Run the setup and check phases relative to the output directory.
def run(self):
stats = None
- with open(os.path.join("output", "eve.json"), "r") as fileobj:
+ with open("eve.json", "r") as fileobj:
for line in fileobj:
event = json.loads(line)
if event["event_type"] == "stats":
self.config = config
def run(self):
- eve_json_path = os.path.join("output", "eve.json")
+ eve_json_path = "eve.json"
if not os.path.exists(eve_json_path):
raise TestError("%s does not exist" % (eve_json_path))
subprocess.check_call(
"%s" % setup[command],
shell=True,
- cwd=self.directory)
+ cwd=os.path.join(self.directory, "output"))
def check_skip(self):
if not "skip" in self.config:
def check(self):
pdir = os.getcwd()
- os.chdir(self.directory)
+ os.chdir(os.path.join(self.directory, "output"))
try:
if "checks" in self.config:
for check in self.config["checks"]:
finally:
os.chdir(pdir)
- if not os.path.exists(os.path.join(self.directory, "check.sh")):
+ # Old style check script.
+ pdir = os.getcwd()
+ os.chdir(os.path.join(self.directory, "output"))
+ try:
+ if not os.path.exists(os.path.join(self.directory, "check.sh")):
+ return True
+ env = {
+ # The suricata source directory.
+ "SRCDIR": self.cwd,
+ "TZ": "UTC",
+ "TEST_DIR": self.directory,
+ "TOPDIR": TOPDIR,
+ "ASAN_OPTIONS": "detect_leaks=0",
+ }
+ r = subprocess.call(
+ [os.path.join(self.directory, "check.sh")], env=env)
+ if r != 0:
+ print("FAILED: verification failed")
+ return False
return True
- r = subprocess.call(["./check.sh"], cwd=self.directory)
- if r != 0:
- print("FAILED: verification failed")
- return False
- return True
-
+ finally:
+ os.chdir(pdir)
+
def default_args(self):
args = [
os.path.join(self.cwd, "src/suricata"),
return True
def main():
+ global TOPDIR
if not check_deps():
return 1
parser.add_argument("patterns", nargs="*", default=[])
args = parser.parse_args()
- topdir = os.path.abspath(os.path.dirname(sys.argv[0]))
-
+ TOPDIR = os.path.abspath(os.path.dirname(sys.argv[0]))
+
skipped = 0
passed = 0
failed = 0
# Create a SuricataConfig object that is passed to all tests.
suricata_config = SuricataConfig(get_suricata_version())
- tdir = os.path.join(topdir, "tests")
+ tdir = os.path.join(TOPDIR, "tests")
if args.dir:
tdir = os.path.abspath(args.dir)
tests = []
for dirpath, dirnames, filenames in os.walk(tdir):
# The top directory is not a test...
- if dirpath == os.path.join(topdir, "tests"):
+ if dirpath == os.path.join(TOPDIR, "tests"):
continue
if dirpath == tdir:
continue
checks:
- shell:
- args: cat output/fast.log | wc -l | xargs
+ args: cat fast.log | wc -l | xargs
expect: 1
- filter:
# Check how many lines were logged to fast.log.
- shell:
- args: cat output/fast.log | wc -l | xargs
+ args: cat fast.log | wc -l | xargs
expect: 1
#! /bin/sh
-. ../../util/functions.sh
+. ${TOPDIR}/util/functions.sh
# Should have 4 DNP3 data match alerts.
-n=$(grep "DNP3 Data match" output/eve.json | wc -l | xargs)
+n=$(grep "DNP3 Data match" eve.json | wc -l | xargs)
assert_eq 4 "$n" "bad event count"
exit 0
#! /bin/sh
-. ../../util/functions.sh
+. ${TOPDIR}/util/functions.sh
# Should have one alert sid 1.
-n=$(jq_count output/eve.json 'select(.alert.signature_id == 1)')
+n=$(jq_count eve.json 'select(.alert.signature_id == 1)')
assert_eq 1 "$n" "sig id 1"
