+pcap: ../../alert-max/alert-max-default/input.pcap
+
args:
- -k none
+pcap: ../flowbit-oring/input.pcap
+
requires:
features:
- HAVE_LIBJANSSON
+pcap: ../flowbit-oring/input.pcap
+
requires:
features:
- HAVE_LIBJANSSON
+pcap: ../app-layer-template/input.pcap
+
# *** Add configuration here ***
requires:
+pcap: ../base64-issue-5223/input.pcap
+
requires:
min-version: 6
+pcap: ../eve-metadata-01-alert/80000000-037-PTP_Example_IPv4_HTTP_Session-PUBLIC-tp-01-TEST1.pcap
+
requires:
features:
- HAVE_LIBJANSSON
+pcap: ../eve-metadata-01-alert/80000000-037-PTP_Example_IPv4_HTTP_Session-PUBLIC-tp-01-TEST1.pcap
+
requires:
features:
- HAVE_LIBJANSSON
+pcap: ../bug-1401-03/80000000-037-PTP_Example_IPv4_HTTP_Session-PUBLIC-tp-01.pcap
+
requires:
features:
- HAVE_LIBJANSSON
+pcap: ../bug-1450-05/tls_DER-incomplete-content.pcap
+
requires:
features:
- HAVE_LIBJANSSON
+pcap: ../bug-1450-04/tls_DER-incomplete-header.pcap
+
requires:
features:
- HAVE_LIBJANSSON
+pcap: ../bug-2558-02/2008.mp4.pcap
+
requires:
features:
- HAVE_LIBJANSSON
+pcap: ../bug-3616-ips/input.pcap
+
requires:
min-version: 6
+pcap: ../bug-4199-4/input.pcap
+
requires:
min-version: 6
+pcap: ../bug-4199-4/input.pcap
+
requires:
min-version: 6
+pcap: ../flowbit-oring/input.pcap
+
requires:
features:
- HAVE_LIBJANSSON
+pcap: ../bug-5066-iponly-cidr-ordering-01/test-limit.pcap
+
requirements:
min-version: 5
+pcap: ../bug-5066-iponly-cidr-ordering-01/test-limit.pcap
+
requirements:
min-version: 5
+pcap: ../bug-5066-iponly-cidr-ordering-01/test-limit.pcap
+
requirements:
min-version: 5
+pcap: ../bug-5066-iponly-cidr-ordering-01/test-limit.pcap
+
requirements:
min-version: 5
+pcap: ../eve-flow-vlan/input.pcap
+
requires:
lt-version: 7
features:
+pcap: ../eve-flow-vlan/input.pcap
+
requires:
min-version: 7
features:
args:
- --simulate-ips
-pcap: ../detect-app-layer-protocol-02/input.pcap
+pcap: ../flowbit-oring/input.pcap
checks:
- filter:
args:
- --simulate-ips
-pcap: ../detect-app-layer-protocol-02/input.pcap
+pcap: ../flowbit-oring/input.pcap
checks:
- filter:
-pcap: ../tls/tls-ja3s/input.pcap
+pcap: ../tls/tls-certs-alert/input.pcap
args:
- -k none
+pcap: ../bug-5929-02/http2_multiple_headers.pcap
+
requires:
min-version: 7
# Pcap
-Pcap comes from the test ``exception-policy-midstream-03`` and is the result of a
+Pcap comes from the test ``alert-testmyids-midstream5`` and is the result of a
curl to www.testmyids.com.
-pcap: ../../exception-policy-midstream-03/input.pcap
+pcap: ../../alert-testmyids-midstream5/input.pcap
args:
- --set stream.midstream=false
# Pcap
-Pcap comes from the test ``exception-policy-midstream-03`` and is the result of a
+Pcap comes from the test ``alert-testmyids-midstream5`` and is the result of a
curl to www.testmyids.com.
-pcap: ../../exception-policy-midstream-03/input.pcap
+pcap: ../../alert-testmyids-midstream5/input.pcap
exit-code: 1
# Pcap
-Pcap comes from the test ``exception-policy-midstream-03`` and is the result of a
+Pcap comes from the test ``alert-testmyids-midstream5`` and is the result of a
curl to www.testmyids.com.
-pcap: ../../exception-policy-midstream-03/input.pcap
+pcap: ../../alert-testmyids-midstream5/input.pcap
requires:
min-version: 7
# Pcap
-Pcap comes from the test ``exception-policy-midstream-03`` and is the result of a
+Pcap comes from the test ``alert-testmyids-midstream5`` and is the result of a
curl to www.testmyids.com.
-pcap: ../../exception-policy-midstream-03/input.pcap
+pcap: ../../alert-testmyids-midstream5/input.pcap
args:
- --set stream.midstream=false
# Pcap
-Pcap comes from the test ``exception-policy-midstream-03`` and is the result of a
+Pcap comes from the test ``alert-testmyids-midstream5`` and is the result of a
curl to www.testmyids.com.
-pcap: ../../exception-policy-midstream-03/input.pcap
+pcap: ../../alert-testmyids-midstream5/input.pcap
args:
- --set stream.midstream=false
# Pcap
-Pcap comes from the test ``exception-policy-midstream-03`` and is the result of a
+Pcap comes from the test ``alert-testmyids-midstream5`` and is the result of a
curl to www.testmyids.com.
-pcap: ../../exception-policy-midstream-03/input.pcap
+pcap: ../../alert-testmyids-midstream5/input.pcap
exit-code: 1
# Pcap
-Pcap comes from the test ``exception-policy-midstream-03`` and is the result of a
+Pcap comes from the test ``alert-testmyids-midstream5`` and is the result of a
curl to www.testmyids.com.
