--- /dev/null
+# Description
+
+Translation of unit test DetectEngineHttpRawUriTest01
--- /dev/null
+alert http any any -> any any (msg:"http raw uri test"; content:"../c/./d"; http_raw_uri; sid:1;)
--- /dev/null
+requires:
+ min-version: 8.0.0
+
+args:
+ - -k none --set stream.inline=true
+
+checks:
+ - filter:
+ count: 1
+ match:
+ event_type: alert
+ alert.signature_id: 1
+ pcap_cnt: 5
--- /dev/null
+# Description
+
+Translation of unit test DetectEngineHttpRawUriTest02
--- /dev/null
+alert http any any -> any any (msg:"http raw uri test"; content:"/c/./d"; http_raw_uri; offset:5; sid:1;)
--- /dev/null
+requires:
+ min-version: 8.0.0
+
+args:
+ - -k none --set stream.inline=true
+
+checks:
+ - filter:
+ count: 1
+ match:
+ event_type: alert
+ alert.signature_id: 1
--- /dev/null
+# Description
+
+Translation of unit test DetectEngineHttpRawUriTest03
--- /dev/null
+alert http any any -> any any (msg:"http raw uri test"; content:"/a/b"; http_raw_uri; offset:10; sid:1;)
--- /dev/null
+requires:
+ min-version: 8.0.0
+
+args:
+ - -k none --set stream.inline=true
+
+checks:
+ - filter:
+ count: 0
+ match:
+ event_type: alert
+ alert.signature_id: 1
--- /dev/null
+# Description
+
+Translation of unit test DetectEngineHttpRawUriTest04
--- /dev/null
+alert http any any -> any any (msg:"http raw uri test"; content:!"/a/b"; http_raw_uri; offset:10; sid:1;)
--- /dev/null
+requires:
+ min-version: 8.0.0
+
+args:
+ - -k none --set stream.inline=true
+
+checks:
+ - filter:
+ count: 1
+ match:
+ event_type: alert
+ alert.signature_id: 1
+ pcap_cnt: 5
--- /dev/null
+# Description
+
+Translation of unit test DetectEngineHttpRawUriTest05
--- /dev/null
+alert http any any -> any any (msg:"http raw uri test"; content:"a/b"; http_raw_uri; depth:10; sid:1;)
--- /dev/null
+requires:
+ min-version: 8.0.0
+
+args:
+ - -k none --set stream.inline=true
+
+checks:
+ - filter:
+ count: 1
+ match:
+ event_type: alert
+ alert.signature_id: 1
+ pcap_cnt: 5
--- /dev/null
+# Description
+
+Translation of unit test DetectEngineHttpRawUriTest06
--- /dev/null
+alert http any any -> any any (msg:"http raw uri test"; content:!"/a/b"; http_raw_uri; depth:25; sid:1;)
--- /dev/null
+requires:
+ min-version: 8.0.0
+
+args:
+ - -k none --set stream.inline=true
+
+checks:
+ - filter:
+ count: 0
+ match:
+ event_type: alert
+ alert.signature_id: 1
--- /dev/null
+# Description
+
+Translation of unit test DetectEngineHttpRawUriTest07
--- /dev/null
+alert http any any -> any any (msg:"http raw uri test"; content:!"/c/./d"; http_raw_uri; depth:12; sid:1;)
--- /dev/null
+requires:
+ min-version: 8.0.0
+
+args:
+ - -k none --set stream.inline=true
+
+checks:
+ - filter:
+ count: 1
+ match:
+ event_type: alert
+ alert.signature_id: 1
+ pcap_cnt: 5
--- /dev/null
+# Description
+
+Translation of unit test DetectEngineHttpRawUriTest08
--- /dev/null
+alert http any any -> any any (msg:"http raw uri test"; content:!"/c/./d"; http_raw_uri; depth:18; sid:1;)
--- /dev/null
+requires:
+ min-version: 8.0.0
+
+args:
+ - -k none --set stream.inline=true
+
+checks:
+ - filter:
+ count: 0
+ match:
+ event_type: alert
+ alert.signature_id: 1
--- /dev/null
