]> git.ipfire.org Git - thirdparty/suricata-verify.git/log
thirdparty/suricata-verify.git
4 years agoframework: add python requirements.txt 424/head
Aaron Bungay [Thu, 28 Jan 2021 17:21:37 +0000 (17:21 +0000)] 
framework: add python requirements.txt

4 years agobug-4199: need to pass on suri 6 463/head
Victor Julien [Fri, 26 Feb 2021 07:17:28 +0000 (08:17 +0100)] 
bug-4199: need to pass on suri 6

4 years agotests: add more complex tests for bug 4199
Victor Julien [Fri, 26 Feb 2021 07:15:10 +0000 (08:15 +0100)] 
tests: add more complex tests for bug 4199

4 years agobug-4199: Add test for forum-reported issue 460/head
Jeff Lucovsky [Sat, 23 Jan 2021 20:26:33 +0000 (15:26 -0500)] 
bug-4199: Add test for forum-reported issue

4 years agobug-4199: Tests for shared http request body
Jeff Lucovsky [Sat, 12 Dec 2020 15:04:25 +0000 (10:04 -0500)] 
bug-4199: Tests for shared http request body

4 years agotests: dcerpc/zerologon now passes on 6
Victor Julien [Wed, 24 Feb 2021 08:04:54 +0000 (09:04 +0100)] 
tests: dcerpc/zerologon now passes on 6

4 years agodcerpc: limit test for bug 4198 to 7 for now 459/head
Victor Julien [Tue, 23 Feb 2021 20:14:42 +0000 (21:14 +0100)] 
dcerpc: limit test for bug 4198 to 7 for now

4 years agodcerpc: test for bug 4198
Shivani Bhardwaj [Sat, 20 Feb 2021 14:46:31 +0000 (20:16 +0530)] 
dcerpc: test for bug 4198

4 years agosmb: lock new tests for 7 for now
Victor Julien [Tue, 23 Feb 2021 19:54:35 +0000 (20:54 +0100)] 
smb: lock new tests for 7 for now

4 years agoAdds test for SMB AndX evasion 458/head
Philippe Antoine [Wed, 25 Nov 2020 15:04:55 +0000 (16:04 +0100)] 
Adds test for SMB AndX evasion

4 years agoAdds test for smb padding evasion
Philippe Antoine [Tue, 14 Apr 2020 12:05:16 +0000 (14:05 +0200)] 
Adds test for smb padding evasion

4 years agoAdds smb overlap evasion test
Philippe Antoine [Tue, 14 Apr 2020 11:46:02 +0000 (13:46 +0200)] 
Adds smb overlap evasion test

4 years agohttp: increase time limit for sticky start test 441/head 456/head
Philippe Antoine [Wed, 17 Feb 2021 15:37:17 +0000 (16:37 +0100)] 
http: increase time limit for sticky start test

4 years agotests: add midstream protocol detection test 451/head
Ilya Bakhtin [Mon, 15 Feb 2021 18:04:39 +0000 (19:04 +0100)] 
tests: add midstream protocol detection test

In midstream protocol detection, the protocol must be detected
if the server message is split

4 years agodatasets: add test for loading 1m StringSets 450/head
Shivani Bhardwaj [Mon, 7 Sep 2020 07:03:02 +0000 (12:33 +0530)] 
datasets: add test for loading 1m StringSets

4 years agohttp/connect: remove app proto from filter 445/head
Shivani Bhardwaj [Fri, 19 Feb 2021 07:47:02 +0000 (13:17 +0530)] 
http/connect: remove app proto from filter

There is no DCERPC packet in the pcap. With the addition of probe
function in DCERPC, app_proto check for dcerpc causes the test to fail.
It is incorrect, remove it.

4 years agodcerpc/udp: remove test as pcap is not good
Shivani Bhardwaj [Sat, 13 Feb 2021 11:22:08 +0000 (16:52 +0530)] 
dcerpc/udp: remove test as pcap is not good

The pcap contains a lot of suspicious data that does not look like
DCERPC/UDP e.g. body in auth verifier. It is not properly handled by
applayer UDP parser with the probe function as there are UDP packets
preceding DCERPC/UDP causing failures.