-pcap: ../../exception-policy-midstream-03/input.pcap
+pcap: ../../alert-testmyids-midstream5/input.pcap
exit-code: 1
# Pcap
-Pcap comes from the test ``exception-policy-midstream-03`` and is the result of a
+Pcap comes from the test ``alert-testmyids-midstream5`` and is the result of a
curl to www.testmyids.com.
-pcap: ../../exception-policy-midstream-03/input.pcap
+pcap: ../../alert-testmyids-midstream5/input.pcap
exit-code: 1
# Pcap
-Pcap comes from the test ``exception-policy-midstream-03`` and is the result of a
+Pcap comes from the test ``alert-testmyids-midstream5`` and is the result of a
curl to www.testmyids.com.
-pcap: ../../exception-policy-midstream-03/input.pcap
+pcap: ../../alert-testmyids-midstream5/input.pcap
exit-code: 1
# Pcap
-Pcap comes from the test ``exception-policy-midstream-03`` and is the result of a
+Pcap comes from the test ``alert-testmyids-midstream5`` and is the result of a
curl to www.testmyids.com.
-pcap: ../../exception-policy-midstream-03/input.pcap
+pcap: ../../alert-testmyids-midstream5/input.pcap
args:
- --set stream.midstream=true
# Pcap
-Pcap comes from the test ``exception-policy-midstream-03`` and is the result of a
+Pcap comes from the test ``alert-testmyids-midstream5`` and is the result of a
curl to www.testmyids.com.
-pcap: ../../exception-policy-midstream-03/input.pcap
+pcap: ../../alert-testmyids-midstream5/input.pcap
args:
- --set stream.midstream=true
# Pcap
-Pcap comes from the test ``exception-policy-midstream-03`` and is the result of a
+Pcap comes from the test ``alert-testmyids-midstream5`` and is the result of a
curl to www.testmyids.com.
-pcap: ../../exception-policy-midstream-03/input.pcap
+pcap: ../../alert-testmyids-midstream5/input.pcap
exit-code: 1
# Pcap
-Pcap comes from the test ``exception-policy-midstream-03`` and is the result of a
+Pcap comes from the test ``alert-testmyids-midstream5`` and is the result of a
curl to www.testmyids.com.
-pcap: ../../exception-policy-midstream-03/input.pcap
+pcap: ../../alert-testmyids-midstream5/input.pcap
exit-code: 1
# Pcap
-Pcap comes from the test ``exception-policy-midstream-03`` and is the result of a
+Pcap comes from the test ``alert-testmyids-midstream5`` and is the result of a
curl to www.testmyids.com.
-pcap: ../../exception-policy-midstream-03/input.pcap
+pcap: ../../alert-testmyids-midstream5/input.pcap
args:
- --simulate-ips
# Pcap
-Pcap comes from the test ``exception-policy-midstream-03`` and is the result of a
+Pcap comes from the test ``alert-testmyids-midstream5`` and is the result of a
curl to www.testmyids.com.
-pcap: ../../exception-policy-midstream-03/input.pcap
+pcap: ../../alert-testmyids-midstream5/input.pcap
args:
- --set stream.midstream=false
# Pcap
-Pcap comes from the test ``exception-policy-midstream-03`` and is the result of a
+Pcap comes from the test ``alert-testmyids-midstream5`` and is the result of a
curl to www.testmyids.com.
-pcap: ../../exception-policy-midstream-03/input.pcap
+pcap: ../../alert-testmyids-midstream5/input.pcap
exit-code: 1
# Pcap
-Pcap comes from the test ``exception-policy-midstream-03`` and is the result of a
+Pcap comes from the test ``alert-testmyids-midstream5`` and is the result of a
curl to www.testmyids.com.
-pcap: ../../exception-policy-midstream-03/input.pcap
+pcap: ../../alert-testmyids-midstream5/input.pcap
args:
- --simulate-ips
# Pcap
-Pcap comes from the test ``exception-policy-midstream-03`` and is the result of a
+Pcap comes from the test ``alert-testmyids-midstream5`` and is the result of a
curl to www.testmyids.com.
-pcap: ../../exception-policy-midstream-03/input.pcap
+pcap: ../../alert-testmyids-midstream5/input.pcap
args:
- --simulate-ips
# Pcap
-Pcap comes from the test ``exception-policy-midstream-03`` and is the result of a
+Pcap comes from the test ``alert-testmyids-midstream5`` and is the result of a
curl to www.testmyids.com.
-pcap: ../../exception-policy-midstream-03/input.pcap
+pcap: ../../alert-testmyids-midstream5/input.pcap
exit-code: 1
# Pcap
-Pcap comes from the test ``exception-policy-midstream-03`` and is the result of a
+Pcap comes from the test ``alert-testmyids-midstream5`` and is the result of a
curl to www.testmyids.com.
-pcap: ../../exception-policy-midstream-03/input.pcap
+pcap: ../../alert-testmyids-midstream5/input.pcap
args:
- --simulate-ips
# Pcap
-Pcap comes from the test ``exception-policy-midstream-03`` and is the result of a
+Pcap comes from the test ``alert-testmyids-midstream5`` and is the result of a
curl to www.testmyids.com.
-pcap: ../../exception-policy-midstream-03/input.pcap
+pcap: ../../alert-testmyids-midstream5/input.pcap
exit-code: 1
# Pcap
-Pcap comes from the test ``exception-policy-midstream-03`` and is the result of a
+Pcap comes from the test ``alert-testmyids-midstream5`` and is the result of a
curl to www.testmyids.com.