+# Description
+
+Translation of unit test DetectEngineHttpRawUriTest09
--- /dev/null
+alert http any any -> any any (msg:"http raw uri test"; content:"/a"; http_raw_uri; content:"./c/."; http_raw_uri; within:9; sid:1;)
--- /dev/null
+requires:
+ min-version: 8.0.0
+
+args:
+ - -k none --set stream.inline=true
+
+checks:
+ - filter:
+ count: 1
+ match:
+ event_type: alert
+ alert.signature_id: 1
+ pcap_cnt: 5
--- /dev/null
+# Description
+
+Translation of unit test DetectEngineHttpRawUriTest10
--- /dev/null
+alert http any any -> any any (msg:"http raw uri test"; content:"/a"; http_raw_uri; content:!"boom"; http_raw_uri; within:5; sid:1;)
--- /dev/null
+requires:
+ min-version: 8.0.0
+
+args:
+ - -k none --set stream.inline=true
+
+checks:
+ - filter:
+ count: 1
+ match:
+ event_type: alert
+ alert.signature_id: 1
+ pcap_cnt: 5
--- /dev/null
+# Description
+
+Translation of unit test DetectEngineHttpRawUriTest11
--- /dev/null
+alert http any any -> any any (msg:"http raw uri test"; content:"./a"; http_raw_uri; content:"boom"; http_raw_uri; within:5; sid:1;)
--- /dev/null
+requires:
+ min-version: 8.0.0
+
+args:
+ - -k none --set stream.inline=true
+
+checks:
+ - filter:
+ count: 0
+ match:
+ event_type: alert
+ alert.signature_id: 1
--- /dev/null
+# Description
+
+Translation of unit test DetectEngineHttpRawUriTest12
--- /dev/null
+alert http any any -> any any (msg:"http raw uri test"; content:"./a"; http_raw_uri; content:!"/b/.."; http_raw_uri; within:5; sid:1;)
--- /dev/null
+requires:
+ min-version: 8.0.0
+
+args:
+ - -k none --set stream.inline=true
+
+checks:
+ - filter:
+ count: 0
+ match:
+ event_type: alert
+ alert.signature_id: 1
--- /dev/null
+# Description
+
+Translation of unit test DetectEngineHttpRawUriTest13
--- /dev/null
+alert http any any -> any any (msg:"http raw uri test"; content:"./a"; http_raw_uri; content:"/c/."; http_raw_uri; distance:5; sid:1;)
--- /dev/null
+requires:
+ min-version: 8.0.0
+
+args:
+ - -k none --set stream.inline=true
+
+checks:
+ - filter:
+ count: 1
+ match:
+ event_type: alert
+ alert.signature_id: 1
+ pcap_cnt: 5
--- /dev/null
+# Description
+
+Translation of unit test DetectEngineHttpRawUriTest14
--- /dev/null
+alert http any any -> any any (msg:"http raw uri test"; content:"./a"; http_raw_uri; content:!"b/.."; http_raw_uri; distance:5; sid:1;)
--- /dev/null
+requires:
+ min-version: 8.0.0
+
+args:
+ - -k none --set stream.inline=true
+
+checks:
+ - filter:
+ count: 1
+ match:
+ event_type: alert
+ alert.signature_id: 1
+ pcap_cnt: 5
--- /dev/null
+# Description
+
+Translation of unit test DetectEngineHttpRawUriTest15
--- /dev/null
+alert http any any -> any any (msg:"http raw uri test"; content:"./a"; http_raw_uri; content:"/c/"; http_raw_uri; distance:7; sid:1;)
--- /dev/null
+requires:
+ min-version: 8.0.0
+
+args:
+ - -k none --set stream.inline=true
+
+checks:
+ - filter:
+ count: 0
+ match:
+ event_type: alert
+ alert.signature_id: 1
--- /dev/null
+# Description
+
+Translation of unit test DetectEngineHttpRawUriTest16
--- /dev/null
+alert http any any -> any any (msg:"http raw uri test"; content:"./a"; http_raw_uri; content:!"/c/"; http_raw_uri; distance:4; sid:1;)
