tests: filename/fileext tests

diff --git a/tests/fileext-01/test.rules b/tests/fileext-01/test.rules
new file mode 100755 (executable)
index 0000000..b3af97c
--- /dev/null
+++ b/tests/fileext-01/test.rules
@@ -0,0 +1,11 @@
+alert tcp any any -> any any (fileext:"PDF"; sid:1;)
+alert tcp any any -> any any (fileext:"pdf"; sid:2;)
+alert tcp any any -> any any (fileext:"pDf"; sid:3;)
+
+alert tcp any any -> any any (fileext:!"DOC"; sid:4;)
+alert tcp any any -> any any (fileext:!"doc"; sid:5;)
+alert tcp any any -> any any (fileext:!"dOc"; sid:6;)
+
+alert tcp any any -> any any (fileext:!"PDF"; sid:7;)
+alert tcp any any -> any any (fileext:!"pdf"; sid:8;)
+alert tcp any any -> any any (fileext:!"pDf"; sid:9;)

diff --git a/tests/fileext-01/test.yaml b/tests/fileext-01/test.yaml
new file mode 100644 (file)
index 0000000..7edf6ae
--- /dev/null
+++ b/tests/fileext-01/test.yaml
@@ -0,0 +1,46 @@
+requires:
+  features:
+    - HAVE_LIBJANSSON
+
+pcap: ../filemagic-flowbits/pdf-dl.pcap
+
+args:
+  - -k none
+
+checks:
+  - filter:
+      count: 1
+      match:
+        alert.signature_id: 1
+  - filter:
+      count: 1
+      match:
+        alert.signature_id: 2
+  - filter:
+      count: 1
+      match:
+        alert.signature_id: 3
+  - filter:
+      count: 1
+      match:
+        alert.signature_id: 4
+  - filter:
+      count: 1
+      match:
+        alert.signature_id: 5
+  - filter:
+      count: 1
+      match:
+        alert.signature_id: 6
+  - filter:
+      count: 0
+      match:
+        alert.signature_id: 7
+  - filter:
+      count: 0
+      match:
+        alert.signature_id: 8
+  - filter:
+      count: 0
+      match:
+        alert.signature_id: 9

diff --git a/tests/fileext-02/test.rules b/tests/fileext-02/test.rules
new file mode 100755 (executable)
index 0000000..2b32913
--- /dev/null
+++ b/tests/fileext-02/test.rules
@@ -0,0 +1,3 @@
+alert tcp any any -> any any (filename:"r"; fileext:"PDF"; sid:1;)
+alert tcp any any -> any any (filename:"r"; fileext:"DOC"; sid:2;)
+alert tcp any any -> any any (filename:"x"; fileext:"pdf"; sid:3;)

diff --git a/tests/fileext-02/test.yaml b/tests/fileext-02/test.yaml
new file mode 100644 (file)
index 0000000..45d3dc9
--- /dev/null
+++ b/tests/fileext-02/test.yaml
@@ -0,0 +1,22 @@
+requires:
+  features:
+    - HAVE_LIBJANSSON
+
+pcap: ../filemagic-flowbits/pdf-dl.pcap
+
+args:
+  - -k none
+
+checks:
+  - filter:
+      count: 1
+      match:
+        alert.signature_id: 1
+  - filter:
+      count: 0
+      match:
+        alert.signature_id: 2
+  - filter:
+      count: 0
+      match:
+        alert.signature_id: 3

diff --git a/tests/filename-01/test.rules b/tests/filename-01/test.rules
new file mode 100755 (executable)
index 0000000..dd104b3
--- /dev/null
+++ b/tests/filename-01/test.rules
@@ -0,0 +1,11 @@
+alert tcp any any -> any any (filename:"R.PDF"; sid:1;)
+alert tcp any any -> any any (filename:"r.pdf"; sid:2;)
+alert tcp any any -> any any (filename:"R.pDf"; sid:3;)
+
+alert tcp any any -> any any (filename:!"S.PDF"; sid:4;)
+alert tcp any any -> any any (filename:!"s.pdf"; sid:5;)
+alert tcp any any -> any any (filename:!"S.pDf"; sid:6;)
+
+alert tcp any any -> any any (filename:!"R.PDF"; sid:7;)
+alert tcp any any -> any any (filename:!"r.pdf"; sid:8;)
+alert tcp any any -> any any (filename:!"R.pDf"; sid:9;)

diff --git a/tests/filename-01/test.yaml b/tests/filename-01/test.yaml
new file mode 100644 (file)
index 0000000..7edf6ae
--- /dev/null
+++ b/tests/filename-01/test.yaml
@@ -0,0 +1,46 @@
+requires:
+  features:
+    - HAVE_LIBJANSSON
+
+pcap: ../filemagic-flowbits/pdf-dl.pcap
+
+args:
+  - -k none
+
+checks:
+  - filter:
+      count: 1
+      match:
+        alert.signature_id: 1
+  - filter:
+      count: 1
+      match:
+        alert.signature_id: 2
+  - filter:
+      count: 1
+      match:
+        alert.signature_id: 3
+  - filter:
+      count: 1
+      match:
+        alert.signature_id: 4
+  - filter:
+      count: 1
+      match:
+        alert.signature_id: 5
+  - filter:
+      count: 1
+      match:
+        alert.signature_id: 6
+  - filter:
+      count: 0
+      match:
+        alert.signature_id: 7
+  - filter:
+      count: 0
+      match:
+        alert.signature_id: 8
+  - filter:
+      count: 0
+      match:
+        alert.signature_id: 9