From 568c19e7b199e527b4ef7c2fd57fa970102615b5 Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Fri, 27 Mar 2026 08:18:45 +0000
Subject: [PATCH 1/6] Add btest framework and GitHub Actions for Zeek packages

This commit introduces a testing framework for the JA4+ Zeek packages using `btest`.
- Configures `btest.cfg` and environment to test against existing sample PCAPs.
- Adds test scripts for JA4, JA4S, JA4H, JA4SSH, and JA4D.
- Generates baseline logs (`ssl.log`, `http.log`, `conn.log`, `ja4ssh.log`, `ja4d.log`) from sample data.
- Creates a GitHub Actions workflow (`zeek-test.yml`) to run the tests in the `zeek/zeek:8.0.0` container on push/PR.

Co-authored-by: J0eJ0h <16658048+J0eJ0h@users.noreply.github.com>
---
 .github/workflows/zeek-test.yml               | 34 +++++++++++++++++++
 zeek/tests/Scripts/ja4-conn.zeek              |  2 ++
 zeek/tests/Scripts/ja4-dhcp.zeek              |  2 ++
 .../tests/Scripts/ja4-http1-with-cookies.zeek |  2 ++
 zeek/tests/Scripts/ja4-ssh2.zeek              |  2 ++
 zeek/tests/Scripts/ja4-tls-handshake.zeek     |  2 ++
 zeek/tests/Traces/Scripts.ja4-conn/conn.log   | 11 ++++++
 zeek/tests/Traces/Scripts.ja4-dhcp/ja4d.log   | 14 ++++++++
 .../Scripts.ja4-http1-with-cookies/http.log   | 11 ++++++
 zeek/tests/Traces/Scripts.ja4-ssh2/ja4ssh.log | 12 +++++++
 .../Traces/Scripts.ja4-tls-handshake/ssl.log  | 30 ++++++++++++++++
 zeek/tests/btest.cfg                          | 15 ++++++++
 zeek/tests/random.seed                        | 21 ++++++++++++
 13 files changed, 158 insertions(+)
 create mode 100644 .github/workflows/zeek-test.yml
 create mode 100644 zeek/tests/Scripts/ja4-conn.zeek
 create mode 100644 zeek/tests/Scripts/ja4-dhcp.zeek
 create mode 100644 zeek/tests/Scripts/ja4-http1-with-cookies.zeek
 create mode 100644 zeek/tests/Scripts/ja4-ssh2.zeek
 create mode 100644 zeek/tests/Scripts/ja4-tls-handshake.zeek
 create mode 100644 zeek/tests/Traces/Scripts.ja4-conn/conn.log
 create mode 100644 zeek/tests/Traces/Scripts.ja4-dhcp/ja4d.log
 create mode 100644 zeek/tests/Traces/Scripts.ja4-http1-with-cookies/http.log
 create mode 100644 zeek/tests/Traces/Scripts.ja4-ssh2/ja4ssh.log
 create mode 100644 zeek/tests/Traces/Scripts.ja4-tls-handshake/ssl.log
 create mode 100644 zeek/tests/btest.cfg
 create mode 100644 zeek/tests/random.seed