--- /dev/null
+requires:
+ min-version: 8.0.0
+
+args:
+ - -k none --set stream.inline=true
+
+checks:
+ - filter:
+ count: 0
+ match:
+ event_type: alert
+ alert.signature_id: 1
--- /dev/null
+# Description
+
+Translation of unit test DetectEngineHttpRawUriTest21
--- /dev/null
+alert http any any -> any any (msg:"http raw uri test"; pcre:/\.\/a/I; content:!"/c/"; http_raw_uri; within:5; sid:1;)
--- /dev/null
+requires:
+ min-version: 8.0.0
+
+args:
+ - -k none --set stream.inline=true
+
+checks:
+ - filter:
+ count: 1
+ match:
+ event_type: alert
+ alert.signature_id: 1
+ pcap_cnt: 5
--- /dev/null
+# Description
+
+Translation of unit test DetectEngineHttpRawUriTest22
--- /dev/null
+alert http any any -> any any (msg:"http raw uri test"; pcre:/\.\/a/I; content:!"/c/"; within:5; http_raw_uri; sid:1;)
--- /dev/null
+requires:
+ min-version: 8.0.0
+
+args:
+ - -k none --set stream.inline=true
+
+checks:
+ - filter:
+ count: 1
+ match:
+ event_type: alert
+ alert.signature_id: 1
+ pcap_cnt: 5
--- /dev/null
+# Description
+
+Translation of unit test DetectEngineHttpRawUriTest23
--- /dev/null
+alert http any any -> any any (msg:"http raw uri test"; pcre:/\.\/a/I; content:!"/c/"; distance:3; http_raw_uri; sid:1;)
--- /dev/null
+requires:
+ min-version: 8.0.0
+
+args:
+ - -k none --set stream.inline=true
+
+checks:
+ - filter:
+ count: 0
+ match:
+ event_type: alert
+ alert.signature_id: 1
--- /dev/null
+# Description
+
+Translation of unit test DetectEngineHttpRawUriTest24
--- /dev/null
+alert http any any -> any any (msg:"http raw uri test"; pcre:/\.\/a/I; content:!"/c/"; distance:10; http_raw_uri; sid:1;)
--- /dev/null
+requires:
+ min-version: 8.0.0
+
+args:
+ - -k none --set stream.inline=true
+
+checks:
+ - filter:
+ count: 1
+ match:
+ event_type: alert
+ alert.signature_id: 1
+ pcap_cnt: 5
--- /dev/null
+# Description
+
+Translation of unit test DetectEngineHttpRawUriTest25
--- /dev/null
+alert http any any -> any any (msg:"http raw uri test"; pcre:/\.\/a/I; content:"/c/"; within:10; http_raw_uri; sid:1;)
--- /dev/null
+requires:
+ min-version: 8.0.0
+
+args:
+ - -k none --set stream.inline=true
+
+checks:
+ - filter:
+ count: 1
+ match:
+ event_type: alert
+ alert.signature_id: 1
+ pcap_cnt: 5
--- /dev/null
+# Description
+
+Translation of unit test DetectEngineHttpRawUriTest26
--- /dev/null
+alert http any any -> any any (msg:"http raw uri test"; pcre:/\.\/a/I; content:"/c/"; within:5; http_raw_uri; sid:1;)
--- /dev/null
+requires:
+ min-version: 8.0.0
+
+args:
+ - -k none --set stream.inline=true
+
+checks:
+ - filter:
+ count: 0
+ match:
+ event_type: alert
+ alert.signature_id: 1
--- /dev/null
+# Description
+
+Translation of unit test DetectEngineHttpRawUriTest27
--- /dev/null
+alert http any any -> any any (msg:"http raw uri test"; pcre:/\.\/a/I; content:"/c/"; distance:5; http_raw_uri; sid:1;)
--- /dev/null
+requires:
+ min-version: 8.0.0
+
+args:
+ - -k none --set stream.inline=true
+
+checks:
+ - filter:
+ count: 1
+ match:
+ event_type: alert
+ alert.signature_id: 1
+ pcap_cnt: 5
--- /dev/null
+# Description
+
