From: Philippe Antoine Date: Wed, 6 Mar 2019 07:57:48 +0000 (+0100) Subject: Adds a test case for http auth unrecognized X-Git-Tag: suricata-6.0.4~463 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=032d476e3b0253bbe62342ce3c021b480c31d501;p=thirdparty%2Fsuricata-verify.git Adds a test case for http auth unrecognized --- diff --git a/tests/http-auth-unrecognized/README.md b/tests/http-auth-unrecognized/README.md new file mode 100644 index 000000000..31045ae62 --- /dev/null +++ b/tests/http-auth-unrecognized/README.md @@ -0,0 +1,9 @@ +# Description + +Test http unrecognized authorisation method + +# PCAP + +The pcap comes from running +`python -m SimpleHTTPServer 8000` or `python3 -m http.server` as a server and the following command +`curl --header "Authorization: Turbo customAuthDataHere" 127.0.0.1:8000/` as a client diff --git a/tests/http-auth-unrecognized/input.pcap b/tests/http-auth-unrecognized/input.pcap new file mode 100644 index 000000000..483baf96a Binary files /dev/null and b/tests/http-auth-unrecognized/input.pcap differ diff --git a/tests/http-auth-unrecognized/test.rules b/tests/http-auth-unrecognized/test.rules new file mode 100644 index 000000000..087e4afb4 --- /dev/null +++ b/tests/http-auth-unrecognized/test.rules @@ -0,0 +1 @@ +alert http any any -> any any (msg:"SURICATA HTTP Request unrecognized authorization method"; flow:established,to_server; app-layer-event:http.request_auth_unrecognized; flowint:http.anomaly.count,+,1; classtype:protocol-command-decode; sid:1; rev:1;) diff --git a/tests/http-auth-unrecognized/test.yaml b/tests/http-auth-unrecognized/test.yaml new file mode 100644 index 000000000..2fadf930d --- /dev/null +++ b/tests/http-auth-unrecognized/test.yaml @@ -0,0 +1,15 @@ +requires: + features: + - HAVE_LIBJANSSON + min-version: 5.0.0 + +# disables checksum verification +args: + - -k none + +checks: + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 1