From: Eric Leblond Date: Sun, 13 Oct 2024 11:32:20 +0000 (+0200) Subject: tests: add sha256 test to datajson X-Git-Tag: suricata-7.0.11~31 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=49d937a53df57e7c8774c19cd476c17d7a3ec022;p=thirdparty%2Fsuricata-verify.git tests: add sha256 test to datajson --- diff --git a/tests/datajson/datajson-04-sha256/badsha.lst b/tests/datajson/datajson-04-sha256/badsha.lst new file mode 100644 index 000000000..58bcade9d --- /dev/null +++ b/tests/datajson/datajson-04-sha256/badsha.lst @@ -0,0 +1,2 @@ +e0ca4ff795b3f32d45260678e4ab79884793c05a149f2b350d10274451dc210a,{"year":2005,"where":"internet"} +#E0CA4FF795B3F32D45260678E4AB79884793C05A149F2B350D10274451DC210A,{"year":2005,"where":"internet"} diff --git a/tests/datajson/datajson-04-sha256/input.pcap b/tests/datajson/datajson-04-sha256/input.pcap new file mode 100644 index 000000000..8fb6832de Binary files /dev/null and b/tests/datajson/datajson-04-sha256/input.pcap differ diff --git a/tests/datajson/datajson-04-sha256/test.rules b/tests/datajson/datajson-04-sha256/test.rules new file mode 100644 index 000000000..018173048 --- /dev/null +++ b/tests/datajson/datajson-04-sha256/test.rules @@ -0,0 +1 @@ +alert http any any -> any any (flow:established,to_server; http.host; content: "testmyids"; to_sha256; datajson:isset,badcat,type sha256,load badsha.lst,key bad_sha; sid:1; rev:1;) diff --git a/tests/datajson/datajson-04-sha256/test.yaml b/tests/datajson/datajson-04-sha256/test.yaml new file mode 100644 index 000000000..4dad013b4 --- /dev/null +++ b/tests/datajson/datajson-04-sha256/test.yaml @@ -0,0 +1,20 @@ +requires: + features: + - HAVE_LIBJANSSON + files: + - src/datasets.c + +args: + - -k none --set datasets.enabled=yes + +checks: + - filter: + count: 1 + match: + event_type: alert + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 1 + alert.extra.bad_sha.year: 2005