+Translation of unit test DetectEngineHttpRawUriTest28
--- /dev/null
+alert http any any -> any any (msg:"http raw uri test"; pcre:/\.\/a/I; content:"/c/"; distance:10; http_raw_uri; sid:1;)
--- /dev/null
+requires:
+ min-version: 8.0.0
+
+args:
+ - -k none --set stream.inline=true
+
+checks:
+ - filter:
+ count: 0
+ match:
+ event_type: alert
+ alert.signature_id: 1
--- /dev/null
+# Description
+
+Translation of unit test DetectEngineHttpRawUriTest29
--- /dev/null
+alert tcp any any -> any any (msg:"test multiple relative raw uri contents"; content:"/c/"; http_raw_uri; isdataat:4,relative; sid:1;)
--- /dev/null
+requires:
+ min-version: 8.0.0
+
+args:
+ - -k none --set stream.inline=true
+
+checks:
+ - filter:
+ count: 1
+ match:
+ event_type: alert
+ alert.signature_id: 1
--- /dev/null
+# Description
+
+Translation of unit test DetectEngineHttpRawUriTest30
--- /dev/null
+alert tcp any any -> any any (msg:"test multiple relative raw uri contents"; uricontent:"/c/"; isdataat:!10,relative; sid:1;)
--- /dev/null
+requires:
+ min-version: 8.0.0
+
+args:
+ - -k none --set stream.inline=true
+
+checks:
+ - filter:
+ count: 1
+ match:
+ event_type: alert
+ alert.signature_id: 1
--- /dev/null
+# Description
+
+Translation of unit test UriTestSig01
--- /dev/null
+alert tcp any any -> any any (msg:"Test uricontent option"; uricontent:"one"; sid:1;)
--- /dev/null
+requires:
+ min-version: 8.0.0
+
+args:
+ - -k none --set stream.inline=true
+
+checks:
+ - filter:
+ count: 1
+ match:
+ event_type: alert
+ alert.signature_id: 1
+ pcap_cnt: 4
+ - filter:
+ count: 1
+ match:
+ event_type: alert
+ alert.signature_id: 1
+ pcap_cnt: 5
--- /dev/null
+# Description
+
+Translation of unit test UriTestSig02
--- /dev/null
+alert tcp any any -> any any (msg:"Test pcre /U option"; pcre:/one/U; sid:1;)
--- /dev/null
+requires:
+ min-version: 8.0.0
+
+args:
+ - -k none --set stream.inline=true
+
+checks:
+ - filter:
+ count: 1
+ match:
+ event_type: alert
+ alert.signature_id: 1
+ pcap_cnt: 5
--- /dev/null
+# Description
+
+Translation of unit test UriTestSig03
--- /dev/null
+alert tcp any any -> any any (msg:"Test pcre /U option"; pcre:/blah/U; sid:1;)
--- /dev/null
+requires:
+ min-version: 8.0.0
+
+args:
+ - -k none --set stream.inline=true
+
+checks:
+ - filter:
+ count: 0
+ match:
+ event_type: alert
+ alert.signature_id: 1
--- /dev/null
+# Description
+
+Translation of unit test UriTestSig04
--- /dev/null
+alert tcp any any -> any any (msg:"Test urilen option"; urilen:>20; sid:1;)
--- /dev/null
+requires:
+ min-version: 8.0.0
+
+args:
+ - -k none --set stream.inline=true
+
+checks:
+ - filter:
+ count: 0
+ match:
+ event_type: alert
+ alert.signature_id: 1
--- /dev/null
+# Description
+
+Translation of unit test UriTestSig05
--- /dev/null
+alert tcp any any -> any any (msg:"Test urilen option"; urilen:>4; sid:1;)
--- /dev/null
+requires:
+ min-version: 8.0.0
+
+args:
+ - -k none --set stream.inline=true
+
+checks:
+ - filter:
+ count: 1
+ match:
+ event_type: alert
+ alert.signature_id: 1
+ pcap_cnt: 5
--- /dev/null
+# Description
+
+Translation of unit test UriTestSig06
--- /dev/null
