resources/1/nonconforming-file.123four
new file mode 100644
index 00000000..e69de29b
diff --git a/agent/modules/suriquery/test_resources/2/so-pcap.123broken b/agent/modules/suriquery/test_resources/2/so-pcap.123broken
new file mode 100644
index 00000000..e69de29b
diff --git a/agent/modules/suriquery/test_resources/3/so-pcap.1575817346 b/agent/modules/suriquery/test_resources/3/so-pcap.1575817346
new file mode 100644
index 0000000000000000000000000000000000000000..d5d2494eeff4c9c00847674d454900ae82d53ca6
GIT binary patch
literal 14918
zcmeI3OH3749L5h^K=P&khL$cUO=CcmhYBdDfFKWf`2+zGw6>z+n}=|DgCVvt#&)4y
z5mFM`G}WYO(lj=ezMH1qb*1gfl}R@wZfeqH?K#8a&di;eduGlo)C|ca7ZyLhbMBe%
z|C)L5>sKGgvjn#C^YkfWar~F7DUXjgb%oeo{#jftZLGEWHhUvuwqY!p)upiVnf5AH
zk(Av3<&`JDFBDW>zILCbW`2><D@gP4rO7$djKwD;-c5*4#+qZ-OT^#fLZJjfzOEy4
z=0{(5FY!5<v2w<$SXI*8UxF&=EcM#`N3HR<IlXWG)smZYuSLjjUP?<7bWUC)$hA`;
zR>S|3xS}){&m7S-kC-&~ar&L<l+dk#e6BH0(_1FUg7`is)^nP;qKG9k9U5`Kl9(2{
zb)(Tp40jKP1$9=ZGinEl)4vfr@NTwg2k!747@SUF19LAeQMtyoeD!65__>Z4rL%aZ
zQ`0$Q(mAND{1v|PT%%4wY`hm@AMjO+D@x;)^m{_%)rS@u!_#S8WBaPc0-<sJhU}c&
zyp5YS=NA-i*;-V*ZTpUr(z2c96}u{{s%v)F*3~yO?%BI<|AB)|&4*fA+YYxM>F7Lq
z?5*Q(zjLDN<f+r$XU?8Gf8pXKg3$IJ*S46*w9Bk5@nQOc&^9$?()JJEzp&W9PwpDE
z`6R7};LjR+dI`R4R!?sq!H-?%pnif6U!MS7Ca9kS4KzSdK2S@bL4xYZTn2>+ibs3}
zG(=FlS5`s81f`oU0vaKx+`T%`C_%vn^q?_<cRw+J#tEK{$q1Stcy%}vXp-R3D$SrN
zf;Z2N0%Z_9nRhfOlOP`jg!6yq?EK$q&Od2%{^VIZ=a0k{3u)^J9s-mVD2w1e(piGm
z6I_Q(YtROQ+t_OZ$|krB;&z}Mg1c<M7L-eHl~&k;@(6D769>>nf{R4Q3ABkIpD{Ut
zHWQ>%FK19bK{khr0V*I!CWEm+g#@{*GA3vXK`K3s4cbbO$#W$@MFfe2Sq4;0h@E*$
zfwmE1rtos0?Sx1zAe{d<XXpP;bN&gV^S@kU=ls^yg`~6{gcxOtEU1LwT<=JON(qjI
zlRT)5;8cOR0PQ3=lyYuB<pleh&=shHU|U?e1MMQ%RjDpPl?0n|*Da`upmwq&c^$#B
z0C%mZx`tp?$$J3pCRnrtynt#6(Y*yvpgKZSlfoOQo?z~Fcmy>NOl=ddphkkR|Kb_6
zhhS*rNP>j(|LyGj-)qi4Zgl?CMLXxWs(}dl9+RXrE6_fIu34o5+D~w<PO_w1YJ}DH
znUbOd2MH^EI7LtsVY#8F3Th@Sbq19|hX`7WQ61Dm5WPwtK&=FyKy3tn6tx{D__8z}
zh6#S`k%;F6(ODcA3=a*DjE;>@OipEFu9Lq-bm<(yCr~HBA4Q!<3BD|ihhc&rdnDpH
z!H3P(5(9$Ow<erFb-}UE|AXfIV@BtH{X;wF_tJGHC?BZh<cFYoGM7Oo2#QC11=K}Q
zyH{30CkaY7T?BNBpmO)>K&J@`HlPP}6TJJ00d$7o*_e!=vjndWX9Argc(h70==`&(
z$y*$VTHFPKr+^X-x=4^t-gJ@40>tN`FW&T0IDe6|^Z%$h|ESUV*Ou8ie<aro=AkhT
z)N(==%tPfmSHV0~u5%U4L*+VGZswuR{ekCkdMTX0$=UgT(wu+9==@oa?3`b2*F}a9
z%tPfmSHV0ql1(_(_rW|=u5%U4L*+VG`gy3@jOSULUJB>$cXs}tHRm5TI)B~`JLeDP
zp>mz8U>+*hxeDf?a-FMS9xB%*@-`2(8ah7T(@Wv}pE^7LFPifY8J)jytDW=5dj2|?
zhsr%QAIwALo|+Hlp>j{n2lLR#(^XDS0$a~RU%ct1aQ;6Ygv2X<+GTogjj<fY-vz8l
rnqM@%w-y$!q&4%`7CWAZPvS?g9{b4p*GJZWKC<Hf^l!hCd}93%!M1~=

