From: Jason Ish <jason.ish@oisf.net>
Date: Mon, 29 Mar 2021 16:28:17 +0000 (-0600)
Subject: tests: add test for Rust template parser
X-Git-Tag: suricata-6.0.4~99
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=refs%2Fpull%2F483%2Fhead;p=thirdparty%2Fsuricata-verify.git

tests: add test for Rust template parser
---

diff --git a/tests/app-layer-template-rust/input.pcap b/tests/app-layer-template-rust/input.pcap
new file mode 100644
index 000000000..00abe264f
Binary files /dev/null and b/tests/app-layer-template-rust/input.pcap differ
diff --git a/tests/app-layer-template-rust/suricata.yaml b/tests/app-layer-template-rust/suricata.yaml
new file mode 100644
index 000000000..4a8c639c8
--- /dev/null
+++ b/tests/app-layer-template-rust/suricata.yaml
@@ -0,0 +1,17 @@
+%YAML 1.1
+---
+
+outputs:
+  - eve-log:
+      enabled: yes
+      types:
+        - template-rust
+        - alert
+        - flow
+
+app-layer:
+  protocols:
+    template-rust:
+      enabled: yes
+      detection-ports:
+        dp: 7000
diff --git a/tests/app-layer-template-rust/test.rules b/tests/app-layer-template-rust/test.rules
new file mode 100644
index 000000000..6bb665081
--- /dev/null
+++ b/tests/app-layer-template-rust/test.rules
@@ -0,0 +1,2 @@
+alert template-rust any any -> any any (msg:"TEST"; content:"Hello"; flow:established,to_server; sid:1; rev:1;)
+alert template-rust any any -> any any (msg:"TEST"; content:"Bye"; flow:established,to_client; sid:2; rev:1;)
diff --git a/tests/app-layer-template-rust/test.yaml b/tests/app-layer-template-rust/test.yaml
new file mode 100644
index 000000000..a92b6f2c6
--- /dev/null
+++ b/tests/app-layer-template-rust/test.yaml
@@ -0,0 +1,54 @@
+# *** Add configuration here ***
+
+args:
+- -k none
+
+checks:
+- filter:
+    count: 1
+    match:
+      dest_ip: 10.16.1.10
+      dest_port: 7000
+      event_type: template-rust
+      pcap_cnt: 7
+      proto: TCP
+      src_ip: 10.16.1.11
+      src_port: 58352
+      template.request: Hello World!
+      template.response: Bye
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 1
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 2
+- filter:
+    count: 1
+    match:
+      app_proto: template-rust
+      dest_ip: 10.16.1.10
+      dest_port: 7000
+      event_type: flow
+      flow.age: 20
+      flow.alerted: true
+      flow.bytes_toclient: 277
+      flow.bytes_toserver: 419
+      flow.pkts_toclient: 4
+      flow.pkts_toserver: 6
+      flow.reason: shutdown
+      flow.state: closed
+      proto: TCP
+      src_ip: 10.16.1.11
+      src_port: 58352
+      tcp.ack: true
+      tcp.fin: true
+      tcp.psh: true
+      tcp.state: closed
+      tcp.syn: true
+      tcp.tcp_flags: 1b
+      tcp.tcp_flags_tc: 1b
+      tcp.tcp_flags_ts: 1b