From 14745f168a11213dde5e599aed3e24e6acced223 Mon Sep 17 00:00:00 2001
From: Eric Leblond <el@stamus-networks.com>
Date: Fri, 20 Dec 2024 22:50:41 +0100
Subject: [PATCH] tests: add json datajson

---
 .../datajson-09-jsonformat/hosts-direct.json  |   1 +
 .../datajson-09-jsonformat/hosts-nested.json  |   1 +
 .../datajson-09-jsonformat/hosts.json         |   1 +
 .../datajson-09-jsonformat/input.pcap         | Bin 0 -> 1104 bytes
 .../datajson/datajson-09-jsonformat/src.json  |   3 ++
 .../datajson-09-jsonformat/test.rules         |   6 +++
 .../datajson/datajson-09-jsonformat/test.yaml |  35 ++++++++++++++++++
 7 files changed, 47 insertions(+)
 create mode 100644 tests/datajson/datajson-09-jsonformat/hosts-direct.json
 create mode 100644 tests/datajson/datajson-09-jsonformat/hosts-nested.json
 create mode 100644 tests/datajson/datajson-09-jsonformat/hosts.json
 create mode 100644 tests/datajson/datajson-09-jsonformat/input.pcap
 create mode 100644 tests/datajson/datajson-09-jsonformat/src.json
 create mode 100644 tests/datajson/datajson-09-jsonformat/test.rules
 create mode 100644 tests/datajson/datajson-09-jsonformat/test.yaml

diff --git a/tests/datajson/datajson-09-jsonformat/hosts-direct.json b/tests/datajson/datajson-09-jsonformat/hosts-direct.json
new file mode 100644
index 000000000..c3ef34c9d
--- /dev/null
+++ b/tests/datajson/datajson-09-jsonformat/hosts-direct.json
@@ -0,0 +1 @@
+[ {"context":"gold old test", "year": 2005, "host": "www.testmyids.com"} ]
diff --git a/tests/datajson/datajson-09-jsonformat/hosts-nested.json b/tests/datajson/datajson-09-jsonformat/hosts-nested.json
new file mode 100644
index 000000000..7106dcab0
--- /dev/null
+++ b/tests/datajson/datajson-09-jsonformat/hosts-nested.json
@@ -0,0 +1 @@
+{ "info": {"threat": [ {"context":"gold old test", "year": 2005, "host": "www.testmyids.com"} ] } }
diff --git a/tests/datajson/datajson-09-jsonformat/hosts.json b/tests/datajson/datajson-09-jsonformat/hosts.json
new file mode 100644
index 000000000..c7761c184
--- /dev/null
+++ b/tests/datajson/datajson-09-jsonformat/hosts.json
@@ -0,0 +1 @@
+{"threat": [ {"context":"gold old test", "year": 2005, "host": "www.testmyids.com"} ] }
diff --git a/tests/datajson/datajson-09-jsonformat/input.pcap b/tests/datajson/datajson-09-jsonformat/input.pcap
new file mode 100644
index 0000000000000000000000000000000000000000..8fb6832de69b21a5981f5eab3f5820dec990de8b
GIT binary patch
literal 1104
zc-noE-A~g{7{=f314*%Am>7vyCtS!JY-_tOXc$5iK?b^D4cE0hj3umH+729lfJ9@$
zohZaa5(ytSMx!?-P7`i0+&M3d8n1+yC|;^}dQO`KSe7+;o1XXd{PLXVeLieIUv+^8
z4j&IN<o#y*_T-&zfKhM?PM_hL{(RiMd$4-B8HND*7Vi(hK-0=D>tk9b)}Ad_wje#f
zv;La?{Mcpq9?b%{Jl+=`S2N3+{w~^Q-0l;U{I|so{bWtcVLE)9%mWO7&?IS;O6icU
zY%T4-KS${0!l|{4_R1kwX~~mrh!ax0o=*SblCAS=jm|P5cBXx>cfsr2_6eaZ5Wqq`
zN@?+dO}ST>(hhrP-vJB{$ta9QWH}ucLITH*=%yv1xw*NJg-t78%4N)us^>ZOhKY^f
zU>0j+TP+$h;Y27J3Go~|sH(U?nt^bDV>y<}+WhW?KBB0vo>hL?pjPd>Ypm*=-`QwQ
z`<PV!)#_L&tNg<Yy=1zyYFSK|Y*N;@e|1^yOzLe5K=pD+<au;0#j%$Z3rlDcXS$IP
zL8HYPvLnQiC`wUL;uC0iT;|y8*qFtJga!+WI*mDYOfjwCxSq*P<#0wq<GMyp$Iz&v
zQEmc>5lIlFSj;&+Br917bqGCz+7s<nf?^^V6%&FQn-UZ?s`4FG-+~j0mc^!oZkCAQ
z9D7mMEaGu+3~O0yT0)WD!=79!5ZxBOWre4${0w!wn9C%2zoF~ad6Yf+ZRo{<SzX#g
z`9+Lukhq6-R=yn1%0}zbekDK>caYq4#_{rJL&~yE`COOMMkpH&<!QOOQ9vv^Ak6Wh
jRsw|NOSdtp<dvfV`At|26s_2bKGi7l5nh*luXTX`;&4rh