diff --git a/.github/workflows/zeek-test.yml b/.github/workflows/zeek-test.yml
new file mode 100644
index 00000000..ccf8b74f
--- /dev/null
+++ b/.github/workflows/zeek-test.yml
@@ -0,0 +1,34 @@
+name: Zeek Tests
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - 'zeek/**'
+      - '.github/workflows/zeek-test.yml'
+  pull_request:
+    paths:
+      - 'zeek/**'
+      - '.github/workflows/zeek-test.yml'
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    container:
+      image: zeek/zeek:8.0.0
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Install dependencies
+        run: |
+          apt-get update
+          apt-get install -y python3-pip git
+          # btest is distributed as a python package
+          pip3 install btest --break-system-packages
+
+      - name: Run btest
+        run: |
+          cd zeek/tests
+          btest -d Scripts/
diff --git a/zeek/tests/Scripts/ja4-conn.zeek b/zeek/tests/Scripts/ja4-conn.zeek
new file mode 100644
index 00000000..c2a1d523
--- /dev/null
+++ b/zeek/tests/Scripts/ja4-conn.zeek
@@ -0,0 +1,2 @@
+# @TEST-EXEC: zeek -C -r ${TRACES}/ipv6.pcapng ../../../__load__.zeek %INPUT
+# @TEST-EXEC: btest-diff conn.log
diff --git a/zeek/tests/Scripts/ja4-dhcp.zeek b/zeek/tests/Scripts/ja4-dhcp.zeek
new file mode 100644
index 00000000..439b4c56
--- /dev/null
+++ b/zeek/tests/Scripts/ja4-dhcp.zeek
@@ -0,0 +1,2 @@
+# @TEST-EXEC: zeek -C -r ${TRACES}/dhcp.pcapng ../../../__load__.zeek %INPUT
+# @TEST-EXEC: btest-diff ja4d.log
diff --git a/zeek/tests/Scripts/ja4-http1-with-cookies.zeek b/zeek/tests/Scripts/ja4-http1-with-cookies.zeek
new file mode 100644
index 00000000..bacb3f3d
--- /dev/null
+++ b/zeek/tests/Scripts/ja4-http1-with-cookies.zeek
@@ -0,0 +1,2 @@
+# @TEST-EXEC: zeek -C -r ${TRACES}/http1-with-cookies.pcapng ../../../__load__.zeek %INPUT
+# @TEST-EXEC: btest-diff http.log
diff --git a/zeek/tests/Scripts/ja4-ssh2.zeek b/zeek/tests/Scripts/ja4-ssh2.zeek
new file mode 100644
index 00000000..04d173c5
--- /dev/null
+++ b/zeek/tests/Scripts/ja4-ssh2.zeek
@@ -0,0 +1,2 @@
+# @TEST-EXEC: zeek -C -r ${TRACES}/ssh2.pcapng ../../../__load__.zeek %INPUT
+# @TEST-EXEC: btest-diff ja4ssh.log
diff --git a/zeek/tests/Scripts/ja4-tls-handshake.zeek b/zeek/tests/Scripts/ja4-tls-handshake.zeek
new file mode 100644
index 00000000..4b2c3664
--- /dev/null
+++ b/zeek/tests/Scripts/ja4-tls-handshake.zeek
@@ -0,0 +1,2 @@
+# @TEST-EXEC: zeek -C -r ${TRACES}/tls-handshake.pcapng ../../../__load__.zeek %INPUT
+# @TEST-EXEC: btest-diff ssl.log
diff --git a/zeek/tests/Traces/Scripts.ja4-conn/conn.log b/zeek/tests/Traces/Scripts.ja4-conn/conn.log
new file mode 100644
index 00000000..de6aad58
--- /dev/null
+++ b/zeek/tests/Traces/Scripts.ja4-conn/conn.log
@@ -0,0 +1,11 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+#separator \x09
+#set_separator	,
+#empty_field	(empty)
+#unset_field	-
+#path	conn
+#open	2026-03-27-08-01-36
+#fields	ts	uid	id.orig_h	id.orig_p	id.resp_h	id.resp_p	proto	service	duration	orig_bytes	resp_bytes	conn_state	local_orig	local_resp	missed_bytes	history	orig_pkts	orig_ip_bytes	resp_pkts	resp_ip_bytes	tunnel_parents	ip_proto	ja4l	ja4ls	ja4t	ja4ts
+#types	time	string	addr	port	addr	port	enum	string	interval	count	count	string	bool	bool	count	string	count	count	count	count	set[string]	count	string	string	string	string
+1593980608.621087	C73Zcd4XqUIenT3Fef	2001:4998:ef83:14:8000::100d	64034	2606:4700::6811:d209	443	tcp	ssl	0.075341	237	2810	S1	F	F	0	ShADad	4	501	5	3122	-	6	35_64	18862_59_14792	65535__0_0	65535__0_0
+#close	2026-03-27-08-01-36
diff --git a/zeek/tests/Traces/Scripts.ja4-dhcp/ja4d.log b/zeek/tests/Traces/Scripts.ja4-dhcp/ja4d.log
new file mode 100644
index 00000000..79133c0f
--- /dev/null
+++ b/zeek/tests/Traces/Scripts.ja4-dhcp/ja4d.log
@@ -0,0 +1,14 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+#separator \x09
+#set_separator	,
+#empty_field	(empty)
+#unset_field	-
+#path	ja4d
+#open	2026-03-27-08-01-37
+#fields	ts	uid	id.orig_h	id.orig_p	id.resp_h	id.resp_p	ja4d	client_mac	requested_ip	vendor_class_id	hostname
+#types	time	string	addr	port	addr	port	string	string	addr	string	string
+1102274184.317453	C73Zcd4XqUIenT3Fef	0.0.0.0	68	255.255.255.255	67	disco0000in_61-55_1-3-6-42	00:0b:82:01:fc:42	0.0.0.0	(empty)	(empty)
