From: Jeff Lucovsky Date: Thu, 7 May 2020 13:27:07 +0000 (-0400) Subject: tests: Add file_data/strip-ws transform tests X-Git-Tag: suricata-6.0.4~230 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=b8eca29f32b6a82aca641ea59e3ae8543669c466;p=thirdparty%2Fsuricata-verify.git tests: Add file_data/strip-ws transform tests --- diff --git a/tests/detect-strip_whitespace-01/input.rules b/tests/detect-strip_whitespace-01/input.rules new file mode 100644 index 000000000..f10a3ecd5 --- /dev/null +++ b/tests/detect-strip_whitespace-01/input.rules @@ -0,0 +1 @@ +alert http any any -> any any (msg:"HTTP strip_whitespace 1"; flow:established; file_data; strip_whitespace; content:"embrace holistically"; sid:1;) diff --git a/tests/detect-strip_whitespace-01/test.yaml b/tests/detect-strip_whitespace-01/test.yaml new file mode 100644 index 000000000..086536f72 --- /dev/null +++ b/tests/detect-strip_whitespace-01/test.yaml @@ -0,0 +1,12 @@ +requires: + min-version: 6 + pcap: false + +exit-code: 1 +args: + - --engine-analysis + +checks: + - shell: + args: grep "incompatible with strip_whitespace transform" stderr| wc -l | xargs + expect: 1 diff --git a/tests/detect-strip_whitespace-02/input.pcap b/tests/detect-strip_whitespace-02/input.pcap new file mode 100644 index 000000000..cc069dc98 Binary files /dev/null and b/tests/detect-strip_whitespace-02/input.pcap differ diff --git a/tests/detect-strip_whitespace-02/input.rules b/tests/detect-strip_whitespace-02/input.rules new file mode 100644 index 000000000..63c453ca0 --- /dev/null +++ b/tests/detect-strip_whitespace-02/input.rules @@ -0,0 +1 @@ +alert http any any -> any any (msg:"HTTP strip_whitespace 1"; flow:established; file_data; strip_whitespace; content:"embraceholistically"; sid:1;) diff --git a/tests/detect-strip_whitespace-02/test.yaml b/tests/detect-strip_whitespace-02/test.yaml new file mode 100644 index 000000000..808abea47 --- /dev/null +++ b/tests/detect-strip_whitespace-02/test.yaml @@ -0,0 +1,12 @@ +requires: + min-version: 6 + +args: + - -k none + +checks: + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 1