]> git.ipfire.org Git - thirdparty/suricata-verify.git/commitdiff
run.py: add __startswith and __endswith for string matching
authorJason Ish <jason.ish@oisf.net>
Fri, 24 May 2024 17:09:07 +0000 (11:09 -0600)
committerJason Ish <jason.ish@oisf.net>
Mon, 27 May 2024 21:49:58 +0000 (15:49 -0600)
README.md
run.py

index a6d4ce99d93ab1b6a17a8ece7cea429a08415104..9760eb9e9954ba37af549bd17221c860198a3045 100644 (file)
--- a/README.md
+++ b/README.md
@@ -159,6 +159,12 @@ checks:
            # Find a substring in a field
                engine.message.__find: script failed
 
+        # Check if a string starts with an expected value
+        engine.message.__startswith: "This is the start of the string"
+
+        # Check if a string ends with an expected value
+        engine.message.__endswith: "the end of a string"
+
   - shell:
       # A simple shell check. If the command exits with a non-0 exit code the
       # check will fail. The script is run in the output directory of the
diff --git a/run.py b/run.py
index 2d195e2a7d0408c4b6f86b21b294a3e51a53482e..15160705090c541de9fe72ca8afa1c2ba0852215 100755 (executable)
--- a/run.py
+++ b/run.py
@@ -390,9 +390,8 @@ def find_value(name, obj):
                 return len(obj)
             except:
                 return -1
-        if part == "__find":
-            # Return full obj on __find and do a substring find in caller
-            # where the expected is also available
+        if part in ["__find", "__startswith", "__endswith"]:
+            # Return full object, caller will handle the special match logic.
             break
         name = None
         index = None
@@ -562,13 +561,18 @@ class FilterCheck:
                     return False
             else:
                 val = find_value(key, event)
-                if val != expected:
-                    if key.endswith("__find"):
-                        if val.find(expected) != -1:
-                            return True
+                if key.endswith("__find"):
+                    if val.find(expected) < 0:
+                        return False
+                elif key.endswith("__startswith"):
+                    if not val.startswith(expected):
+                        return False
+                elif key.endswith("__endswith"):
+                    if not val.endswith(expected):
+                        return False
+                elif val != expected:
                     if str(val) == str(expected):
                         print("Different types but same string", type(val), val, type(expected), expected)
-                        return False
                     return False
         return True