-pcap: ../../exception-policy-midstream-03/input.pcap
+pcap: ../../alert-testmyids-midstream5/input.pcap
exit-code: 1
# Pcap
-Pcap comes from the test ``exception-policy-midstream-03`` and is the result of a
+Pcap comes from the test ``alert-testmyids-midstream5`` and is the result of a
curl to www.testmyids.com.
-pcap: ../../exception-policy-midstream-03/input.pcap
+pcap: ../../alert-testmyids-midstream5/input.pcap
exit-code: 1
# Pcap
-Pcap comes from the test ``exception-policy-midstream-03`` and is the result of a
+Pcap comes from the test ``alert-testmyids-midstream5`` and is the result of a
curl to www.testmyids.com.
-pcap: ../../exception-policy-midstream-03/input.pcap
+pcap: ../../alert-testmyids-midstream5/input.pcap
args:
- --simulate-ips
# Pcap
-Pcap comes from the test ``exception-policy-midstream-03`` and is the result of a
+Pcap comes from the test ``alert-testmyids-midstream5`` and is the result of a
curl to www.testmyids.com.
-pcap: ../../exception-policy-midstream-03/input.pcap
+pcap: ../../alert-testmyids-midstream5/input.pcap
args:
- --simulate-ips
# Pcap
-Pcap comes from the test ``exception-policy-midstream-03`` and is the result of a
+Pcap comes from the test ``alert-testmyids-midstream5`` and is the result of a
curl to www.testmyids.com.
-pcap: ../../exception-policy-midstream-03/input.pcap
+pcap: ../../alert-testmyids-midstream5/input.pcap
exit-code: 1
# Pcap
-Pcap comes from the test ``exception-policy-midstream-03`` and is the result of a
+Pcap comes from the test ``alert-testmyids-midstream5`` and is the result of a
curl to www.testmyids.com.
-pcap: ../../exception-policy-midstream-03/input.pcap
+pcap: ../../alert-testmyids-midstream5/input.pcap
exit-code: 1
-pcap: ../exception-policy-midstream-03/input.pcap
+pcap: ../alert-testmyids-midstream5/input.pcap
args:
- --set stream.midstream=false
requires:
min-version: 7
-pcap: ../tls/tls-ja3s/input.pcap
+pcap: ../tls/tls-certs-alert/input.pcap
args:
- -k none
- DEBUG
min-version: 7
-pcap: ../tls/tls-ja3s/input.pcap
+pcap: ../tls/tls-certs-alert/input.pcap
args:
- -k none
+pcap: ../bug-78-uricontent/input.pcap
+
requires:
features:
- HAVE_LIBJANSSON
+pcap: ../dns-udp-z-flag-fp/suricatafpdnsdecoder.pcap
+
requires:
min-version: 6
+pcap: ../detect-pcrexform-01/input.pcap
+
requires:
min-version: 7
command: |
- ${SRCDIR}/src/suricata -v --set classification-file="${TEST_DIR}/classification.config" -l ${OUTPUT_DIR} -c ${SRCDIR}/suricata.yaml -S ${TEST_DIR}/test.rules -r ${TEST_DIR}/input.pcap
+ ${SRCDIR}/src/suricata -v --set classification-file="${TEST_DIR}/classification.config" -l ${OUTPUT_DIR} -c ${SRCDIR}/suricata.yaml -S ${TEST_DIR}/test.rules -r ../detect-pcrexform-01/input.pcap
checks:
+pcap: ../flowbit-oring/input.pcap
+
requires:
features:
- HAVE_LIBJANSSON
+pcap: ../content-incomplete-hex-t-version-6-init-errors-fatal/empty.pcap
+
requires:
min-version: 7
+pcap: ../datarep-01/input.pcap
+
requires:
features:
- HAVE_LIBJANSSON
+pcap: ../flowbit-oring/input.pcap
+
requires:
files:
- src/datasets.c
+pcap: ../flowbit-oring/input.pcap
+
requires:
features:
- HAVE_LIBJANSSON
+pcap: ../datasets-05-state/input.pcap
+
requires:
features:
- HAVE_LIBJANSSON
+pcap: ../datasets-05-state/input.pcap
+
requires:
features:
- HAVE_LIBJANSSON
+pcap: ../flowbit-oring/input.pcap
+
requires:
features:
- HAVE_LIBJANSSON
+pcap: ../flowbit-oring/input.pcap
+
requires:
features:
- HAVE_LIBJANSSON
+pcap: ../flowbit-oring/input.pcap
+
exit-code: 0
command: |
${SRCDIR}/src/suricata --set classification-file="${SRCDIR}/etc/classification.config" \
--set reference-config-file="${SRCDIR}/etc/reference.config" -l ${OUTPUT_DIR} \
--set threshold-file="${TEST_DIR}/threshold.config" \
- -c "${SRCDIR}/suricata.yaml" -r ${TEST_DIR}/input.pcap -S ${TEST_DIR}/test.rules
+ -c "${SRCDIR}/suricata.yaml" -r ../flowbit-oring/input.pcap -S ${TEST_DIR}/test.rules
checks:
- shell:
files:
- src/datasets.c
-pcap: ../datasets-02-load/input.pcap
+pcap: ../flowbit-oring/input.pcap
args:
- -k none
+pcap: ../../datasets/datasets-parent-path/one-packet.pcap
