From: Victor Julien Date: Wed, 23 Dec 2020 15:49:08 +0000 (+0100) Subject: tests: add more midstream test variants X-Git-Tag: suricata-6.0.4~204 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=81517e51148ec6100482f14da6a14ba08943c802;p=thirdparty%2Fsuricata-verify.git tests: add more midstream test variants --- diff --git a/tests/alert-testmyids-midstream3/input.pcap b/tests/alert-testmyids-midstream3/input.pcap new file mode 100644 index 000000000..00604d55e Binary files /dev/null and b/tests/alert-testmyids-midstream3/input.pcap differ diff --git a/tests/alert-testmyids-midstream3/suricata.yaml b/tests/alert-testmyids-midstream3/suricata.yaml new file mode 100644 index 000000000..2c7f4cc6d --- /dev/null +++ b/tests/alert-testmyids-midstream3/suricata.yaml @@ -0,0 +1,37 @@ +%YAML 1.1 +--- + +logging: + default-log-level: notice + default-output-filter: + outputs: + - console: + enabled: yes + +outputs: + - fast: + enabled: yes + filename: fast.log + append: yes + + - eve-log: + enabled: yes + filetype: regular #regular|syslog|unix_dgram|unix_stream|redis + filename: eve.json + types: + - alert: + payload: yes + payload-buffer-size: 4kb + payload-printable: yes + packet: yes + http: yes + tls: yes + ssh: yes + smtp: yes + xff: + enabled: yes + mode: extra-data + deployment: reverse + header: X-Forwarded-For + - flow + - http diff --git a/tests/alert-testmyids-midstream3/test.rules b/tests/alert-testmyids-midstream3/test.rules new file mode 100644 index 000000000..9f1307bdb --- /dev/null +++ b/tests/alert-testmyids-midstream3/test.rules @@ -0,0 +1 @@ +alert ip any any -> any any (msg:"GPL ATTACK_RESPONSE id check returned root"; content:"uid=0|28|root|29|"; classtype:bad-unknown; sid:2100498; rev:7;) diff --git a/tests/alert-testmyids-midstream3/test.yaml b/tests/alert-testmyids-midstream3/test.yaml new file mode 100644 index 000000000..9cef3c776 --- /dev/null +++ b/tests/alert-testmyids-midstream3/test.yaml @@ -0,0 +1,30 @@ +requires: + features: + - HAVE_LIBJANSSON + +args: +- --set stream.midstream=true + +checks: + + # Check that we only have one alert event type in eve. + - filter: + count: 1 + match: + event_type: alert + src_port: 80 + - filter: + count: 1 + match: + event_type: flow + dest_port: 80 + - filter: + count: 1 + match: + event_type: http + dest_port: 80 + + # Check how many lines were logged to fast.log. + - shell: + args: cat fast.log | wc -l | xargs + expect: 1 diff --git a/tests/alert-testmyids-midstream5/input.pcap b/tests/alert-testmyids-midstream5/input.pcap new file mode 100644 index 000000000..7a89ef172 Binary files /dev/null and b/tests/alert-testmyids-midstream5/input.pcap differ diff --git a/tests/alert-testmyids-midstream5/suricata.yaml b/tests/alert-testmyids-midstream5/suricata.yaml new file mode 100644 index 000000000..2c7f4cc6d --- /dev/null +++ b/tests/alert-testmyids-midstream5/suricata.yaml @@ -0,0 +1,37 @@ +%YAML 1.1 +--- + +logging: + default-log-level: notice + default-output-filter: + outputs: + - console: + enabled: yes + +outputs: + - fast: + enabled: yes + filename: fast.log + append: yes + + - eve-log: + enabled: yes + filetype: regular #regular|syslog|unix_dgram|unix_stream|redis + filename: eve.json + types: + - alert: + payload: yes + payload-buffer-size: 4kb + payload-printable: yes + packet: yes + http: yes + tls: yes + ssh: yes + smtp: yes + xff: + enabled: yes + mode: extra-data + deployment: reverse + header: X-Forwarded-For + - flow + - http diff --git a/tests/alert-testmyids-midstream5/test.rules b/tests/alert-testmyids-midstream5/test.rules new file mode 100644 index 000000000..9f1307bdb --- /dev/null +++ b/tests/alert-testmyids-midstream5/test.rules @@ -0,0 +1 @@ +alert ip any any -> any any (msg:"GPL ATTACK_RESPONSE id check returned root"; content:"uid=0|28|root|29|"; classtype:bad-unknown; sid:2100498; rev:7;) diff --git a/tests/alert-testmyids-midstream5/test.yaml b/tests/alert-testmyids-midstream5/test.yaml new file mode 100644 index 000000000..8f28e5852 --- /dev/null +++ b/tests/alert-testmyids-midstream5/test.yaml @@ -0,0 +1,31 @@ +requires: + features: + - HAVE_LIBJANSSON + min-version: 5.0.0 + +args: +- --set stream.midstream=true + +checks: + + # Check that we only have one alert event type in eve. + - filter: + count: 1 + match: + event_type: alert + src_port: 80 + - filter: + count: 1 + match: + event_type: flow + dest_port: 80 + - filter: + count: 1 + match: + event_type: http + dest_port: 80 + + # Check how many lines were logged to fast.log. + - shell: + args: cat fast.log | wc -l | xargs + expect: 1