-requires:
- features:
- - HAVE_LIBJANSSON
- files:
- - src/datasets.c
-
args:
- -k none
pcap: ../datarep-01/input.pcap
-requires:
- features:
- - HAVE_LIBJANSSON
- - HAVE_NSS
- files:
- - src/datasets.c
-
args:
- -k none
requires:
- features:
- - HAVE_NSS
- files:
- - src/datasets.c
-
# No pcap required.
pcap: false
pcap: ../flowbit-oring/input.pcap
-requires:
- files:
- - src/datasets.c
-
args:
- --data-dir=${OUTPUT_DIR}
pcap: ../flowbit-oring/input.pcap
-requires:
- features:
- - HAVE_LIBJANSSON
- files:
- - src/datasets.c
-
args:
- -k none
pcap: ../datasets-05-state/input.pcap
-requires:
- features:
- - HAVE_LIBJANSSON
- files:
- - src/datasets.c
-
args:
- -k none
-requires:
- features:
- - HAVE_LIBJANSSON
- files:
- - src/datasets.c
-
args:
- -k none
-requires:
- features:
- - HAVE_LIBJANSSON
- files:
- - src/datasets.c
-
args:
- --data-dir=${OUTPUT_DIR}
-requires:
- features:
- - HAVE_LIBJANSSON
- files:
- - src/datasets.c
-
args:
- --data-dir=${OUTPUT_DIR}
pcap: ../datasets-05-state/input.pcap
-requires:
- features:
- - HAVE_LIBJANSSON
- files:
- - src/detect-ipaddr.c
-
args:
- --data-dir=${OUTPUT_DIR}
-requires:
- features:
- - HAVE_LIBJANSSON
- files:
- - src/detect-ipaddr.c
-
args:
- --no-random --data-dir=${OUTPUT_DIR}
pcap: ../flowbit-oring/input.pcap
-requires:
- features:
- - HAVE_LIBJANSSON
- files:
- - src/detect-ipaddr.c
-
args:
- -k none
pcap: ../flowbit-oring/input.pcap
-requires:
- features:
- - HAVE_LIBJANSSON
- files:
- - src/datasets.c
-
args:
- -k none
-requires:
- files:
- - src/datasets.c
-
pcap: ../flowbit-oring/input.pcap
args:
requires:
min-version: 6
- features:
- - HAVE_LIBJANSSON
- files:
- - src/datasets.c
args:
- -k none --no-random --data-dir=${OUTPUT_DIR}
pcap: ../../flowbit-oring/input.pcap
-requires:
- features:
- - HAVE_LIBJANSSON
- files:
- - src/datasets.c
-
args:
- -k none
pcap: ../../flowbit-oring/input.pcap
-requires:
- features:
- - HAVE_LIBJANSSON
- files:
- - src/datasets.c
-
args:
- -k none
pcap: ../detect-bytemath-01/input.pcap
-requires:
- files:
- - src/detect-bytemath.c
-
checks:
- filter:
count: 1
pcap: ../detect-bytemath-01/input.pcap
-requires:
- files:
- - src/detect-bytemath.c
-
checks:
- filter:
count: 0
pcap: ../detect-bytemath-01/input.pcap
-requires:
- files:
- - src/detect-bytemath.c
checks:
- filter:
-requires:
-
- files:
- - src/detect-transform-pcrexform.c
-
checks:
- filter:
count: 1
pcap: ../detect-pcrexform-01/input.pcap
-requires:
-
- files:
- - src/detect-transform-pcrexform.c
-
exit-code: 1
checks:
pcap: ../detect-pcrexform-01/input.pcap
-requires:
-
- files:
- - src/detect-transform-pcrexform.c
exit-code: 1
pcap: ../detect-pcrexform-01/input.pcap
-requires:
-
- files:
- - src/detect-transform-pcrexform.c
-
checks:
- filter:
count: 1
pcap: ../detect-pcrexform-01/input.pcap
-requires:
-
- files:
- - src/detect-transform-pcrexform.c
-
checks:
- filter:
