From: Philippe Antoine <pantoine@oisf.net>
Date: Tue, 4 Mar 2025 15:58:33 +0000 (+0100)
Subject: detect: add tests for file.data
X-Git-Tag: suricata-7.0.9~19
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=659bd37637fa4dbee6efa7d2668bd312676d26a4;p=thirdparty%2Fsuricata-verify.git

detect: add tests for file.data

with HTTP1 multipart and multiple files

Ticket: 7577
---

diff --git a/tests/file-match-crossed/README.md b/tests/file-match-crossed/README.md
new file mode 100644
index 000000000..0fb88f716
--- /dev/null
+++ b/tests/file-match-crossed/README.md
@@ -0,0 +1,7 @@
+# Description
+
+Test `file.data` with HTTP1 multipart small files
+
+Cf https://redmine.openinfosecfoundation.org/issues/7577
+
+Pcap crafted
diff --git a/tests/file-match-crossed/http-multipart-post.pcap b/tests/file-match-crossed/http-multipart-post.pcap
new file mode 100644
index 000000000..755001e63
Binary files /dev/null and b/tests/file-match-crossed/http-multipart-post.pcap differ
diff --git a/tests/file-match-crossed/test.rules b/tests/file-match-crossed/test.rules
new file mode 100644
index 000000000..bf09ea390
--- /dev/null
+++ b/tests/file-match-crossed/test.rules
@@ -0,0 +1,13 @@
+# matching ones
+alert http any any -> any any (msg:"test"; file.data; content:"bateau"; file.name; content:"titi.txt"; sid:1;)
+alert http any any -> any any (msg:"test"; file.data; content:"bateau"; file.name; content:"toto.txt"; sid:2;)
+alert http any any -> any any (msg:"test"; file.data; content:"Titi"; sid:3;)
+alert http any any -> any any (msg:"test"; file.data; content:"minet"; sid:4;)
+alert http any any -> any any (msg:"test"; file.data; content:"Titi"; file.data; content:"minet"; sid:5;)
+alert http any any -> any any (msg:"test"; file.data; content:"minet"; fast_pattern; sid:6;)
+
+# matching as different file.data have each content
+alert http any any -> any any (msg:"test"; file.data; content:"bateau"; file.data; content:"minet"; sid:7;)
+# not matching as not the same file.data has both contents
+alert http any any -> any any (msg:"test"; file.data; content:"bateau"; content:"minet"; sid:8;)
+
diff --git a/tests/file-match-crossed/test.yaml b/tests/file-match-crossed/test.yaml
new file mode 100644
index 000000000..95d4dfe0c
--- /dev/null
+++ b/tests/file-match-crossed/test.yaml
@@ -0,0 +1,47 @@
+requires:
+  min-version: 8
+
+args:
+  - -k none
+
+checks:
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 1
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 2
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 3
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 4
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 5
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 6
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 7
+  - filter:
+      count: 0
+      match:
+        event_type: alert
+        alert.signature_id: 8
diff --git a/tests/file-match-crossed/titi.txt b/tests/file-match-crossed/titi.txt
new file mode 100644
index 000000000..bc8b1199d
--- /dev/null
+++ b/tests/file-match-crossed/titi.txt
@@ -0,0 +1 @@
+Titi a vu un gros minet.
diff --git a/tests/file-match-crossed/toto.txt b/tests/file-match-crossed/toto.txt
new file mode 100644
index 000000000..a10ca640a
--- /dev/null
+++ b/tests/file-match-crossed/toto.txt
@@ -0,0 +1 @@
+toto est dans un bateau