From: Eric Leblond Date: Wed, 2 Oct 2024 20:48:08 +0000 (+0200) Subject: tests: add second datajson test X-Git-Tag: suricata-7.0.11~32 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=ce21f0c76fed0ab774c348204f93355bfceb365d;p=thirdparty%2Fsuricata-verify.git tests: add second datajson test --- diff --git a/tests/datajson/datajson-02-multiple/host.lst b/tests/datajson/datajson-02-multiple/host.lst new file mode 100644 index 000000000..f1b1a17a6 --- /dev/null +++ b/tests/datajson/datajson-02-multiple/host.lst @@ -0,0 +1 @@ +d3d3LnRlc3RteWlkcy5jb20=,{"context":"gold old test", "year": 2005} diff --git a/tests/datajson/datajson-02-multiple/input.pcap b/tests/datajson/datajson-02-multiple/input.pcap new file mode 100644 index 000000000..8fb6832de Binary files /dev/null and b/tests/datajson/datajson-02-multiple/input.pcap differ diff --git a/tests/datajson/datajson-02-multiple/src.lst b/tests/datajson/datajson-02-multiple/src.lst new file mode 100644 index 000000000..f44ad188c --- /dev/null +++ b/tests/datajson/datajson-02-multiple/src.lst @@ -0,0 +1 @@ +10.16.1.11,{"test": "success","context":3} diff --git a/tests/datajson/datajson-02-multiple/test.rules b/tests/datajson/datajson-02-multiple/test.rules new file mode 100644 index 000000000..acbf3045a --- /dev/null +++ b/tests/datajson/datajson-02-multiple/test.rules @@ -0,0 +1 @@ +alert http any any -> any any (flow:established,to_server; http.host; datajson:isset,badhost,type string,load host.lst,key bad_host; ip.src; datajson:isset,src_ip,type ip,load src.lst,key src_ip; sid:1;) diff --git a/tests/datajson/datajson-02-multiple/test.yaml b/tests/datajson/datajson-02-multiple/test.yaml new file mode 100644 index 000000000..bad24cf2d --- /dev/null +++ b/tests/datajson/datajson-02-multiple/test.yaml @@ -0,0 +1,21 @@ +requires: + features: + - HAVE_LIBJANSSON + files: + - src/datasets.c + +args: + - -k none --set datasets.enabled=yes + +checks: + - filter: + count: 1 + match: + event_type: alert + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 1 + alert.extra.src_ip.test: success + alert.extra.bad_host.year: 2005