+
args:
- -vvv
+pcap: ../../datasets/datasets-parent-path/one-packet.pcap
+
exit-code: 1
checks:
+pcap: ../../datasets/datasets-parent-path/one-packet.pcap
+
exit-code: 1
checks:
+pcap: ../bug-5162/input.pcap
+
args:
- -k none
+pcap: ../../dcerpc/dcerpc-dce-iface-02/input.pcap
+
requires:
min-version: 6.0.0
+pcap: ../../dcerpc/dcerpc-dce-iface-02/input.pcap
+
requires:
features:
- HAVE_LIBJANSSON
+pcap: ../../dcerpc/dcerpc-dce-iface-02/input.pcap
+
requires:
features:
- HAVE_LIBJANSSON
+pcap: ../../dcerpc/dcerpc-dce-iface-02/input.pcap
+
requires:
features:
- HAVE_LIBJANSSON
+pcap: ../../dcerpc/dcerpc-dce-iface-02/input.pcap
+
requires:
features:
- HAVE_LIBJANSSON
+pcap: ../../dcerpc/dcerpc-dce-iface-02/input.pcap
+
requires:
features:
- HAVE_LIBJANSSON
+pcap: ../decode-erspan-typeI-02/input.pcap
+
requires:
min-version: 6.0.0
+pcap: ../decode-erspan-typeI-02/input.pcap
+
requires:
min-version: 5
+pcap: ../decode-vntag-03/input.pcap
+
requires:
min-version: 7
+pcap: ../decode-vntag-03/input.pcap
+
requires:
min-version: 6.0.3
+pcap: ../flowbit-oring/input.pcap
+
checks:
- filter:
count: 0
+pcap: ../flowbit-oring/input.pcap
+
requires:
min-version: 7
+pcap: ../detect-bytemath-01/input.pcap
+
requires:
min-version: 7
+pcap: ../detect-bytemath-01/input.pcap
+
requires:
files:
- src/detect-bytemath.c
+pcap: ../detect-bytemath-01/input.pcap
+
requires:
files:
- src/detect-bytemath.c
+pcap: ../detect-bytemath-01/input.pcap
+
requires:
files:
- src/detect-bytemath.c
+pcap: ../byte-extract-01/input.pcap
+
requires:
min-version: 6.0
+pcap: ../detect-bytetest-03/input.pcap
+
requires:
min-version: 7
args:
- --set stream.midstream=true
-pcap: ../detect-bytetest-04/input.pcap
+pcap: ../detect-bytetest-03/input.pcap
checks:
- shell:
+pcap: ../bug-3616-ips/input.pcap
+
requires:
min-version: 6
pcap: false
+pcap: ../bug-3616-ips/input.pcap
+
requires:
min-version: 6
+pcap: ../detect-content-ends-with-negated-01/input.pcap
+
requires:
gt-version: 6.0.11
+pcap: ../tcp-fastopen-01/tfo.pcap
+
args:
- -k none
+pcap: ../detect-filestore-config-04/test.pcap
+
requires:
min-version: 5.0.1
features:
+pcap: ../../detect-flowbits/input.pcap
+
args:
- -k none
+pcap: ../../detect-flowbits/input.pcap
+
args:
- -k none
+pcap: ../../detect-flowbits/input.pcap
+
args:
- -k none
+pcap: ../detect-itype-prefilter/icmpv4-ping.pcap
+
args:
- -k none
+pcap: ../detect-pcrexform-01/input.pcap
+
requires:
files:
+pcap: ../detect-pcrexform-01/input.pcap
+
requires:
lt-version: 7
+pcap: ../detect-pcrexform-01/input.pcap
+
requires:
files:
+pcap: ../detect-pcrexform-01/input.pcap
+
requires:
files:
+pcap: ../detect-pcrexform-01/input.pcap
+
requires:
files:
+pcap: ../bug-3616-ips/input.pcap
+
requires:
min-version: 6
+pcap: ../dhcp-eve-extended/input.pcap
+
requires:
lt-version: 6.0.0
features:
+pcap: ../dnp3-eve/input.pcap
+
requires:
features:
- HAVE_LIBJANSSON
+pcap: ../dnp3-eve/input.pcap
+
requires:
features:
- HAVE_LIBJANSSON
+pcap: ../dnp3-eve/input.pcap
+
requires:
features:
- HAVE_LIBJANSSON
+pcap: ../dns-eve/input.pcap
+
requires:
features:
- HAVE_LIBJANSSON
+pcap: ../dns-eve/input.pcap
+
requires:
lt-version: 6
features:
+pcap: ../cond-log-dns-dig/input.pcap
+
requires:
features:
- HAVE_LUA
+pcap: ../dns-single-request-v1/input.pcap
+
requires:
features:
- HAVE_LIBJANSSON
+pcap: ../dns-tcp-multirequest-buffer/dns-tcp-multirequest-buffer.pcap
+
requires:
features:
- HAVE_LIBJANSSON
+pcap: ../dns-tcp-www-google-com-v1/dns.pcap
+
requires:
features:
- HAVE_LIBJANSSON
+pcap: ../dns-udp-double-request-response-v1/dns-udp-double-request-response.pcap
+
requires:
features:
- HAVE_LIBJANSSON
+pcap: ../dns-udp-eve-log-query-only-v1/dns-udp-google.com-a-aaaa-mx.pcap
+
requires:
features:
- HAVE_LIBJANSSON
+pcap: ../dns-udp-eve-log-query-only-v1/dns-udp-google.com-a-aaaa-mx.pcap
+
requires:
features:
- HAVE_LIBJANSSON
+pcap: ../dns-udp-eve-log-query-only-v1/dns-udp-google.com-a-aaaa-mx.pcap
+
requires:
features:
- HAVE_LIBJANSSON
+pcap: ../dns-udp-eve-log-query-only-v1/dns-udp-google.com-a-aaaa-mx.pcap
