detect: add tests for file.data

with HTTP1 multipart and multiple files

Ticket: 7577

diff --git a/tests/file-match-crossed/README.md b/tests/file-match-crossed/README.md
new file mode 100644 (file)
index 0000000..0fb88f7
--- /dev/null
+++ b/tests/file-match-crossed/README.md
@@ -0,0 +1,7 @@
+# Description
+
+Test `file.data` with HTTP1 multipart small files
+
+Cf https://redmine.openinfosecfoundation.org/issues/7577
+
+Pcap crafted

diff --git a/tests/file-match-crossed/http-multipart-post.pcap b/tests/file-match-crossed/http-multipart-post.pcap
new file mode 100644 (file)
index 0000000..755001e
Binary files /dev/null and b/tests/file-match-crossed/http-multipart-post.pcap differ

diff --git a/tests/file-match-crossed/test.rules b/tests/file-match-crossed/test.rules
new file mode 100644 (file)
index 0000000..bf09ea3
--- /dev/null
+++ b/tests/file-match-crossed/test.rules
@@ -0,0 +1,13 @@
+# matching ones
+alert http any any -> any any (msg:"test"; file.data; content:"bateau"; file.name; content:"titi.txt"; sid:1;)
+alert http any any -> any any (msg:"test"; file.data; content:"bateau"; file.name; content:"toto.txt"; sid:2;)
+alert http any any -> any any (msg:"test"; file.data; content:"Titi"; sid:3;)
+alert http any any -> any any (msg:"test"; file.data; content:"minet"; sid:4;)
+alert http any any -> any any (msg:"test"; file.data; content:"Titi"; file.data; content:"minet"; sid:5;)
+alert http any any -> any any (msg:"test"; file.data; content:"minet"; fast_pattern; sid:6;)
+
+# matching as different file.data have each content
+alert http any any -> any any (msg:"test"; file.data; content:"bateau"; file.data; content:"minet"; sid:7;)
+# not matching as not the same file.data has both contents
+alert http any any -> any any (msg:"test"; file.data; content:"bateau"; content:"minet"; sid:8;)
+

diff --git a/tests/file-match-crossed/test.yaml b/tests/file-match-crossed/test.yaml
new file mode 100644 (file)
index 0000000..95d4dfe
--- /dev/null
+++ b/tests/file-match-crossed/test.yaml
@@ -0,0 +1,47 @@
+requires:
+  min-version: 8
+
+args:
+  - -k none
+
+checks:
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 1
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 2
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 3
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 4
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 5
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 6
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 7
+  - filter:
+      count: 0
+      match:
+        event_type: alert
+        alert.signature_id: 8

diff --git a/tests/file-match-crossed/titi.txt b/tests/file-match-crossed/titi.txt
new file mode 100644 (file)
index 0000000..bc8b119
--- /dev/null
+++ b/tests/file-match-crossed/titi.txt
@@ -0,0 +1 @@
+Titi a vu un gros minet.

diff --git a/tests/file-match-crossed/toto.txt b/tests/file-match-crossed/toto.txt
new file mode 100644 (file)
index 0000000..a10ca64
--- /dev/null
+++ b/tests/file-match-crossed/toto.txt
@@ -0,0 +1 @@
+toto est dans un bateau