base64: add basic tests

diff --git a/tests/base64/README.md b/tests/base64/README.md
new file mode 100644 (file)
index 0000000..4fb949a
--- /dev/null
+++ b/tests/base64/README.md
@@ -0,0 +1 @@
+Match on base64 operations.

diff --git a/tests/base64/input.pcap b/tests/base64/input.pcap
new file mode 100644 (file)
index 0000000..392ce8d
Binary files /dev/null and b/tests/base64/input.pcap differ

diff --git a/tests/base64/test.rules b/tests/base64/test.rules
new file mode 100644 (file)
index 0000000..50217b0
--- /dev/null
+++ b/tests/base64/test.rules
@@ -0,0 +1,6 @@
+# input pcap contains a query to http://home.regit.org/?arg=dGhpc2lzYXRlc3QK
+# "dGhpc2lzYXRlc3QK" is "thisisatest"
+alert http any any -> any any (msg:"Example"; http.uri; content:"arg"; base64_decode:bytes 17, offset 1, relative; base64_data; content:"thisisatest"; sid:1; rev:1;)
+alert http any any -> any any (msg:"Example"; content:"arg"; http_uri; base64_decode:bytes 17, offset 1, relative; base64_data; content:"thisisatest"; sid:2; rev:1;)
+alert http any any -> any any (msg:"Example"; http.uri; content:"arg"; base64_decode:bytes 10, offset 1, relative; base64_data; content:"test"; sid:3; rev:1;)
+alert http any any -> any any (msg:"Example"; http.uri; content:"arg"; base64_decode:bytes 17, offset 1, relative; base64_data; content:"toast"; sid:4; rev:1;)

diff --git a/tests/base64/test.yaml b/tests/base64/test.yaml
new file mode 100644 (file)
index 0000000..7bc37ce
--- /dev/null
+++ b/tests/base64/test.yaml
@@ -0,0 +1,31 @@
+requires:
+  features:
+    - HAVE_LIBJANSSON
+  min-version: 5.0.0
+
+args:
+  - -k none
+
+pcap: input.pcap
+
+checks:
+  - filter:
+      count: 1
+      match:
+         event_type: alert
+         alert.signature_id: 1
+  - filter:
+      count: 1
+      match:
+         event_type: alert
+         alert.signature_id: 2
+  - filter:
+      count: 0
+      match:
+         event_type: alert
+         alert.signature_id: 3
+  - filter:
+      count: 0
+      match:
+         event_type: alert
+         alert.signature_id: 4