tests: add various eve payload representation tests

Overlaps and gaps.

diff --git a/tests/eve-overlap-payload-01/suricata.yaml b/tests/eve-overlap-payload-01/suricata.yaml
new file mode 100644 (file)
index 0000000..2214ea8
--- /dev/null
+++ b/tests/eve-overlap-payload-01/suricata.yaml
@@ -0,0 +1,14 @@
+%YAML 1.1
+---
+
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
+      filename: eve.json
+      types:
+        - alert:
+            payload: yes             # enable dumping payload in Base64
+            payload-buffer-size: 4kb # max size of payload buffer to output in eve-log
+            payload-printable: yes   # enable dumping payload in printable (lossy) format
+            packet: yes              # enable dumping of packet (without stream segments)

diff --git a/tests/eve-overlap-payload-01/tcp-overlap.pcap b/tests/eve-overlap-payload-01/tcp-overlap.pcap
new file mode 100644 (file)
index 0000000..221d7e7
Binary files /dev/null and b/tests/eve-overlap-payload-01/tcp-overlap.pcap differ

diff --git a/tests/eve-overlap-payload-01/tcp-overlap.py b/tests/eve-overlap-payload-01/tcp-overlap.py
new file mode 100755 (executable)
index 0000000..8d9d933
--- /dev/null
+++ b/tests/eve-overlap-payload-01/tcp-overlap.py
@@ -0,0 +1,44 @@
+#!/usr/bin/env python
+from scapy.all import *
+
+pkts = []
+
+pkt1 = Ether(dst='05:04:03:02:01:00', src='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(src='1.1.1.1', dst='2.2.2.2')/TCP(dport=8080,sport=12345,flags='S',seq=1,options=[('WScale', 5)])
+pkt2 = Ether(src='05:04:03:02:01:00', dst='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(dst='1.1.1.1', src='2.2.2.2')/TCP(sport=8080,dport=12345,flags='SA',seq=1000,ack=2,options=[('WScale', 5)],window=4096)
+pkt3 = Ether(dst='05:04:03:02:01:00', src='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(src='1.1.1.1', dst='2.2.2.2')/TCP(dport=8080,sport=12345,flags='A',seq=2,ack=1001,window=4096)
+pkt4 = Ether(src='05:04:03:02:01:00', dst='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(dst='1.1.1.1', src='2.2.2.2')/TCP(sport=8080,dport=12345,flags='A',seq=1001,ack=2,window=4096)
+pkt5 = Ether(dst='05:04:03:02:01:00', src='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(src='1.1.1.1', dst='2.2.2.2')/TCP(dport=8080,sport=12345,flags='A',seq=2,ack=1001,window=4096)/"GOOD"
+pkt6 = Ether(dst='05:04:03:02:01:00', src='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(src='1.1.1.1', dst='2.2.2.2')/TCP(dport=8080,sport=12345,flags='A',seq=2,ack=1001,window=4096)/"EVIL"
+pkt7 = Ether(src='05:04:03:02:01:00', dst='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(dst='1.1.1.1', src='2.2.2.2')/TCP(sport=8080,dport=12345,flags='A',ack=6,seq=1001,window=4096)
+
+# VLAN tagged packet
+pkts += pkt1
+pkts += pkt2
+pkts += pkt3
+pkts += pkt4
+pkts += pkt5
+pkts += pkt6
+pkts += pkt7
+
+wrpcap('tcp-overlap.pcap', pkts)
+
+pkts = []
+
+pkt1 = Ether(dst='05:04:03:02:01:00', src='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(src='1.1.1.1', dst='2.2.2.2')/TCP(dport=8080,sport=12345,flags='S',seq=1,options=[('WScale', 5)])
+pkt2 = Ether(src='05:04:03:02:01:00', dst='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(dst='1.1.1.1', src='2.2.2.2')/TCP(sport=8080,dport=12345,flags='SA',seq=1000,ack=2,options=[('WScale', 5)],window=4096)
+pkt3 = Ether(dst='05:04:03:02:01:00', src='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(src='1.1.1.1', dst='2.2.2.2')/TCP(dport=8080,sport=12345,flags='A',seq=2,ack=1001,window=4096)
+pkt4 = Ether(src='05:04:03:02:01:00', dst='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(dst='1.1.1.1', src='2.2.2.2')/TCP(sport=8080,dport=12345,flags='A',seq=1001,ack=2,window=4096)
+pkt5 = Ether(dst='05:04:03:02:01:00', src='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(src='1.1.1.1', dst='2.2.2.2')/TCP(dport=8080,sport=12345,flags='A',seq=2,ack=1001,window=4096)/"GOOD"
+pkt6 = Ether(dst='05:04:03:02:01:00', src='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(src='1.1.1.1', dst='2.2.2.2')/TCP(dport=8080,sport=12345,flags='A',seq=3, ack=1001,window=4096)/"XXX"
+pkt7 = Ether(src='05:04:03:02:01:00', dst='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(dst='1.1.1.1', src='2.2.2.2')/TCP(sport=8080,dport=12345,flags='A',ack=6,seq=1001,window=4096)
+
+# VLAN tagged packet
+pkts += pkt1
+pkts += pkt2
+pkts += pkt3
+pkts += pkt4
+pkts += pkt5
+pkts += pkt6
+pkts += pkt7
+
+wrpcap('tcp-overlap2.pcap', pkts)

diff --git a/tests/eve-overlap-payload-01/tcp-overlap.rules b/tests/eve-overlap-payload-01/tcp-overlap.rules
new file mode 100644 (file)
index 0000000..4d4dcab
--- /dev/null
+++ b/tests/eve-overlap-payload-01/tcp-overlap.rules
@@ -0,0 +1,5 @@
+alert tcp-stream any any -> any any (content:"EVIL"; sid:1;)
+alert tcp-stream any any -> any any (content:"GOOD"; sid:2;)
+
+alert tcp-pkt any any -> any any (content:"EVIL"; sid:3;)
+alert tcp-pkt any any -> any any (content:"GOOD"; sid:4;)