+1102274184.317748	Cl5woUpqKxGTMghIc	192.168.0.10	68	192.168.0.1	67	offer0000nn_1-58-59-51-54_00	00:0b:82:01:fc:42	-	(empty)	(empty)
+1102274184.317453	C73Zcd4XqUIenT3Fef	0.0.0.0	68	255.255.255.255	67	reqst0000in_61-54-55_1-3-6-42	00:0b:82:01:fc:42	192.168.0.10	(empty)	(empty)
+1102274184.317748	Cl5woUpqKxGTMghIc	192.168.0.10	68	192.168.0.1	67	dpack0000nn_58-59-51-54-1_00	00:0b:82:01:fc:42	-	(empty)	(empty)
+#close	2026-03-27-08-01-37
diff --git a/zeek/tests/Traces/Scripts.ja4-http1-with-cookies/http.log b/zeek/tests/Traces/Scripts.ja4-http1-with-cookies/http.log
new file mode 100644
index 00000000..c9b719ff
--- /dev/null
+++ b/zeek/tests/Traces/Scripts.ja4-http1-with-cookies/http.log
@@ -0,0 +1,11 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+#separator \x09
+#set_separator	,
+#empty_field	(empty)
+#unset_field	-
+#path	http
+#open	2026-03-27-08-01-38
+#fields	ts	uid	id.orig_h	id.orig_p	id.resp_h	id.resp_p	trans_depth	method	host	uri	referrer	version	user_agent	origin	request_body_len	response_body_len	status_code	status_msg	info_code	info_msg	tags	username	password	proxied	orig_fuids	orig_filenames	orig_mime_types	resp_fuids	resp_filenames	resp_mime_types	ja4h
+#types	time	string	addr	port	addr	port	count	string	string	string	string	string	string	string	count	count	count	string	count	string	set[enum]	string	string	set[string]	vector[string]	vector[string]	vector[string]	vector[string]	vector[string]	vector[string]	string
+1690483736.912889	C73Zcd4XqUIenT3Fef	127.0.0.1	61256	127.0.0.1	8000	1	GET	localhost:8000	/	https://fake.example	1.0	curl/8.1.2	-	0	1114	200	OK	-	-	(empty)	-	-	-	-	-	-	FvbTb11CCpKvM264U8	-	text/html	ge11cr04da00_8ddaef5d77af_280f366eaa04_c2fb0fe53442
+#close	2026-03-27-08-01-38
diff --git a/zeek/tests/Traces/Scripts.ja4-ssh2/ja4ssh.log b/zeek/tests/Traces/Scripts.ja4-ssh2/ja4ssh.log
new file mode 100644
index 00000000..70587ace
--- /dev/null
+++ b/zeek/tests/Traces/Scripts.ja4-ssh2/ja4ssh.log
@@ -0,0 +1,12 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+#separator \x09
+#set_separator	,
+#empty_field	(empty)
+#unset_field	-
+#path	ja4ssh
+#open	2026-03-27-08-01-38
+#fields	ts	uid	id.orig_h	id.orig_p	id.resp_h	id.resp_p	ja4ssh
+#types	time	string	addr	port	addr	port	string
+1688672868.776057	Chu4srlj1wba0b8Fk	172.16.225.48	57377	54.160.114.75	22	c36s36_c76s124_c74s6
+1688672868.776057	Chu4srlj1wba0b8Fk	172.16.225.48	57377	54.160.114.75	22	c36s52_c42s76_c51s2
+#close	2026-03-27-08-01-38
diff --git a/zeek/tests/Traces/Scripts.ja4-tls-handshake/ssl.log b/zeek/tests/Traces/Scripts.ja4-tls-handshake/ssl.log
new file mode 100644
index 00000000..d7707852
--- /dev/null
+++ b/zeek/tests/Traces/Scripts.ja4-tls-handshake/ssl.log
@@ -0,0 +1,30 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+#separator \x09
+#set_separator	,
+#empty_field	(empty)
+#unset_field	-
+#path	ssl
+#open	2026-03-27-08-01-39
+#fields	ts	uid	id.orig_h	id.orig_p	id.resp_h	id.resp_p	version	cipher	curve	server_name	resumed	last_alert	next_protocol	established	ssl_history	cert_chain_fps	client_cert_chain_fps	sni_matches_cert	ja4	ja4s
+#types	time	string	addr	port	addr	port	string	string	string	string	bool	string	string	bool	string	vector[string]	vector[string]	bool	string	string
+1675707161.245230	CGBsqN2uXmDTPVzDEl	192.168.1.168	52166	31.13.66.35	443	TLSv13	TLS_AES_128_GCM_SHA256	x25519	www.facebook.com	F	-	-	F	Cs	-	-	-	q13d0310h3_55b375c5d22e_cd85d2d88918	q130200_1301_a56c5b993250
+1675707152.011673	CErRvO2gbIalp3tOc5	192.168.1.168	55945	142.251.16.95	443	TLSv13	TLS_AES_128_GCM_SHA256	x25519	www.googleapis.com	F	-	-	F	Cs	-	-	-	q13d0310h3_55b375c5d22e_cd85d2d88918	q130200_1301_234ea6891581
+1675707155.389827	ChIaVxLkUs61KxAz8	192.168.1.168	55906	142.251.16.100	443	TLSv13	TLS_AES_128_GCM_SHA256	x25519	ogs.google.com	F	-	-	F	Cs	-	-	-	q13d0310h3_55b375c5d22e_cd85d2d88918	q130200_1301_234ea6891581
+1675707155.300029	C2FwSz1eKJKOYWy4K3	192.168.1.168	60486	142.251.111.101	443	TLSv13	TLS_AES_128_GCM_SHA256	x25519	history.google.com	F	-	-	F	Cs	-	-	-	q13d0310h3_55b375c5d22e_cd85d2d88918	q130200_1301_234ea6891581
+1675707155.391962	C50XAHll41sdt2ft7	192.168.1.168	61836	142.251.111.101	443	TLSv13	TLS_AES_128_GCM_SHA256	x25519	aa.google.com	F	-	-	F	Cs	-	-	-	q13d0310h3_55b375c5d22e_cd85d2d88918	q130200_1301_234ea6891581
