From efed1efe07cbe68aa83e11dca160372057f9cdce Mon Sep 17 00:00:00 2001
From: Juliana Fajardini <jufajardini@oisf.net>
Date: Wed, 2 Apr 2025 16:48:09 -0700
Subject: [PATCH] pgsql: add tests for copy-out mode

Task #4854
---
 tests/pgsql/pgsql-copy-data-out/input.pcap    | Bin 0 -> 5447 bytes
 tests/pgsql/pgsql-copy-data-out/suricata.yaml |  18 +++++++++++++++
 tests/pgsql/pgsql-copy-data-out/test.yaml     |  21 ++++++++++++++++++
 3 files changed, 39 insertions(+)
 create mode 100644 tests/pgsql/pgsql-copy-data-out/input.pcap
 create mode 100644 tests/pgsql/pgsql-copy-data-out/suricata.yaml
 create mode 100644 tests/pgsql/pgsql-copy-data-out/test.yaml

diff --git a/tests/pgsql/pgsql-copy-data-out/input.pcap b/tests/pgsql/pgsql-copy-data-out/input.pcap
new file mode 100644
index 0000000000000000000000000000000000000000..9618ef90ddaef49a27372c0fc9d59efc9f72c32c
GIT binary patch
literal 5447
zc-qC7eP|o!8Ng3Y(#6T*CS%T$eXzHV(>SYT-KTVtoezH~wiDZOY}tuZI_<r?_pGZ=
zcj|rkBV;4&k5MRtP{tZqN;A5`*dHtGgE9?9!d$wJu4CQkItUAfg+a5i(Xqf1-0gW!
zvK%QFIc#J#oF(0R_j{lBd476Mcfb4j55C>RY-ZN~HZu|Uf5iUlEdR~z%yD>6H?#Z3
z0jV^8^VXN&&u(SX4AZkRag;gwNWZjgXJk8U+e%kj<;9DaenlCVn{NMI`!&NfZQk;u
z%}rakwRHaRJl!AJwCQ7%{Ph>s$z^7lUnVmQCAU9Isg&L-m#(ZXe?JEFw=aL<!)Nb2
zw@&_E)1xm_`WpGCK<)!-Us%lI%4868PhHG!1D!p;Gji+kn-F8994{qP;`J9AW+598
zg;3(2$gS<~)Di)*b@MyBW0bsnaXr?1vLKcYQS#Fhby;A6{w~D2`uMdnc`XB!=uhon
z`hnITMwCj21LAlnaZhCRy)Ug1ceYaE7)AaDkPQ+#6)ZnhxBPbj%h81H|FF9J4=9!r
z(ew`H0?;mm5x=@JO^JOsLy3^kuiUOB0%VNY#4x@~9LDiY;xZccu!3Du`G|`}(@?Qz
z*jCQM1;P~FXG}&l4PtpYVyU)fShLJj_LyAO{=MlPjmmN)G>P2e#TVOYS@wUon#A2S
zMoK(8*1}|fmI)*FmW~F*zEC2R<<GBGiBps~0hEu!w&l*1%X=yQ&XX<79PF42OXyQ8
zr-BkaTAR=p+hK~sG@)-@T}$Y7iB3@jN=HGH6f7h-BB-LMaH1};I*t>p%c9D$oG7YN
zkgKt$S{mi5H(1$N-O3Kb^rJLa?SHARY=%yM6o})Wh4v9CZ}r5;^QAsY%>ONv2)Wu{
zsuI6Ni8NPRY3G@Q?bG2V(4oDdI?$0%4PcK<dP^o@h9@(fXmntve1>6pWR^HNu#I>|
z0YtN{VB|ByFyhQ(vwT+3cD-2#hUwTR4L9fdMdAdyR!-Op@8^MZ@8n`-1U46fW;mgX
zOQMbeq8Qjh!KWzKRh-pkIi7ujI~bgVT;kHBbJ+Ltwqu+P7F_u<&;$0l9=0^>XgSrk
zblWMwoH^HX;HA2V)+{XPjBODn?WwV;Y(I0Ntli0fj6MI`<}=j4VOp=NpJSMBFy-wY
z`M$PtI`}r<sFQDWb@|mxP_KUuY^ln(NNaWyC@1?f<1?sZGCh*+&!R7&V-uNC6hx0s
z4W%d2$hCb(CFl@3Kod)>Sl+ih2>t*X86F+ZBIzK?X3%7IATyO^XpE11o@r!he_-iI
zty8aFf;eBImbSfC<J2N0{woz>-iO%fR!`h=tu#Q1+ROJN{vlQ+{)rNYAg;$4W(RZM
zKMk&UqL2_okz<?rILFFyxtVLu4i2NCsj)1Y^xdMN8n*AE$)J#E*ivlY(oo0v5_Sr<
zgLK0r2s@skW7TsHHrM8^8JooMP~P*3s6Bl;o1Pf!9m$QQvj|&DD0&#R4`oKv)g2uL
zcQ)1bKTO}&jdasqND**RF%36Qv~C1Cdhjhwwe3Td)7tLZsXKN770df`4h_3Na&UlV
zP@h$jVu6WWFIU7Kd;zU)<Pe=Wgbw+R*;&Bm0(MB3MHbwc7xS$mR_7qrXoVS_m!q!g
z7)8&GB{`Oj!`vozU2myKQVQ0hzBOmr3&3>^EmbK3on$`6bsuczSzd~=LX_hX7f-SA
z6wf`uvduD|V4;b!BB$|KQj`Rb<18G@>d<0Yj@<9O+TDVfV)?G5#7YTq<59iY@=bFa
zmBuVf!&Rh7-Yv~2HY-Kz2Mgw+<Bq+!gia9!s$rU_cdb~+u+UI8JB}uZTeK~gG;*g#
z6Yz$<gc$Q*&mAI8r)THN{kuB|qRXiqo68fd5$7(4;3Us?&j}du>^VRcRfnY7Vqfey
zl2T3ECFfjURiS<AkiVsau?aZD%L6WNn_7yBfJ~!cc%8^|Kpvzl<y=SYgpLa{XfBGg
zoiG<<1#$KE!3pz*8{`cP1pSKi!r{iCk|N9T!UM>b+)y?tp=*h_sOnNuPVh>Cl{H!C
z6j9RSGGXP1En90@Hoh!dg1uX|6Ld9ql|Aj{iDUQ$)T?QbU>9YS;9{qR%jK!Xs!AJm
zqX(X<aT8(}bs}kcyce^{URl+WEbaWaq4U21UH^@+&i|8AI_Uhb*LMCN4+NbbexJOq
z)OP-UIj$ry7I-W`fqV61GIWTfo@@)zM~#|Tal2Hz5Yr&W=xiQ-SwvxNQP)=C16@FQ
z=K{g-iy^9jqM8kj4JyS+qNXL2@&kC5U^nzkOKL=Au_Wq5(Fv!-Sym*vDC?{!Lc>!Z
zvS*K#JrgRPag99dBWhmYQJ>+dHuRE*Z`%eFHg--?xo74viF=yI`?@Ikf~@*-@$90h
z#s%Uo`X1{_-V*N=K2k%t4Gj@wmPoqJbBZn}L{?Ig0!i?2EhGfT;qL4q8?v`-h*&X%
zZ)C^_nZ@eT|Iv^QCTwg7H<X;oYsZzRrIDF}-J6`A67>Pwnp38Q#EGmwO^$!0X7C%D
z!Rrz)3cM!r2}PB;gs6*2MHdK8V8Tmr{UMs6(#Ko$*~s?b7DHmzZ)4Q%NTbIbGr>J{
zyzVyUrPbxqo9A~n?b}^_%5(iHZS9nJvM0g}0&Osim|Qs%5ZO@To~C`J<yzut8al-m
zdm0A%WPlaxu-^%=yCBfF?hUl(P^8h_(Xrs}Xt?%@R(g|C>AlSE52{zR8<a|kKfBhD
zI2aIzLWr*f#9yotceSh$f8W{Eh&U7w2SbUwfcV2Iv2Bgm5^ZXb$I2tf3w3#X1*pFa
M3ZALv@!ypCA5*<&cmMzZ