# Should have one alert sid 2.
-n=$(jq_count output/eve.json 'select(.alert.signature_id == 2)')
+n=$(jq_count eve.json 'select(.alert.signature_id == 2)')
assert_eq 1 "$n" "sig id 1"
exit 0
#! /bin/sh
-. ../../util/functions.sh
+. ${TOPDIR}/util/functions.sh
-n=$(jq_count output/eve.json 'select(.event_type == "dnp3")')
+n=$(jq_count eve.json 'select(.event_type == "dnp3")')
assert_eq 55 "$n" "bad dnp3 event count"
exit 0
#! /bin/sh
# Expect 9 dns records.
-n=$(cat output/dns.json | jq -c 'select(.event_type == "dns")' | wc -l | xargs)
+n=$(cat dns.json | jq -c 'select(.event_type == "dns")' | wc -l | xargs)
if test $n -ne 9; then
echo "failed: expected 9 dns events, got $n"
exit 1
fi
# 4 are queries.
-n=$(cat output/dns.json | jq -c 'select(.event_type == "dns") | select(.dns.type == "query")' | wc -l | xargs)
+n=$(cat dns.json | jq -c 'select(.event_type == "dns") | select(.dns.type == "query")' | wc -l | xargs)
if test $n -ne 4; then
echo "failed: expected 4 dns queries, got $n"
exit 1
fi
# 4 are queries.
-n=$(cat output/dns.json | jq -c 'select(.event_type == "dns") | select(.dns.type == "answer")' | wc -l | xargs)
+n=$(cat dns.json | jq -c 'select(.event_type == "dns") | select(.dns.type == "answer")' | wc -l | xargs)
if test $n -ne 5; then
echo "failed: expected 5 dns answers, got $n"
exit 1
#! /bin/sh
-count=$(cat output/eve.json | jq -c 'select(.dns.type=="query")' | wc -l | xargs)
+count=$(cat eve.json | jq -c 'select(.dns.type=="query")' | wc -l | xargs)
if [ "${count}" -ne 20 ]; then
echo "error: expected 20 queries, got ${count}"
exit 1
fi
-count=$(cat output/eve.json | jq -c 'select(.dns.type=="answer")' | wc -l | xargs)
+count=$(cat eve.json | jq -c 'select(.dns.type=="answer")' | wc -l | xargs)
if [ "${count}" -ne 40 ]; then
echo "error: expected 40 answers, got ${count}"
exit 1
#! /bin/sh
-. ../../util/functions.sh
+. ${TOPDIR}/util/functions.sh
# As a request was missing, we should have 2 requests, but 26
# responses, as each request resulted in 12 responses.
-log=./output/eve.json
+log=./eve.json
n=$(cat ${log} | \
jq -c 'select(.event_type == "dns") | select(.dns.type == "query")' | \
#! /bin/sh
-. ../../util/functions.sh
+. ${TOPDIR}/util/functions.sh
# One DNS request.
-n=$(jq_count output/eve.json 'select(.event_type == "dns") | select(.dns.type == "query")')
+n=$(jq_count eve.json 'select(.event_type == "dns") | select(.dns.type == "query")')
assert_eq 1 $n "dns requests"
# 12 DNS responses.
-n=$(jq_count output/eve.json 'select(.event_type == "dns") | select(.dns.type == "answer")')
+n=$(jq_count eve.json 'select(.event_type == "dns") | select(.dns.type == "answer")')
assert_eq 12 $n "dns responses"
#! /bin/sh
-n=$(grep Query output/dns.log | wc -l | xargs)
+n=$(grep Query dns.log | wc -l | xargs)
if [ "$n" -ne 4 ]; then
echo "expected 4 queries, found $n"
exit 1
fi
-n=$(grep Response output/dns.log | wc -l | xargs)
+n=$(grep Response dns.log | wc -l | xargs)
if [ "$n" -ne 4 ]; then
echo "expected 4 responses, found $n"
