From: Jeff Lucovsky Date: Sat, 11 Nov 2023 08:50:21 +0000 (-0500) Subject: test/transform: Tests for case changing transforms X-Git-Tag: suricata-6.0.16~50 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=91882fc9f68bdb1707f9fa783ef5d0d608237f27;p=thirdparty%2Fsuricata-verify.git test/transform: Tests for case changing transforms Issue: 6439 Tests for case-changing transforms: - to_lowercase - to_uppercase --- diff --git a/tests/detect-to_lowercase-01/input.rules b/tests/detect-to_lowercase-01/input.rules new file mode 100644 index 000000000..9c5ef937d --- /dev/null +++ b/tests/detect-to_lowercase-01/input.rules @@ -0,0 +1 @@ +alert http any any -> any any (msg:"lower-case 1"; flow:established; file_data; to_lowercase; content:"at patpoopy, we have"; sid:1;) diff --git a/tests/detect-to_lowercase-01/test.yaml b/tests/detect-to_lowercase-01/test.yaml new file mode 100644 index 000000000..fbaae82f0 --- /dev/null +++ b/tests/detect-to_lowercase-01/test.yaml @@ -0,0 +1,14 @@ +pcap: ../bug-3616-ips/input.pcap + +requires: + min-version: 7.0.3 + pcap: false + +exit-code: 0 + +checks: + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 1 diff --git a/tests/detect-to_lowercase-02/input.rules b/tests/detect-to_lowercase-02/input.rules new file mode 100644 index 000000000..36b8de370 --- /dev/null +++ b/tests/detect-to_lowercase-02/input.rules @@ -0,0 +1 @@ +alert http any any -> any any (msg:"lower-case - fail"; flow:established; file_data; to_lowercase; content:"AT PATPOOPY, WE HAVE"; sid:1;) diff --git a/tests/detect-to_lowercase-02/test.yaml b/tests/detect-to_lowercase-02/test.yaml new file mode 100644 index 000000000..57806a6b7 --- /dev/null +++ b/tests/detect-to_lowercase-02/test.yaml @@ -0,0 +1,12 @@ +pcap: ../bug-3616-ips/input.pcap + +requires: + min-version: 7.0.3 + pcap: false + +exit-code: 1 + +checks: + - shell: + args: grep -c 'error parsing signature' suricata.log + expect: 1 diff --git a/tests/detect-to_uppercase-01/input.rules b/tests/detect-to_uppercase-01/input.rules new file mode 100644 index 000000000..3b0900aff --- /dev/null +++ b/tests/detect-to_uppercase-01/input.rules @@ -0,0 +1 @@ +alert http any any -> any any (msg:"lower-case 1"; flow:established; file_data; to_uppercase; content:"AT PATPOOPY, WE HAVE"; sid:1;) diff --git a/tests/detect-to_uppercase-01/test.yaml b/tests/detect-to_uppercase-01/test.yaml new file mode 100644 index 000000000..fbaae82f0 --- /dev/null +++ b/tests/detect-to_uppercase-01/test.yaml @@ -0,0 +1,14 @@ +pcap: ../bug-3616-ips/input.pcap + +requires: + min-version: 7.0.3 + pcap: false + +exit-code: 0 + +checks: + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 1 diff --git a/tests/detect-to_uppercase-02/input.rules b/tests/detect-to_uppercase-02/input.rules new file mode 100644 index 000000000..81ff94137 --- /dev/null +++ b/tests/detect-to_uppercase-02/input.rules @@ -0,0 +1 @@ +alert http any any -> any any (msg:"lower-case 1"; flow:established; file_data; to_uppercase; content:"at patpoopy, we have"; sid:1;) diff --git a/tests/detect-to_uppercase-02/test.yaml b/tests/detect-to_uppercase-02/test.yaml new file mode 100644 index 000000000..57806a6b7 --- /dev/null +++ b/tests/detect-to_uppercase-02/test.yaml @@ -0,0 +1,12 @@ +pcap: ../bug-3616-ips/input.pcap + +requires: + min-version: 7.0.3 + pcap: false + +exit-code: 1 + +checks: + - shell: + args: grep -c 'error parsing signature' suricata.log + expect: 1