+1675707153.800775	CfIcQD2Ei8f1el2PJf	192.168.1.168	49333	142.251.163.94	443	TLSv13	TLS_AES_128_GCM_SHA256	x25519	update.googleapis.com	F	-	-	F	Cs	-	-	-	q13d0310h3_55b375c5d22e_cd85d2d88918	q130200_1301_234ea6891581
+1675707163.847611	CxgSZ03njQU3vGwSdi	192.168.1.168	50053	142.251.163.95	443	TLSv13	TLS_AES_128_GCM_SHA256	x25519	optimizationguide-pa.googleapis.com	F	-	-	F	Cs	-	-	-	q13d0310h3_55b375c5d22e_cd85d2d88918	q130200_1301_234ea6891581
+1675707161.164729	CKWJ9iIqGVdwNGbvc	192.168.1.168	51782	142.251.163.95	443	TLSv13	TLS_AES_128_GCM_SHA256	x25519	safebrowsing.googleapis.com	F	-	-	F	Cs	-	-	-	q13d0310h3_55b375c5d22e_cd85d2d88918	q130200_1301_234ea6891581
+1675707163.742632	CIbjXu4xSHdPAYPjA9	192.168.1.168	55309	142.251.163.95	443	TLSv13	TLS_AES_128_GCM_SHA256	x25519	content-autofill.googleapis.com	F	-	-	F	Cs	-	-	-	q13d0310h3_55b375c5d22e_cd85d2d88918	q130200_1301_234ea6891581
+1675707154.505201	CnWgof2NddogII3Yia	192.168.1.168	57662	142.251.163.102	443	TLSv13	TLS_AES_128_GCM_SHA256	x25519	encrypted-tbn0.gstatic.com	F	-	-	F	Cs	-	-	-	q13d0310h3_55b375c5d22e_cd85d2d88918	q130200_1301_234ea6891581
+1675707171.303486	C5rYFO1qSQXNJm9dEa	192.168.1.168	57188	142.251.163.132	443	TLSv13	TLS_AES_128_GCM_SHA256	x25519	lh5.googleusercontent.com	F	-	-	F	Cs	-	-	-	q13d0310h3_55b375c5d22e_cd85d2d88918	q130200_1301_234ea6891581
+1675707158.762270	CXRgQm10C8g8cktdTe	192.168.1.168	51905	142.251.163.138	443	TLSv13	TLS_AES_128_GCM_SHA256	x25519	encrypted-tbn0.gstatic.com	F	-	-	F	Cs	-	-	-	q13d0310h3_55b375c5d22e_cd85d2d88918	q130200_1301_234ea6891581
+1675707151.936380	Cl5woUpqKxGTMghIc	192.168.1.168	59102	142.251.163.147	443	TLSv13	TLS_AES_128_GCM_SHA256	x25519	www.google.com	F	-	-	F	Cs	-	-	-	q13d0310h3_55b375c5d22e_cd85d2d88918	q130200_1301_234ea6891581
+1675707161.165864	Co1c5e3TdbKAJB3ldg	192.168.1.168	54980	157.240.229.1	443	TLSv13	TLS_AES_128_GCM_SHA256	x25519	static.xx.fbcdn.net	F	-	-	F	Cs	-	-	-	q13d0310h3_55b375c5d22e_cd85d2d88918	q130200_1301_a56c5b993250
+1675707161.269152	COaaiw3h19kSgb1BO6	192.168.1.168	59444	157.240.229.1	443	TLSv13	TLS_AES_128_GCM_SHA256	x25519	static.xx.fbcdn.net	F	-	-	F	Cs	-	-	-	q13d0310h3_55b375c5d22e_cd85d2d88918	q130200_1301_a56c5b993250
+1675707161.165564	COQYXVPH0daDqWk2	192.168.1.168	61730	157.240.229.1	443	TLSv13	TLS_AES_128_GCM_SHA256	x25519	scontent-iad3-2.xx.fbcdn.net	F	-	-	F	Cs	-	-	-	q13d0310h3_55b375c5d22e_cd85d2d88918	q130200_1301_a56c5b993250
+1675707163.575152	CVIuI3mAyVewLEUf	192.168.1.168	60374	157.240.229.2	443	TLSv13	TLS_AES_128_GCM_SHA256	x25519	video-iad3-2.xx.fbcdn.net	F	-	-	F	Cs	-	-	-	q13d0310h3_55b375c5d22e_cd85d2d88918	q130200_1301_a56c5b993250
+1675707155.429145	CYq93o1jzMmpzZkM6d	192.168.1.168	59221	172.253.63.95	443	TLSv13	TLS_AES_128_GCM_SHA256	x25519	content-autofill.googleapis.com	F	-	-	F	Cs	-	-	-	q13d0310h3_55b375c5d22e_cd85d2d88918	q130200_1301_234ea6891581
+1675707151.936708	CN3K5p4CkjEhKRbQSg	192.168.1.168	57816	172.253.122.84	443	TLSv13	TLS_AES_128_GCM_SHA256	x25519	accounts.google.com	F	-	-	F	Cs	-	-	-	q13d0310h3_55b375c5d22e_cd85d2d88918	q130200_1301_234ea6891581
+1675707155.341160	CMGtLttXbs1Yadtzc	192.168.1.168	60845	172.253.122.94	443	TLSv13	TLS_AES_128_GCM_SHA256	x25519	www.gstatic.com	F	-	-	F	Cs	-	-	-	q13d0310h3_55b375c5d22e_cd85d2d88918	q130200_1301_234ea6891581
+#close	2026-03-27-08-01-39
diff --git a/zeek/tests/btest.cfg b/zeek/tests/btest.cfg
new file mode 100644
index 00000000..cd37c8e8
--- /dev/null
+++ b/zeek/tests/btest.cfg
@@ -0,0 +1,15 @@
+[btest]
+TestDirs=Scripts
+TmpDir=%(testbase)s/.tmp
+BaselineDir=%(testbase)s/Traces
+IgnoreDirs=.svn CVS .git .tmp
+IgnoreFiles=*.tmp *.swp #* *.trace .DS_Store
+
+[environment]
+ZEEK_SEED_FILE=%(testbase)s/random.seed
+TZ=UTC
+LC_ALL=C
+TRACES=%(testbase)s/../../pcap
+BROPATH=`zeek-config --zeekpath`:%(testbase)s/..
+ZEEKPATH=`zeek-config --zeekpath`:%(testbase)s/..
+ZEEK_PLUGIN_PATH=`zeek-config --plugin_dir`
diff --git a/zeek/tests/random.seed b/zeek/tests/random.seed
new file mode 100644
index 00000000..3acb2614
--- /dev/null
+++ b/zeek/tests/random.seed
@@ -0,0 +1,21 @@
+1907645451
+2542257355
+2690548683
+2465255630
+3074807866
+4232382387
+2004422659
+2917066712
+2706037395
+2004411388
+2230090280
+4142033565
+1001624462
+1613373517
+3901537915
+1566829475
+1593044761
+3743307041
+2274259402
+2761772015
+2243476871