4 years agodcerpc/udp: test with Scapy gen PCAP
Shivani Bhardwaj [Fri, 22 Jan 2021 13:17:08 +0000 (18:47 +0530)] 
dcerpc/udp: test with Scapy gen PCAP

4 years agotests: add iprep test for issue 4280 437/head
Victor Julien [Sat, 13 Feb 2021 19:23:05 +0000 (20:23 +0100)] 
tests: add iprep test for issue 4280

4 years agoparallel runs: initialize failedLogs on non-Linux 439/head
Tharushi Jayasekara [Tue, 16 Feb 2021 16:43:24 +0000 (22:13 +0530)] 
parallel runs: initialize failedLogs on non-Linux

4 years agoparallel runs: don't initialize MP at all on non-linux
Jason Ish [Thu, 11 Feb 2021 17:27:50 +0000 (11:27 -0600)] 
parallel runs: don't initialize MP at all on non-linux

On Windows, simply initializing seems to fail.

4 years agorun: remove parallel tests capability for Windows/Mac
Tharushi Jayasekara [Thu, 14 Jan 2021 13:32:48 +0000 (19:02 +0530)] 
run: remove parallel tests capability for Windows/Mac

4 years agorun.py: default to using python 3
Tharushi Jayasekara [Fri, 8 Jan 2021 06:35:02 +0000 (12:05 +0530)] 
run.py: default to using python 3

4 years agorun: fix maximum number of parallel processes
Tharushi Jayasekara [Fri, 8 Jan 2021 06:03:58 +0000 (11:33 +0530)] 
run: fix maximum number of parallel processes

Unless -j is provided, set the maximum number of processes to 8 if
the cpu count exceeds that.

4 years agorun: parallel tests capability
Tharushi Jayasekara [Mon, 14 Dec 2020 04:45:02 +0000 (10:15 +0530)] 
run: parallel tests capability

Used the python multiprocessing module to add parallel tests
capability.

Added a -j parameter to control the number of jobs defaulting to the
number of cores found by the mp module.

4 years agoCheck libnss required for JA3 support 425/head
Shivani Bhardwaj [Sat, 30 Jan 2021 06:37:08 +0000 (12:07 +0530)] 
Check libnss required for JA3 support

4 years agoCheck libnss for the required hash calculation
Shivani Bhardwaj [Sat, 30 Jan 2021 06:36:10 +0000 (12:06 +0530)] 
Check libnss for the required hash calculation

4 years agoAdds test for http post data decompression 422/head
Philippe Antoine [Tue, 1 Oct 2019 08:37:00 +0000 (10:37 +0200)] 
Adds test for http post data decompression

4 years agoframework: adds feature filtering per check 419/head
Philippe Antoine [Fri, 8 Jan 2021 14:50:19 +0000 (15:50 +0100)] 
framework: adds feature filtering per check

4 years agoAdds check for http2 file brotli decompression
Philippe Antoine [Tue, 17 Nov 2020 14:34:21 +0000 (15:34 +0100)] 
Adds check for http2 file brotli decompression

4 years agoAdds check for http2 file gzip decompression
Philippe Antoine [Thu, 12 Nov 2020 09:48:49 +0000 (10:48 +0100)] 
Adds check for http2 file gzip decompression

4 years agohttp2: checks there are no anomaly
Philippe Antoine [Tue, 10 Nov 2020 09:22:46 +0000 (10:22 +0100)] 
http2: checks there are no anomaly

4 years agohttp2: add files testing
Victor Julien [Sat, 7 Nov 2020 15:59:47 +0000 (16:59 +0100)] 
http2: add files testing

Update basic test to count files.

Add new test to inspect file.data and file hashes.

4 years agotests: nfs version for 5 414/head
Victor Julien [Wed, 20 Jan 2021 21:26:45 +0000 (22:26 +0100)] 
tests: nfs version for 5

4 years agotests: extend nfs test with logging, rules
Victor Julien [Wed, 20 Jan 2021 19:40:29 +0000 (20:40 +0100)] 
tests: extend nfs test with logging, rules

Limit to v6+

4 years agotests: add ssh keyword tests
Victor Julien [Wed, 20 Jan 2021 15:03:36 +0000 (16:03 +0100)] 
tests: add ssh keyword tests

4 years agotests: smb add smb.share test
Victor Julien [Wed, 20 Jan 2021 14:57:38 +0000 (15:57 +0100)] 
tests: smb add smb.share test

4 years agotests: add etopen parse test 412/head
Victor Julien [Wed, 20 Jan 2021 11:15:04 +0000 (12:15 +0100)] 
tests: add etopen parse test

