From: Jeff Lucovsky Date: Wed, 13 Apr 2022 13:06:26 +0000 (-0400) Subject: test/from_base64: from_base64 transform test X-Git-Tag: suricata-5.0.10~57 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=7c1ff6dcca1c313eac2cae2b1feeb3ae40e53fec;p=thirdparty%2Fsuricata-verify.git test/from_base64: from_base64 transform test Issue: 5220 This commit adds a simple test case for the from_base64 transform. --- diff --git a/tests/detect-from_base64-01/README.md b/tests/detect-from_base64-01/README.md new file mode 100644 index 000000000..ebf338a01 --- /dev/null +++ b/tests/detect-from_base64-01/README.md @@ -0,0 +1 @@ +Test from_base64 transform diff --git a/tests/detect-from_base64-01/input.pcap b/tests/detect-from_base64-01/input.pcap new file mode 100644 index 000000000..96af08e83 Binary files /dev/null and b/tests/detect-from_base64-01/input.pcap differ diff --git a/tests/detect-from_base64-01/test.rules b/tests/detect-from_base64-01/test.rules new file mode 100644 index 000000000..dbcbe18d8 --- /dev/null +++ b/tests/detect-from_base64-01/test.rules @@ -0,0 +1 @@ +alert http any any -> any any (msg:"from_base64 transform"; flow:established,from_server; http.response_body; from_base64; content: "This is Suricata"; sid: 1;) diff --git a/tests/detect-from_base64-01/test.yaml b/tests/detect-from_base64-01/test.yaml new file mode 100644 index 000000000..57c5e081d --- /dev/null +++ b/tests/detect-from_base64-01/test.yaml @@ -0,0 +1,13 @@ +args: + - -k none + +requires: + files: + - src/detect-transform-base64.c + +checks: + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 1