tests: add test for pgsql event

Related to
Task #5566

diff --git a/tests/pgsql/pgsql-events/README.md b/tests/pgsql/pgsql-events/README.md
new file mode 100644 (file)
index 0000000..677d229
--- /dev/null
+++ b/tests/pgsql/pgsql-events/README.md
@@ -0,0 +1,11 @@
+# Test
+
+Showcase/ test PGSQL events.
+
+# Pcap
+
+Provided by Victor Julien.
+
+# Ticket
+
+https://redmine.openinfosecfoundation.org/issues/5566

diff --git a/tests/pgsql/pgsql-events/UnknownMessage.pcap b/tests/pgsql/pgsql-events/UnknownMessage.pcap
new file mode 100644 (file)
index 0000000..a249b70
Binary files /dev/null and b/tests/pgsql/pgsql-events/UnknownMessage.pcap differ

diff --git a/tests/pgsql/pgsql-events/suricata.yaml b/tests/pgsql/pgsql-events/suricata.yaml
new file mode 100644 (file)
index 0000000..e55017e
--- /dev/null
+++ b/tests/pgsql/pgsql-events/suricata.yaml
@@ -0,0 +1,23 @@
+%YAML 1.1
+---
+
+outputs:
+   - eve-log:
+       enabled: yes
+       filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
+       filename: eve.json
+       types:
+         - pgsql:
+             enabled: yes
+         - alert
+         - flow
+         - stats
+
+app-layer:
+  protocols:
+    pgsql:
+      enabled: yes
+      # Stream reassembly size for PostgreSQL. By default, track it completely.
+      stream-depth: 0
+      # Maximum number of live PostgreSQL transactions per flow
+      # max-tx: 1024

diff --git a/tests/pgsql/pgsql-events/test.rules b/tests/pgsql/pgsql-events/test.rules
new file mode 100644 (file)
index 0000000..f78f18d
--- /dev/null
+++ b/tests/pgsql/pgsql-events/test.rules
@@ -0,0 +1 @@
+alert pgsql any any -> any any (msg:"PGSQL unknown/ malformed message"; app-layer-event:pgsql.malformed_request; flow:to_server; sid:1;)

diff --git a/tests/pgsql/pgsql-events/test.yaml b/tests/pgsql/pgsql-events/test.yaml
new file mode 100644 (file)
index 0000000..fd4b187
--- /dev/null
+++ b/tests/pgsql/pgsql-events/test.yaml
@@ -0,0 +1,13 @@
+requires:
+    min-version: 8
+
+args:
+- -k none --set stream.midstream=true --set stream.inline=true
+
+checks:
+    - filter:
+        filename: eve.json
+        count: 1
+        match:
+            event_type: alert
+            alert.signature_id: 1