From c5c4b4d7f5f8335323d2a32d154af0663caacea4 Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Fri, 27 Mar 2026 08:43:41 +0000
Subject: [PATCH 2/6] Fix CI failure: canonify Zeek baseline logs to ignore
 timestamped open and close comments

Co-authored-by: J0eJ0h <16658048+J0eJ0h@users.noreply.github.com>
---
 zeek/tests/Traces/Scripts.ja4-conn/conn.log              | 9 ---------
 zeek/tests/Traces/Scripts.ja4-dhcp/ja4d.log              | 9 ---------
 .../tests/Traces/Scripts.ja4-http1-with-cookies/http.log | 9 ---------
 zeek/tests/Traces/Scripts.ja4-ssh2/ja4ssh.log            | 9 ---------
 zeek/tests/Traces/Scripts.ja4-tls-handshake/ssl.log      | 9 ---------
 zeek/tests/btest.cfg                                     | 1 +
 6 files changed, 1 insertion(+), 45 deletions(-)

diff --git a/zeek/tests/Traces/Scripts.ja4-conn/conn.log b/zeek/tests/Traces/Scripts.ja4-conn/conn.log
index de6aad58..56129e06 100644
--- a/zeek/tests/Traces/Scripts.ja4-conn/conn.log
+++ b/zeek/tests/Traces/Scripts.ja4-conn/conn.log
@@ -1,11 +1,2 @@
 ### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
-#separator \x09
-#set_separator	,
-#empty_field	(empty)
-#unset_field	-
-#path	conn
-#open	2026-03-27-08-01-36
-#fields	ts	uid	id.orig_h	id.orig_p	id.resp_h	id.resp_p	proto	service	duration	orig_bytes	resp_bytes	conn_state	local_orig	local_resp	missed_bytes	history	orig_pkts	orig_ip_bytes	resp_pkts	resp_ip_bytes	tunnel_parents	ip_proto	ja4l	ja4ls	ja4t	ja4ts
-#types	time	string	addr	port	addr	port	enum	string	interval	count	count	string	bool	bool	count	string	count	count	count	count	set[string]	count	string	string	string	string
 1593980608.621087	C73Zcd4XqUIenT3Fef	2001:4998:ef83:14:8000::100d	64034	2606:4700::6811:d209	443	tcp	ssl	0.075341	237	2810	S1	F	F	0	ShADad	4	501	5	3122	-	6	35_64	18862_59_14792	65535__0_0	65535__0_0
-#close	2026-03-27-08-01-36
diff --git a/zeek/tests/Traces/Scripts.ja4-dhcp/ja4d.log b/zeek/tests/Traces/Scripts.ja4-dhcp/ja4d.log
index 79133c0f..8c872c11 100644
--- a/zeek/tests/Traces/Scripts.ja4-dhcp/ja4d.log
+++ b/zeek/tests/Traces/Scripts.ja4-dhcp/ja4d.log
@@ -1,14 +1,5 @@
 ### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
-#separator \x09
-#set_separator	,
-#empty_field	(empty)
-#unset_field	-
-#path	ja4d
-#open	2026-03-27-08-01-37
-#fields	ts	uid	id.orig_h	id.orig_p	id.resp_h	id.resp_p	ja4d	client_mac	requested_ip	vendor_class_id	hostname
-#types	time	string	addr	port	addr	port	string	string	addr	string	string
 1102274184.317453	C73Zcd4XqUIenT3Fef	0.0.0.0	68	255.255.255.255	67	disco0000in_61-55_1-3-6-42	00:0b:82:01:fc:42	0.0.0.0	(empty)	(empty)
 1102274184.317748	Cl5woUpqKxGTMghIc	192.168.0.10	68	192.168.0.1	67	offer0000nn_1-58-59-51-54_00	00:0b:82:01:fc:42	-	(empty)	(empty)
 1102274184.317453	C73Zcd4XqUIenT3Fef	0.0.0.0	68	255.255.255.255	67	reqst0000in_61-54-55_1-3-6-42	00:0b:82:01:fc:42	192.168.0.10	(empty)	(empty)
 1102274184.317748	Cl5woUpqKxGTMghIc	192.168.0.10	68	192.168.0.1	67	dpack0000nn_58-59-51-54-1_00	00:0b:82:01:fc:42	-	(empty)	(empty)
-#close	2026-03-27-08-01-37
diff --git a/zeek/tests/Traces/Scripts.ja4-http1-with-cookies/http.log b/zeek/tests/Traces/Scripts.ja4-http1-with-cookies/http.log
index c9b719ff..fd1e7809 100644
--- a/zeek/tests/Traces/Scripts.ja4-http1-with-cookies/http.log
+++ b/zeek/tests/Traces/Scripts.ja4-http1-with-cookies/http.log
@@ -1,11 +1,2 @@
 ### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
-#separator \x09
-#set_separator	,
-#empty_field	(empty)
-#unset_field	-
-#path	http
-#open	2026-03-27-08-01-38
-#fields	ts	uid	id.orig_h	id.orig_p	id.resp_h	id.resp_p	trans_depth	method	host	uri	referrer	version	user_agent	origin	request_body_len	response_body_len	status_code	status_msg	info_code	info_msg	tags	username	password	proxied	orig_fuids	orig_filenames	orig_mime_types	resp_fuids	resp_filenames	resp_mime_types	ja4h
