]> git.ipfire.org Git - thirdparty/suricata-verify.git/log
thirdparty/suricata-verify.git
3 years agocheck-eve: print full filename being tested
Jason Ish [Tue, 26 Oct 2021 15:45:43 +0000 (09:45 -0600)] 
check-eve: print full filename being tested

With check-eve it makes more sense to print the full filename
being tested rather than just the test name.  As it is possible
that more than the expected eve.json is being tested.

3 years agogithub-ci: add python3-jsonschema
Jason Ish [Mon, 1 Mar 2021 16:17:56 +0000 (10:17 -0600)] 
github-ci: add python3-jsonschema

Required for the EVE schema tests.

3 years agorun.py: integrate check-eve.py
Tharushi Jayasekara [Wed, 24 Feb 2021 16:53:25 +0000 (22:23 +0530)] 
run.py: integrate check-eve.py

3 years agocheck-eve: script to validate eve.json output
Tharushi Jayasekara [Wed, 24 Feb 2021 16:52:16 +0000 (22:22 +0530)] 
check-eve: script to validate eve.json output

3 years agoschema.json: schema to validate eve.json output
Tharushi Jayasekara [Wed, 24 Feb 2021 16:49:44 +0000 (22:19 +0530)] 
schema.json: schema to validate eve.json output

3 years agolua: adds test about ScFlowVarGet
Philippe Antoine [Thu, 21 Oct 2021 11:43:01 +0000 (13:43 +0200)] 
lua: adds test about ScFlowVarGet

cf redmine 2094

3 years agoframework: allow to use env variables in args
Philippe Antoine [Fri, 22 Oct 2021 10:16:42 +0000 (12:16 +0200)] 
framework: allow to use env variables in args

such as OUTPUT_DIR for datasets

3 years agoAdds test with dataset and pcrexform for unique param
Philippe Antoine [Thu, 21 Oct 2021 20:03:34 +0000 (22:03 +0200)] 
Adds test with dataset and pcrexform for unique param

3 years agotls-fingerprint: test sticky buffer variant
Jason [Mon, 18 Oct 2021 21:44:22 +0000 (17:44 -0400)] 
tls-fingerprint: test sticky buffer variant

Add another rule and filter to test the sticky buffer variant
of a tls fingerprint match. Also shows that the 2 are more or
less equivalent.

3 years agoAdds test about HTTP2 disabled
Philippe Antoine [Fri, 17 Sep 2021 14:47:35 +0000 (16:47 +0200)] 
Adds test about HTTP2 disabled

3 years agotests: fix http-urldecode-body test on openbsd 564/head
Victor Julien [Mon, 18 Oct 2021 14:59:30 +0000 (16:59 +0200)] 
tests: fix http-urldecode-body test on openbsd

Tshark rewrite of the pcap, turning timestamps from nanosecond
to microsecond.

3 years agotests: fix fastopen test on openbsd 563/head
Victor Julien [Mon, 18 Oct 2021 14:30:32 +0000 (16:30 +0200)] 
tests: fix fastopen test on openbsd

Just rewrote it with:

tshark -F pcap -r <old> -w <new>

This changed the md5sum, so something changed.

OpenBSD 7.0 reported caplen of 0.

3 years agotests: fix pcapng pcaps 562/head
Victor Julien [Mon, 18 Oct 2021 13:18:49 +0000 (15:18 +0200)] 
tests: fix pcapng pcaps

3 years agoci: fix pcapng check on ubuntu
Victor Julien [Mon, 18 Oct 2021 13:16:57 +0000 (15:16 +0200)] 
ci: fix pcapng check on ubuntu

3 years agorunner: fix tests always being run in quiet mode 558/head
Jason Ish [Sun, 10 Oct 2021 05:10:35 +0000 (23:10 -0600)] 
runner: fix tests always being run in quiet mode

Fix an early return introduced in
9839097b816d2f7e1cb00d4f4e98919565d122a1, which resulted in a quiet like
mode all the time.

