From bec8c58b1b5abd8dbbf8d6ebba91784fe5cf25ea Mon Sep 17 00:00:00 2001 From: Philippe Antoine Date: Thu, 18 Sep 2025 10:00:17 +0200 Subject: [PATCH] mqtt: add test with type keyword and index Ticket: 7480 --- tests/mqtt-connect-rules-3/suricata.yaml | 16 ++++++++++++++++ tests/mqtt-connect-rules-3/test.rules | 2 ++ tests/mqtt-connect-rules-3/test.yaml | 14 ++++++++++++++ 3 files changed, 32 insertions(+) create mode 100644 tests/mqtt-connect-rules-3/suricata.yaml create mode 100644 tests/mqtt-connect-rules-3/test.rules create mode 100644 tests/mqtt-connect-rules-3/test.yaml diff --git a/tests/mqtt-connect-rules-3/suricata.yaml b/tests/mqtt-connect-rules-3/suricata.yaml new file mode 100644 index 000000000..6fb68aab1 --- /dev/null +++ b/tests/mqtt-connect-rules-3/suricata.yaml @@ -0,0 +1,16 @@ +%YAML 1.1 +--- + +outputs: + - eve-log: + enabled: yes + filetype: regular + filename: eve.json + types: + - mqtt + - alert + +app-layer: + protocols: + mqtt: + enabled: yes \ No newline at end of file diff --git a/tests/mqtt-connect-rules-3/test.rules b/tests/mqtt-connect-rules-3/test.rules new file mode 100644 index 000000000..fdea33583 --- /dev/null +++ b/tests/mqtt-connect-rules-3/test.rules @@ -0,0 +1,2 @@ +alert mqtt any any -> any any (msg:"MQTT CONNACK reason code 0"; mqtt.type:CONNECT,0; mqtt.type:CONNACK,1; mqtt.reason_code:0; sid:4;) + diff --git a/tests/mqtt-connect-rules-3/test.yaml b/tests/mqtt-connect-rules-3/test.yaml new file mode 100644 index 000000000..b2b88cd92 --- /dev/null +++ b/tests/mqtt-connect-rules-3/test.yaml @@ -0,0 +1,14 @@ +requires: + min-version: 9 + +args: + - -k none + +pcap: ../mqtt-connect-rules/mqtt5_pub_jpeg.pcap + +checks: + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 4 -- 2.47.3