-#types	time	string	addr	port	addr	port	count	string	string	string	string	string	string	string	count	count	count	string	count	string	set[enum]	string	string	set[string]	vector[string]	vector[string]	vector[string]	vector[string]	vector[string]	vector[string]	string
 1690483736.912889	C73Zcd4XqUIenT3Fef	127.0.0.1	61256	127.0.0.1	8000	1	GET	localhost:8000	/	https://fake.example	1.0	curl/8.1.2	-	0	1114	200	OK	-	-	(empty)	-	-	-	-	-	-	FvbTb11CCpKvM264U8	-	text/html	ge11cr04da00_8ddaef5d77af_280f366eaa04_c2fb0fe53442
-#close	2026-03-27-08-01-38
diff --git a/zeek/tests/Traces/Scripts.ja4-ssh2/ja4ssh.log b/zeek/tests/Traces/Scripts.ja4-ssh2/ja4ssh.log
index 70587ace..3ce730d5 100644
--- a/zeek/tests/Traces/Scripts.ja4-ssh2/ja4ssh.log
+++ b/zeek/tests/Traces/Scripts.ja4-ssh2/ja4ssh.log
@@ -1,12 +1,3 @@
 ### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
-#separator \x09
-#set_separator	,
-#empty_field	(empty)
-#unset_field	-
-#path	ja4ssh
-#open	2026-03-27-08-01-38
-#fields	ts	uid	id.orig_h	id.orig_p	id.resp_h	id.resp_p	ja4ssh
-#types	time	string	addr	port	addr	port	string
 1688672868.776057	Chu4srlj1wba0b8Fk	172.16.225.48	57377	54.160.114.75	22	c36s36_c76s124_c74s6
 1688672868.776057	Chu4srlj1wba0b8Fk	172.16.225.48	57377	54.160.114.75	22	c36s52_c42s76_c51s2
-#close	2026-03-27-08-01-38
diff --git a/zeek/tests/Traces/Scripts.ja4-tls-handshake/ssl.log b/zeek/tests/Traces/Scripts.ja4-tls-handshake/ssl.log
index d7707852..3dde6575 100644
--- a/zeek/tests/Traces/Scripts.ja4-tls-handshake/ssl.log
+++ b/zeek/tests/Traces/Scripts.ja4-tls-handshake/ssl.log
@@ -1,12 +1,4 @@
 ### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
-#separator \x09
-#set_separator	,
-#empty_field	(empty)
-#unset_field	-
-#path	ssl
-#open	2026-03-27-08-01-39
-#fields	ts	uid	id.orig_h	id.orig_p	id.resp_h	id.resp_p	version	cipher	curve	server_name	resumed	last_alert	next_protocol	established	ssl_history	cert_chain_fps	client_cert_chain_fps	sni_matches_cert	ja4	ja4s
-#types	time	string	addr	port	addr	port	string	string	string	string	bool	string	string	bool	string	vector[string]	vector[string]	bool	string	string
 1675707161.245230	CGBsqN2uXmDTPVzDEl	192.168.1.168	52166	31.13.66.35	443	TLSv13	TLS_AES_128_GCM_SHA256	x25519	www.facebook.com	F	-	-	F	Cs	-	-	-	q13d0310h3_55b375c5d22e_cd85d2d88918	q130200_1301_a56c5b993250
 1675707152.011673	CErRvO2gbIalp3tOc5	192.168.1.168	55945	142.251.16.95	443	TLSv13	TLS_AES_128_GCM_SHA256	x25519	www.googleapis.com	F	-	-	F	Cs	-	-	-	q13d0310h3_55b375c5d22e_cd85d2d88918	q130200_1301_234ea6891581
 1675707155.389827	ChIaVxLkUs61KxAz8	192.168.1.168	55906	142.251.16.100	443	TLSv13	TLS_AES_128_GCM_SHA256	x25519	ogs.google.com	F	-	-	F	Cs	-	-	-	q13d0310h3_55b375c5d22e_cd85d2d88918	q130200_1301_234ea6891581
@@ -27,4 +19,3 @@
 1675707155.429145	CYq93o1jzMmpzZkM6d	192.168.1.168	59221	172.253.63.95	443	TLSv13	TLS_AES_128_GCM_SHA256	x25519	content-autofill.googleapis.com	F	-	-	F	Cs	-	-	-	q13d0310h3_55b375c5d22e_cd85d2d88918	q130200_1301_234ea6891581
 1675707151.936708	CN3K5p4CkjEhKRbQSg	192.168.1.168	57816	172.253.122.84	443	TLSv13	TLS_AES_128_GCM_SHA256	x25519	accounts.google.com	F	-	-	F	Cs	-	-	-	q13d0310h3_55b375c5d22e_cd85d2d88918	q130200_1301_234ea6891581
 1675707155.341160	CMGtLttXbs1Yadtzc	192.168.1.168	60845	172.253.122.94	443	TLSv13	TLS_AES_128_GCM_SHA256	x25519	www.gstatic.com	F	-	-	F	Cs	-	-	-	q13d0310h3_55b375c5d22e_cd85d2d88918	q130200_1301_234ea6891581
-#close	2026-03-27-08-01-39
diff --git a/zeek/tests/btest.cfg b/zeek/tests/btest.cfg
index cd37c8e8..d3c6861d 100644
--- a/zeek/tests/btest.cfg
+++ b/zeek/tests/btest.cfg
@@ -8,6 +8,7 @@ IgnoreFiles=*.tmp *.swp #* *.trace .DS_Store
 [environment]
 ZEEK_SEED_FILE=%(testbase)s/random.seed
 TZ=UTC
+TEST_DIFF_CANONIFIER=grep -v "^#"
 LC_ALL=C
 TRACES=%(testbase)s/../../pcap
 BROPATH=`zeek-config --zeekpath`:%(testbase)s/..