3 years agotests: convert check.sh to test.yaml
Jason Ish [Mon, 20 Sep 2021 17:43:49 +0000 (11:43 -0600)] 
tests: convert check.sh to test.yaml

3 years agoAdds tests about IPv6 fragmentation 557/head
Philippe Antoine [Fri, 10 Sep 2021 11:38:05 +0000 (13:38 +0200)] 
Adds tests about IPv6 fragmentation

3 years agomodbus: enable in configuration
Philippe Antoine [Thu, 7 Oct 2021 08:53:00 +0000 (10:53 +0200)] 
modbus: enable in configuration

3 years agosmb-eicar-padding: bump min-version to 6
Shivani Bhardwaj [Wed, 6 Oct 2021 10:29:39 +0000 (15:59 +0530)] 
smb-eicar-padding: bump min-version to 6

3 years agosmb-eicar-overlap: bump min-version to 6
Shivani Bhardwaj [Wed, 6 Oct 2021 10:29:28 +0000 (15:59 +0530)] 
smb-eicar-overlap: bump min-version to 6

3 years agokrb5-probing: bump min-version to 6
Shivani Bhardwaj [Wed, 6 Oct 2021 10:29:13 +0000 (15:59 +0530)] 
krb5-probing: bump min-version to 6

3 years agoissue-3703: bump min-version to 6
Shivani Bhardwaj [Wed, 6 Oct 2021 10:29:02 +0000 (15:59 +0530)] 
issue-3703: bump min-version to 6

3 years agossh: fix alert count 554/head
Shivani Bhardwaj [Mon, 6 Sep 2021 01:00:30 +0000 (06:30 +0530)] 
ssh: fix alert count

3 years agogithub-ci: add pcre2
Jason Ish [Wed, 29 Sep 2021 17:44:02 +0000 (11:44 -0600)] 
github-ci: add pcre2

3 years agoUse generic PCRE string for error code checking 549/head
Philippe Antoine [Tue, 25 May 2021 15:38:38 +0000 (17:38 +0200)] 
Use generic PCRE string for error code checking

3 years agopcrexform: test becomes obsolete in version 7
Philippe Antoine [Tue, 16 Mar 2021 19:37:07 +0000 (20:37 +0100)] 
pcrexform: test becomes obsolete in version 7

converted to a unit test failing to load the signature

3 years agotests: enable issue 4663 tests for 5 and 6
Victor Julien [Tue, 28 Sep 2021 12:41:26 +0000 (14:41 +0200)] 
tests: enable issue 4663 tests for 5 and 6

3 years agoSets minimum version 6 for ip6 invalid fragment length 547/head
Philippe Antoine [Fri, 10 Sep 2021 09:06:08 +0000 (11:06 +0200)] 
Sets minimum version 6 for ip6 invalid fragment length

3 years agoAds various tests about IPv6 denial of service
Philippe Antoine [Fri, 23 Jul 2021 15:56:35 +0000 (17:56 +0200)] 
Ads various tests about IPv6 denial of service

3 years agoAdds test about IPv6 smurf detection
Philippe Antoine [Fri, 23 Jul 2021 15:44:06 +0000 (17:44 +0200)] 
Adds test about IPv6 smurf detection

aka (spoofed) ping to multicast

3 years agoAdds test about ICMPv6 kill router
Philippe Antoine [Tue, 20 Jul 2021 08:51:27 +0000 (10:51 +0200)] 
Adds test about ICMPv6 kill router

3 years agoAdds test about ipv6 unknown dst opts
Philippe Antoine [Tue, 20 Jul 2021 07:57:00 +0000 (09:57 +0200)] 
Adds test about ipv6 unknown dst opts

used as way to have a covert channel

3 years agoAdds test about icmpv6 type and code detection
Philippe Antoine [Mon, 19 Jul 2021 13:47:40 +0000 (15:47 +0200)] 
Adds test about icmpv6 type and code detection

3 years agoAdds test about tcp protocol detection bailout
Philippe Antoine [Fri, 23 Apr 2021 20:24:20 +0000 (22:24 +0200)] 
Adds test about tcp protocol detection bailout

3 years agoAdd test for Bug #4503
Mats Klepsland [Mon, 31 May 2021 10:57:05 +0000 (12:57 +0200)] 
Add test for Bug #4503

3 years agorun.py: remove support for check.sh
Jason Ish [Mon, 20 Sep 2021 19:28:38 +0000 (13:28 -0600)] 
run.py: remove support for check.sh

3 years agoci: run in quiet mode
Jason Ish [Sat, 18 Sep 2021 00:30:53 +0000 (18:30 -0600)] 
ci: run in quiet mode

3 years agoci: give jobs better names
Jason Ish [Fri, 17 Sep 2021 22:30:46 +0000 (16:30 -0600)] 
ci: give jobs better names

3 years agoci: add lua to the ubuntu builds
Jason Ish [Fri, 17 Sep 2021 22:29:11 +0000 (16:29 -0600)] 
ci: add lua to the ubuntu builds

3 years agoci: add almalinux build to test on RHEL-like systems
Jason Ish [Fri, 17 Sep 2021 22:24:03 +0000 (16:24 -0600)] 
ci: add almalinux build to test on RHEL-like systems

The test is done on Ubuntu, but there are some variations
between RHEL-like and Ubuntu that we should catch.