diff --git a/tests/eve-overlap-payload-01/test.yaml b/tests/eve-overlap-payload-01/test.yaml
new file mode 100644 (file)
index 0000000..4dfe9c6
--- /dev/null
+++ b/tests/eve-overlap-payload-01/test.yaml
@@ -0,0 +1,36 @@
+requires:
+  min-version: 8
+
+args:
+- -k none
+
+checks:
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 1
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 2
+      payload: "R09PRA=="
+      payload_printable: "GOOD"
+      pkt_src: "stream (flow timeout)"
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 3
+      payload: "RVZJTA=="
+      payload_printable: "EVIL"
+      packet: "BQQDAgEAAAECAwQFgQAABggARQAALAABAABABnTGAQEBAQICAgIwOR+QAAAAAgAAA+lQEBAAt3QAAEVWSUw="
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 4
+      payload: "R09PRA=="
+      payload_printable: "GOOD"
+      packet: "BQQDAgEAAAECAwQFgQAABggARQAALAABAABABnTGAQEBAQICAgIwOR+QAAAAAgAAA+lQEBAAr4MAAEdPT0Q="

diff --git a/tests/eve-overlap-payload-02-policy-oldlinux/suricata.yaml b/tests/eve-overlap-payload-02-policy-oldlinux/suricata.yaml
new file mode 100644 (file)
index 0000000..8851187
--- /dev/null
+++ b/tests/eve-overlap-payload-02-policy-oldlinux/suricata.yaml
@@ -0,0 +1,30 @@
+%YAML 1.1
+---
+
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
+      filename: eve.json
+      types:
+        - alert:
+            payload: yes             # enable dumping payload in Base64
+            payload-buffer-size: 4kb # max size of payload buffer to output in eve-log
+            payload-printable: yes   # enable dumping payload in printable (lossy) format
+            packet: yes              # enable dumping of packet (without stream segments)
+
+host-os-policy:
+  # Make the default policy windows.
+  windows: [0.0.0.0/0]
+  bsd: []
+  bsd-right: []
+  old-linux: [2.2.2.2]
+  linux: []
+  old-solaris: []
+  solaris: []
+  hpux10: []
+  hpux11: []
+  irix: []
+  macos: []
+  vista: []
+  windows2k3: []

diff --git a/tests/eve-overlap-payload-02-policy-oldlinux/tcp-overlap.pcap b/tests/eve-overlap-payload-02-policy-oldlinux/tcp-overlap.pcap
new file mode 100644 (file)
index 0000000..221d7e7
Binary files /dev/null and b/tests/eve-overlap-payload-02-policy-oldlinux/tcp-overlap.pcap differ

diff --git a/tests/eve-overlap-payload-02-policy-oldlinux/tcp-overlap.rules b/tests/eve-overlap-payload-02-policy-oldlinux/tcp-overlap.rules
new file mode 100644 (file)
index 0000000..4d4dcab
--- /dev/null
+++ b/tests/eve-overlap-payload-02-policy-oldlinux/tcp-overlap.rules
@@ -0,0 +1,5 @@
+alert tcp-stream any any -> any any (content:"EVIL"; sid:1;)
+alert tcp-stream any any -> any any (content:"GOOD"; sid:2;)
+
+alert tcp-pkt any any -> any any (content:"EVIL"; sid:3;)
+alert tcp-pkt any any -> any any (content:"GOOD"; sid:4;)

diff --git a/tests/eve-overlap-payload-02-policy-oldlinux/test.yaml b/tests/eve-overlap-payload-02-policy-oldlinux/test.yaml
new file mode 100644 (file)
index 0000000..d641ebb
--- /dev/null
+++ b/tests/eve-overlap-payload-02-policy-oldlinux/test.yaml
@@ -0,0 +1,36 @@
+requires:
+  min-version: 8
+
+args:
+- -k none
+
+checks:
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 1
+      payload: "RVZJTA=="
+      payload_printable: "EVIL"
+      pkt_src: "stream (flow timeout)"
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 2
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 3
+      payload: "RVZJTA=="
+      payload_printable: "EVIL"
+      packet: "BQQDAgEAAAECAwQFgQAABggARQAALAABAABABnTGAQEBAQICAgIwOR+QAAAAAgAAA+lQEBAAt3QAAEVWSUw="
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 4
+      payload: "R09PRA=="
+      payload_printable: "GOOD"
+      packet: "BQQDAgEAAAECAwQFgQAABggARQAALAABAABABnTGAQEBAQICAgIwOR+QAAAAAgAAA+lQEBAAr4MAAEdPT0Q="

diff --git a/tests/eve-overlap-payload-03-ips/suricata.yaml b/tests/eve-overlap-payload-03-ips/suricata.yaml
new file mode 100644 (file)
index 0000000..2214ea8
--- /dev/null
+++ b/tests/eve-overlap-payload-03-ips/suricata.yaml
@@ -0,0 +1,14 @@
+%YAML 1.1
+---
+
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
+      filename: eve.json
+      types:
+        - alert:
+            payload: yes             # enable dumping payload in Base64
+            payload-buffer-size: 4kb # max size of payload buffer to output in eve-log
+            payload-printable: yes   # enable dumping payload in printable (lossy) format
+            packet: yes              # enable dumping of packet (without stream segments)

diff --git a/tests/eve-overlap-payload-03-ips/tcp-overlap.pcap b/tests/eve-overlap-payload-03-ips/tcp-overlap.pcap
new file mode 100644 (file)
index 0000000..221d7e7
Binary files /dev/null and b/tests/eve-overlap-payload-03-ips/tcp-overlap.pcap differ

diff --git a/tests/eve-overlap-payload-03-ips/tcp-overlap.rules b/tests/eve-overlap-payload-03-ips/tcp-overlap.rules
new file mode 100644 (file)
index 0000000..4d4dcab
--- /dev/null
+++ b/tests/eve-overlap-payload-03-ips/tcp-overlap.rules
@@ -0,0 +1,5 @@
+alert tcp-stream any any -> any any (content:"EVIL"; sid:1;)
+alert tcp-stream any any -> any any (content:"GOOD"; sid:2;)
+
+alert tcp-pkt any any -> any any (content:"EVIL"; sid:3;)
+alert tcp-pkt any any -> any any (content:"GOOD"; sid:4;)