4 years agotests: add dnp3 tests 410/head
Victor Julien [Tue, 19 Jan 2021 18:23:24 +0000 (19:23 +0100)] 
tests: add dnp3 tests

Based on pcaps from:
https://github.com/bro/bro/tree/master/testing/btest/Traces/dnp3

4 years agotests: don't test proto IPv6-ICMP 409/head
Victor Julien [Mon, 18 Jan 2021 21:28:10 +0000 (22:28 +0100)] 
tests: don't test proto IPv6-ICMP

https://redmine.openinfosecfoundation.org/issues/4267

4 years agotests/esp: Add test for logging ESP flow/netflow
Emmanuel Thompson [Wed, 6 May 2020 14:05:23 +0000 (10:05 -0400)] 
tests/esp: Add test for logging ESP flow/netflow

4 years agotests: add teredo test 408/head
Victor Julien [Mon, 18 Jan 2021 18:22:28 +0000 (19:22 +0100)] 
tests: add teredo test

4 years agotests: sctp should work with Windows
Victor Julien [Mon, 18 Jan 2021 17:02:45 +0000 (18:02 +0100)] 
tests: sctp should work with Windows

4 years agotests: add ERSPAN II test
Victor Julien [Mon, 18 Jan 2021 17:01:54 +0000 (18:01 +0100)] 
tests: add ERSPAN II test

4 years agotests: add tests for various tickets 407/head
Victor Julien [Mon, 18 Jan 2021 14:48:03 +0000 (15:48 +0100)] 
tests: add tests for various tickets

4 years agotests: add smb tests
Victor Julien [Mon, 18 Jan 2021 14:42:46 +0000 (15:42 +0100)] 
tests: add smb tests

4 years agotests: skip sctp test on windows 406/head
Victor Julien [Mon, 18 Jan 2021 10:57:58 +0000 (11:57 +0100)] 
tests: skip sctp test on windows

4 years agotests: add issue 3267 test 405/head
Victor Julien [Mon, 18 Jan 2021 09:48:14 +0000 (10:48 +0100)] 
tests: add issue 3267 test

4 years agotests: add issue 3341 test
Victor Julien [Mon, 18 Jan 2021 09:46:37 +0000 (10:46 +0100)] 
tests: add issue 3341 test

4 years agotests: add bug 2736 tests
Victor Julien [Mon, 18 Jan 2021 09:45:21 +0000 (10:45 +0100)] 
tests: add bug 2736 tests

4 years agotests: add bug 2558 tests
Victor Julien [Mon, 18 Jan 2021 09:44:17 +0000 (10:44 +0100)] 
tests: add bug 2558 tests

4 years agotests: add 2491 tests
Victor Julien [Mon, 18 Jan 2021 09:43:11 +0000 (10:43 +0100)] 
tests: add 2491 tests

4 years agotests: add bug 2430 test
Victor Julien [Mon, 18 Jan 2021 09:41:56 +0000 (10:41 +0100)] 
tests: add bug 2430 test

4 years agotests: add bug 1045 test
Victor Julien [Mon, 18 Jan 2021 09:41:12 +0000 (10:41 +0100)] 
tests: add bug 1045 test

4 years agotests: add bug 2158 test
Victor Julien [Mon, 18 Jan 2021 09:39:35 +0000 (10:39 +0100)] 
tests: add bug 2158 test

4 years agotests: add bug 2511 test
Victor Julien [Mon, 18 Jan 2021 09:38:54 +0000 (10:38 +0100)] 
tests: add bug 2511 test

4 years agotests: bug 856 test
Victor Julien [Mon, 18 Jan 2021 09:38:25 +0000 (10:38 +0100)] 
tests: bug 856 test

4 years agotests: add bug 814 test
Victor Julien [Mon, 18 Jan 2021 09:37:33 +0000 (10:37 +0100)] 
tests: add bug 814 test

4 years agotests: add bug 990 test
Victor Julien [Mon, 18 Jan 2021 09:37:04 +0000 (10:37 +0100)] 
tests: add bug 990 test

4 years agotests: add bug 1401 tests
Victor Julien [Mon, 18 Jan 2021 09:36:16 +0000 (10:36 +0100)] 
tests: add bug 1401 tests