+
requires:
features:
- HAVE_LIBJANSSON
+pcap: ../dns-udp-eve-log-query-only-v1/dns-udp-google.com-a-aaaa-mx.pcap
+
requires:
features:
- HAVE_LIBJANSSON
+pcap: ../dns-udp-eve-log-query-only-v1/dns-udp-google.com-a-aaaa-mx.pcap
+
requires:
features:
- HAVE_LIBJANSSON
+pcap: ../dns-udp-eve-log-query-only-v1/dns-udp-google.com-a-aaaa-mx.pcap
+
requires:
features:
- HAVE_LIBJANSSON
requires:
lt-version: 7
-pcap: ../dns-udp-eve-v2-dig/input.pcap
+pcap: ../cond-log-dns-dig//input.pcap
checks:
- filter:
+pcap: ../cond-log-dns-dig/input.pcap
+
checks:
- filter:
count: 2
+pcap: ../dns-eve-v2-udp-nxdomain-soa/dns-udp-nxdomain-soa.pcap
+
requires:
features:
- HAVE_LIBJANSSON
+pcap: ../dns-eve-v2-udp-nxdomain-soa/dns-udp-nxdomain-soa.pcap
+
requires:
features:
- HAVE_LIBJANSSON
+pcap: ../dns-udp-unsolicited-response-v1/dns-response-2x.pcap
+
checks:
- filter:
count: 1
+pcap: ../dcerpc/dcerpc-3109/input.pcap
+
args:
- --simulate-ips
- --set stream.midstream=true
+pcap: ../exception-policy-midstream-06/input-http-ACK.pcap
+
args:
- --simulate-ips
- --set stream.midstream=true
+pcap: ../smb3-01/input.pcap
+
args:
- --simulate-ips
- --set stream.midstream=true
+pcap: ../eve-metadata/testmyids.pcap
+
requires:
script:
+pcap: ../eve-metadata/testmyids.pcap
+
requires:
script:
+pcap: ../eve-metadata/testmyids.pcap
+
requires:
script:
+pcap: ../eve-metadata/testmyids.pcap
+
requires:
script:
+pcap: ../eve-metadata-01-alert/80000000-037-PTP_Example_IPv4_HTTP_Session-PUBLIC-tp-01-TEST1.pcap
+
requires:
features:
- HAVE_LIBJANSSON
+pcap: ../eve-metadata-01-alert/80000000-037-PTP_Example_IPv4_HTTP_Session-PUBLIC-tp-01-TEST1.pcap
+
requires:
features:
- HAVE_LIBJANSSON
+pcap: ../eve-metadata-01-alert/80000000-037-PTP_Example_IPv4_HTTP_Session-PUBLIC-tp-01-TEST1.pcap
+
requires:
features:
- HAVE_LIBJANSSON
- --runmode=single
- -k none
-pcap: ../smtp-file-data-02/input.pcap
+pcap: ../bug-3616-smtp/input.pcap
checks:
- filter:
- DEBUG
files:
- src/util-exception-policy.c
-pcap: ../tls/tls-ja3s/input.pcap
+pcap: ../tls/tls-certs-alert/input.pcap
args:
- --simulate-ips
- -k none
- DEBUG
files:
- src/util-exception-policy.c
-pcap: ../tls/tls-ja3s/input.pcap
+pcap: ../tls/tls-certs-alert/input.pcap
args:
- --simulate-ips
- -k none
-pcap: ../exception-policy-midstream-03/input.pcap
+pcap: ../alert-testmyids-midstream5/input.pcap
args:
- --set stream.midstream=true
+pcap: ../alert-testmyids-midstream5/input.pcap
+
args:
- --simulate-ips
- --set exception-policy=auto
+pcap: ../alert-testmyids-midstream5/input.pcap
+
checks:
- filter:
count: 1
+pcap: ../../alert-testmyids-midstream5/input.pcap
+
requires:
min-version: 7
+pcap: ../../alert-testmyids-midstream5/input.pcap
+
requires:
min-version: 7
+pcap: ../../alert-testmyids-midstream5/input.pcap
+
requires:
min-version: 7
+pcap: ../../alert-testmyids-midstream5/input.pcap
+
requires:
min-version: 7
+pcap: ../../alert-testmyids-midstream5/input.pcap
+
requires:
min-version: 7
+pcap: ../../alert-testmyids-midstream5/input.pcap
+
requires:
min-version: 7
+pcap: ../../alert-testmyids-midstream5/input.pcap
+
requires:
min-version: 7
+pcap: ../alert-testmyids-midstream5/input.pcap
+
args:
- --simulate-ips
- --set stream.midstream-policy=pass-flow
+pcap: ../tcp-async-01/input.pcap
+
args:
- --simulate-ips
- --set stream.async-oneside=true
+pcap: ../alert-testmyids-midstream5/input.pcap
+
args:
- --simulate-ips
- --set stream.midstream=true
+pcap: ../exception-policy-midstream-06/input-http-ACK.pcap
+
args:
- --simulate-ips
- --set stream.midstream-policy=pass-flow
+pcap: ../alert-testmyids-midstream5/input.pcap
+
args:
- --simulate-ips
- --set stream.midstream-policy=bypass
+pcap: ../smb3-01/input.pcap
+
args:
- --simulate-ips
- --set stream.midstream-policy=bypass
+pcap: ../exception-policy-midstream-06/input-http-ACK.pcap
+
args:
- --simulate-ips
- --set stream.midstream-policy=reject
- DEBUG
files:
- src/util-exception-policy.c
-pcap: ../tls/tls-ja3s/input.pcap
+pcap: ../tls/tls-certs-alert/input.pcap
args:
- --simulate-ips
- -k none