+alert tcp any any -> any any (msg:"Test pcre /U option"; pcre:/(oneself)+/U; sid:1;)
--- /dev/null
+requires:
+ min-version: 8.0.0
+
+args:
+ - -k none --set stream.inline=true
+
+checks:
+ - filter:
+ count: 1
+ match:
+ event_type: alert
+ alert.signature_id: 1
+ pcap_cnt: 5
--- /dev/null
+# Description
+
+Translation of unit test UriTestSig07
--- /dev/null
+alert tcp any any -> any any (msg:"Test pcre /U option with urilen "; pcre:/(one){2,}(self)?/U; urilen:3<>20; sid:1;)
--- /dev/null
+requires:
+ min-version: 8.0.0
+
+args:
+ - -k none --set stream.inline=true
+
+checks:
+ - filter:
+ count: 1
+ match:
+ event_type: alert
+ alert.signature_id: 1
+ pcap_cnt: 4
+ - filter:
+ count: 1
+ match:
+ event_type: alert
+ alert.signature_id: 1
+ pcap_cnt: 5
--- /dev/null
+# Description
+
+Translation of unit test UriTestSig08
--- /dev/null
+alert tcp any any -> any any (msg:"Test pcre /U option with urilen"; pcre:/(blabla){2,}(self)?/U; urilen:3<>20; sid:1;)
--- /dev/null
+requires:
+ min-version: 8.0.0
+
+args:
+ - -k none --set stream.inline=true
+
+checks:
+ - filter:
+ count: 0
+ match:
+ event_type: alert
+ alert.signature_id: 1
--- /dev/null
+# Description
+
+Translation of unit test UriTestSig09
--- /dev/null
+alert tcp any any -> any any (msg:"Test pcre /U option with urilen "; pcre:/(one){2,}(self)?/U; urilen:<2; sid:1;)
--- /dev/null
+requires:
+ min-version: 8.0.0
+
+args:
+ - -k none --set stream.inline=true
+
+checks:
+ - filter:
+ count: 0
+ match:
+ event_type: alert
+ alert.signature_id: 1
--- /dev/null
+# Description
+
+Translation of unit test UriTestSig12
--- /dev/null
+alert tcp any any -> any any (msg:"Test pcre /U, uricontent and urilen option"; uricontent:"one"; pcre:/(one)+self/U; urilen:>2; sid:1;)
--- /dev/null
+requires:
+ min-version: 8.0.0
+
+args:
+ - -k none --set stream.inline=true
+
+checks:
+ - filter:
+ count: 1
+ match:
+ event_type: alert
+ alert.signature_id: 1
+ pcap_cnt: 5
--- /dev/null
+# Description
+
+Translation of unit test UriTestSig13
--- /dev/null
+alert tcp any any -> any any (msg:"Test urilen option"; urilen:>2; uricontent:"one"; sid:1;)
--- /dev/null
+requires:
+ min-version: 8.0.0
+
+args:
+ - -k none --set stream.inline=true
+
+checks:
+ - filter:
+ count: 1
+ match:
+ event_type: alert
+ alert.signature_id: 1
+ pcap_cnt: 4
+ - filter:
+ count: 1
+ match:
+ event_type: alert
+ alert.signature_id: 1
+ pcap_cnt: 5
--- /dev/null
+# Description
+
+Translation of unit test UriTestSig14
--- /dev/null
+alert tcp any any -> any any (msg:"Test uricontent option"; uricontent:"one"; pcre:/one(self)?/U;sid:1;)
--- /dev/null
+requires:
+ min-version: 8.0.0
+
+args:
+ - -k none --set stream.inline=true
+
+checks:
+ - filter:
+ count: 1
+ match:
+ event_type: alert
+ alert.signature_id: 1
+ pcap_cnt: 4
+ - filter:
+ count: 1
+ match:
+ event_type: alert
+ alert.signature_id: 1
+ pcap_cnt: 5
--- /dev/null
+# Description
+
+Translation of unit test UriTestSig15
--- /dev/null
+alert tcp any any -> any any (msg:"Test uricontent option"; uricontent:"one"; pcre:/^\/one(self)?$/U;sid:1;)
--- /dev/null
+requires:
+ min-version: 8.0.0
+
+args:
+ - -k none --set stream.inline=true
+
+checks:
+ - filter:
+ count: 1
+ match:
+ event_type: alert
+ alert.signature_id: 1
+ pcap_cnt: 4
+ - filter:
+ count: 1
+ match:
+ event_type: alert
+ alert.signature_id: 1
+ pcap_cnt: 5
--- /dev/null
+# Description
+
+Translation of unit test UriTestSig16
--- /dev/null
+drop tcp any any -> any any (flow:to_server,established; uricontent:"/search?q="; pcre:"/^\/search\?q=[0-9]{1,3}(&aq=7(\?[0-9a-f]{8})?)?/U"; pcre:"/\x0d\x0aHost\: \d+\.\d+\.\d+\.\d+\x0d\x0a/"; sid:2009024; rev:9;)
--- /dev/null
+requires:
+ min-version: 8.0.0
+
+args:
+ - -k none --set stream.inline=true
+
+checks:
+ - filter:
+ count: 1
+ match:
+ event_type: alert
+ alert.signature_id: 2009024
+ pcap_cnt: 4
--- /dev/null
+# Description
+
+Translation of unit test UriTestSig17
--- /dev/null
+alert tcp any any -> any any (msg:"test multiple relative uricontents"; uricontent:"this"; uricontent:"is"; within:6; uricontent:"big"; within:8; uricontent:"string"; within:8; sid:1;)
--- /dev/null
+requires:
+ min-version: 8.0.0
+
+args:
+ - -k none --set stream.inline=true
+
+checks:
+ - filter:
+ count: 1
+ match:
+ event_type: alert
+ alert.signature_id: 1
--- /dev/null
+# Description
+
+Translation of unit test UriTestSig18
--- /dev/null
+alert tcp any any -> any any (msg:"test multiple relative uricontents"; uricontent:"this"; uricontent:"is"; within:9; uricontent:"big"; within:12; uricontent:"string"; within:8; sid:1;)
--- /dev/null
+requires:
+ min-version: 8.0.0
+
+args:
+ - -k none --set stream.inline=true
+
+checks:
+ - filter:
+ count: 1
+ match:
+ event_type: alert
+ alert.signature_id: 1
--- /dev/null
+# Description
+
+Translation of unit test UriTestSig19
--- /dev/null
+alert tcp any any -> any any (msg:"test multiple relative uricontents"; uricontent:"now"; uricontent:"this"; uricontent:"is"; within:12; uricontent:"big"; within:8; uricontent:"string"; within:8; sid:1;)
--- /dev/null
+requires:
+ min-version: 8.0.0
+
+args:
+ - -k none --set stream.inline=true
+
+checks:
+ - filter:
+ count: 1
+ match:
+ event_type: alert
+ alert.signature_id: 1
--- /dev/null
+# Description
+
+Translation of unit test UriTestSig20
--- /dev/null
+alert tcp any any -> any any (msg:"test multiple relative uricontents"; uricontent:"thus"; offset:8; uricontent:"is"; within:6; uricontent:"big"; within:8; sid:1;)
--- /dev/null
+requires:
+ min-version: 8.0.0
+
+args:
+ - -k none --set stream.inline=true
+
+checks:
+ - filter:
+ count: 1
+ match:
+ event_type: alert
+ alert.signature_id: 1
--- /dev/null
+# Description
+
+Translation of unit test UriTestSig21
--- /dev/null
+alert tcp any any -> any any (msg:"test multiple relative uricontents"; uricontent:"fix"; uricontent:"this"; within:6; uricontent:!"and"; distance:0; sid:1;)
--- /dev/null
+requires:
+ min-version: 8.0.0
+
+args:
+ - -k none --set stream.inline=true
+
+checks:
+ - filter:
+ count: 1
+ match:
+ event_type: alert
+ alert.signature_id: 1
--- /dev/null
+# Description
+
+Translation of unit test UriTestSig22
--- /dev/null
+alert tcp any any -> any any (msg:"test multiple relative uricontents"; pcre:/super/U; uricontent:"nova"; within:7; sid:1;)
--- /dev/null
+requires:
+ min-version: 8.0.0