4 years agotests: sctp pcapng -> pcap
Victor Julien [Mon, 18 Jan 2021 09:13:01 +0000 (10:13 +0100)] 
tests: sctp pcapng -> pcap

4 years agotests: add simple sctp decoder test 404/head
Victor Julien [Mon, 18 Jan 2021 07:47:19 +0000 (08:47 +0100)] 
tests: add simple sctp decoder test

4 years agotests: add 2 simple nfs tests
Victor Julien [Mon, 18 Jan 2021 07:46:00 +0000 (08:46 +0100)] 
tests: add 2 simple nfs tests

4 years agotests: http.start add transform test
Victor Julien [Mon, 18 Jan 2021 07:21:47 +0000 (08:21 +0100)] 
tests: http.start add transform test

4 years agotests: update krb test to do detection 403/head
Victor Julien [Sun, 17 Jan 2021 19:12:36 +0000 (20:12 +0100)] 
tests: update krb test to do detection

4 years agotests: add http.start test
Victor Julien [Sun, 17 Jan 2021 18:45:56 +0000 (19:45 +0100)] 
tests: add http.start test

4 years agorun: support symlink for test directories 402/head
Tharushi Jayasekara [Fri, 15 Jan 2021 17:22:32 +0000 (22:52 +0530)] 
run: support symlink for test directories

4 years agosmtp-md5: test md5 logging of smtp subject and body 393/head
Jason Ish [Wed, 23 Dec 2020 22:56:20 +0000 (16:56 -0600)] 
smtp-md5: test md5 logging of smtp subject and body

4 years agonsh: add minimal detect testing 392/head
Victor Julien [Thu, 31 Dec 2020 11:36:41 +0000 (12:36 +0100)] 
nsh: add minimal detect testing

4 years agonsh: run for 7, add more detail
Victor Julien [Thu, 31 Dec 2020 11:24:06 +0000 (12:24 +0100)] 
nsh: run for 7, add more detail

4 years agonsh: Add tests for NSH headers types 1 and 2
Carl Smith [Tue, 18 Aug 2020 00:05:01 +0000 (12:05 +1200)] 
nsh: Add tests for NSH headers types 1 and 2

4 years agogithub-ci: 4.1 is eol, 6.0 test added 388/head
Victor Julien [Wed, 23 Dec 2020 20:32:15 +0000 (21:32 +0100)] 
github-ci: 4.1 is eol, 6.0 test added

4 years agotests: add more midstream test variants
Victor Julien [Wed, 23 Dec 2020 15:49:08 +0000 (16:49 +0100)] 
tests: add more midstream test variants

4 years agotests: add TCP async matching test 386/head
Victor Julien [Fri, 18 Dec 2020 07:08:25 +0000 (08:08 +0100)] 
tests: add TCP async matching test

4 years agotests: add tcp async testmyids test
Victor Julien [Thu, 17 Dec 2020 09:52:59 +0000 (10:52 +0100)] 
tests: add tcp async testmyids test

4 years agotests/dns: add test for logging SOA fields 378/head
Simon Dugas [Tue, 7 Apr 2020 17:40:29 +0000 (17:40 +0000)] 
tests/dns: add test for logging SOA fields

test config and pcap were copied from an existing test dns-udp-nxdomain-soa

4 years agodns: add test for SRV EVE-JSON output
Sascha Steinbiss [Tue, 3 Nov 2020 23:55:36 +0000 (00:55 +0100)] 
dns: add test for SRV EVE-JSON output

4 years agodns: add test for NULL record
Simon Dugas [Thu, 10 Sep 2020 21:04:40 +0000 (21:04 +0000)] 
dns: add test for NULL record

Add test case to show that NULL record types are being logged.

4 years agoAdds test against invalid HTTP protocol
Philippe Antoine [Thu, 5 Nov 2020 13:03:56 +0000 (14:03 +0100)] 
Adds test against invalid HTTP protocol

4 years agogeneve-test: simple test of the geneve decoder 372/head
Jason Ish [Fri, 4 Sep 2020 16:03:47 +0000 (10:03 -0600)] 
geneve-test: simple test of the geneve decoder

Just check the ICMP flow to see that decoding occurred.

4 years agotests/mac-eve-packet: check packet context metadata
Sascha Steinbiss [Sun, 8 Nov 2020 17:34:49 +0000 (18:34 +0100)] 
tests/mac-eve-packet: check packet context metadata

This refers to Redmine bug #4109.