diff --git a/tests/eve-overlap-payload-03-ips/test.yaml b/tests/eve-overlap-payload-03-ips/test.yaml
new file mode 100644 (file)
index 0000000..0da9f7d
--- /dev/null
+++ b/tests/eve-overlap-payload-03-ips/test.yaml
@@ -0,0 +1,35 @@
+requires:
+  min-version: 8
+
+args:
+- -k none
+
+checks:
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 1
+- filter:
+    count: 2 # one for original, one for overlap
+    match:
+      event_type: alert
+      alert.signature_id: 2
+      payload: "R09PRA=="
+      payload_printable: "GOOD"
+      packet: "BQQDAgEAAAECAwQFgQAABggARQAALAABAABABnTGAQEBAQICAgIwOR+QAAAAAgAAA+lQEBAAr4MAAEdPT0Q="
+      stream: 1
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 3
+- filter:
+    count: 2
+    match:
+      event_type: alert
+      alert.signature_id: 4
+      payload: "R09PRA=="
+      payload_printable: "GOOD"
+      packet: "BQQDAgEAAAECAwQFgQAABggARQAALAABAABABnTGAQEBAQICAgIwOR+QAAAAAgAAA+lQEBAAr4MAAEdPT0Q="
+      stream: 0

diff --git a/tests/eve-overlap-payload-04-partial-overlap/suricata.yaml b/tests/eve-overlap-payload-04-partial-overlap/suricata.yaml
new file mode 100644 (file)
index 0000000..2214ea8
--- /dev/null
+++ b/tests/eve-overlap-payload-04-partial-overlap/suricata.yaml
@@ -0,0 +1,14 @@
+%YAML 1.1
+---
+
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
+      filename: eve.json
+      types:
+        - alert:
+            payload: yes             # enable dumping payload in Base64
+            payload-buffer-size: 4kb # max size of payload buffer to output in eve-log
+            payload-printable: yes   # enable dumping payload in printable (lossy) format
+            packet: yes              # enable dumping of packet (without stream segments)

diff --git a/tests/eve-overlap-payload-04-partial-overlap/tcp-overlap.rules b/tests/eve-overlap-payload-04-partial-overlap/tcp-overlap.rules
new file mode 100644 (file)
index 0000000..c41465d
--- /dev/null
+++ b/tests/eve-overlap-payload-04-partial-overlap/tcp-overlap.rules
@@ -0,0 +1,5 @@
+alert tcp-stream any any -> any any (content:"XXX"; sid:1;)
+alert tcp-stream any any -> any any (content:"GOOD"; sid:2;)
+
+alert tcp-pkt any any -> any any (content:"XXX"; sid:3;)
+alert tcp-pkt any any -> any any (content:"GOOD"; sid:4;)

diff --git a/tests/eve-overlap-payload-04-partial-overlap/tcp-overlap2.pcap b/tests/eve-overlap-payload-04-partial-overlap/tcp-overlap2.pcap
new file mode 100644 (file)
index 0000000..e860e23
Binary files /dev/null and b/tests/eve-overlap-payload-04-partial-overlap/tcp-overlap2.pcap differ

diff --git a/tests/eve-overlap-payload-04-partial-overlap/test.yaml b/tests/eve-overlap-payload-04-partial-overlap/test.yaml
new file mode 100644 (file)
index 0000000..2a8ef3c
--- /dev/null
+++ b/tests/eve-overlap-payload-04-partial-overlap/test.yaml
@@ -0,0 +1,39 @@
+requires:
+  min-version: 8
+
+
+args:
+- -k none
+
+checks:
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 1
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 2
+      stream: 1
+      payload: "R09PRA=="
+      payload_printable: "GOOD"
+      pkt_src: "stream (flow timeout)"
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 3
+      stream: 0
+      payload: "WFhY"
+      payload_printable: "XXX"
+      packet: "BQQDAgEAAAECAwQFgQAABggARQAAKwABAABABnTHAQEBAQICAgIwOR+QAAAAAwAAA+lQEBAAlb4AAFhYWA=="
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 4
+      payload: "R09PRA=="
+      payload_printable: "GOOD"
+      packet: "BQQDAgEAAAECAwQFgQAABggARQAALAABAABABnTGAQEBAQICAgIwOR+QAAAAAgAAA+lQEBAAr4MAAEdPT0Q="

diff --git a/tests/eve-overlap-payload-05-gap/suricata.yaml b/tests/eve-overlap-payload-05-gap/suricata.yaml
new file mode 100644 (file)
index 0000000..2214ea8
--- /dev/null
+++ b/tests/eve-overlap-payload-05-gap/suricata.yaml
@@ -0,0 +1,14 @@
+%YAML 1.1
+---
+
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
+      filename: eve.json
+      types:
+        - alert:
+            payload: yes             # enable dumping payload in Base64
+            payload-buffer-size: 4kb # max size of payload buffer to output in eve-log
+            payload-printable: yes   # enable dumping payload in printable (lossy) format
+            packet: yes              # enable dumping of packet (without stream segments)

diff --git a/tests/eve-overlap-payload-05-gap/tcp-simple-gap2.pcap b/tests/eve-overlap-payload-05-gap/tcp-simple-gap2.pcap
new file mode 100644 (file)
index 0000000..bd60b4d
Binary files /dev/null and b/tests/eve-overlap-payload-05-gap/tcp-simple-gap2.pcap differ

diff --git a/tests/eve-overlap-payload-05-gap/test.rules b/tests/eve-overlap-payload-05-gap/test.rules
new file mode 100644 (file)
index 0000000..8b0bb46
--- /dev/null
+++ b/tests/eve-overlap-payload-05-gap/test.rules
@@ -0,0 +1,9 @@
+alert tcp-stream any any -> any any (content:"VERY"; sid:1;)
+alert tcp-stream any any -> any any (content:"GOOD"; sid:2;)
+alert tcp-stream any any -> any any (content:"DATA"; sid:3;)
+
+alert tcp-pkt any any -> any any (content:"VERY"; sid:4;)
+alert tcp-pkt any any -> any any (content:"GOOD"; sid:5;)
+alert tcp-pkt any any -> any any (content:"DATA"; sid:6;)
+
+alert tcp-stream any any -> any any (content:"VERYGOODDATA"; sid:7;)