count: 0
-requires:
- features:
- - HAVE_LIBJANSSON
- files:
- - src/output-json-metadata.c
args:
- --set stream.midstream=true
pcap: ../eve-metadata-01-alert/80000000-037-PTP_Example_IPv4_HTTP_Session-PUBLIC-tp-01-TEST1.pcap
-requires:
- features:
- - HAVE_LIBJANSSON
- files:
- - src/output-json-metadata.c
args:
- --set stream.midstream=true
pcap: ../eve-metadata-01-alert/80000000-037-PTP_Example_IPv4_HTTP_Session-PUBLIC-tp-01-TEST1.pcap
-requires:
- features:
- - HAVE_LIBJANSSON
- files:
- - src/output-json-metadata.c
args:
- --set stream.midstream=true
pcap: ../eve-metadata-01-alert/80000000-037-PTP_Example_IPv4_HTTP_Session-PUBLIC-tp-01-TEST1.pcap
-requires:
- features:
- - HAVE_LIBJANSSON
- files:
- - src/output-json-metadata.c
args:
- --set stream.midstream=true
requires:
features:
- DEBUG
- files:
- - src/util-exception-policy.c
pcap: ../tls/tls-certs-alert/input.pcap
args:
- --simulate-ips
min-version: 7
features:
- DEBUG
- files:
- - src/util-exception-policy.c
pcap: ../tls/tls-certs-alert/input.pcap
args:
- --simulate-ips
requires:
features:
- DEBUG
- files:
- - src/util-exception-policy.c
pcap: ../tls/tls-certs-alert/input.pcap
args:
- --simulate-ips
requires:
features:
- DEBUG
- files:
- - src/util-exception-policy.c
pcap: ../tls/tls-certs-alert/input.pcap
args:
- --simulate-ips
min-version: 7
features:
- DEBUG
- files:
- - src/util-exception-policy.c
pcap: ../tls/tls-certs-alert/input.pcap
args:
- --simulate-ips
min-version: 7
features:
- DEBUG
- files:
- - src/util-exception-policy.c
pcap: ../tls/tls-certs-alert/input.pcap
args:
- --simulate-ips
requires:
features:
- DEBUG
- files:
- - src/util-exception-policy.c
pcap: ../tls/tls-certs-alert/input.pcap
args:
- --simulate-ips
requires:
features:
- DEBUG
- files:
- - src/util-exception-policy.c
pcap: ../tls/tls-certs-alert/input.pcap
args:
- --simulate-ips
requires:
features:
- MAGIC
- - HAVE_NSS
- files:
- - src/output-filestore.c
checks:
requires:
features:
- - HAVE_NSS
- MAGIC
- files:
- - src/output-filestore.c
checks:
requires:
features:
- - HAVE_NSS
- MAGIC
- - RUST
- files:
- - src/output-filestore.c
checks:
requires:
features:
- - HAVE_NSS
- MAGIC
- - RUST
- files:
- - src/output-filestore.c
checks:
- filter:
requires:
features:
- - HAVE_NSS
- MAGIC
- - RUST
- files:
- - src/output-filestore.c
min-version: 7
args:
-requires:
- features:
- - HAVE_NSS
- files:
- - src/output-filestore.c
-
checks:
- shell:
-requires:
- features:
- - HAVE_NSS
- files:
- - src/output-filestore.c
-
pcap: ../filestore-v2.1-forced/suricata-update-pdf.pcap
checks:
-requires:
- features:
- - HAVE_NSS
- files:
- - src/output-filestore.c
-
skip:
- uid: 0
msg: "Test fails when run as root"
-requires:
- features:
- - HAVE_NSS
- - HAVE_LIBJANSSON
- files:
- - src/output-filestore.c
-
pcap: ../filestore-v2.1-forced/suricata-update-pdf.pcap
checks:
-requires:
- features:
- - HAVE_NSS
- files:
- - src/output-filestore.c
-
pcap: ../filestore-v2.1-forced/suricata-update-pdf.pcap
# For this test we expect an exit code.
requires:
- features:
- - HAVE_LIBJANSSON
- - HAVE_NSS
- files:
- - src/output-filestore.c
min-version: 5.0.0
args:
requires:
- features:
- - HAVE_NSS
- files:
- - src/output-filestore.c
min-version: 6
args:
requires:
- features:
- - HAVE_NSS
- files:
- - src/output-filestore.c
min-version: 6
args:
requires:
- features:
- - HAVE_LIBJANSSON
- files:
- - rust/src/ike/parser.rs
min-version: 7.0.0
checks:
pcap: ../ikev1-rules/ikev1-isakmp-main-mode.pcap
requires:
- features:
- - HAVE_NSS
- - HAVE_LIBJANSSON
- files:
- - rust/src/ike/parser.rs
min-version: 7.0.0
checks:
pcap: ../ikev1-rules/ikev1-isakmp-main-mode.pcap
requires:
- features:
- - HAVE_LIBJANSSON
- files:
- - rust/src/ike/parser.rs
min-version: 7.0.0
checks:
requires:
min-version: 7.0.6
- files:
- - rust/src/ja4.rs
args:
- -k none --set app-layer.protocols.tls.ja4-fingerprints=no
requires:
min-version: 6.0.0
- files:
- - src/util-macset.c
args:
- -k none
requires:
min-version: 6.0.0
- files:
- - src/util-macset.c
args:
- -k none
requires:
min-version: 6.0.0
- files:
- - src/util-macset.c
args:
- -k none
requires:
min-version: 6.0.0
- files:
- - src/util-macset.c
args:
- -k none
pcap: ../mqtt-pub-rules/mqtt5_pub_jpeg.pcap
-requires:
- features:
- - HAVE_LIBJANSSON
- files:
- - rust/src/mqtt/parser.rs
-
args:
- -k none
-requires:
- features:
- - HAVE_LIBJANSSON
- files:
- - rust/src/mqtt/parser.rs
-
args:
- -k none
-requires:
- features:
- - HAVE_LIBJANSSON
- files:
- - rust/src/mqtt/parser.rs
-
args:
- -k none
-requires:
- features:
- - HAVE_LIBJANSSON
- files:
- - rust/src/mqtt/parser.rs
-
args:
- -k none
-requires:
- features:
- - HAVE_LIBJANSSON
- files:
- - rust/src/mqtt/parser.rs
-
args:
- -k none
pcap: ../mqtt-limit-2/input.pcap
-requires:
- features:
- - HAVE_LIBJANSSON
- files:
- - rust/src/mqtt/parser.rs
-
args:
- -k none
-requires:
- features:
- - HAVE_LIBJANSSON
- files:
- - rust/src/mqtt/parser.rs
-
args:
- -k none
pcap: ../mqtt-limit-2/input.pcap
-requires:
- features:
- - HAVE_LIBJANSSON
- files:
- - rust/src/mqtt/parser.rs
-
args:
- -k none
requires:
min-version: 8
- files:
- - rust/src/mqtt/parser.rs
args:
- -k none
-requires:
- features:
- - HAVE_LIBJANSSON
- files:
- - rust/src/mqtt/parser.rs
-
args:
- -k none
-requires:
- features:
- - HAVE_LIBJANSSON
- files:
- - rust/src/mqtt/parser.rs
-
args:
- -k none
pcap: ../mqtt5-sub-userpass/input.pcap
-requires:
- features:
- - HAVE_LIBJANSSON
- files:
- - rust/src/mqtt/parser.rs
-
args:
- -k none
pcap: ../mqtt5-unsub-userpass/input.pcap
-requires:
- features:
- - HAVE_LIBJANSSON
- files:
- - rust/src/mqtt/parser.rs
-
args:
- -k none
-requires:
- features:
- - HAVE_LIBJANSSON
- files:
- - rust/src/mqtt/parser.rs
-
args:
- -k none
-requires:
- features:
- - HAVE_LIBJANSSON
- files:
- - rust/src/mqtt/parser.rs
-
args:
- -k none
-requires:
- features:
- - HAVE_LIBJANSSON
- files:
- - rust/src/mqtt/parser.rs
-
args:
- -k none
-requires:
- features:
- - HAVE_LIBJANSSON
- files:
- - rust/src/mqtt/parser.rs
-
args:
- -k none
-requires:
- features:
- - HAVE_LIBJANSSON
- files:
- - rust/src/mqtt/parser.rs