literal 0
HcmV?d00001

diff --git a/agent/modules/suriquery/test_resources/3/so-pcap.9900000000 b/agent/modules/suriquery/test_resources/3/so-pcap.9900000000
new file mode 100644
index 00000000..e69de29b
diff --git a/packet/test_resources/parser_resource.pcap b/packet/test_resources/parser_resource.pcap
new file mode 100644
index 0000000000000000000000000000000000000000..04f0c2f9045d91017db4025df20e195b182bd1d6
GIT binary patch
literal 1552
zcmca|c+)~A1{MYwxWmf8zzF2rcr-om_)#8)DL^&|Gl<!76rMM`(<-;wfrG)7fuZfv
z0S5*L!N8ycD^4>WSaFJRL#)tNh9U+A4v=bw6b1%^4n_thpg!|&EMOfW3=BXWjLQB%
z9n3(?%E9pM6Dtn`;~$`1AU(@|Fo7rr0YM>Q5m7O52}vnw8Cf}b1w|!g6;(BL4NWa=
z9bG+r14AQY6H_yDkQ>Fyco|}VdO#TBI*3cbHu~*ga$v9%%<}-b59H2e*MM%cLb&li
z7(iUg!N$PI!NA4>^gh_-AQu7+1p<(JL3U-7BkaNm55G$X!Qs&fvIk_}={8imP{IRd
z7c_i8HXv*T*~OvA2M>D;f3@vk2K$R2=C6i2w6F(<I@DjF*b3RP85sJEt7e0I1-6ah
zA4Oq*6X-^sQ+U(IA#ivEz`}!^^uhWTm_C^P0__6D!?eGor4NuB{}uA$3r7}kIP#GY
zj$6RtI13SuycD_d7SN3rm+*$;VQ@Htat+z}?AK#pI5Pi(hT{TOW>9bvozFmSjH|^P
zj;!Et<Ru{-w}QiQCL$b}o>1b(+dwz|xPdnukATC`kCJdqxC3+}%YSG%TJn$<jvzPY
aH{lIOHgGudkPwdBz~MLp5sn!Yxe)+4c6sIi