literal 0
Hc-jL100001

diff --git a/tests/pgsql/pgsql-copy-data-out/suricata.yaml b/tests/pgsql/pgsql-copy-data-out/suricata.yaml
new file mode 100644
index 000000000..bade98943
--- /dev/null
+++ b/tests/pgsql/pgsql-copy-data-out/suricata.yaml
@@ -0,0 +1,18 @@
+%YAML 1.1
+---
+
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular
+      filename: eve.json
+      types:
+        - pgsql:
+            passwords: false
+
+app-layer:
+  protocols:
+    pgsql:
+      enabled: yes
+      stream-depth: 0
+
diff --git a/tests/pgsql/pgsql-copy-data-out/test.yaml b/tests/pgsql/pgsql-copy-data-out/test.yaml
new file mode 100644
index 000000000..7bb7d63af
--- /dev/null
+++ b/tests/pgsql/pgsql-copy-data-out/test.yaml
@@ -0,0 +1,21 @@
+requires:
+  min-version: 8
+
+args:
+- -k none
+
+checks:
+- filter:
+    count: 5
+    match:
+      event_type: pgsql
+- filter:
+    count: 1
+    match:
+      event_type: pgsql
+      pgsql.request.simple_query: "COPY (SELECT * FROM rules WHERE source = 'tgreen/hunting' LIMIT 5) TO STDOUT"
+      pgsql.response.command_completed: COPY 5
+      pgsql.response.copy_data_out.row_count: 5
+      pgsql.response.copy_data_out.data_size: 2779
+      pgsql.tx_id: 4
+      proto: TCP
-- 
2.47.2