3 years agoAdds http2 range test
Philippe Antoine [Fri, 3 Sep 2021 09:09:57 +0000 (11:09 +0200)] 
Adds http2 range test

3 years agoAdds http range test over multiple flows
Philippe Antoine [Thu, 18 Feb 2021 09:40:22 +0000 (10:40 +0100)] 
Adds http range test over multiple flows

3 years agoAdds incomplete test for http range file
Philippe Antoine [Fri, 6 Dec 2019 14:58:09 +0000 (15:58 +0100)] 
Adds incomplete test for http range file

3 years agolua: fix ua-scfileinfo on 5.0.x w/o NSS 546/head
Victor Julien [Mon, 27 Sep 2021 12:38:25 +0000 (14:38 +0200)] 
lua: fix ua-scfileinfo on 5.0.x w/o NSS

3 years agofilestore-stream-depth: fix test for 6.0.x
Shivani Bhardwaj [Fri, 17 Sep 2021 06:06:58 +0000 (11:36 +0530)] 
filestore-stream-depth: fix test for 6.0.x

3 years agolua/fileinfo: match script and expected output 540/head
Victor Julien [Fri, 17 Sep 2021 09:24:33 +0000 (11:24 +0200)] 
lua/fileinfo: match script and expected output

3 years agotests: add test for lua SCFileInfo
Juliana Fajardini [Thu, 16 Sep 2021 13:41:00 +0000 (14:41 +0100)] 
tests: add test for lua SCFileInfo

Prep for using lua's pushinteger function in SCFileInfo callbacks

3 years agotests: add test for lua's SCRuleIds function
Juliana Fajardini [Mon, 26 Jul 2021 13:58:19 +0000 (14:58 +0100)] 
tests: add test for lua's SCRuleIds function

3 years agotests: add test for SCFlowStats function
Juliana Fajardini [Mon, 26 Jul 2021 13:49:23 +0000 (14:49 +0100)] 
tests: add test for SCFlowStats function

3 years agotests: add lua SCPacketTuple test
Juliana Fajardini [Thu, 1 Jul 2021 18:58:22 +0000 (19:58 +0100)] 
tests: add lua SCPacketTuple test

3 years agotests: add lua SCFlowTuple test
Juliana Fajardini [Thu, 1 Jul 2021 18:57:11 +0000 (19:57 +0100)] 
tests: add lua SCFlowTuple test

3 years agotests: add bug 4663 and 4670 tests
Victor Julien [Fri, 3 Sep 2021 15:03:24 +0000 (17:03 +0200)] 
tests: add bug 4663 and 4670 tests

3 years agorunner: add --quiet option
Jason Ish [Wed, 8 Sep 2021 16:59:44 +0000 (10:59 -0600)] 
runner: add --quiet option

With --quiet each successful test won't be output, instead
just failed tests, the final summary and maybe some other
useful diagnostic info.

Quiet will also suppress skipped tests from being printed.

3 years agotests: fix tests for suricata <=6 530/head
Victor Julien [Mon, 6 Sep 2021 10:17:56 +0000 (12:17 +0200)] 
tests: fix tests for suricata <=6

3 years agoAdds a test about IPv6 fragment invalid length 527/head
Philippe Antoine [Mon, 19 Jul 2021 15:23:04 +0000 (17:23 +0200)] 
Adds a test about IPv6 fragment invalid length

3 years agoAdds http.header on HTTP2 traffic check
Philippe Antoine [Mon, 31 May 2021 08:50:19 +0000 (10:50 +0200)] 
Adds http.header on HTTP2 traffic check

3 years agoAdds http.header_names on HTTP2 traffic check
Philippe Antoine [Mon, 31 May 2021 08:11:05 +0000 (10:11 +0200)] 
Adds http.header_names on HTTP2 traffic check

3 years agoAdds http.host on HTTP2 traffic check
Philippe Antoine [Wed, 26 May 2021 20:00:53 +0000 (22:00 +0200)] 
Adds http.host on HTTP2 traffic check

3 years agohttp2: upgrade transforms Host into :authority
Philippe Antoine [Wed, 26 May 2021 18:58:24 +0000 (20:58 +0200)] 
http2: upgrade transforms Host into :authority

3 years agoAdds test about http2 deflate decompression
Philippe Antoine [Mon, 5 Jul 2021 08:59:27 +0000 (10:59 +0200)] 
Adds test about http2 deflate decompression

