From: Sascha Steinbiss Date: Fri, 11 Mar 2022 18:46:32 +0000 (+0100) Subject: add tests for MQTT events X-Git-Tag: suricata-5.0.10~49 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=f8864862b47163dff753cd3ea95e24260325f50d;p=thirdparty%2Fsuricata-verify.git add tests for MQTT events --- diff --git a/tests/mqtt5-excessiveproplen/input.pcap b/tests/mqtt5-excessiveproplen/input.pcap new file mode 100644 index 000000000..2dc68d832 Binary files /dev/null and b/tests/mqtt5-excessiveproplen/input.pcap differ diff --git a/tests/mqtt5-excessiveproplen/suricata.yaml b/tests/mqtt5-excessiveproplen/suricata.yaml new file mode 100644 index 000000000..f6afe7659 --- /dev/null +++ b/tests/mqtt5-excessiveproplen/suricata.yaml @@ -0,0 +1,17 @@ +%YAML 1.1 +--- + +outputs: + - eve-log: + enabled: yes + filetype: regular + filename: eve.json + types: + - mqtt + - alert + - anomaly + +app-layer: + protocols: + mqtt: + enabled: yes diff --git a/tests/mqtt5-excessiveproplen/test.rules b/tests/mqtt5-excessiveproplen/test.rules new file mode 100644 index 000000000..a1c245453 --- /dev/null +++ b/tests/mqtt5-excessiveproplen/test.rules @@ -0,0 +1 @@ +alert mqtt any any -> any any (msg:"SURICATA MQTT Malformed Traffic"; app-layer-event:mqtt.malformed_traffic; classtype:protocol-command-decode; sid:1234; rev:1;) diff --git a/tests/mqtt5-excessiveproplen/test.yaml b/tests/mqtt5-excessiveproplen/test.yaml new file mode 100644 index 000000000..aa1c9bb21 --- /dev/null +++ b/tests/mqtt5-excessiveproplen/test.yaml @@ -0,0 +1,25 @@ +requires: + features: + - HAVE_LIBJANSSON + files: + - rust/src/mqtt/parser.rs + +args: + - -k none + +checks: + + - filter: + count: 1 + match: + event_type: anomaly + anomaly.app_proto: mqtt + anomaly.type: applayer + anomaly.event: malformed_traffic + anomaly.layer: proto_parser + + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 1234