From: Jeff Lucovsky Date: Sun, 17 May 2020 13:59:28 +0000 (-0400) Subject: test:byte_jump Test from_end X-Git-Tag: suricata-6.0.4~250 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=refs%2Fpull%2F298%2Fhead;p=thirdparty%2Fsuricata-verify.git test:byte_jump Test from_end This commit adds test cases for the `byte_jump` `from_end` keyword. --- diff --git a/tests/detect-bytejump-01/input.pcap b/tests/detect-bytejump-01/input.pcap new file mode 100644 index 000000000..fe0da7bc9 Binary files /dev/null and b/tests/detect-bytejump-01/input.pcap differ diff --git a/tests/detect-bytejump-01/test.rules b/tests/detect-bytejump-01/test.rules new file mode 100644 index 000000000..4a0c7617a --- /dev/null +++ b/tests/detect-bytejump-01/test.rules @@ -0,0 +1,4 @@ +# Jump value from payload will be 13 (dec) +# payload; `Question?13When will the pandemic end?` +alert tcp any any -> any any (msg:"Byte-jump test 1";content:"Question?"; byte_jump:2,0,relative,string,from_end,post_offset -26; content:"pandemic";distance:0; sid:1;) +alert tcp any any -> any any (msg:"Byte-jump test 2";content:"Question?"; byte_jump:0,0,relative,string,from_end,post_offset -3; content:"pandemic";distance:0; sid:2;) diff --git a/tests/detect-bytejump-01/test.yaml b/tests/detect-bytejump-01/test.yaml new file mode 100644 index 000000000..880832376 --- /dev/null +++ b/tests/detect-bytejump-01/test.yaml @@ -0,0 +1,18 @@ +requires: + min-version: 6 + +args: + - -k none + +checks: + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 1 + + - filter: + count: 0 + match: + event_type: alert + alert.signature_id: 2