literal 0
Hc-jL100001

diff --git a/tests/datajson/datajson-09-jsonformat/src.json b/tests/datajson/datajson-09-jsonformat/src.json
new file mode 100644
index 000000000..21b598ed3
--- /dev/null
+++ b/tests/datajson/datajson-09-jsonformat/src.json
@@ -0,0 +1,3 @@
+[
+    {"ip": "10.16.1.11", "test": "success","context":3}
+]
diff --git a/tests/datajson/datajson-09-jsonformat/test.rules b/tests/datajson/datajson-09-jsonformat/test.rules
new file mode 100644
index 000000000..c22e29164
--- /dev/null
+++ b/tests/datajson/datajson-09-jsonformat/test.rules
@@ -0,0 +1,6 @@
+alert http any any -> any any (flow:established,to_server; http.host; datajson:isset,badhost,type string,load hosts.json,key bad_host,json_key host, array_key threat; ip.src; datajson:isset,src_ip,type ip,load src.json,key src_ip,json_key ip; sid:1;)
+
+alert http any any -> any any (flow:established,to_server; http.host; datajson:isset,dbadhost,type string,load hosts-direct.json,key dbad_host,json_key host; ip.src; datajson:isset,src_ip,type ip,load src.json,key src_ip,json_key ip; sid:2;)
+
+
+alert http any any -> any any (flow:established,to_server; http.host; datajson:isset,nbadhost,type string,load hosts-nested.json,key nbad_host,json_key host, array_key info.threat; ip.src; datajson:isset,src_ip,type ip,load src.json,key src_ip,json_key ip; sid:3;)
diff --git a/tests/datajson/datajson-09-jsonformat/test.yaml b/tests/datajson/datajson-09-jsonformat/test.yaml
new file mode 100644
index 000000000..6e95693a5
--- /dev/null
+++ b/tests/datajson/datajson-09-jsonformat/test.yaml
@@ -0,0 +1,35 @@
+requires:
+  features:
+    - HAVE_LIBJANSSON
+  files:
+    - src/datasets.c
+
+args:
+ - -k none --set datasets.enabled=yes
+
+checks:
+  - filter:
+      count: 3
+      match:
+        event_type: alert
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 1
+        alert.extra.src_ip.test: success
+        alert.extra.bad_host.year: 2005
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 2
+        alert.extra.src_ip.test: success
+        alert.extra.dbad_host.year: 2005
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 3
+        alert.extra.src_ip.test: success
+        alert.extra.nbad_host.year: 2005
-- 
2.47.2