-
args:
- -k none
-requires:
- features:
- - HAVE_LIBJANSSON
- files:
- - rust/src/mqtt/parser.rs
-
args:
- -k none
-requires:
- features:
- - HAVE_LIBJANSSON
- files:
- - rust/src/mqtt/parser.rs
-
args:
- -k none
-requires:
- features:
- - HAVE_LIBJANSSON
- files:
- - rust/src/mqtt/parser.rs
-
args:
- -k none
-requires:
- features:
- - HAVE_LIBJANSSON
- files:
- - rust/src/mqtt/parser.rs
-
args:
- -k none
-requires:
- features:
- - HAVE_LIBJANSSON
- files:
- - rust/src/mqtt/parser.rs
-
args:
- -k none
-requires:
- features:
- - HAVE_LIBJANSSON
- files:
- - rust/src/mqtt/parser.rs
-
args:
- -k none
-requires:
- features:
- - HAVE_LIBJANSSON
- files:
- - rust/src/mqtt/parser.rs
-
args:
- -k none
-requires:
- features:
- - HAVE_LIBJANSSON
- files:
- - rust/src/mqtt/parser.rs
-
args:
- -k none
-requires:
- features:
- - HAVE_LIBJANSSON
- files:
- - rust/src/mqtt/parser.rs
-
args:
- -k none
-requires:
- features:
- - HAVE_LIBJANSSON
- files:
- - rust/src/mqtt/parser.rs
-
args:
- -k none
-requires:
- features:
- - HAVE_LIBJANSSON
- files:
- - rust/src/mqtt/parser.rs
-
args:
- -k none
-requires:
- features:
- - HAVE_LIBJANSSON
- files:
- - rust/src/mqtt/parser.rs
-
args:
- -k none
-requires:
- features:
- - HAVE_LIBJANSSON
- files:
- - rust/src/mqtt/parser.rs
-
args:
- -k none
-requires:
- features:
- - HAVE_LIBJANSSON
- files:
- - rust/src/mqtt/parser.rs
-
args:
- -k none
-requires:
- features:
- - HAVE_LIBJANSSON
- files:
- - rust/src/mqtt/parser.rs
-
args:
- -k none
-requires:
- features:
- - HAVE_LIBJANSSON
- files:
- - rust/src/mqtt/parser.rs
-
args:
- -k none
-requires:
- features:
- - HAVE_LIBJANSSON
- files:
- - rust/src/mqtt/parser.rs
-
args:
- -k none
-requires:
- features:
- - HAVE_LIBJANSSON
- files:
- - rust/src/mqtt/parser.rs
-
args:
- -k none
-requires:
- features:
- - HAVE_LIBJANSSON
- files:
- - rust/src/mqtt/parser.rs
-
args:
- -k none
-requires:
- features:
- - HAVE_LIBJANSSON
- files:
- - rust/src/mqtt/parser.rs
-
args:
- -k none
-requires:
- features:
- - HAVE_LIBJANSSON
- files:
- - rust/src/mqtt/parser.rs
-
args:
- -k none
-requires:
- features:
- - HAVE_LIBJANSSON
- files:
- - rust/src/mqtt/parser.rs
-
args:
- -k none
-requires:
- features:
- - HAVE_LIBJANSSON
- files:
- - rust/src/mqtt/parser.rs
-
args:
- -k none
requires:
min-version: 6.0
- files:
- - rust/src/nfs/nfs3.rs
args:
- -k none
pcap: ../output-eve-anomaly-packethdr/anomaly.pcap
-requires:
- features:
- - HAVE_LIBJANSSON
-
- files:
- - src/output-json-anomaly.c
-
args:
- -k none
-requires:
- features:
- - HAVE_LIBJANSSON
-
- files:
- - src/output-json-anomaly.c
-
args:
- -k none
pcap: ../output-eve-anomaly-02/input.pcap
-requires:
- features:
- - HAVE_LIBJANSSON
-
- files:
- - src/output-json-anomaly.c
-
args:
- -k none
-requires:
- features:
- - HAVE_LIBJANSSON
-
- files:
- - src/output-json-anomaly.c
-
args:
- -k none
pcap: ../bug-3519/input.pcap
-requires:
- features:
- - HAVE_LIBJANSSON
-
- files:
- - src/output-json-ftp.c
-
checks:
- filter:
count: 8
pcap: ../rdp-protocol/RDP-003.pcap
-requires:
- features:
- - HAVE_LIBJANSSON
- files:
- - rust/src/rdp/parser.rs
-
checks:
- filter:
-requires:
- features:
- - HAVE_LIBJANSSON
- files:
- - rust/src/rdp/parser.rs
-
checks:
# Check if rdp is detected and some protocol specific details are in the output
-requires:
- features:
- - HAVE_LIBJANSSON
- files:
- - rust/src/rfb/parser.rs
-
checks:
- filter:
pcap: ../rfb-rules/00-vnc-openwall-3.7.pcap
-requires:
- features:
- - HAVE_LIBJANSSON
- files:
- - rust/src/rfb/parser.rs
-
checks:
- filter:
-requires:
- features:
- - HAVE_LIBJANSSON
- files:
- - rust/src/rfb/parser.rs
-
checks:
- filter:
-requires:
- features:
- - HAVE_LIBJANSSON
- files:
- - rust/src/rfb/parser.rs
-
checks:
- filter:
-requires:
- features:
- - HAVE_LIBJANSSON
- - RUST
- files:
- - rust/src/smb/smb.rs
args:
- --set stream.midstream=true
-requires:
- features:
- - HAVE_LIBJANSSON
- - RUST
- files:
- - rust/src/smb/smb.rs
args:
- --set stream.reassembly.depth=0
requires:
- features:
- - HAVE_LIBJANSSON
- - RUST
- files:
- - rust/src/smb/smb.rs
min-version: 5.0.0
args:
-requires:
- features:
- - HAVE_LIBJANSSON
- - RUST
- files:
- - rust/src/smb/smb.rs
args:
- --set stream.reassembly.depth=0
- -k none
pcap: ../smb2-03-rule/smb2.pcap
-requires:
- features:
- - HAVE_LIBJANSSON
- - RUST
- files:
- - rust/src/smb/smb.rs
args:
- --set stream.reassembly.depth=0
-requires:
- features:
- - HAVE_LIBJANSSON
- - RUST
- files:
- - rust/src/smb/smb.rs
args:
- --set stream.reassembly.depth=0
-requires:
- features:
- - HAVE_LIBJANSSON
- - RUST
- files:
- - rust/src/smb/smb.rs
args:
- --set stream.reassembly.depth=0
- --set stream.midstream=true
-requires:
- features:
- - HAVE_LIBJANSSON
- - RUST
- files:
- - rust/src/smb/smb.rs
args:
- --set stream.reassembly.depth=0
- --set stream.midstream=true
-requires:
- features:
- - HAVE_LIBJANSSON
- - RUST
- files:
- - rust/src/smb/smb.rs
args:
- --set stream.reassembly.depth=0
- --set stream.midstream=true
-requires:
- features:
- - HAVE_LIBJANSSON
- - RUST
- files:
- - rust/src/smb/smb.rs
args:
- --set stream.reassembly.depth=0
- --set stream.midstream=true
pcap: ../smb2-03-rule/smb2.pcap
-requires:
- features:
- - HAVE_LIBJANSSON
- - RUST
- files:
- - rust/src/smb/smb.rs
- - src/detect-smb-ntlmssp.c
args:
- --set stream.reassembly.depth=0
-requires:
- features:
- - HAVE_LIBJANSSON
- - RUST
- files:
- - rust/src/smb/smb.rs
args:
- --set stream.reassembly.depth=0
- --set stream.midstream=true
-requires:
- features:
- - HAVE_LIBJANSSON
- - RUST
- files:
- - rust/src/smb/smb.rs
args:
- --set stream.reassembly.depth=0
- --set stream.midstream=true
requires:
- features:
- - HAVE_LIBJANSSON
- - RUST
- files:
- - rust/src/smb/smb.rs
min-version: 5.0.0
args:
- --set stream.reassembly.depth=0
requires:
min-version: 5.0.0
- features:
- - HAVE_NSS
- files:
- - src/output-filestore.c
checks:
-requires:
- features:
- - HAVE_LIBJANSSON
- - RUST
- files:
- - rust/src/snmp/snmp.rs
-
args:
- -k none
-requires:
- features:
- - HAVE_LIBJANSSON
- - RUST
- files:
- - rust/src/snmp/snmp.rs
-
args:
- -k none
-requires:
- features:
- - HAVE_LIBJANSSON
- - RUST
- files:
- - rust/src/snmp/snmp.rs
-
args:
- -k none
-requires:
- files:
- - src/output-eve-stream.c
-
args:
- --simulate-ips
#- --set stream.midstream=true
-requires:
- files:
- - src/output-eve-stream.c
-
args:
- --simulate-ips
- --runmode=single