From f93e9533626816d3b91914fdfbdca47fb7bb8dce Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Fri, 27 Mar 2026 09:02:27 +0000
Subject: [PATCH 3/6] Fix CI failure: canonify Zeek baseline logs to ignore
 timestamped open and close comments

Co-authored-by: J0eJ0h <16658048+J0eJ0h@users.noreply.github.com>
---
 zeek/tests/Traces/Scripts.ja4-conn/conn.log               | 7 +++++++
 zeek/tests/Traces/Scripts.ja4-dhcp/ja4d.log               | 7 +++++++
 zeek/tests/Traces/Scripts.ja4-http1-with-cookies/http.log | 7 +++++++
 zeek/tests/Traces/Scripts.ja4-ssh2/ja4ssh.log             | 7 +++++++
 zeek/tests/Traces/Scripts.ja4-tls-handshake/ssl.log       | 7 +++++++
 zeek/tests/btest.cfg                                      | 2 +-
 6 files changed, 36 insertions(+), 1 deletion(-)

diff --git a/zeek/tests/Traces/Scripts.ja4-conn/conn.log b/zeek/tests/Traces/Scripts.ja4-conn/conn.log
index 56129e06..8d2350f0 100644
--- a/zeek/tests/Traces/Scripts.ja4-conn/conn.log
+++ b/zeek/tests/Traces/Scripts.ja4-conn/conn.log
@@ -1,2 +1,9 @@
 ### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+#separator \x09
+#set_separator	,
+#empty_field	(empty)
+#unset_field	-
+#path	conn
+#fields	ts	uid	id.orig_h	id.orig_p	id.resp_h	id.resp_p	proto	service	duration	orig_bytes	resp_bytes	conn_state	local_orig	local_resp	missed_bytes	history	orig_pkts	orig_ip_bytes	resp_pkts	resp_ip_bytes	tunnel_parents	ip_proto	ja4l	ja4ls	ja4t	ja4ts
+#types	time	string	addr	port	addr	port	enum	string	interval	count	count	string	bool	bool	count	string	count	count	count	count	set[string]	count	string	string	string	string
 1593980608.621087	C73Zcd4XqUIenT3Fef	2001:4998:ef83:14:8000::100d	64034	2606:4700::6811:d209	443	tcp	ssl	0.075341	237	2810	S1	F	F	0	ShADad	4	501	5	3122	-	6	35_64	18862_59_14792	65535__0_0	65535__0_0
diff --git a/zeek/tests/Traces/Scripts.ja4-dhcp/ja4d.log b/zeek/tests/Traces/Scripts.ja4-dhcp/ja4d.log
index 8c872c11..3cc83f5f 100644
--- a/zeek/tests/Traces/Scripts.ja4-dhcp/ja4d.log
+++ b/zeek/tests/Traces/Scripts.ja4-dhcp/ja4d.log
@@ -1,4 +1,11 @@
 ### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+#separator \x09
+#set_separator	,
+#empty_field	(empty)
+#unset_field	-
+#path	ja4d
+#fields	ts	uid	id.orig_h	id.orig_p	id.resp_h	id.resp_p	ja4d	client_mac	requested_ip	vendor_class_id	hostname
+#types	time	string	addr	port	addr	port	string	string	addr	string	string
 1102274184.317453	C73Zcd4XqUIenT3Fef	0.0.0.0	68	255.255.255.255	67	disco0000in_61-55_1-3-6-42	00:0b:82:01:fc:42	0.0.0.0	(empty)	(empty)
 1102274184.317748	Cl5woUpqKxGTMghIc	192.168.0.10	68	192.168.0.1	67	offer0000nn_1-58-59-51-54_00	00:0b:82:01:fc:42	-	(empty)	(empty)
 1102274184.317453	C73Zcd4XqUIenT3Fef	0.0.0.0	68	255.255.255.255	67	reqst0000in_61-54-55_1-3-6-42	00:0b:82:01:fc:42	192.168.0.10	(empty)	(empty)
diff --git a/zeek/tests/Traces/Scripts.ja4-http1-with-cookies/http.log b/zeek/tests/Traces/Scripts.ja4-http1-with-cookies/http.log
index fd1e7809..e8be62e1 100644
--- a/zeek/tests/Traces/Scripts.ja4-http1-with-cookies/http.log
+++ b/zeek/tests/Traces/Scripts.ja4-http1-with-cookies/http.log
@@ -1,2 +1,9 @@
 ### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+#separator \x09
+#set_separator	,
+#empty_field	(empty)
+#unset_field	-
+#path	http
+#fields	ts	uid	id.orig_h	id.orig_p	id.resp_h	id.resp_p	trans_depth	method	host	uri	referrer	version	user_agent	origin	request_body_len	response_body_len	status_code	status_msg	info_code	info_msg	tags	username	password	proxied	orig_fuids	orig_filenames	orig_mime_types	resp_fuids	resp_filenames	resp_mime_types	ja4h
+#types	time	string	addr	port	addr	port	count	string	string	string	string	string	string	string	count	count	count	string	count	string	set[enum]	string	string	set[string]	vector[string]	vector[string]	vector[string]	vector[string]	vector[string]	vector[string]	string
 1690483736.912889	C73Zcd4XqUIenT3Fef	127.0.0.1	61256	127.0.0.1	8000	1	GET	localhost:8000	/	https://fake.example	1.0	curl/8.1.2	-	0	1114	200	OK	-	-	(empty)	-	-	-	-	-	-	FvbTb11CCpKvM264U8	-	text/html	ge11cr04da00_8ddaef5d77af_280f366eaa04_c2fb0fe53442
diff --git a/zeek/tests/Traces/Scripts.ja4-ssh2/ja4ssh.log b/zeek/tests/Traces/Scripts.ja4-ssh2/ja4ssh.log
index 3ce730d5..9662fa0d 100644
--- a/zeek/tests/Traces/Scripts.ja4-ssh2/ja4ssh.log
+++ b/zeek/tests/Traces/Scripts.ja4-ssh2/ja4ssh.log
@@ -1,3 +1,10 @@
 ### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+#separator \x09
+#set_separator	,
+#empty_field	(empty)
+#unset_field	-
+#path	ja4ssh
+#fields	ts	uid	id.orig_h	id.orig_p	id.resp_h	id.resp_p	ja4ssh
+#types	time	string	addr	port	addr	port	string
 1688672868.776057	Chu4srlj1wba0b8Fk	172.16.225.48	57377	54.160.114.75	22	c36s36_c76s124_c74s6
 1688672868.776057	Chu4srlj1wba0b8Fk	172.16.225.48	57377	54.160.114.75	22	c36s52_c42s76_c51s2
diff --git a/zeek/tests/Traces/Scripts.ja4-tls-handshake/ssl.log b/zeek/tests/Traces/Scripts.ja4-tls-handshake/ssl.log
index 3dde6575..f4a22103 100644
--- a/zeek/tests/Traces/Scripts.ja4-tls-handshake/ssl.log
+++ b/zeek/tests/Traces/Scripts.ja4-tls-handshake/ssl.log
@@ -1,4 +1,11 @@
 ### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+#separator \x09
+#set_separator	,
+#empty_field	(empty)
+#unset_field	-
+#path	ssl
+#fields	ts	uid	id.orig_h	id.orig_p	id.resp_h	id.resp_p	version	cipher	curve	server_name	resumed	last_alert	next_protocol	established	ssl_history	cert_chain_fps	client_cert_chain_fps	sni_matches_cert	ja4	ja4s
+#types	time	string	addr	port	addr	port	string	string	string	string	bool	string	string	bool	string	vector[string]	vector[string]	bool	string	string
 1675707161.245230	CGBsqN2uXmDTPVzDEl	192.168.1.168	52166	31.13.66.35	443	TLSv13	TLS_AES_128_GCM_SHA256	x25519	www.facebook.com	F	-	-	F	Cs	-	-	-	q13d0310h3_55b375c5d22e_cd85d2d88918	q130200_1301_a56c5b993250
 1675707152.011673	CErRvO2gbIalp3tOc5	192.168.1.168	55945	142.251.16.95	443	TLSv13	TLS_AES_128_GCM_SHA256	x25519	www.googleapis.com	F	-	-	F	Cs	-	-	-	q13d0310h3_55b375c5d22e_cd85d2d88918	q130200_1301_234ea6891581
 1675707155.389827	ChIaVxLkUs61KxAz8	192.168.1.168	55906	142.251.16.100	443	TLSv13	TLS_AES_128_GCM_SHA256	x25519	ogs.google.com	F	-	-	F	Cs	-	-	-	q13d0310h3_55b375c5d22e_cd85d2d88918	q130200_1301_234ea6891581
diff --git a/zeek/tests/btest.cfg b/zeek/tests/btest.cfg
index d3c6861d..5302bf14 100644
--- a/zeek/tests/btest.cfg
+++ b/zeek/tests/btest.cfg
@@ -8,7 +8,7 @@ IgnoreFiles=*.tmp *.swp #* *.trace .DS_Store
 [environment]
 ZEEK_SEED_FILE=%(testbase)s/random.seed
 TZ=UTC
-TEST_DIFF_CANONIFIER=grep -v "^#"
+TEST_DIFF_CANONIFIER=awk '{ if ($1 == "#open" || $1 == "#close") next; print $0 }'
 LC_ALL=C
 TRACES=%(testbase)s/../../pcap
 BROPATH=`zeek-config --zeekpath`:%(testbase)s/..