diff --git a/tests/eve-overlap-payload-05-gap/test.yaml b/tests/eve-overlap-payload-05-gap/test.yaml
new file mode 100644 (file)
index 0000000..20c9011
--- /dev/null
+++ b/tests/eve-overlap-payload-05-gap/test.yaml
@@ -0,0 +1,59 @@
+requires:
+  min-version: 8
+
+
+args:
+- -k none
+
+checks:
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 1
+      stream: 1
+      payload: "VkVSWVs0IGJ5dGVzIG1pc3NpbmddREFUQQ=="
+      payload_printable: "VERY[4 bytes missing]DATA"
+      pkt_src: "stream (flow timeout)"
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 2
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 3
+      stream: 1
+      payload: "VkVSWVs0IGJ5dGVzIG1pc3NpbmddREFUQQ=="
+      payload_printable: "VERY[4 bytes missing]DATA"
+      pkt_src: "stream (flow timeout)"
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 4
+      payload: "VkVSWQ=="
+      payload_printable: "VERY"
+      packet: "BQQDAgEAAAECAwQFgQAABggARQAALAABAABABnTGAQEBAQICAgIwOR+QAAAAAgAAA+lQEAQAqXgAAFZFUlk="
+      stream: 0
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 5
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 6
+      payload: "REFUQQ=="
+      payload_printable: "DATA"
+      packet: "BQQDAgEAAAECAwQFgQAABggARQAALAABAABABnTGAQEBAQICAgIwOR+QAAAACgAAA+lQEAQAuYwAAERBVEE="
+      stream: 0
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 7

diff --git a/tests/eve-payload-01-tcp-exact-overlap/suricata.yaml b/tests/eve-payload-01-tcp-exact-overlap/suricata.yaml
new file mode 100644 (file)
index 0000000..2214ea8
--- /dev/null
+++ b/tests/eve-payload-01-tcp-exact-overlap/suricata.yaml
@@ -0,0 +1,14 @@
+%YAML 1.1
+---
+
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
+      filename: eve.json
+      types:
+        - alert:
+            payload: yes             # enable dumping payload in Base64
+            payload-buffer-size: 4kb # max size of payload buffer to output in eve-log
+            payload-printable: yes   # enable dumping payload in printable (lossy) format
+            packet: yes              # enable dumping of packet (without stream segments)

diff --git a/tests/eve-payload-01-tcp-exact-overlap/tcp-overlap.pcap b/tests/eve-payload-01-tcp-exact-overlap/tcp-overlap.pcap
new file mode 100644 (file)
index 0000000..221d7e7
Binary files /dev/null and b/tests/eve-payload-01-tcp-exact-overlap/tcp-overlap.pcap differ

diff --git a/tests/eve-payload-01-tcp-exact-overlap/tcp-overlap.py b/tests/eve-payload-01-tcp-exact-overlap/tcp-overlap.py
new file mode 100755 (executable)
index 0000000..8d9d933
--- /dev/null
+++ b/tests/eve-payload-01-tcp-exact-overlap/tcp-overlap.py
@@ -0,0 +1,44 @@
+#!/usr/bin/env python
+from scapy.all import *
+
+pkts = []
+
+pkt1 = Ether(dst='05:04:03:02:01:00', src='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(src='1.1.1.1', dst='2.2.2.2')/TCP(dport=8080,sport=12345,flags='S',seq=1,options=[('WScale', 5)])
+pkt2 = Ether(src='05:04:03:02:01:00', dst='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(dst='1.1.1.1', src='2.2.2.2')/TCP(sport=8080,dport=12345,flags='SA',seq=1000,ack=2,options=[('WScale', 5)],window=4096)
+pkt3 = Ether(dst='05:04:03:02:01:00', src='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(src='1.1.1.1', dst='2.2.2.2')/TCP(dport=8080,sport=12345,flags='A',seq=2,ack=1001,window=4096)
+pkt4 = Ether(src='05:04:03:02:01:00', dst='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(dst='1.1.1.1', src='2.2.2.2')/TCP(sport=8080,dport=12345,flags='A',seq=1001,ack=2,window=4096)
+pkt5 = Ether(dst='05:04:03:02:01:00', src='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(src='1.1.1.1', dst='2.2.2.2')/TCP(dport=8080,sport=12345,flags='A',seq=2,ack=1001,window=4096)/"GOOD"
+pkt6 = Ether(dst='05:04:03:02:01:00', src='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(src='1.1.1.1', dst='2.2.2.2')/TCP(dport=8080,sport=12345,flags='A',seq=2,ack=1001,window=4096)/"EVIL"
+pkt7 = Ether(src='05:04:03:02:01:00', dst='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(dst='1.1.1.1', src='2.2.2.2')/TCP(sport=8080,dport=12345,flags='A',ack=6,seq=1001,window=4096)
+
+# VLAN tagged packet
+pkts += pkt1
+pkts += pkt2
+pkts += pkt3
+pkts += pkt4
+pkts += pkt5
+pkts += pkt6
+pkts += pkt7
+
+wrpcap('tcp-overlap.pcap', pkts)
+
+pkts = []
+
+pkt1 = Ether(dst='05:04:03:02:01:00', src='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(src='1.1.1.1', dst='2.2.2.2')/TCP(dport=8080,sport=12345,flags='S',seq=1,options=[('WScale', 5)])
+pkt2 = Ether(src='05:04:03:02:01:00', dst='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(dst='1.1.1.1', src='2.2.2.2')/TCP(sport=8080,dport=12345,flags='SA',seq=1000,ack=2,options=[('WScale', 5)],window=4096)
+pkt3 = Ether(dst='05:04:03:02:01:00', src='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(src='1.1.1.1', dst='2.2.2.2')/TCP(dport=8080,sport=12345,flags='A',seq=2,ack=1001,window=4096)
+pkt4 = Ether(src='05:04:03:02:01:00', dst='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(dst='1.1.1.1', src='2.2.2.2')/TCP(sport=8080,dport=12345,flags='A',seq=1001,ack=2,window=4096)
+pkt5 = Ether(dst='05:04:03:02:01:00', src='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(src='1.1.1.1', dst='2.2.2.2')/TCP(dport=8080,sport=12345,flags='A',seq=2,ack=1001,window=4096)/"GOOD"
+pkt6 = Ether(dst='05:04:03:02:01:00', src='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(src='1.1.1.1', dst='2.2.2.2')/TCP(dport=8080,sport=12345,flags='A',seq=3, ack=1001,window=4096)/"XXX"
+pkt7 = Ether(src='05:04:03:02:01:00', dst='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(dst='1.1.1.1', src='2.2.2.2')/TCP(sport=8080,dport=12345,flags='A',ack=6,seq=1001,window=4096)
+
+# VLAN tagged packet
+pkts += pkt1
+pkts += pkt2
+pkts += pkt3
+pkts += pkt4
+pkts += pkt5
+pkts += pkt6
+pkts += pkt7
+
+wrpcap('tcp-overlap2.pcap', pkts)

