From: Juliana Fajardini <jufajardini@gmail.com>
Date: Fri, 14 Feb 2025 23:06:23 +0000 (-0300)
Subject: tests: add test for pgsql event
X-Git-Tag: suricata-7.0.9~36
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=refs%2Fpull%2F2306%2Fhead;p=thirdparty%2Fsuricata-verify.git

tests: add test for pgsql event

Related to
Task #5566
---

diff --git a/tests/pgsql/pgsql-events/README.md b/tests/pgsql/pgsql-events/README.md
new file mode 100644
index 000000000..677d229ac
--- /dev/null
+++ b/tests/pgsql/pgsql-events/README.md
@@ -0,0 +1,11 @@
+# Test
+
+Showcase/ test PGSQL events.
+
+# Pcap
+
+Provided by Victor Julien.
+
+# Ticket
+
+https://redmine.openinfosecfoundation.org/issues/5566
diff --git a/tests/pgsql/pgsql-events/UnknownMessage.pcap b/tests/pgsql/pgsql-events/UnknownMessage.pcap
new file mode 100644
index 000000000..a249b708b
Binary files /dev/null and b/tests/pgsql/pgsql-events/UnknownMessage.pcap differ
diff --git a/tests/pgsql/pgsql-events/suricata.yaml b/tests/pgsql/pgsql-events/suricata.yaml
new file mode 100644
index 000000000..e55017e86
--- /dev/null
+++ b/tests/pgsql/pgsql-events/suricata.yaml
@@ -0,0 +1,23 @@
+%YAML 1.1
+---
+
+outputs:
+   - eve-log:
+       enabled: yes
+       filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
+       filename: eve.json
+       types:
+         - pgsql:
+             enabled: yes
+         - alert
+         - flow
+         - stats
+
+app-layer:
+  protocols:
+    pgsql:
+      enabled: yes
+      # Stream reassembly size for PostgreSQL. By default, track it completely.
+      stream-depth: 0
+      # Maximum number of live PostgreSQL transactions per flow
+      # max-tx: 1024
diff --git a/tests/pgsql/pgsql-events/test.rules b/tests/pgsql/pgsql-events/test.rules
new file mode 100644
index 000000000..f78f18d55
--- /dev/null
+++ b/tests/pgsql/pgsql-events/test.rules
@@ -0,0 +1 @@
+alert pgsql any any -> any any (msg:"PGSQL unknown/ malformed message"; app-layer-event:pgsql.malformed_request; flow:to_server; sid:1;)
diff --git a/tests/pgsql/pgsql-events/test.yaml b/tests/pgsql/pgsql-events/test.yaml
new file mode 100644
index 000000000..fd4b1878e
--- /dev/null
+++ b/tests/pgsql/pgsql-events/test.yaml
@@ -0,0 +1,13 @@
+requires:
+    min-version: 8
+
+args:
+- -k none --set stream.midstream=true --set stream.inline=true
+
+checks:
+    - filter:
+        filename: eve.json
+        count: 1
+        match:
+            event_type: alert
+            alert.signature_id: 1