exit 1
#! /bin/sh
# Check queries.
-c=$(cat output/eve.json | jq -c 'select(.dns.type == "query")' | wc -l | xargs)
+c=$(cat eve.json | jq -c 'select(.dns.type == "query")' | wc -l | xargs)
if [ "${c}" -ne 2 ]; then
echo "error: expected 2 DNS queries, got ${c}"
exit 1
fi
# Check answer count.
-c=$(cat output/eve.json | jq -c 'select(.dns.type == "answer")' | wc -l | xargs)
+c=$(cat eve.json | jq -c 'select(.dns.type == "answer")' | wc -l | xargs)
if [ "${c}" -ne 9 ]; then
echo "error: expected 9 DNS answers, got ${c}"
exit 1
#! /bin/sh
-. ../../util/functions.sh
+. ${TOPDIR}/util/functions.sh
-n=$(jq_count output/eve.json 'select(.dns.rrtype == "AAAA")')
+n=$(jq_count eve.json 'select(.dns.rrtype == "AAAA")')
assert_eq 2 $n "expected 2 aaaa records"
-n=$(jq_count output/eve.json 'select(.dns.rrtype != "AAAA")')
+n=$(jq_count eve.json 'select(.dns.rrtype != "AAAA")')
assert_eq 0 $n "expected 0 non-aaaa records"
exit 0
#! /bin/sh
-. ../../util/functions.sh
+. ${TOPDIR}/util/functions.sh
# Should be no answers.
-n=$(jq_count output/eve.json 'select(.event_type == "dns") | select(.dns.type != "answer")')
+n=$(jq_count eve.json 'select(.event_type == "dns") | select(.dns.type != "answer")')
assert_eq 0 $n "only answers expected"
exit 0
#! /bin/sh
-. ../../util/functions.sh
+. ${TOPDIR}/util/functions.sh
-n=$(jq_count output/eve.json 'select(.dns.rrtype != "MX")')
+n=$(jq_count eve.json 'select(.dns.rrtype != "MX")')
assert_eq 0 $n "only expected mx records"
exit 0
#! /bin/sh
-. ../../util/functions.sh
+. ${TOPDIR}/util/functions.sh
# Should be no answers.
-n=$(jq_count output/eve.json 'select(.event_type == "dns") | select(.dns.type != "query")')
+n=$(jq_count eve.json 'select(.event_type == "dns") | select(.dns.type != "query")')
assert_eq 0 $n "only queries expected"
exit 0
set -e
-txt=$(cat output/eve.json | \
+txt=$(cat eve.json | \
jq -c 'select(.dns.type == "answer") | select(.dns.rrtype == "TXT") | .dns.rdata')
test "${txt}" = '"v=spf1 include:_spf.google.com ~all"'
#! /bin/sh
-. ../../util/functions.sh
+. ${TOPDIR}/util/functions.sh
# Look for 2 responses with rcode == "NXDOMAIN".
-n=$(jq_count output/eve.json 'select(.dns.rcode == "NXDOMAIN")')
+n=$(jq_count eve.json 'select(.dns.rcode == "NXDOMAIN")')
assert_eq 2 "$n" "nxdomain responses"
exit 0
#! /bin/sh
# Check for 1 DNS request.
-n=$(cat output/eve.json | jq -c 'select(.dns.type == "query")' | wc -l | xargs)
+n=$(cat eve.json | jq -c 'select(.dns.type == "query")' | wc -l | xargs)
if [ ${n} -ne 1 ]; then
exit 1
fi
# Check for 1 DNS response.
-n=$(cat output/eve.json | jq -c 'select(.dns.type == "answer")' | wc -l | xargs)
+n=$(cat eve.json | jq -c 'select(.dns.type == "answer")' | wc -l | xargs)
if [ ${n} -ne 2 ]; then
exit 1
fi
# Check for one alert.
-n=$(cat output/eve.json | jq -c 'select(.event_type == "alert")' | wc -l | xargs)
+n=$(cat eve.json | jq -c 'select(.event_type == "alert")' | wc -l | xargs)