diff --git a/tests/eve-payload-01-tcp-exact-overlap/tcp-overlap.rules b/tests/eve-payload-01-tcp-exact-overlap/tcp-overlap.rules
new file mode 100644 (file)
index 0000000..4d4dcab
--- /dev/null
+++ b/tests/eve-payload-01-tcp-exact-overlap/tcp-overlap.rules
@@ -0,0 +1,5 @@
+alert tcp-stream any any -> any any (content:"EVIL"; sid:1;)
+alert tcp-stream any any -> any any (content:"GOOD"; sid:2;)
+
+alert tcp-pkt any any -> any any (content:"EVIL"; sid:3;)
+alert tcp-pkt any any -> any any (content:"GOOD"; sid:4;)

diff --git a/tests/eve-payload-01-tcp-exact-overlap/test.yaml b/tests/eve-payload-01-tcp-exact-overlap/test.yaml
new file mode 100644 (file)
index 0000000..4dfe9c6
--- /dev/null
+++ b/tests/eve-payload-01-tcp-exact-overlap/test.yaml
@@ -0,0 +1,36 @@
+requires:
+  min-version: 8
+
+args:
+- -k none
+
+checks:
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 1
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 2
+      payload: "R09PRA=="
+      payload_printable: "GOOD"
+      pkt_src: "stream (flow timeout)"
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 3
+      payload: "RVZJTA=="
+      payload_printable: "EVIL"
+      packet: "BQQDAgEAAAECAwQFgQAABggARQAALAABAABABnTGAQEBAQICAgIwOR+QAAAAAgAAA+lQEBAAt3QAAEVWSUw="
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 4
+      payload: "R09PRA=="
+      payload_printable: "GOOD"
+      packet: "BQQDAgEAAAECAwQFgQAABggARQAALAABAABABnTGAQEBAQICAgIwOR+QAAAAAgAAA+lQEBAAr4MAAEdPT0Q="

diff --git a/tests/eve-payload-02-tcp-exact-overlap-policy-oldlinux/suricata.yaml b/tests/eve-payload-02-tcp-exact-overlap-policy-oldlinux/suricata.yaml
new file mode 100644 (file)
index 0000000..8851187
--- /dev/null
+++ b/tests/eve-payload-02-tcp-exact-overlap-policy-oldlinux/suricata.yaml
@@ -0,0 +1,30 @@
+%YAML 1.1
+---
+
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
+      filename: eve.json
+      types:
+        - alert:
+            payload: yes             # enable dumping payload in Base64
+            payload-buffer-size: 4kb # max size of payload buffer to output in eve-log
+            payload-printable: yes   # enable dumping payload in printable (lossy) format
+            packet: yes              # enable dumping of packet (without stream segments)
+
+host-os-policy:
+  # Make the default policy windows.
+  windows: [0.0.0.0/0]
+  bsd: []
+  bsd-right: []
+  old-linux: [2.2.2.2]
+  linux: []
+  old-solaris: []
+  solaris: []
+  hpux10: []
+  hpux11: []
+  irix: []
+  macos: []
+  vista: []
+  windows2k3: []

diff --git a/tests/eve-payload-02-tcp-exact-overlap-policy-oldlinux/tcp-overlap.pcap b/tests/eve-payload-02-tcp-exact-overlap-policy-oldlinux/tcp-overlap.pcap
new file mode 100644 (file)
index 0000000..221d7e7
Binary files /dev/null and b/tests/eve-payload-02-tcp-exact-overlap-policy-oldlinux/tcp-overlap.pcap differ

diff --git a/tests/eve-payload-02-tcp-exact-overlap-policy-oldlinux/tcp-overlap.rules b/tests/eve-payload-02-tcp-exact-overlap-policy-oldlinux/tcp-overlap.rules
new file mode 100644 (file)
index 0000000..4d4dcab
--- /dev/null
+++ b/tests/eve-payload-02-tcp-exact-overlap-policy-oldlinux/tcp-overlap.rules
@@ -0,0 +1,5 @@
+alert tcp-stream any any -> any any (content:"EVIL"; sid:1;)
+alert tcp-stream any any -> any any (content:"GOOD"; sid:2;)
+
+alert tcp-pkt any any -> any any (content:"EVIL"; sid:3;)
+alert tcp-pkt any any -> any any (content:"GOOD"; sid:4;)

diff --git a/tests/eve-payload-02-tcp-exact-overlap-policy-oldlinux/test.yaml b/tests/eve-payload-02-tcp-exact-overlap-policy-oldlinux/test.yaml
new file mode 100644 (file)
index 0000000..d641ebb
--- /dev/null
+++ b/tests/eve-payload-02-tcp-exact-overlap-policy-oldlinux/test.yaml
@@ -0,0 +1,36 @@
+requires:
+  min-version: 8
+
+args:
+- -k none
+
+checks:
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 1
+      payload: "RVZJTA=="
+      payload_printable: "EVIL"
+      pkt_src: "stream (flow timeout)"
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 2
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 3
+      payload: "RVZJTA=="
+      payload_printable: "EVIL"
+      packet: "BQQDAgEAAAECAwQFgQAABggARQAALAABAABABnTGAQEBAQICAgIwOR+QAAAAAgAAA+lQEBAAt3QAAEVWSUw="
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 4
+      payload: "R09PRA=="
+      payload_printable: "GOOD"
+      packet: "BQQDAgEAAAECAwQFgQAABggARQAALAABAABABnTGAQEBAQICAgIwOR+QAAAAAgAAA+lQEBAAr4MAAEdPT0Q="

