From: Eric Leblond Date: Sun, 13 Oct 2019 10:19:28 +0000 (+0200) Subject: base64: add basic tests X-Git-Tag: suricata-6.0.4~372 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=f281fc24f110923c3e189df80d75ca9ad3446449;p=thirdparty%2Fsuricata-verify.git base64: add basic tests --- diff --git a/tests/base64/README.md b/tests/base64/README.md new file mode 100644 index 000000000..4fb949a2a --- /dev/null +++ b/tests/base64/README.md @@ -0,0 +1 @@ +Match on base64 operations. diff --git a/tests/base64/input.pcap b/tests/base64/input.pcap new file mode 100644 index 000000000..392ce8d9a Binary files /dev/null and b/tests/base64/input.pcap differ diff --git a/tests/base64/test.rules b/tests/base64/test.rules new file mode 100644 index 000000000..50217b044 --- /dev/null +++ b/tests/base64/test.rules @@ -0,0 +1,6 @@ +# input pcap contains a query to http://home.regit.org/?arg=dGhpc2lzYXRlc3QK +# "dGhpc2lzYXRlc3QK" is "thisisatest" +alert http any any -> any any (msg:"Example"; http.uri; content:"arg"; base64_decode:bytes 17, offset 1, relative; base64_data; content:"thisisatest"; sid:1; rev:1;) +alert http any any -> any any (msg:"Example"; content:"arg"; http_uri; base64_decode:bytes 17, offset 1, relative; base64_data; content:"thisisatest"; sid:2; rev:1;) +alert http any any -> any any (msg:"Example"; http.uri; content:"arg"; base64_decode:bytes 10, offset 1, relative; base64_data; content:"test"; sid:3; rev:1;) +alert http any any -> any any (msg:"Example"; http.uri; content:"arg"; base64_decode:bytes 17, offset 1, relative; base64_data; content:"toast"; sid:4; rev:1;) diff --git a/tests/base64/test.yaml b/tests/base64/test.yaml new file mode 100644 index 000000000..7bc37ceba --- /dev/null +++ b/tests/base64/test.yaml @@ -0,0 +1,31 @@ +requires: + features: + - HAVE_LIBJANSSON + min-version: 5.0.0 + +args: + - -k none + +pcap: input.pcap + +checks: + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 1 + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 2 + - filter: + count: 0 + match: + event_type: alert + alert.signature_id: 3 + - filter: + count: 0 + match: + event_type: alert + alert.signature_id: 4