]> git.ipfire.org Git - thirdparty/suricata-verify.git/log
thirdparty/suricata-verify.git
3 years agolua: fix ua-scfileinfo on 5.0.x w/o NSS 546/head
Victor Julien [Mon, 27 Sep 2021 12:38:25 +0000 (14:38 +0200)] 
lua: fix ua-scfileinfo on 5.0.x w/o NSS

3 years agofilestore-stream-depth: fix test for 6.0.x
Shivani Bhardwaj [Fri, 17 Sep 2021 06:06:58 +0000 (11:36 +0530)] 
filestore-stream-depth: fix test for 6.0.x

3 years agolua/fileinfo: match script and expected output 540/head
Victor Julien [Fri, 17 Sep 2021 09:24:33 +0000 (11:24 +0200)] 
lua/fileinfo: match script and expected output

3 years agotests: add test for lua SCFileInfo
Juliana Fajardini [Thu, 16 Sep 2021 13:41:00 +0000 (14:41 +0100)] 
tests: add test for lua SCFileInfo

Prep for using lua's pushinteger function in SCFileInfo callbacks

3 years agotests: add test for lua's SCRuleIds function
Juliana Fajardini [Mon, 26 Jul 2021 13:58:19 +0000 (14:58 +0100)] 
tests: add test for lua's SCRuleIds function

3 years agotests: add test for SCFlowStats function
Juliana Fajardini [Mon, 26 Jul 2021 13:49:23 +0000 (14:49 +0100)] 
tests: add test for SCFlowStats function

3 years agotests: add lua SCPacketTuple test
Juliana Fajardini [Thu, 1 Jul 2021 18:58:22 +0000 (19:58 +0100)] 
tests: add lua SCPacketTuple test

3 years agotests: add lua SCFlowTuple test
Juliana Fajardini [Thu, 1 Jul 2021 18:57:11 +0000 (19:57 +0100)] 
tests: add lua SCFlowTuple test

3 years agotests: add bug 4663 and 4670 tests
Victor Julien [Fri, 3 Sep 2021 15:03:24 +0000 (17:03 +0200)] 
tests: add bug 4663 and 4670 tests

3 years agorunner: add --quiet option
Jason Ish [Wed, 8 Sep 2021 16:59:44 +0000 (10:59 -0600)] 
runner: add --quiet option

With --quiet each successful test won't be output, instead
just failed tests, the final summary and maybe some other
useful diagnostic info.

Quiet will also suppress skipped tests from being printed.

3 years agotests: fix tests for suricata <=6 530/head
Victor Julien [Mon, 6 Sep 2021 10:17:56 +0000 (12:17 +0200)] 
tests: fix tests for suricata <=6

3 years agoAdds a test about IPv6 fragment invalid length 527/head
Philippe Antoine [Mon, 19 Jul 2021 15:23:04 +0000 (17:23 +0200)] 
Adds a test about IPv6 fragment invalid length

3 years agoAdds http.header on HTTP2 traffic check
Philippe Antoine [Mon, 31 May 2021 08:50:19 +0000 (10:50 +0200)] 
Adds http.header on HTTP2 traffic check

3 years agoAdds http.header_names on HTTP2 traffic check
Philippe Antoine [Mon, 31 May 2021 08:11:05 +0000 (10:11 +0200)] 
Adds http.header_names on HTTP2 traffic check

3 years agoAdds http.host on HTTP2 traffic check
Philippe Antoine [Wed, 26 May 2021 20:00:53 +0000 (22:00 +0200)] 
Adds http.host on HTTP2 traffic check

3 years agohttp2: upgrade transforms Host into :authority
Philippe Antoine [Wed, 26 May 2021 18:58:24 +0000 (20:58 +0200)] 
http2: upgrade transforms Host into :authority

3 years agoAdds test about http2 deflate decompression
Philippe Antoine [Mon, 5 Jul 2021 08:59:27 +0000 (10:59 +0200)] 
Adds test about http2 deflate decompression

