From d637aed967b6c269068a293a61c9623346770623 Mon Sep 17 00:00:00 2001 From: Jeff Lucovsky Date: Sun, 17 Aug 2025 10:21:39 -0400 Subject: [PATCH] test/from_base64: Use transform with default values This test uses default values for the parameters accepted by from_base64: - bytes - offset - decode type Issue: 7853 --- tests/from_base64-04/README.md | 1 + tests/from_base64-04/test.rules | 1 + tests/from_base64-04/test.yaml | 22 ++++++++++++++++++++++ 3 files changed, 24 insertions(+) create mode 100644 tests/from_base64-04/README.md create mode 100644 tests/from_base64-04/test.rules create mode 100644 tests/from_base64-04/test.yaml diff --git a/tests/from_base64-04/README.md b/tests/from_base64-04/README.md new file mode 100644 index 000000000..d0f9c13b0 --- /dev/null +++ b/tests/from_base64-04/README.md @@ -0,0 +1 @@ +from_base64 transform tests with default arguments diff --git a/tests/from_base64-04/test.rules b/tests/from_base64-04/test.rules new file mode 100644 index 000000000..84eef83b5 --- /dev/null +++ b/tests/from_base64-04/test.rules @@ -0,0 +1 @@ +alert smtp any any -> any any (msg:"Decode User value";frame:smtp.command_line; from_base64; content:"galunt"; sid:1;) diff --git a/tests/from_base64-04/test.yaml b/tests/from_base64-04/test.yaml new file mode 100644 index 000000000..bde3d8981 --- /dev/null +++ b/tests/from_base64-04/test.yaml @@ -0,0 +1,22 @@ +requires: + min-version: 8.0.1 + +pcap: ../smtp-long-DATA-line/input.pcap + +args: + - -k none + +checks: + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 1 + frame.payload: "WjJGc2RXNTANCg==" + + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 1 + frame.payload: "WjJGc2RXNTA=" -- 2.47.2