diff --git a/tests/eve-payload-03-tcp-exact-overlap-ips/suricata.yaml b/tests/eve-payload-03-tcp-exact-overlap-ips/suricata.yaml
new file mode 100644 (file)
index 0000000..2214ea8
--- /dev/null
+++ b/tests/eve-payload-03-tcp-exact-overlap-ips/suricata.yaml
@@ -0,0 +1,14 @@
+%YAML 1.1
+---
+
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
+      filename: eve.json
+      types:
+        - alert:
+            payload: yes             # enable dumping payload in Base64
+            payload-buffer-size: 4kb # max size of payload buffer to output in eve-log
+            payload-printable: yes   # enable dumping payload in printable (lossy) format
+            packet: yes              # enable dumping of packet (without stream segments)

diff --git a/tests/eve-payload-03-tcp-exact-overlap-ips/tcp-overlap.pcap b/tests/eve-payload-03-tcp-exact-overlap-ips/tcp-overlap.pcap
new file mode 100644 (file)
index 0000000..221d7e7
Binary files /dev/null and b/tests/eve-payload-03-tcp-exact-overlap-ips/tcp-overlap.pcap differ

diff --git a/tests/eve-payload-03-tcp-exact-overlap-ips/tcp-overlap.rules b/tests/eve-payload-03-tcp-exact-overlap-ips/tcp-overlap.rules
new file mode 100644 (file)
index 0000000..4d4dcab
--- /dev/null
+++ b/tests/eve-payload-03-tcp-exact-overlap-ips/tcp-overlap.rules
@@ -0,0 +1,5 @@
+alert tcp-stream any any -> any any (content:"EVIL"; sid:1;)
+alert tcp-stream any any -> any any (content:"GOOD"; sid:2;)
+
+alert tcp-pkt any any -> any any (content:"EVIL"; sid:3;)
+alert tcp-pkt any any -> any any (content:"GOOD"; sid:4;)

diff --git a/tests/eve-payload-03-tcp-exact-overlap-ips/test.yaml b/tests/eve-payload-03-tcp-exact-overlap-ips/test.yaml
new file mode 100644 (file)
index 0000000..0da9f7d
--- /dev/null
+++ b/tests/eve-payload-03-tcp-exact-overlap-ips/test.yaml
@@ -0,0 +1,35 @@
+requires:
+  min-version: 8
+
+args:
+- -k none
+
+checks:
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 1
+- filter:
+    count: 2 # one for original, one for overlap
+    match:
+      event_type: alert
+      alert.signature_id: 2
+      payload: "R09PRA=="
+      payload_printable: "GOOD"
+      packet: "BQQDAgEAAAECAwQFgQAABggARQAALAABAABABnTGAQEBAQICAgIwOR+QAAAAAgAAA+lQEBAAr4MAAEdPT0Q="
+      stream: 1
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 3
+- filter:
+    count: 2
+    match:
+      event_type: alert
+      alert.signature_id: 4
+      payload: "R09PRA=="
+      payload_printable: "GOOD"
+      packet: "BQQDAgEAAAECAwQFgQAABggARQAALAABAABABnTGAQEBAQICAgIwOR+QAAAAAgAAA+lQEBAAr4MAAEdPT0Q="
+      stream: 0

diff --git a/tests/eve-payload-04-partial-overlap/suricata.yaml b/tests/eve-payload-04-partial-overlap/suricata.yaml
new file mode 100644 (file)
index 0000000..2214ea8
--- /dev/null
+++ b/tests/eve-payload-04-partial-overlap/suricata.yaml
@@ -0,0 +1,14 @@
+%YAML 1.1
+---
+
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
+      filename: eve.json
+      types:
+        - alert:
+            payload: yes             # enable dumping payload in Base64
+            payload-buffer-size: 4kb # max size of payload buffer to output in eve-log
+            payload-printable: yes   # enable dumping payload in printable (lossy) format
+            packet: yes              # enable dumping of packet (without stream segments)

diff --git a/tests/eve-payload-04-partial-overlap/tcp-overlap.rules b/tests/eve-payload-04-partial-overlap/tcp-overlap.rules
new file mode 100644 (file)
index 0000000..c41465d
--- /dev/null
+++ b/tests/eve-payload-04-partial-overlap/tcp-overlap.rules
@@ -0,0 +1,5 @@
+alert tcp-stream any any -> any any (content:"XXX"; sid:1;)
+alert tcp-stream any any -> any any (content:"GOOD"; sid:2;)
+
+alert tcp-pkt any any -> any any (content:"XXX"; sid:3;)
+alert tcp-pkt any any -> any any (content:"GOOD"; sid:4;)

diff --git a/tests/eve-payload-04-partial-overlap/tcp-overlap2.pcap b/tests/eve-payload-04-partial-overlap/tcp-overlap2.pcap
new file mode 100644 (file)
index 0000000..e860e23
Binary files /dev/null and b/tests/eve-payload-04-partial-overlap/tcp-overlap2.pcap differ

diff --git a/tests/eve-payload-04-partial-overlap/test.yaml b/tests/eve-payload-04-partial-overlap/test.yaml
new file mode 100644 (file)
index 0000000..2a8ef3c
--- /dev/null
+++ b/tests/eve-payload-04-partial-overlap/test.yaml
@@ -0,0 +1,39 @@
+requires:
+  min-version: 8
+
+
+args:
+- -k none
+
+checks:
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 1
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 2
+      stream: 1
+      payload: "R09PRA=="
+      payload_printable: "GOOD"
+      pkt_src: "stream (flow timeout)"
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 3
+      stream: 0
+      payload: "WFhY"
+      payload_printable: "XXX"
+      packet: "BQQDAgEAAAECAwQFgQAABggARQAAKwABAABABnTHAQEBAQICAgIwOR+QAAAAAwAAA+lQEBAAlb4AAFhYWA=="
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 4
+      payload: "R09PRA=="
+      payload_printable: "GOOD"
+      packet: "BQQDAgEAAAECAwQFgQAABggARQAALAABAABABnTGAQEBAQICAgIwOR+QAAAAAgAAA+lQEBAAr4MAAEdPT0Q="