literal 0
HcmV?d00001

diff --git a/packet/test_resources/so-pcap.1575817346 b/packet/test_resources/so-pcap.1575817346
new file mode 100644
index 0000000000000000000000000000000000000000..d5d2494eeff4c9c00847674d454900ae82d53ca6
GIT binary patch
literal 14918
zcmeI3OH3749L5h^K=P&khL$cUO=CcmhYBdDfFKWf`2+zGw6>z+n}=|DgCVvt#&)4y
z5mFM`G}WYO(lj=ezMH1qb*1gfl}R@wZfeqH?K#8a&di;eduGlo)C|ca7ZyLhbMBe%
z|C)L5>sKGgvjn#C^YkfWar~F7DUXjgb%oeo{#jftZLGEWHhUvuwqY!p)upiVnf5AH
zk(Av3<&`JDFBDW>zILCbW`2><D@gP4rO7$djKwD;-c5*4#+qZ-OT^#fLZJjfzOEy4
z=0{(5FY!5<v2w<$SXI*8UxF&=EcM#`N3HR<IlXWG)smZYuSLjjUP?<7bWUC)$hA`;
zR>S|3xS}){&m7S-kC-&~ar&L<l+dk#e6BH0(_1FUg7`is)^nP;qKG9k9U5`Kl9(2{
zb)(Tp40jKP1$9=ZGinEl)4vfr@NTwg2k!747@SUF19LAeQMtyoeD!65__>Z4rL%aZ
zQ`0$Q(mAND{1v|PT%%4wY`hm@AMjO+D@x;)^m{_%)rS@u!_#S8WBaPc0-<sJhU}c&
zyp5YS=NA-i*;-V*ZTpUr(z2c96}u{{s%v)F*3~yO?%BI<|AB)|&4*fA+YYxM>F7Lq
z?5*Q(zjLDN<f+r$XU?8Gf8pXKg3$IJ*S46*w9Bk5@nQOc&^9$?()JJEzp&W9PwpDE
z`6R7};LjR+dI`R4R!?sq!H-?%pnif6U!MS7Ca9kS4KzSdK2S@bL4xYZTn2>+ibs3}
zG(=FlS5`s81f`oU0vaKx+`T%`C_%vn^q?_<cRw+J#tEK{$q1Stcy%}vXp-R3D$SrN
zf;Z2N0%Z_9nRhfOlOP`jg!6yq?EK$q&Od2%{^VIZ=a0k{3u)^J9s-mVD2w1e(piGm
z6I_Q(YtROQ+t_OZ$|krB;&z}Mg1c<M7L-eHl~&k;@(6D769>>nf{R4Q3ABkIpD{Ut
zHWQ>%FK19bK{khr0V*I!CWEm+g#@{*GA3vXK`K3s4cbbO$#W$@MFfe2Sq4;0h@E*$
zfwmE1rtos0?Sx1zAe{d<XXpP;bN&gV^S@kU=ls^yg`~6{gcxOtEU1LwT<=JON(qjI
zlRT)5;8cOR0PQ3=lyYuB<pleh&=shHU|U?e1MMQ%RjDpPl?0n|*Da`upmwq&c^$#B
z0C%mZx`tp?$$J3pCRnrtynt#6(Y*yvpgKZSlfoOQo?z~Fcmy>NOl=ddphkkR|Kb_6
zhhS*rNP>j(|LyGj-)qi4Zgl?CMLXxWs(}dl9+RXrE6_fIu34o5+D~w<PO_w1YJ}DH
znUbOd2MH^EI7LtsVY#8F3Th@Sbq19|hX`7WQ61Dm5WPwtK&=FyKy3tn6tx{D__8z}
zh6#S`k%;F6(ODcA3=a*DjE;>@OipEFu9Lq-bm<(yCr~HBA4Q!<3BD|ihhc&rdnDpH
z!H3P(5(9$Ow<erFb-}UE|AXfIV@BtH{X;wF_tJGHC?BZh<cFYoGM7Oo2#QC11=K}Q
zyH{30CkaY7T?BNBpmO)>K&J@`HlPP}6TJJ00d$7o*_e!=vjndWX9Argc(h70==`&(
z$y*$VTHFPKr+^X-x=4^t-gJ@40>tN`FW&T0IDe6|^Z%$h|ESUV*Ou8ie<aro=AkhT
z)N(==%tPfmSHV0~u5%U4L*+VGZswuR{ekCkdMTX0$=UgT(wu+9==@oa?3`b2*F}a9
z%tPfmSHV0ql1(_(_rW|=u5%U4L*+VG`gy3@jOSULUJB>$cXs}tHRm5TI)B~`JLeDP
zp>mz8U>+*hxeDf?a-FMS9xB%*@-`2(8ah7T(@Wv}pE^7LFPifY8J)jytDW=5dj2|?
zhsr%QAIwALo|+Hlp>j{n2lLR#(^XDS0$a~RU%ct1aQ;6Ygv2X<+GTogjj<fY-vz8l
rnqM@%w-y$!q&4%`7CWAZPvS?g9{b4p*GJZWKC<Hf^l!hCd}93%!M1~=

literal 0
HcmV?d00001