]> git.ipfire.org Git - thirdparty/suricata-verify.git/commitdiff
Adds test for http file to server
authorPhilippe Antoine <contact@catenacyber.fr>
Fri, 26 Aug 2022 07:26:59 +0000 (09:26 +0200)
committerVictor Julien <victor@inliniac.net>
Tue, 13 Sep 2022 09:42:14 +0000 (11:42 +0200)
tests/http-post-file/README.md [new file with mode: 0644]
tests/http-post-file/input.pcap [new file with mode: 0644]
tests/http-post-file/mm.go [new file with mode: 0644]
tests/http-post-file/test.rules [new file with mode: 0644]
tests/http-post-file/test.yaml [new file with mode: 0644]

diff --git a/tests/http-post-file/README.md b/tests/http-post-file/README.md
new file mode 100644 (file)
index 0000000..5176882
--- /dev/null
@@ -0,0 +1,10 @@
+# Description
+
+Test HTTP file to server.
+
+# PCAP
+
+The pcap comes from running server
+`docker run --name mattermost-preview -d --publish 8065:8065 mattermost/mattermost-preview -m=4G`
+
+And client from mm.go (you need to setup credentials and channel Id)
diff --git a/tests/http-post-file/input.pcap b/tests/http-post-file/input.pcap
new file mode 100644 (file)
index 0000000..1ba2be5
Binary files /dev/null and b/tests/http-post-file/input.pcap differ
diff --git a/tests/http-post-file/mm.go b/tests/http-post-file/mm.go
new file mode 100644 (file)
index 0000000..0e9ed86
--- /dev/null
@@ -0,0 +1,23 @@
+package main
+
+import (
+       "bytes"
+       "encoding/hex"
+       "fmt"
+       "github.com/mattermost/mattermost-server/v5/model"
+)
+
+func main() {
+       Client := model.NewAPIv4Client("http://localhost:8065/")
+       Client.Login("toto", "tototo")
+       data, _ := hex.DecodeString("58354f2150254041505b345c505a58353428505e2937434329377d2445494341522d5354414e444152442d414e544956495255532d544553542d46494c452124482b482a")
+       us := &model.UploadSession{
+               ChannelId: "7wynam16o38tbfgegi1qjr53oy",
+               Filename:  "eicar",
+               FileSize:  int64(len(data)),
+       }
+       us, response := Client.CreateUpload(us)
+       fmt.Printf("lol %s %#+v\n", us, response)
+       info, err2 := Client.UploadData(us.Id, bytes.NewReader(data))
+       fmt.Printf("lol %s %#+v\n", err2, info)
+}
diff --git a/tests/http-post-file/test.rules b/tests/http-post-file/test.rules
new file mode 100644 (file)
index 0000000..225de0d
--- /dev/null
@@ -0,0 +1 @@
+alert http any any -> any any (msg:"EICAR file"; flow:to_server; file_data; content:"|58354f2150254041505b345c505a58353428505e2937434329377d2445494341522d5354414e444152442d414e544956495255532d544553542d46494c452124482b482a|"; sid:1; rev:1;)
diff --git a/tests/http-post-file/test.yaml b/tests/http-post-file/test.yaml
new file mode 100644 (file)
index 0000000..66335ef
--- /dev/null
@@ -0,0 +1,13 @@
+requires:
+  min-version: 7
+
+# disables checksum verification
+args:
+- -k none
+
+checks:
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 1