if [ ${n} -ne 1 ]; then
exit 1
fi
#! /bin/sh
-. ../../util/functions.sh
+. ${TOPDIR}/util/functions.sh
# Check that there are no events.
-n=$(cat output/fast.log | wc -l | xargs)
+n=$(cat fast.log | wc -l | xargs)
assert_eq 0 "$n" "no events expected"
#! /bin/sh
-. ../../util/functions.sh
+. ${TOPDIR}/util/functions.sh
# 4 queries.
-n=$(jq_count output/eve.json 'select(.dns.type == "query")')
+n=$(jq_count eve.json 'select(.dns.type == "query")')
assert_eq 4 "$n" "queries"
# 5 answers.
-n=$(jq_count output/eve.json 'select(.dns.type == "answer")')
+n=$(jq_count eve.json 'select(.dns.type == "answer")')
assert_eq 5 "$n" "answers"
checks:
- shell:
- args: test -e output/filestore/48/48d179a2f8d17331446c7a75a082851eee9ad841705ed5fbce730f51a0598d62
+ args: test -e filestore/48/48d179a2f8d17331446c7a75a082851eee9ad841705ed5fbce730f51a0598d62
- stats:
file_store.fs_errors: 0
checks:
- shell:
- args: test -e output/filestore/48/48d179a2f8d17331446c7a75a082851eee9ad841705ed5fbce730f51a0598d62
+ args: test -e filestore/48/48d179a2f8d17331446c7a75a082851eee9ad841705ed5fbce730f51a0598d62
- stats:
file_store.fs_errors: 0
setup:
# Create a filestore directory where the rename to will fail.
- script: |
- mkdir -p output/filestore/48
- chmod 444 output/filestore/48
+ mkdir -p filestore/48
+ chmod 444 filestore/48
checks:
# We should have one file_store.fs_errors.
# Check how many lines were logged to fast.log.
- shell:
- args: cat output/filestore/48/48d179a2f8d17331446c7a75a082851eee9ad841705ed5fbce730f51a0598d62.1515441287.1.json | jq -c 'select(.fileinfo.sha256=="48d179a2f8d17331446c7a75a082851eee9ad841705ed5fbce730f51a0598d62")' | wc -l | xargs
+ args: cat filestore/48/48d179a2f8d17331446c7a75a082851eee9ad841705ed5fbce730f51a0598d62.1515441287.1.json | jq -c 'select(.fileinfo.sha256=="48d179a2f8d17331446c7a75a082851eee9ad841705ed5fbce730f51a0598d62")' | wc -l | xargs
expect: 1
- shell:
- args: cat output/filestore/48/48d179a2f8d17331446c7a75a082851eee9ad841705ed5fbce730f51a0598d62.1515441287.1.json | jq -c 'select(.fileinfo.stored==true)' | wc -l | xargs
+ args: cat filestore/48/48d179a2f8d17331446c7a75a082851eee9ad841705ed5fbce730f51a0598d62.1515441287.1.json | jq -c 'select(.fileinfo.stored==true)' | wc -l | xargs
expect: 1
#! /bin/sh
-tcp=$(cat output/eve.json | \
+tcp=$(cat eve.json | \
jq -c 'select(.event_type == "stats") | .stats.decoder.tcp')
test "${tcp}" = "7"
set -e
-if ! grep -q "Query TX 0d4f \[\*\*\] block.dropbox.com \[\*\*\] A \[\*\*\] 10.16.1.11:49697 -> 10.16.1.1:53" output/lua-dns.log; then
+if ! grep -q "Query TX 0d4f \[\*\*\] block.dropbox.com \[\*\*\] A \[\*\*\] 10.16.1.11:49697 -> 10.16.1.1:53" lua-dns.log; then
echo "failed to find query for block.dropbox.com"
exit 1
fi
-if ! cat output/lua-dns.log | \
+if ! cat lua-dns.log | \
grep "Response" | \
grep "client-cf.dropbox.com" | \
grep "52.85.112.21" > /dev/null;
exit 1
fi
-if ! cat output/lua-dns.log | \
+if ! cat lua-dns.log | \