3 years agotests: add issue 3703 test 526/head
Victor Julien [Wed, 24 Mar 2021 20:43:27 +0000 (21:43 +0100)] 
tests: add issue 3703 test

3 years agotests: updates after fixing issue 3703
Victor Julien [Tue, 23 Mar 2021 10:49:43 +0000 (11:49 +0100)] 
tests: updates after fixing issue 3703

3 years agoBetter checks for file deletion over SMB2
Philippe Antoine [Tue, 13 Jul 2021 11:52:00 +0000 (13:52 +0200)] 
Better checks for file deletion over SMB2

3 years agoAdds test about file deletion over SMB2
Philippe Antoine [Tue, 13 Jul 2021 08:56:52 +0000 (10:56 +0200)] 
Adds test about file deletion over SMB2

3 years agorequires: document per-check requires with a test conversion
Jason Ish [Mon, 23 Aug 2021 22:58:32 +0000 (16:58 -0600)] 
requires: document per-check requires with a test conversion

3 years agorunner: use same require checks in filters as main test
Jason Ish [Mon, 23 Aug 2021 22:28:08 +0000 (16:28 -0600)] 
runner: use same require checks in filters as main test

Re-use the requirements checking code from the test case in the
per-test filters.  This means all requirements like lt-version,
etc are available at the filter level.

3 years agorunner: remove 'config' requires
Jason Ish [Mon, 23 Aug 2021 22:17:29 +0000 (16:17 -0600)] 
runner: remove 'config' requires

This is not used, and not documented and did have a spurious
debug line.  I think it was an unfinished prototype that
never got used.

4 years agofile-compare: skip file-compare tests on Windows
Jason Ish [Wed, 7 Jul 2021 13:53:24 +0000 (07:53 -0600)] 
file-compare: skip file-compare tests on Windows

These should work, but it looks like there is a path issue,
so skip these tests on Windows until it can be fixed.

4 years agooutput-tcp-data: use file-compare in test.yaml
Jason Ish [Tue, 6 Jul 2021 23:00:20 +0000 (17:00 -0600)] 
output-tcp-data: use file-compare in test.yaml

4 years agorun: convert cmp tests to python
Tharushi Jayasekara [Tue, 16 Feb 2021 18:57:27 +0000 (00:27 +0530)] 
run: convert cmp tests to python

4 years agoreadme: example of file-compare check
Tharushi Jayasekara [Tue, 16 Feb 2021 18:53:55 +0000 (00:23 +0530)] 
readme: example of file-compare check

4 years agotests: add file-compare test
Tharushi Jayasekara [Tue, 16 Feb 2021 18:53:05 +0000 (00:23 +0530)] 
tests: add file-compare test

4 years agotests: add test for issue 4394
Victor Julien [Thu, 11 Mar 2021 16:12:56 +0000 (17:12 +0100)] 
tests: add test for issue 4394

4 years agodecode/vntag: 6.0.3+ backport support
Jeff Lucovsky [Tue, 18 May 2021 12:22:12 +0000 (08:22 -0400)] 
decode/vntag: 6.0.3+ backport support

4 years agotests/vntag: Basic test case for VNTAG decode
Jeff Lucovsky [Sat, 24 Apr 2021 20:04:04 +0000 (16:04 -0400)] 
tests/vntag: Basic test case for VNTAG decode

4 years agomqtt: add suricata.yaml enabling MQTT for testing
Sascha Steinbiss [Sat, 26 Jun 2021 12:12:50 +0000 (14:12 +0200)] 
mqtt: add suricata.yaml enabling MQTT for testing

4 years agothreshold-config: New test for issue in 2190
Jeff Lucovsky [Sat, 5 Dec 2020 14:43:12 +0000 (09:43 -0500)] 
threshold-config: New test for issue in 2190

This commit adds a test case for large IP address handling in the
threshold.config file.

4 years agoMake HTTP2 test work on version 6
Philippe Antoine [Wed, 26 May 2021 09:44:48 +0000 (11:44 +0200)] 
Make HTTP2 test work on version 6

4 years agotest/mqtt: add sid to mqtt-binary-message rule
Juliana Fajardini [Thu, 17 Jun 2021 17:27:07 +0000 (18:27 +0100)] 
test/mqtt: add sid to mqtt-binary-message rule

mqtt-binary-message: add sid to rule in test.rules

4 years agoAdds check about ssh bypass
Philippe Antoine [Fri, 4 Jun 2021 08:36:04 +0000 (10:36 +0200)] 
Adds check about ssh bypass

4 years agoAdds test about ftp epsv response parsing 491/head
Philippe Antoine [Tue, 27 Apr 2021 07:15:24 +0000 (09:15 +0200)] 
Adds test about ftp epsv response parsing

4 years agomodbus: add test cases
Simon Dugas [Sun, 6 Dec 2020 17:20:24 +0000 (17:20 +0000)] 
modbus: add test cases

Add tests for modbus logging and alerting.

