From: Sascha Steinbiss <satta@debian.org>
Date: Wed, 11 Oct 2023 20:21:46 +0000 (+0200)
Subject: mqtt: add test case for protocol string keyword
X-Git-Tag: suricata-6.0.16~38
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=refs%2Fpull%2F1476%2Fhead;p=thirdparty%2Fsuricata-verify.git

mqtt: add test case for protocol string keyword

Ticket:  OISF#6396
---

diff --git a/tests/mqtt-connect-rules/mqtt5_pub_jpeg.pcap b/tests/mqtt-connect-rules/mqtt5_pub_jpeg.pcap
new file mode 100644
index 000000000..fd6e90509
Binary files /dev/null and b/tests/mqtt-connect-rules/mqtt5_pub_jpeg.pcap differ
diff --git a/tests/mqtt-connect-rules/suricata.yaml b/tests/mqtt-connect-rules/suricata.yaml
new file mode 100644
index 000000000..6fb68aab1
--- /dev/null
+++ b/tests/mqtt-connect-rules/suricata.yaml
@@ -0,0 +1,16 @@
+%YAML 1.1
+---
+
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular
+      filename: eve.json
+      types:
+        - mqtt
+        - alert
+
+app-layer:
+  protocols:
+    mqtt:
+      enabled: yes
\ No newline at end of file
diff --git a/tests/mqtt-connect-rules/test.rules b/tests/mqtt-connect-rules/test.rules
new file mode 100644
index 000000000..4668f5cb6
--- /dev/null
+++ b/tests/mqtt-connect-rules/test.rules
@@ -0,0 +1,4 @@
+alert mqtt any any -> any any (msg:"MQTT CONNECT protocol string SUCCESS"; mqtt.connect.protocol_string; content:"MQTT"; sid:1;)
+alert mqtt any any -> any any (msg:"MQTT CONNECT protocol string SUCCESS2"; mqtt.connect.protocol_string; content:"M"; sid:2;)
+alert mqtt any any -> any any (msg:"MQTT CONNECT protocol string FAIL"; mqtt.connect.protocol_string; content:"Foobar"; sid:3;)
+
diff --git a/tests/mqtt-connect-rules/test.yaml b/tests/mqtt-connect-rules/test.yaml
new file mode 100644
index 000000000..191314072
--- /dev/null
+++ b/tests/mqtt-connect-rules/test.yaml
@@ -0,0 +1,63 @@
+requires:
+  files:
+    - src/detect-mqtt-connect-protocol-string.c
+
+args:
+  - -k none
+
+checks:
+
+  - filter:
+      count: 1
+      match:
+        event_type: mqtt
+        mqtt.connect.protocol_string: MQTT
+        mqtt.connect.protocol_version: 5
+        mqtt.connect.flags.username: true
+        mqtt.connect.flags.password: true
+        mqtt.connect.flags.will: false
+        mqtt.connect.flags.will_retain: false
+        mqtt.connect.flags.clean_session: true
+        mqtt.connect.client_id: ""
+        mqtt.connect.username: user
+        mqtt.connect.password: pass
+        mqtt.connect.properties.receive_maximum: 20
+        mqtt.connack.session_present: false
+        mqtt.connack.return_code: 0
+        mqtt.connack.properties.topic_alias_maximum: 10
+
+  - filter:
+      count: 1
+      match:
+        event_type: mqtt
+        mqtt.publish.qos: 0
+        mqtt.publish.retain: false
+        mqtt.publish.dup: false
+        mqtt.publish.topic: topicX
+
+  - filter:
+      count: 1
+      match:
+        event_type: mqtt
+        mqtt.disconnect.qos: 0
+        mqtt.disconnect.retain: false
+        mqtt.disconnect.dup: false
+        mqtt.disconnect.reason_code: 0
+
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature: MQTT CONNECT protocol string SUCCESS
+
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature: MQTT CONNECT protocol string SUCCESS2
+
+  - filter:
+      count: 0
+      match:
+        event_type: alert
+        alert.signature: MQTT CONNECT protocol string FAIL