- DEBUG
files:
- src/util-exception-policy.c
-pcap: ../tls/tls-ja3s/input.pcap
+pcap: ../tls/tls-certs-alert/input.pcap
args:
- --simulate-ips
- -k none
- DEBUG
files:
- src/util-exception-policy.c
-pcap: ../tls/tls-ja3s/input.pcap
+pcap: ../tls/tls-certs-alert/input.pcap
args:
- --simulate-ips
- -k none
- DEBUG
files:
- src/util-exception-policy.c
-pcap: ../tls/tls-ja3s/input.pcap
+pcap: ../tls/tls-certs-alert/input.pcap
args:
- --simulate-ips
- -k none
- DEBUG
files:
- src/util-exception-policy.c
-pcap: ../tls/tls-ja3s/input.pcap
+pcap: ../tls/tls-certs-alert/input.pcap
args:
- --simulate-ips
- -k none
- DEBUG
files:
- src/util-exception-policy.c
-pcap: ../tls/tls-ja3s/input.pcap
+pcap: ../tls/tls-certs-alert/input.pcap
args:
- --simulate-ips
- -k none
- DEBUG
files:
- src/util-exception-policy.c
-pcap: ../tls/tls-ja3s/input.pcap
+pcap: ../tls/tls-certs-alert/input.pcap
args:
- --simulate-ips
- -k none
- DEBUG
files:
- src/util-exception-policy.c
-pcap: ../tls/tls-ja3s/input.pcap
+pcap: ../tls/tls-certs-alert/input.pcap
args:
- --simulate-ips
- -k none
- DEBUG
files:
- src/util-exception-policy.c
-pcap: ../tls/tls-ja3s/input.pcap
+pcap: ../tls/tls-certs-alert/input.pcap
args:
- --simulate-ips
- -k none
- DEBUG
files:
- src/util-exception-policy.c
-pcap: ../tls/tls-ja3s/input.pcap
+pcap: ../tls/tls-certs-alert/input.pcap
args:
- --simulate-ips
- -k none
+pcap: ../smb-eicar-file/input.pcap
+
# disables checksum verification
args:
- -k none
+pcap: ../bug-5066-iponly-cidr-ordering-01/test-limit.pcap
+
requirements:
min-version: 6
+pcap: ../content-incomplete-hex-t-version-6-init-errors-fatal/empty.pcap
+
requires:
lt-version: 7
+pcap: ../content-incomplete-hex-t-version-6-init-errors-fatal/empty.pcap
+
requires:
lt-version: 7
+pcap: ../content-incomplete-hex-t-version-6-init-errors-fatal/empty.pcap
+
requires:
lt-version: 7
- HAVE_LIBJANSSON
- GeoIP2
-pcap: ../alert-testmyids/input.pcap
+pcap: ../flowbit-oring/input.pcap
checks:
+pcap: ../bug-3616-urldecode/input.pcap
+
requires:
features:
- HAVE_LIBJANSSON
+pcap: ../http-gap-simple/input.pcap
+
requires:
features:
- HAVE_LIBJANSSON
+pcap: ../http-gap-simple/input.pcap
+
requires:
features:
- HAVE_LIBJANSSON
+pcap: ../detect-pcrexform-01/input.pcap
+
requires:
features:
- HAVE_LIBJANSSON
+pcap: ../bug-4663/input.pcap
+
requires:
features:
- HAVE_LIBJANSSON
+pcap: ../http-xff-eve-reverse-overwrite/test.pcap
+
args:
- -k none
+pcap: ../http-xff-eve-reverse-overwrite/test.pcap
+
args:
- -k none
+pcap: ../http-xff-eve-reverse-overwrite/test.pcap
+
args:
- -k none
+pcap: ../http2-keywords/input.pcap
+
requires:
features:
- HAVE_LIBJANSSON
+pcap: ../http2-keywords2/input.pcap
+
requires:
features:
- HAVE_LIBJANSSON
+pcap: ../http2-keywords/input.pcap
+
requires:
features:
- HAVE_NSS
+pcap: ../http2-keywords/input.pcap
+
requires:
features:
- HAVE_NSS
requires:
min-version: 7
-pcap: ../http2-basic/input.pcap
+pcap: ../http2-keywords/input.pcap
# disables checksum verification
args:
+pcap: ../http2-keywords2/input.pcap
+
requires:
features:
- HAVE_LIBJANSSON
+pcap: ../bug-2190/input.pcap
+
requires:
min-version: 6
+pcap: ../ikev1-rules/ikev1-isakmp-main-mode.pcap
+
requires:
features:
- HAVE_NSS
+pcap: ../ikev1-rules/ikev1-isakmp-main-mode.pcap
+
requires:
features:
- HAVE_LIBJANSSON
command: |
${SRCDIR}/src/suricata -l ${OUTPUT_DIR} \
-c ${TEST_DIR}/suricata.yaml \
- -r ${TEST_DIR}/input.pcap -S ${TEST_DIR}/iprep.rules \
+ -r ../issue-4280-iprep/input.pcap -S ${TEST_DIR}/iprep.rules \
--data-dir="${OUTPUT_DIR}" \
--set default-reputation-path=${TEST_DIR} \
--set reputation-categories-file=${TEST_DIR}/scirius-categories.txt \
+pcap: ../../issues/issue-4759.1/tcpdns.pcap
+
checks:
- filter:
count: 2
+pcap: ../flowbit-oring/input.pcap
+
requires:
min-version: 7
+pcap: ../flowbit-oring/input.pcap
+
requires:
min-version: 7
features:
+pcap: ../bug-3616-smtp/input.pcap
+
requires:
features:
- HAVE_LUA
+pcap: ../lua-output-http/input.pcap
+
requires:
features:
- HAVE_LUA
+pcap: ../lua-output-http/input.pcap
+
requires:
features:
- HAVE_LUA
+pcap: ../lua-output-http/input.pcap
+
requires:
features:
- HAVE_LUA
+pcap: ../flowbit-oring/input.pcap
+
requires:
features:
- HAVE_LUA
+pcap: ../mac-eve-multiple-disabled/multi_mac.pcap
+
requires:
min-version: 6.0.0
files:
+pcap: ../mac-eve-single-disabled/test.pcap
+
requires:
min-version: 6.0.0
files:
+pcap: ../mqtt-pub-rules/mqtt5_pub_jpeg.pcap
+
requires:
features:
- HAVE_LIBJANSSON
+pcap: ../mqtt-limit-2/input.pcap
+
requires:
features:
- HAVE_LIBJANSSON
+pcap: ../mqtt-limit-2/input.pcap
+
requires:
features:
- HAVE_LIBJANSSON
+pcap: ../mqtt5-sub-userpass/input.pcap
+
requires:
features:
- HAVE_LIBJANSSON
+pcap: ../mqtt5-unsub-userpass/input.pcap
+
requires:
features:
- HAVE_LIBJANSSON
+pcap: ../eve-metadata/testmyids.pcap
+
checks:
- filter:
count: 1
${SRCDIR}/src/suricata --set classification-file="${SRCDIR}/etc/classification.config" \
--set reference-config-file="${SRCDIR}/etc/reference.config" -l ${OUTPUT_DIR} \
--set threshold-file="${TEST_DIR}/threshold.config" \
- -c "${SRCDIR}/suricata.yaml" -r ${TEST_DIR}/input.pcap -S ${TEST_DIR}/test.rules
+ -c "${SRCDIR}/suricata.yaml" -r ../detect-itype-prefilter/icmpv4-ping.pcap -S ${TEST_DIR}/test.rules
checks:
- shell:
+pcap: ../detect-itype-prefilter/icmpv4-ping.pcap
+
requires:
version: 5
+pcap: ../output-eve-anomaly-packethdr/anomaly.pcap
+
requires:
features:
- HAVE_LIBJANSSON
+pcap: ../output-eve-anomaly-02/input.pcap
+
requires:
features:
- HAVE_LIBJANSSON
+pcap: ../output-eve-anomaly-02/input.pcap
+
requires:
lt-version: 7
+pcap: ../output-eve-anomaly-02/input.pcap
+
requires:
min-version: 7
+pcap: ../output-eve-anomaly-02/input.pcap
+
requires:
min-version: 6
+pcap: ../dhcp-eve-extended/input.pcap
+
requires:
features:
- RUST
+pcap: ../bug-3519/input.pcap
+
requires:
features:
- HAVE_LIBJANSSON
+pcap: ../rdp-protocol/RDP-003.pcap
+
requires:
features:
- HAVE_LIBJANSSON
+pcap: ../lua-output-http/input.pcap
+
requires:
min-version: 7
+pcap: ../lua-output-http/input.pcap
+
checks:
- shell:
args: test ! -e log.pcap.0
+pcap: ../lua-output-http/input.pcap
+
checks:
- file-compare:
filename: tcp-data.log
mkdir pcap-log
chmod 555 pcap-log
-pcap: ../alert-testmyids/input.pcap
+pcap: ../flowbit-oring/input.pcap
checks:
- filter:
+pcap: ../detect-dotprefix-01/input.pcap
+
requires:
min-version: 6
+pcap: ../output-eve-anomaly-02/input.pcap
+
requires:
features:
- HAVE_LIBJANSSON
min-version: 7
command: |
- ${SRCDIR}/src/suricata -v --set reference-config-file="${TEST_DIR}/reference.config" -l ${OUTPUT_DIR} -c ${SRCDIR}/suricata.yaml -S ${TEST_DIR}/test.rules -r ${TEST_DIR}/input.pcap
+ ${SRCDIR}/src/suricata -v --set reference-config-file="${TEST_DIR}/reference.config" -l ${OUTPUT_DIR} -c ${SRCDIR}/suricata.yaml -S ${TEST_DIR}/test.rules -r ../detect-pcrexform-01/input.pcap
checks:
+pcap: ../rfb-rules/00-vnc-openwall-3.7.pcap
+
requires:
features:
- HAVE_LIBJANSSON
+pcap: ../smb-dce_iface/input.pcap
+
requires:
min-version: 6
+pcap: ../smb-eicar-file/input.pcap
+
requires:
min-version: 7
+pcap: ../smb-named-pipe-ascii/input.pcap
+
requires:
min-version: 7
+pcap: ../output-eve-smb-01/input.pcap
+
requires:
features:
- HAVE_LIBJANSSON
+pcap: ../smb2-03-rule/smb2.pcap
+
requires:
features:
- HAVE_LIBJANSSON
+pcap: ../smb2-07/20171220_smb_psexec_add_user.pcap
+
requires:
min-version: 7
+pcap: ../smb2-03-rule/smb2.pcap
+
requires:
features:
- HAVE_LIBJANSSON
+pcap: ../bug-3616-smtp/input.pcap
+
requires:
features:
- HAVE_LIBJANSSON
+pcap: ../bug-3616-smtp/input.pcap
+
requires:
min-version: 6
+pcap: ../bug-3616-smtp/input.pcap
+
requires:
features:
- HAVE_LIBJANSSON
+pcap: ../smtp-extract-url-schemes/input.pcap
+
checks:
- filter:
count: 1
+pcap: ../bug-3616-smtp/input.pcap
+
requires:
features:
- HAVE_LIBJANSSON
+pcap: ../smb2-03-rule/smb2.pcap
+
requires:
min-version: 7
+pcap: ../smb-eicar-file/input.pcap
+
# disables checksum verification
args:
- -k none
+pcap: ../tcp-fastopen-01/tfo.pcap
+
requires:
features:
- HAVE_LIBJANSSON
+pcap: ../tcp-fastopen-05/tfo.pcap
+
requires:
features:
- HAVE_LIBJANSSON