+
+args:
+ - -k none --set stream.inline=true
+
+checks:
+ - filter:
+ count: 1
+ match:
+ event_type: alert
+ alert.signature_id: 1
--- /dev/null
+# Description
+
+Translation of unit test UriTestSig23
--- /dev/null
+alert tcp any any -> any any (msg:"test multiple relative uricontents"; uricontent:!"fix_this_now"; sid:1;)
--- /dev/null
+requires:
+ min-version: 8.0.0
+
+args:
+ - -k none --set stream.inline=true
+
+checks:
+ - filter:
+ count: 0
+ match:
+ event_type: alert
+ alert.signature_id: 1
--- /dev/null
+# Description
+
+Translation of unit test UriTestSig24
--- /dev/null
+alert tcp any any -> any any (msg:"test multiple relative uricontents"; uricontent:"we_need_to"; uricontent:!"fix_this_now"; sid:1;)
--- /dev/null
+requires:
+ min-version: 8.0.0
+
+args:
+ - -k none --set stream.inline=true
+
+checks:
+ - filter:
+ count: 0
+ match:
+ event_type: alert
+ alert.signature_id: 1
--- /dev/null
+# Description
+
+Translation of unit test UriTestSig25
--- /dev/null
+alert tcp any any -> any any (msg:"test multiple relative uricontents"; pcre:/normalized/U; uricontent:"normalized uri"; sid:1;)
--- /dev/null
+requires:
+ min-version: 8.0.0
+
+args:
+ - -k none --set stream.inline=true
+
+checks:
+ - filter:
+ count: 1
+ match:
+ event_type: alert
+ alert.signature_id: 1
--- /dev/null
+# Description
+
+Translation of unit test UriTestSig26
--- /dev/null
+alert tcp any any -> any any (msg:"test multiple relative uricontents"; uricontent:"fix_this"; isdataat:4,relative; sid:1;)
--- /dev/null
+requires:
+ min-version: 8.0.0
+
+args:
+ - -k none --set stream.inline=true
+
+checks:
+ - filter:
+ count: 1
+ match:
+ event_type: alert
+ alert.signature_id: 1
--- /dev/null
+# Description
+
+Translation of unit test UriTestSig27
--- /dev/null
+alert tcp any any -> any any (uricontent:"fix_this"; isdataat:!10,relative; sid:1;)
--- /dev/null
+requires:
+ min-version: 8.0.0
+
+args:
+ - -k none --set stream.inline=true
+
+checks:
+ - filter:
+ count: 1
+ match:
+ event_type: alert
+ alert.signature_id: 1
--- /dev/null
+# Description
+
+Translation of unit test UriTestSig28
--- /dev/null
+alert tcp any any -> any any (msg:"dummy"; uricontent:"this"; byte_extract:1,2,one,string,dec,relative; uricontent:"ring"; distance:one; sid:1;)
--- /dev/null
+requires:
+ min-version: 8.0.0
+
+args:
+ - -k none --set stream.inline=true
+
+checks:
+ - filter:
+ count: 1
+ match:
+ event_type: alert
+ alert.signature_id: 1
--- /dev/null
+# Description
+
+Translation of unit test UriTestSig29
--- /dev/null
+alert tcp any any -> any any (msg:"dummy"; uricontent:"this"; byte_extract:1,2,one,string,dec,relative; uricontent:"ring"; distance:one; sid:1;)
--- /dev/null
+requires:
+ min-version: 8.0.0
+
+args:
+ - -k none --set stream.inline=true
+
+checks:
+ - filter:
+ count: 1
+ match:
+ event_type: alert
+ alert.signature_id: 1
--- /dev/null
+# Description
+
+Translation of unit test UriTestSig30
--- /dev/null
+alert tcp any any -> any any (msg:"dummy"; uricontent:"this"; byte_extract:1,2,one,string,dec,relative; uricontent:"_b5ig"; offset:one; sid:1;)
--- /dev/null
+requires:
+ min-version: 8.0.0
+
+args:
+ - -k none --set stream.inline=true
+
+checks:
+ - filter:
+ count: 1
+ match:
+ event_type: alert
+ alert.signature_id: 1
--- /dev/null
+# Description
+
+Translation of unit test UriTestSig31
--- /dev/null
+alert tcp any any -> any any (msg:"dummy"; uricontent:"this"; byte_extract:1,2,one,string,dec,relative; uricontent:"his"; depth:one; sid:1;)
--- /dev/null
+requires:
+ min-version: 8.0.0
+
+args:
+ - -k none --set stream.inline=true
+
+checks:
+ - filter:
+ count: 1
+ match:
+ event_type: alert
+ alert.signature_id: 1
--- /dev/null
+# Description
+
+Translation of unit test UriTestSig32
--- /dev/null
+alert tcp any any -> any any (msg:"dummy"; uricontent:"this"; byte_extract:1,2,one,string,dec,relative; uricontent:"g_st"; within:one; sid:1;)
--- /dev/null
+requires:
+ min-version: 8.0.0
+
+args:
+ - -k none --set stream.inline=true
+
+checks:
+ - filter:
+ count: 1
+ match:
+ event_type: alert
+ alert.signature_id: 1
--- /dev/null
+# Description
+
+Translation of unit test UriTestSig33
--- /dev/null
+alert tcp any any -> any any (msg:"test multiple relative uricontents"; urilen:15; sid:1;)
--- /dev/null
+requires:
+ min-version: 8.0.0
+
+args:
+ - -k none --set stream.inline=true
+
+checks:
+ - filter:
+ count: 1
+ match:
+ event_type: alert
+ alert.signature_id: 1
--- /dev/null
+# Description
+
+Translation of unit test UriTestSig34
--- /dev/null
+alert tcp any any -> any any (msg:"test multiple relative uricontents"; urilen:15, norm; sid:1;)
--- /dev/null
+requires:
+ min-version: 8.0.0
+
+args:
+ - -k none --set stream.inline=true
+
+checks:
+ - filter:
+ count: 1
+ match:
+ event_type: alert
+ alert.signature_id: 1
--- /dev/null
+# Description
+
+Translation of unit test UriTestSig35
--- /dev/null
+alert tcp any any -> any any (msg:"test multiple relative uricontents"; urilen:16; sid:1;)
--- /dev/null
+requires:
+ min-version: 8.0.0
+
+args:
+ - -k none --set stream.inline=true
+
+checks:
+ - filter:
+ count: 0
+ match:
+ event_type: alert
+ alert.signature_id: 1
--- /dev/null
+# Description
+
+Translation of unit test UriTestSig36
--- /dev/null
+alert tcp any any -> any any (msg:"test multiple relative uricontents"; urilen:16, norm; sid:1;)
--- /dev/null
+requires:
+ min-version: 8.0.0
+
+args:
+ - -k none --set stream.inline=true
+
+checks:
+ - filter:
+ count: 0
+ match:
+ event_type: alert
+ alert.signature_id: 1
--- /dev/null
+# Description
+
+Translation of unit test UriTestSig37
--- /dev/null
+alert tcp any any -> any any (msg:"test multiple relative uricontents"; urilen:17, raw; sid:1;)
--- /dev/null
+requires:
+ min-version: 8.0.0
+
+args:
+ - -k none --set stream.inline=true
+
+checks:
+ - filter:
+ count: 1
+ match:
+ event_type: alert
+ alert.signature_id: 1
--- /dev/null
+# Description
+
+Translation of unit test UriTestSig38
--- /dev/null
+alert tcp any any -> any any (msg:"test multiple relative uricontents"; urilen:18, raw; sid:1;)
--- /dev/null
+requires:
+ min-version: 8.0.0
+
+args:
+ - -k none --set stream.inline=true
+
+checks:
+ - filter:
+ count: 0
+ match:
+ event_type: alert
+ alert.signature_id: 1
projects / thirdparty / suricata-verify.git / commitdiff