4 years agotests/anomaly: Verify metadata section
Jeff Lucovsky [Thu, 17 Sep 2020 13:54:04 +0000 (09:54 -0400)] 
tests/anomaly: Verify metadata section

This commit verifies that the "metadata" element, if any, is in the
proper place within anomaly event records.

4 years agotests/dcerpc: fix event log check 371/head
Victor Julien [Thu, 26 Nov 2020 11:48:10 +0000 (12:48 +0100)] 
tests/dcerpc: fix event log check

4 years agogithub-ci: fix env handling 370/head
Victor Julien [Fri, 20 Nov 2020 07:22:34 +0000 (08:22 +0100)] 
github-ci: fix env handling

4 years agotests: ICMPv4 header tests
Jeff Lucovsky [Thu, 5 Nov 2020 12:44:53 +0000 (07:44 -0500)] 
tests: ICMPv4 header tests

4 years agoAdds test case for url-decode transform keyword
Philippe Antoine [Wed, 6 Nov 2019 12:23:21 +0000 (13:23 +0100)] 
Adds test case for url-decode transform keyword

4 years agoAdd tests for DCERPC/UDP
Shivani Bhardwaj [Thu, 12 Nov 2020 11:02:29 +0000 (16:32 +0530)] 
Add tests for DCERPC/UDP

4 years agorun: don't disable asan leak checks
Victor Julien [Mon, 16 Nov 2020 08:08:58 +0000 (09:08 +0100)] 
run: don't disable asan leak checks

4 years agotests: Mixed file_data/transforms in IPS mode 348/head
Jeff Lucovsky [Wed, 11 Nov 2020 12:31:57 +0000 (07:31 -0500)] 
tests: Mixed file_data/transforms in IPS mode

4 years agotests: Add combo with file_data/fast_pattern
Jeff Lucovsky [Sat, 24 Oct 2020 13:17:37 +0000 (09:17 -0400)] 
tests: Add combo with file_data/fast_pattern

4 years agotests: Add file-data/url_decode test
Jeff Lucovsky [Mon, 19 Oct 2020 12:52:40 +0000 (08:52 -0400)] 
tests: Add file-data/url_decode test

4 years agotests: Add SMTP tests for issue 3616
Jeff Lucovsky [Thu, 15 Oct 2020 12:46:23 +0000 (08:46 -0400)] 
tests: Add SMTP tests for issue 3616

4 years agobug-3616: New test with mixed file_data/transform rules
Jeff Lucovsky [Tue, 6 Oct 2020 12:24:48 +0000 (08:24 -0400)] 
bug-3616: New test with mixed file_data/transform rules

4 years agotests: Add exact match argument 345/head
Jeff Lucovsky [Tue, 20 Oct 2020 12:25:12 +0000 (08:25 -0400)] 
tests: Add exact match argument

This commit extends the CLI with a flag to treat the "pattern"
argument(s) as an exact match instead of a substring match.

4 years agoAdds test with HTTP connect followed by parser failure
Philippe Antoine [Wed, 30 Sep 2020 12:35:33 +0000 (14:35 +0200)] 
Adds test with HTTP connect followed by parser failure

4 years agoAdds http2 test against Suricata bug fixes
Philippe Antoine [Fri, 18 Sep 2020 06:15:44 +0000 (08:15 +0200)] 
Adds http2 test against Suricata bug fixes

4 years agodnp3: test of dnp3 flow direction fix
Ilya Bakhtin [Tue, 25 Aug 2020 13:16:40 +0000 (15:16 +0200)] 
dnp3: test of dnp3 flow direction fix

4 years agotests: Add file_data/compress-ws transform tests
Jeff Lucovsky [Thu, 10 Sep 2020 12:46:00 +0000 (08:46 -0400)] 
tests: Add file_data/compress-ws transform tests

4 years agotests: Add file_data/strip-ws transform tests
Jeff Lucovsky [Thu, 7 May 2020 13:27:07 +0000 (09:27 -0400)] 
tests: Add file_data/strip-ws transform tests

4 years agosmb-eicar-file: check files array 331/head
Jason Ish [Wed, 16 Sep 2020 15:21:22 +0000 (09:21 -0600)] 
smb-eicar-file: check files array

Add a check for the files array to make sure it exists
and has a filename.

Only applicable to v6.0.0+.