grep "Response TX 62b2" | \
grep "NXDOMAIN" > /dev/null;
then
exit 1
fi
-if ! cat output/lua-dns.log | grep "SOA" > /dev/null; then
+if ! cat lua-dns.log | grep "SOA" > /dev/null; then
echo "failed find SOA response record"
exit 1
fi
#! /bin/sh
-exec cmp output/http_lua.log expected/http_lua.log
+exec cmp http_lua.log ${TEST_DIR}/expected/http_lua.log
#! /bin/sh
exec grep -q 'FROM <gurpartap@patriots.in> TO {<raj_deol2002in@yahoo.co.in>}' \
- output/smtp_lua.log
+ smtp_lua.log
#! /bin/sh
-. ../../util/functions.sh
+. ${TOPDIR}/util/functions.sh
-filename=$(cat output/eve.json | jq -c .fileinfo.filename)
+filename=$(cat eve.json | jq -c .fileinfo.filename)
assert_eq '"eicar.com"' "$filename" "bad filename"
exit 0
#! /bin/sh
-exec cmp expected/log.pcap.1444144603 output/log.pcap.1444144603
+exec cmp ${TEST_DIR}/expected/log.pcap.1444144603 log.pcap.1444144603
#! /bin/sh
-exec cmp expected/tcp-data.log output/tcp-data.log
+exec cmp ${TEST_DIR}/expected/tcp-data.log tcp-data.log
# We should get a "SURICATA Applayer Mismatch protocol both
# directions" alert.
-n=$(cat output/eve.json | \
+n=$(cat eve.json | \
jq -c 'select(.alert.signature_id == 2260000)' | \
wc -l | xargs)
if [ "$n" != 1 ]; then
fi
# We should have a flow event with app_proto = http and app_proto_tc = ssh.
-n=$(cat output/eve.json | \
+n=$(cat eve.json | \
jq -c 'select(.event_type == "flow") | select(.app_proto == "http") | select(.app_proto_tc == "ssh")' | \
wc -l | xargs)
if [ "$n" != 1 ]; then
#! /bin/sh
-. ../../util/functions.sh
+. ${TOPDIR}/util/functions.sh
# One query for suricon.net.
-n=$(jq_count output/eve.json 'select(.dns.type == "query") | select(.dns.rrname == "suricon.net")')
+n=$(jq_count eve.json 'select(.dns.type == "query") | select(.dns.rrname == "suricon.net")')
assert_eq 1 "$n" "request"
# One answer with rdata of 181.224.138.142.
-n=$(jq_count output/eve.json 'select(.dns.type == "answer") | select(.dns.rdata == "181.224.138.142")')
+n=$(jq_count eve.json 'select(.dns.type == "answer") | select(.dns.rdata == "181.224.138.142")')
assert_eq 1 "$n" "response"
#! /usr/bin/env bash
# Check for a single alert.
-n=$(cat output/eve.json | jq -c 'select(.event_type == "alert")' | wc -l | xargs)
+n=$(cat eve.json | jq -c 'select(.event_type == "alert")' | wc -l | xargs)
if test "${n}" -ne 1; then
echo "expected 1 event, found ${n}"
exit 1
#! /usr/bin/env bash
# Check for 1 tls event.
-n=$(cat output/eve.json | jq -c 'select(.event_type == "tls")' | wc -l | xargs)
+n=$(cat eve.json | jq -c 'select(.event_type == "tls")' | wc -l | xargs)
if test "${n}" -ne 1; then
echo "expected 1 event, got $n"
exit 1
#! /usr/bin/env bash
# Check for 1 tls event.
-n=$(cat output/eve.json | jq -c 'select(.event_type == "tls")' | wc -l | xargs)
+n=$(cat eve.json | jq -c 'select(.event_type == "tls")' | wc -l | xargs)
if test "${n}" -ne 1; then
echo "expected 1 event, got $n"
exit 1
projects / thirdparty / suricata-verify.git / commitdiff