diff --git a/tests/eve-payload-05-tcp-data-gap/suricata.yaml b/tests/eve-payload-05-tcp-data-gap/suricata.yaml
new file mode 100644 (file)
index 0000000..2214ea8
--- /dev/null
+++ b/tests/eve-payload-05-tcp-data-gap/suricata.yaml
@@ -0,0 +1,14 @@
+%YAML 1.1
+---
+
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
+      filename: eve.json
+      types:
+        - alert:
+            payload: yes             # enable dumping payload in Base64
+            payload-buffer-size: 4kb # max size of payload buffer to output in eve-log
+            payload-printable: yes   # enable dumping payload in printable (lossy) format
+            packet: yes              # enable dumping of packet (without stream segments)

diff --git a/tests/eve-payload-05-tcp-data-gap/tcp-simple-gap2.pcap b/tests/eve-payload-05-tcp-data-gap/tcp-simple-gap2.pcap
new file mode 100644 (file)
index 0000000..bd60b4d
Binary files /dev/null and b/tests/eve-payload-05-tcp-data-gap/tcp-simple-gap2.pcap differ

diff --git a/tests/eve-payload-05-tcp-data-gap/test.rules b/tests/eve-payload-05-tcp-data-gap/test.rules
new file mode 100644 (file)
index 0000000..8b0bb46
--- /dev/null
+++ b/tests/eve-payload-05-tcp-data-gap/test.rules
@@ -0,0 +1,9 @@
+alert tcp-stream any any -> any any (content:"VERY"; sid:1;)
+alert tcp-stream any any -> any any (content:"GOOD"; sid:2;)
+alert tcp-stream any any -> any any (content:"DATA"; sid:3;)
+
+alert tcp-pkt any any -> any any (content:"VERY"; sid:4;)
+alert tcp-pkt any any -> any any (content:"GOOD"; sid:5;)
+alert tcp-pkt any any -> any any (content:"DATA"; sid:6;)
+
+alert tcp-stream any any -> any any (content:"VERYGOODDATA"; sid:7;)

diff --git a/tests/eve-payload-05-tcp-data-gap/test.yaml b/tests/eve-payload-05-tcp-data-gap/test.yaml
new file mode 100644 (file)
index 0000000..20c9011
--- /dev/null
+++ b/tests/eve-payload-05-tcp-data-gap/test.yaml
@@ -0,0 +1,59 @@
+requires:
+  min-version: 8
+
+
+args:
+- -k none
+
+checks:
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 1
+      stream: 1
+      payload: "VkVSWVs0IGJ5dGVzIG1pc3NpbmddREFUQQ=="
+      payload_printable: "VERY[4 bytes missing]DATA"
+      pkt_src: "stream (flow timeout)"
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 2
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 3
+      stream: 1
+      payload: "VkVSWVs0IGJ5dGVzIG1pc3NpbmddREFUQQ=="
+      payload_printable: "VERY[4 bytes missing]DATA"
+      pkt_src: "stream (flow timeout)"
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 4
+      payload: "VkVSWQ=="
+      payload_printable: "VERY"
+      packet: "BQQDAgEAAAECAwQFgQAABggARQAALAABAABABnTGAQEBAQICAgIwOR+QAAAAAgAAA+lQEAQAqXgAAFZFUlk="
+      stream: 0
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 5
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 6
+      payload: "REFUQQ=="
+      payload_printable: "DATA"
+      packet: "BQQDAgEAAAECAwQFgQAABggARQAALAABAABABnTGAQEBAQICAgIwOR+QAAAACgAAA+lQEAQAuYwAAERBVEE="
+      stream: 0
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 7

diff --git a/tests/eve-payload-06-tcp-data-leading-gap/suricata.yaml b/tests/eve-payload-06-tcp-data-leading-gap/suricata.yaml
new file mode 100644 (file)
index 0000000..2214ea8
--- /dev/null
+++ b/tests/eve-payload-06-tcp-data-leading-gap/suricata.yaml
@@ -0,0 +1,14 @@
+%YAML 1.1
+---
+
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
+      filename: eve.json
+      types:
+        - alert:
+            payload: yes             # enable dumping payload in Base64
+            payload-buffer-size: 4kb # max size of payload buffer to output in eve-log
+            payload-printable: yes   # enable dumping payload in printable (lossy) format
+            packet: yes              # enable dumping of packet (without stream segments)

diff --git a/tests/eve-payload-06-tcp-data-leading-gap/tcp-leading-gap.pcap b/tests/eve-payload-06-tcp-data-leading-gap/tcp-leading-gap.pcap
new file mode 100644 (file)
index 0000000..d713a5a
Binary files /dev/null and b/tests/eve-payload-06-tcp-data-leading-gap/tcp-leading-gap.pcap differ

diff --git a/tests/eve-payload-06-tcp-data-leading-gap/tcp.py b/tests/eve-payload-06-tcp-data-leading-gap/tcp.py
new file mode 100755 (executable)
index 0000000..fddd8b0
--- /dev/null
+++ b/tests/eve-payload-06-tcp-data-leading-gap/tcp.py
@@ -0,0 +1,22 @@
+#!/usr/bin/env python
+from scapy.all import *
+
+pkts = []
+
+pkt1 = Ether(dst='05:04:03:02:01:00', src='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(src='1.1.1.1', dst='2.2.2.2')/TCP(dport=8080,sport=12345,flags='S',seq=1,options=[('WScale', 5)])
+pkt2 = Ether(src='05:04:03:02:01:00', dst='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(dst='1.1.1.1', src='2.2.2.2')/TCP(sport=8080,dport=12345,flags='SA',seq=1000,ack=2,options=[('WScale', 5)],window=4096)
+pkt3 = Ether(dst='05:04:03:02:01:00', src='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(src='1.1.1.1', dst='2.2.2.2')/TCP(dport=8080,sport=12345,flags='A',seq=2,ack=1001,window=4096)
+pkt4 = Ether(src='05:04:03:02:01:00', dst='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(dst='1.1.1.1', src='2.2.2.2')/TCP(sport=8080,dport=12345,flags='A',seq=1001,ack=2,window=4096)
+pkt5 = Ether(dst='05:04:03:02:01:00', src='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(src='1.1.1.1', dst='2.2.2.2')/TCP(dport=8080,sport=12345,flags='A',seq=6,ack=1001,window=4096)/"GOOD"
+pkt6 = Ether(dst='05:04:03:02:01:00', src='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(src='1.1.1.1', dst='2.2.2.2')/TCP(dport=8080,sport=12345,flags='A',seq=10,ack=1001,window=4096)/"DATA"
+pkt7 = Ether(src='05:04:03:02:01:00', dst='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(dst='1.1.1.1', src='2.2.2.2')/TCP(sport=8080,dport=12345,flags='A',ack=14,seq=1001,window=4096)
+
+pkts += pkt1
+pkts += pkt2
+pkts += pkt3
+pkts += pkt4
+pkts += pkt5
+pkts += pkt6
+pkts += pkt7
+
+wrpcap('tcp-leading-gap.pcap', pkts)