From 532e1d321b1b5e95cf7a2eb20939d40677e87d1e Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Fri, 27 Mar 2026 10:26:16 +0000
Subject: [PATCH 4/6] chore(actions): silence Node.js 20 deprecation warning by
 enforcing Node.js 24

Co-authored-by: J0eJ0h <16658048+J0eJ0h@users.noreply.github.com>
---
 .github/workflows/zeek-test.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/zeek-test.yml b/.github/workflows/zeek-test.yml
index ccf8b74f..a37326ad 100644
--- a/.github/workflows/zeek-test.yml
+++ b/.github/workflows/zeek-test.yml
@@ -15,6 +15,8 @@ on:
 jobs:
   test:
     runs-on: ubuntu-latest
+    env:
+      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
     container:
       image: zeek/zeek:8.0.0
     steps:

From d768defba28518da5132722a8b95f2399a66fb53 Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Fri, 3 Apr 2026 19:00:45 +0000
Subject: [PATCH 5/6] fix(ja4ssh): pick lowest value in case of a frequency tie
 when calculating mode

Co-authored-by: J0eJ0h <16658048+J0eJ0h@users.noreply.github.com>
---
 zeek/ja4ssh/main.zeek | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/zeek/ja4ssh/main.zeek b/zeek/ja4ssh/main.zeek
index 2714be9c..2d0a585a 100644
--- a/zeek/ja4ssh/main.zeek
+++ b/zeek/ja4ssh/main.zeek
@@ -66,6 +66,8 @@ function get_mode(vec: vector of count): count {
     if (freq > max) {
       max = freq;
       mode = idx;
+    } else if (freq == max && idx < mode) {
+      mode = idx;
     }
   }
 

From f7f4691328e7a0f6948d469edbc47cdb182b90c7 Mon Sep 17 00:00:00 2001
From: Jo <J0eJ0h@users.noreply.github.com>
Date: Fri, 3 Apr 2026 14:00:28 -0700
Subject: [PATCH 6/6] Fix raw syn/ack counting (#4)

* Fix raw syn/ack counting

* Update test expectations

* Fix new wrongly counted packet
---
 zeek/ja4ssh/main.zeek                         | 12 ++++++++----
 zeek/tests/Traces/Scripts.ja4-ssh2/ja4ssh.log |  2 +-
 2 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/zeek/ja4ssh/main.zeek b/zeek/ja4ssh/main.zeek
index 2d0a585a..7c142c37 100644
--- a/zeek/ja4ssh/main.zeek
+++ b/zeek/ja4ssh/main.zeek
@@ -119,16 +119,20 @@ event ConnThreshold::packets_threshold_crossed(c: connection, threshold: count,
     if (is_orig) {
         ConnThreshold::set_packets_threshold(c,threshold + 1,T);
 
-        if (rp$tcp$dl == 0) {
-          ++c$fp$ja4ssh$orig_ack;
+        if ((rp$tcp$dl == 0) ) {
+          if (rp$tcp$flags == 0x10) {
+            ++c$fp$ja4ssh$orig_ack;
+          }
         } else {
           c$fp$ja4ssh$orig_pack_len += rp$tcp$dl;
         }
     } else {
         ConnThreshold::set_packets_threshold(c,threshold + 1,F);
 
-        if (rp$tcp$dl == 0) {
-          ++c$fp$ja4ssh$resp_ack;
+        if ((rp$tcp$dl == 0) ) {
+          if (rp$tcp$flags == 0x10) {
+            ++c$fp$ja4ssh$resp_ack;
+          }
         } else {
           c$fp$ja4ssh$resp_pack_len += rp$tcp$dl;
         }
diff --git a/zeek/tests/Traces/Scripts.ja4-ssh2/ja4ssh.log b/zeek/tests/Traces/Scripts.ja4-ssh2/ja4ssh.log
index 9662fa0d..aee32e3c 100644
--- a/zeek/tests/Traces/Scripts.ja4-ssh2/ja4ssh.log
+++ b/zeek/tests/Traces/Scripts.ja4-ssh2/ja4ssh.log
@@ -6,5 +6,5 @@
 #path	ja4ssh
 #fields	ts	uid	id.orig_h	id.orig_p	id.resp_h	id.resp_p	ja4ssh
 #types	time	string	addr	port	addr	port	string
-1688672868.776057	Chu4srlj1wba0b8Fk	172.16.225.48	57377	54.160.114.75	22	c36s36_c76s124_c74s6
+1688672868.776057	Chu4srlj1wba0b8Fk	172.16.225.48	57377	54.160.114.75	22	c36s36_c76s124_c74s5
 1688672868.776057	Chu4srlj1wba0b8Fk	172.16.225.48	57377	54.160.114.75	22	c36s52_c42s76_c51s2