+pcap: ../test-bsize-values-2/input.pcap
+
args:
- -k none
+pcap: ../detect-dotprefix-01/input.pcap
+
requires:
min-version: 8 # TODO
+pcap: ../output-eve-tftp-01/input.pcap
+
requires:
features:
- HAVE_LIBJANSSON
+pcap: ../http-all-headers/input.pcap
+
requires:
min-version: 7
min-version: 7
command: |
- ${SRCDIR}/src/suricata -v --set threshold-file="${TEST_DIR}/threshold.config" -l ${OUTPUT_DIR} -c ${SRCDIR}/suricata.yaml -S ${TEST_DIR}/test.rules -r ${TEST_DIR}/input.pcap
+ ${SRCDIR}/src/suricata -v --set threshold-file="${TEST_DIR}/threshold.config" -l ${OUTPUT_DIR} -c ${SRCDIR}/suricata.yaml -S ${TEST_DIR}/test.rules -r ../detect-pcrexform-01/input.pcap
checks:
+pcap: ../../http-all-headers/input.pcap
+
requires:
min-version: 7
+pcap: ../../http-all-headers/input.pcap
+
requires:
min-version: 7
+pcap: ../../http-all-headers/input.pcap
+
requires:
min-version: 7
+pcap: ../../http-all-headers/input.pcap
+
requires:
min-version: 7
+pcap: ../../http-all-headers/input.pcap
+
requires:
min-version: 7
+pcap: ../../http-all-headers/input.pcap
+
requires:
min-version: 7
+pcap: ../../http-all-headers/input.pcap
+
requires:
min-version: 7
+pcap: ../../http-all-headers/input.pcap
+
requires:
min-version: 7
+pcap: ../../http-all-headers/input.pcap
+
requires:
min-version: 7
+pcap: ../../http-all-headers/input.pcap
+
requires:
min-version: 7
+pcap: ../../http-all-headers/input.pcap
+
requires:
min-version: 7
+pcap: ../../http-all-headers/input.pcap
+
requires:
min-version: 7
+pcap: ../../http-all-headers/input.pcap
+
requires:
min-version: 7
+pcap: ../../http-all-headers/input.pcap
+
requires:
min-version: 7
+pcap: ../../http-all-headers/input.pcap
+
requires:
min-version: 7
+pcap: ../../http-all-headers/input.pcap
+
requires:
min-version: 7
+pcap: ../../http-all-headers/input.pcap
+
requires:
min-version: 7
+pcap: ../../http-all-headers/input.pcap
+
requires:
min-version: 7
+pcap: ../../http-all-headers/input.pcap
+
requires:
min-version: 7
+pcap: ../../http-all-headers/input.pcap
+
requires:
min-version: 7
+pcap: ../../http-all-headers/input.pcap
+
requires:
min-version: 7
+pcap: ../../http-all-headers/input.pcap
+
requires:
min-version: 7
+pcap: ../../http-all-headers/input.pcap
+
requires:
min-version: 7
+pcap: ../../http-all-headers/input.pcap
+
requires:
min-version: 7
+pcap: ../../http-all-headers/input.pcap
+
requires:
min-version: 7
+pcap: ../../tls/tls-certs-alert/input.pcap
+
requires:
min-version: 5.0.0
features:
+pcap: ../../tls/tls-fingerprint-alert/input.pcap
+
requires:
features:
- HAVE_LIBJANSSON
+pcap: ../../tls/tls-fingerprint-alert/input.pcap
+
requires:
features:
- HAVE_LIBJANSSON
+pcap: ../../tls/tls13-draft28/tls13_draft28.pcap
+
requires:
min-version: 7
+pcap: ../../udp-5379/udp-hlen-invalid-strict/input.pcap
+
exit-code: 0
command: |
${SRCDIR}/src/suricata --set classification-file="${SRCDIR}/etc/classification.config" \
--set reference-config-file="${SRCDIR}/etc/reference.config" -l ${OUTPUT_DIR} \
--set threshold-file="${TEST_DIR}/threshold.config" \
- -c "${SRCDIR}/suricata.yaml" -r ${TEST_DIR}/input.pcap -S ${TEST_DIR}/test.rules
+ -c "${SRCDIR}/suricata.yaml" -r ../../udp-5379/udp-hlen-invalid-strict/input.pcap -S ${TEST_DIR}/test.rules
checks:
- shell:
+pcap: ../../util-action-tests/util-action-13/input.pcap
+
args:
- -k none
- --simulate-ips
+pcap: ../../util-action-tests/util-action-13/input.pcap
+
args:
- -k none
- --simulate-ips
+pcap: ../../util-action-tests/util-action-10/input.pcap
+
args:
- -k none
- --simulate-ips
+pcap: ../../util-action-tests/util-action-10/input.pcap
+
args:
- -k none
- --simulate-ips
+pcap: ../../util-action-tests/util-action-13/input.pcap
+
args:
- -k none
- --simulate-ips
+pcap: ../../util-action-tests/util-action-13/input.pcap
+
args:
- -k none
- --simulate-ips
+pcap: ../../util-action-tests/util-action-13/input.pcap
+
args:
- -k none
- --simulate-ips
+pcap: ../../util-action-tests/util-action-13/input.pcap
+
args:
- -k none
- --simulate-ips
projects / thirdparty / suricata-verify.git / commitdiff