3 years agotests: add issue 3703 test 526/head
Victor Julien [Wed, 24 Mar 2021 20:43:27 +0000 (21:43 +0100)] 
tests: add issue 3703 test

3 years agotests: updates after fixing issue 3703
Victor Julien [Tue, 23 Mar 2021 10:49:43 +0000 (11:49 +0100)] 
tests: updates after fixing issue 3703

3 years agoBetter checks for file deletion over SMB2
Philippe Antoine [Tue, 13 Jul 2021 11:52:00 +0000 (13:52 +0200)] 
Better checks for file deletion over SMB2

3 years agoAdds test about file deletion over SMB2
Philippe Antoine [Tue, 13 Jul 2021 08:56:52 +0000 (10:56 +0200)] 
Adds test about file deletion over SMB2

3 years agorequires: document per-check requires with a test conversion
Jason Ish [Mon, 23 Aug 2021 22:58:32 +0000 (16:58 -0600)] 
requires: document per-check requires with a test conversion

3 years agorunner: use same require checks in filters as main test
Jason Ish [Mon, 23 Aug 2021 22:28:08 +0000 (16:28 -0600)] 
runner: use same require checks in filters as main test

Re-use the requirements checking code from the test case in the
per-test filters.  This means all requirements like lt-version,
etc are available at the filter level.

3 years agorunner: remove 'config' requires
Jason Ish [Mon, 23 Aug 2021 22:17:29 +0000 (16:17 -0600)] 
runner: remove 'config' requires

This is not used, and not documented and did have a spurious
debug line.  I think it was an unfinished prototype that
never got used.

4 years agofile-compare: skip file-compare tests on Windows
Jason Ish [Wed, 7 Jul 2021 13:53:24 +0000 (07:53 -0600)] 
file-compare: skip file-compare tests on Windows

These should work, but it looks like there is a path issue,
so skip these tests on Windows until it can be fixed.

4 years agooutput-tcp-data: use file-compare in test.yaml
Jason Ish [Tue, 6 Jul 2021 23:00:20 +0000 (17:00 -0600)] 
output-tcp-data: use file-compare in test.yaml

4 years agorun: convert cmp tests to python
Tharushi Jayasekara [Tue, 16 Feb 2021 18:57:27 +0000 (00:27 +0530)] 
run: convert cmp tests to python

4 years agoreadme: example of file-compare check
Tharushi Jayasekara [Tue, 16 Feb 2021 18:53:55 +0000 (00:23 +0530)] 
readme: example of file-compare check

4 years agotests: add file-compare test
Tharushi Jayasekara [Tue, 16 Feb 2021 18:53:05 +0000 (00:23 +0530)] 
tests: add file-compare test

4 years agotests: add test for issue 4394
Victor Julien [Thu, 11 Mar 2021 16:12:56 +0000 (17:12 +0100)] 
tests: add test for issue 4394

4 years agodecode/vntag: 6.0.3+ backport support
Jeff Lucovsky [Tue, 18 May 2021 12:22:12 +0000 (08:22 -0400)] 
decode/vntag: 6.0.3+ backport support

4 years agotests/vntag: Basic test case for VNTAG decode
Jeff Lucovsky [Sat, 24 Apr 2021 20:04:04 +0000 (16:04 -0400)] 
tests/vntag: Basic test case for VNTAG decode

4 years agomqtt: add suricata.yaml enabling MQTT for testing
Sascha Steinbiss [Sat, 26 Jun 2021 12:12:50 +0000 (14:12 +0200)] 
mqtt: add suricata.yaml enabling MQTT for testing

4 years agothreshold-config: New test for issue in 2190
Jeff Lucovsky [Sat, 5 Dec 2020 14:43:12 +0000 (09:43 -0500)] 
threshold-config: New test for issue in 2190

This commit adds a test case for large IP address handling in the
threshold.config file.