diff --git a/tests/eve-payload-06-tcp-data-leading-gap/test.rules b/tests/eve-payload-06-tcp-data-leading-gap/test.rules
new file mode 100644 (file)
index 0000000..8b0bb46
--- /dev/null
+++ b/tests/eve-payload-06-tcp-data-leading-gap/test.rules
@@ -0,0 +1,9 @@
+alert tcp-stream any any -> any any (content:"VERY"; sid:1;)
+alert tcp-stream any any -> any any (content:"GOOD"; sid:2;)
+alert tcp-stream any any -> any any (content:"DATA"; sid:3;)
+
+alert tcp-pkt any any -> any any (content:"VERY"; sid:4;)
+alert tcp-pkt any any -> any any (content:"GOOD"; sid:5;)
+alert tcp-pkt any any -> any any (content:"DATA"; sid:6;)
+
+alert tcp-stream any any -> any any (content:"VERYGOODDATA"; sid:7;)

diff --git a/tests/eve-payload-06-tcp-data-leading-gap/test.yaml b/tests/eve-payload-06-tcp-data-leading-gap/test.yaml
new file mode 100644 (file)
index 0000000..557aa1b
--- /dev/null
+++ b/tests/eve-payload-06-tcp-data-leading-gap/test.yaml
@@ -0,0 +1,51 @@
+requires:
+  min-version: 8
+
+
+args:
+- -k none
+
+checks:
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 1
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 2
+      payload_printable: "[4 bytes missing]GOODDATA"
+      stream: 1
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 3
+      stream: 1
+      payload_printable: "[4 bytes missing]GOODDATA"
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 4
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 5
+      payload_printable: "GOOD"
+      stream: 0
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 6
+      payload_printable: "DATA"
+      stream: 0
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 7

diff --git a/tests/eve-payload-07-http-gap/suricata.yaml b/tests/eve-payload-07-http-gap/suricata.yaml
new file mode 100644 (file)
index 0000000..2214ea8
--- /dev/null
+++ b/tests/eve-payload-07-http-gap/suricata.yaml
@@ -0,0 +1,14 @@
+%YAML 1.1
+---
+
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
+      filename: eve.json
+      types:
+        - alert:
+            payload: yes             # enable dumping payload in Base64
+            payload-buffer-size: 4kb # max size of payload buffer to output in eve-log
+            payload-printable: yes   # enable dumping payload in printable (lossy) format
+            packet: yes              # enable dumping of packet (without stream segments)

diff --git a/tests/eve-payload-07-http-gap/test.rules b/tests/eve-payload-07-http-gap/test.rules
new file mode 100644 (file)
index 0000000..5d79601
--- /dev/null
+++ b/tests/eve-payload-07-http-gap/test.rules
@@ -0,0 +1,4 @@
+alert http any any -> any any (http.method; content:"GET"; sid:1;)
+alert http any any -> any any (http.stat_msg; content:"OK"; sid:2;)
+alert http any any -> any any (frame:http1.response; content:"AAAA"; sid:3;)
+alert http any any -> any any (content:"AAAA"; sid:4;)

diff --git a/tests/eve-payload-07-http-gap/test.yaml b/tests/eve-payload-07-http-gap/test.yaml
new file mode 100644 (file)
index 0000000..bd361e2
--- /dev/null
+++ b/tests/eve-payload-07-http-gap/test.yaml
@@ -0,0 +1,61 @@
+requires:
+  min-version: 8
+
+pcap: ../http-gap-beyond-body/input.pcap
+
+args:
+- -k none
+
+checks:
+- filter:
+    count: 3
+    match:
+      event_type: alert
+      alert.signature_id: 1
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 1
+      payload_printable: "GET /1 HTTP/1.0\r\nUser-Agent: Mozilla\r\n\r\n"
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 1
+      payload_printable: "GET /1 HTTP/1.0\r\nUser-Agent: Mozilla\r\n\r\nGET /2 HTTP/1.0\r\nUser-Agent: Mozilla\r\n\r\n"
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 1
+      payload_printable: "GET /1 HTTP/1.0\r\nUser-Agent: Mozilla\r\n\r\nGET /2 HTTP/1.0\r\nUser-Agent: Mozilla\r\n\r\nGET /3 HTTP/1.0\r\nUser-Agent: Mozilla\r\n\r\n"
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 2
+      payload_printable: "HTTP/1.0 200 OK\r\nDate: Mon, 31 Aug 2009 20:25:50 GMT\r\nServer: Apache\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 12\r\n\r\n"
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 3
+      payload_printable: "HTTP/1.0 200 OK\r\nDate: Mon, 31 Aug 2009 20:25:50 GMT\r\nServer: Apache\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 12\r\n\r\n[127 bytes missing]AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHTTP/1.0 200 OK\r\nServer: Apache\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 12\r\n\r\nHello People\r\n"
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 4
+      payload_printable: "HTTP/1.0 200 OK\r\nDate: Mon, 31 Aug 2009 20:25:50 GMT\r\nServer: Apache\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 12\r\n\r\n[127 bytes missing]AAAAAAAAAAAAAAAAAAAAAAAAAAAA"
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 4
+      payload_printable: "HTTP/1.0 200 OK\r\nDate: Mon, 31 Aug 2009 20:25:50 GMT\r\nServer: Apache\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 12\r\n\r\n[127 bytes missing]AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHTTP/1.0 200 OK\r\nServer: Apache\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 12\r\n\r\nHello People\r\n"
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 2