From: DEL VALLE Bastien Date: Tue, 14 Apr 2020 18:11:53 +0000 (+0200) Subject: Adds test for SMB keyword named_pipe with ascii and unicode X-Git-Tag: suricata-6.0.4~303 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=316c2241cbf6159809bdc825ada53ce8bb40c180;p=thirdparty%2Fsuricata-verify.git Adds test for SMB keyword named_pipe with ascii and unicode --- diff --git a/tests/smb-named-pipe-unicode-ascii/README.md b/tests/smb-named-pipe-ascii/README.md similarity index 100% rename from tests/smb-named-pipe-unicode-ascii/README.md rename to tests/smb-named-pipe-ascii/README.md diff --git a/tests/smb-named-pipe-unicode-ascii/input.pcap b/tests/smb-named-pipe-ascii/input.pcap similarity index 100% rename from tests/smb-named-pipe-unicode-ascii/input.pcap rename to tests/smb-named-pipe-ascii/input.pcap diff --git a/tests/smb-named-pipe-unicode-ascii/test.rules b/tests/smb-named-pipe-ascii/test.rules similarity index 100% rename from tests/smb-named-pipe-unicode-ascii/test.rules rename to tests/smb-named-pipe-ascii/test.rules diff --git a/tests/smb-named-pipe-unicode-ascii/test.yaml b/tests/smb-named-pipe-ascii/test.yaml similarity index 100% rename from tests/smb-named-pipe-unicode-ascii/test.yaml rename to tests/smb-named-pipe-ascii/test.yaml diff --git a/tests/smb-named-pipe-unicode/README.md b/tests/smb-named-pipe-unicode/README.md new file mode 100644 index 000000000..31befd72f --- /dev/null +++ b/tests/smb-named-pipe-unicode/README.md @@ -0,0 +1,10 @@ +# Description + +Tests SMB unicode named pipe. + +# PCAP + +The pcap comes from running Linux client smbclient against a Windows 2019 Server (with a shared folder public without needed authentication) + +Command is +`smbclient //ServerIP/IPC$/ -U username%password -m NT1` where ServerIP is the IP address of the Windows server diff --git a/tests/smb-named-pipe-unicode/input.pcap b/tests/smb-named-pipe-unicode/input.pcap new file mode 100644 index 000000000..06ac59f68 Binary files /dev/null and b/tests/smb-named-pipe-unicode/input.pcap differ diff --git a/tests/smb-named-pipe-unicode/test.rules b/tests/smb-named-pipe-unicode/test.rules new file mode 100644 index 000000000..b8d6203dc --- /dev/null +++ b/tests/smb-named-pipe-unicode/test.rules @@ -0,0 +1 @@ +alert smb any any -> any any (msg:"Ascii named_pipe"; flow:established; smb_named_pipe; content:"IPC$"; sid:1; rev:1;) diff --git a/tests/smb-named-pipe-unicode/test.yaml b/tests/smb-named-pipe-unicode/test.yaml new file mode 100644 index 000000000..c1282b105 --- /dev/null +++ b/tests/smb-named-pipe-unicode/test.yaml @@ -0,0 +1,14 @@ +requires: + features: + - HAVE_LIBJANSSON + +# disables checksum verification +args: +- -k none + +checks: + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 1