From: Victor Julien Date: Thu, 29 Jun 2023 19:14:47 +0000 (+0200) Subject: tests: filename/fileext tests X-Git-Tag: suricata-7.0.0~19 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=b736cde93d0c4665afd88141ec17fd1e3a953708;p=thirdparty%2Fsuricata-verify.git tests: filename/fileext tests --- diff --git a/tests/fileext-01/test.rules b/tests/fileext-01/test.rules new file mode 100755 index 000000000..b3af97c4c --- /dev/null +++ b/tests/fileext-01/test.rules @@ -0,0 +1,11 @@ +alert tcp any any -> any any (fileext:"PDF"; sid:1;) +alert tcp any any -> any any (fileext:"pdf"; sid:2;) +alert tcp any any -> any any (fileext:"pDf"; sid:3;) + +alert tcp any any -> any any (fileext:!"DOC"; sid:4;) +alert tcp any any -> any any (fileext:!"doc"; sid:5;) +alert tcp any any -> any any (fileext:!"dOc"; sid:6;) + +alert tcp any any -> any any (fileext:!"PDF"; sid:7;) +alert tcp any any -> any any (fileext:!"pdf"; sid:8;) +alert tcp any any -> any any (fileext:!"pDf"; sid:9;) diff --git a/tests/fileext-01/test.yaml b/tests/fileext-01/test.yaml new file mode 100644 index 000000000..7edf6aee3 --- /dev/null +++ b/tests/fileext-01/test.yaml @@ -0,0 +1,46 @@ +requires: + features: + - HAVE_LIBJANSSON + +pcap: ../filemagic-flowbits/pdf-dl.pcap + +args: + - -k none + +checks: + - filter: + count: 1 + match: + alert.signature_id: 1 + - filter: + count: 1 + match: + alert.signature_id: 2 + - filter: + count: 1 + match: + alert.signature_id: 3 + - filter: + count: 1 + match: + alert.signature_id: 4 + - filter: + count: 1 + match: + alert.signature_id: 5 + - filter: + count: 1 + match: + alert.signature_id: 6 + - filter: + count: 0 + match: + alert.signature_id: 7 + - filter: + count: 0 + match: + alert.signature_id: 8 + - filter: + count: 0 + match: + alert.signature_id: 9 diff --git a/tests/fileext-02/test.rules b/tests/fileext-02/test.rules new file mode 100755 index 000000000..2b3291356 --- /dev/null +++ b/tests/fileext-02/test.rules @@ -0,0 +1,3 @@ +alert tcp any any -> any any (filename:"r"; fileext:"PDF"; sid:1;) +alert tcp any any -> any any (filename:"r"; fileext:"DOC"; sid:2;) +alert tcp any any -> any any (filename:"x"; fileext:"pdf"; sid:3;) diff --git a/tests/fileext-02/test.yaml b/tests/fileext-02/test.yaml new file mode 100644 index 000000000..45d3dc927 --- /dev/null +++ b/tests/fileext-02/test.yaml @@ -0,0 +1,22 @@ +requires: + features: + - HAVE_LIBJANSSON + +pcap: ../filemagic-flowbits/pdf-dl.pcap + +args: + - -k none + +checks: + - filter: + count: 1 + match: + alert.signature_id: 1 + - filter: + count: 0 + match: + alert.signature_id: 2 + - filter: + count: 0 + match: + alert.signature_id: 3 diff --git a/tests/filename-01/test.rules b/tests/filename-01/test.rules new file mode 100755 index 000000000..dd104b3e0 --- /dev/null +++ b/tests/filename-01/test.rules @@ -0,0 +1,11 @@ +alert tcp any any -> any any (filename:"R.PDF"; sid:1;) +alert tcp any any -> any any (filename:"r.pdf"; sid:2;) +alert tcp any any -> any any (filename:"R.pDf"; sid:3;) + +alert tcp any any -> any any (filename:!"S.PDF"; sid:4;) +alert tcp any any -> any any (filename:!"s.pdf"; sid:5;) +alert tcp any any -> any any (filename:!"S.pDf"; sid:6;) + +alert tcp any any -> any any (filename:!"R.PDF"; sid:7;) +alert tcp any any -> any any (filename:!"r.pdf"; sid:8;) +alert tcp any any -> any any (filename:!"R.pDf"; sid:9;) diff --git a/tests/filename-01/test.yaml b/tests/filename-01/test.yaml new file mode 100644 index 000000000..7edf6aee3 --- /dev/null +++ b/tests/filename-01/test.yaml @@ -0,0 +1,46 @@ +requires: + features: + - HAVE_LIBJANSSON + +pcap: ../filemagic-flowbits/pdf-dl.pcap + +args: + - -k none + +checks: + - filter: + count: 1 + match: + alert.signature_id: 1 + - filter: + count: 1 + match: + alert.signature_id: 2 + - filter: + count: 1 + match: + alert.signature_id: 3 + - filter: + count: 1 + match: + alert.signature_id: 4 + - filter: + count: 1 + match: + alert.signature_id: 5 + - filter: + count: 1 + match: + alert.signature_id: 6 + - filter: + count: 0 + match: + alert.signature_id: 7 + - filter: + count: 0 + match: + alert.signature_id: 8 + - filter: + count: 0 + match: + alert.signature_id: 9