4 years agohttp2: fix for suricata 6
Victor Julien [Fri, 21 May 2021 08:50:02 +0000 (10:50 +0200)] 
http2: fix for suricata 6

4 years agoAdds check for http.cookie keyword on http2 traffic 501/head
Philippe Antoine [Mon, 26 Apr 2021 13:50:17 +0000 (15:50 +0200)] 
Adds check for http.cookie keyword on http2 traffic

4 years agoAdds check for http.host.raw keyword on http2 traffic
Philippe Antoine [Mon, 26 Apr 2021 13:29:25 +0000 (15:29 +0200)] 
Adds check for http.host.raw keyword on http2 traffic

4 years agoAdds check for http.method keyword on http2 traffic
Philippe Antoine [Mon, 26 Apr 2021 13:16:24 +0000 (15:16 +0200)] 
Adds check for http.method keyword on http2 traffic

4 years agoAdds check for http.server keyword on http2 traffic
Philippe Antoine [Mon, 26 Apr 2021 13:00:39 +0000 (15:00 +0200)] 
Adds check for http.server keyword on http2 traffic

4 years agohttp2: use stat_code instead of stat_msg as keyword
Philippe Antoine [Mon, 26 Apr 2021 12:42:11 +0000 (14:42 +0200)] 
http2: use stat_code instead of stat_msg as keyword

4 years agohttp-sha256-drop-02: don't use flow_id in test
Eric Leblond [Sun, 18 Apr 2021 10:26:05 +0000 (12:26 +0200)] 
http-sha256-drop-02: don't use flow_id in test

flow_id has no reason to be fix from a user perspective so we
should not use it in test but use information from the flow
itself.

4 years agotests: Invalid threshold.config w/out -T 498/head
Jeff Lucovsky [Sun, 28 Feb 2021 20:06:04 +0000 (15:06 -0500)] 
tests: Invalid threshold.config w/out -T

4 years agotests: Add test for threshold.config validation
Jeff Lucovsky [Sun, 28 Feb 2021 19:42:00 +0000 (14:42 -0500)] 
tests: Add test for threshold.config validation

This commit adds a test case to insure that "-T" stops execution when
threshold.config is not valid.

4 years agotests: basic geoip test
Eric Leblond [Thu, 1 Aug 2019 19:29:12 +0000 (21:29 +0200)] 
tests: basic geoip test

The tests are done by using a local database generated via the
geoip.pl Perl script. The obtained maxmindb test.mmdb and it only
contains 2 entries.

4 years agomore features detection in run.py
Eric Leblond [Thu, 1 Aug 2019 19:28:29 +0000 (21:28 +0200)] 
more features detection in run.py

4 years agotests/ftpdata: add detection
Victor Julien [Tue, 12 Jan 2021 21:03:13 +0000 (22:03 +0100)] 
tests/ftpdata: add detection

4 years agotests/threshold: Code coverage for issue 4407
Jeff Lucovsky [Wed, 31 Mar 2021 12:58:42 +0000 (08:58 -0400)] 
tests/threshold: Code coverage for issue 4407

This test insures that the Suricata code added for issue 4407 is
exercised.

4 years agotests: add test for Rust template parser 483/head
Jason Ish [Mon, 29 Mar 2021 16:28:17 +0000 (10:28 -0600)] 
tests: add test for Rust template parser

4 years agotests: add test for C template parser
Jason Ish [Mon, 29 Mar 2021 16:21:32 +0000 (10:21 -0600)] 
tests: add test for C template parser

4 years agoAdds kerberos probing parser test
Philippe Antoine [Thu, 11 Mar 2021 15:17:56 +0000 (16:17 +0100)] 
Adds kerberos probing parser test

4 years agolicense: add a LICENSE.txt (MIT)
Jason Ish [Tue, 16 Mar 2021 17:41:12 +0000 (11:41 -0600)] 
license: add a LICENSE.txt (MIT)

4 years agodns-udp-eve-log-srv: for Suricata v7+ 479/head
Jason Ish [Tue, 16 Mar 2021 04:24:35 +0000 (22:24 -0600)] 
dns-udp-eve-log-srv: for Suricata v7+

Remove file check and just use a version check now that 7 is out.