4 years agoMake HTTP2 test work on version 6
Philippe Antoine [Wed, 26 May 2021 09:44:48 +0000 (11:44 +0200)] 
Make HTTP2 test work on version 6

4 years agotest/mqtt: add sid to mqtt-binary-message rule
Juliana Fajardini [Thu, 17 Jun 2021 17:27:07 +0000 (18:27 +0100)] 
test/mqtt: add sid to mqtt-binary-message rule

mqtt-binary-message: add sid to rule in test.rules

4 years agoAdds check about ssh bypass
Philippe Antoine [Fri, 4 Jun 2021 08:36:04 +0000 (10:36 +0200)] 
Adds check about ssh bypass

4 years agoAdds test about ftp epsv response parsing 491/head
Philippe Antoine [Tue, 27 Apr 2021 07:15:24 +0000 (09:15 +0200)] 
Adds test about ftp epsv response parsing

4 years agomodbus: add test cases
Simon Dugas [Sun, 6 Dec 2020 17:20:24 +0000 (17:20 +0000)] 
modbus: add test cases

Add tests for modbus logging and alerting.

4 years agohttp2: fix for suricata 6
Victor Julien [Fri, 21 May 2021 08:50:02 +0000 (10:50 +0200)] 
http2: fix for suricata 6

4 years agoAdds check for http.cookie keyword on http2 traffic 501/head
Philippe Antoine [Mon, 26 Apr 2021 13:50:17 +0000 (15:50 +0200)] 
Adds check for http.cookie keyword on http2 traffic

4 years agoAdds check for http.host.raw keyword on http2 traffic
Philippe Antoine [Mon, 26 Apr 2021 13:29:25 +0000 (15:29 +0200)] 
Adds check for http.host.raw keyword on http2 traffic

4 years agoAdds check for http.method keyword on http2 traffic
Philippe Antoine [Mon, 26 Apr 2021 13:16:24 +0000 (15:16 +0200)] 
Adds check for http.method keyword on http2 traffic

4 years agoAdds check for http.server keyword on http2 traffic
Philippe Antoine [Mon, 26 Apr 2021 13:00:39 +0000 (15:00 +0200)] 
Adds check for http.server keyword on http2 traffic

4 years agohttp2: use stat_code instead of stat_msg as keyword
Philippe Antoine [Mon, 26 Apr 2021 12:42:11 +0000 (14:42 +0200)] 
http2: use stat_code instead of stat_msg as keyword

4 years agohttp-sha256-drop-02: don't use flow_id in test
Eric Leblond [Sun, 18 Apr 2021 10:26:05 +0000 (12:26 +0200)] 
http-sha256-drop-02: don't use flow_id in test

flow_id has no reason to be fix from a user perspective so we
should not use it in test but use information from the flow
itself.

4 years agotests: Invalid threshold.config w/out -T 498/head
Jeff Lucovsky [Sun, 28 Feb 2021 20:06:04 +0000 (15:06 -0500)] 
tests: Invalid threshold.config w/out -T

4 years agotests: Add test for threshold.config validation
Jeff Lucovsky [Sun, 28 Feb 2021 19:42:00 +0000 (14:42 -0500)] 
tests: Add test for threshold.config validation

This commit adds a test case to insure that "-T" stops execution when
threshold.config is not valid.

4 years agotests: basic geoip test
Eric Leblond [Thu, 1 Aug 2019 19:29:12 +0000 (21:29 +0200)] 
tests: basic geoip test

The tests are done by using a local database generated via the
geoip.pl Perl script. The obtained maxmindb test.mmdb and it only
contains 2 entries.

4 years agomore features detection in run.py
Eric Leblond [Thu, 1 Aug 2019 19:28:29 +0000 (21:28 +0200)] 
more features detection in run.py

4 years agotests/ftpdata: add detection
Victor Julien [Tue, 12 Jan 2021 21:03:13 +0000 (22:03 +0100)] 
tests/ftpdata: add detection

4 years agotests/threshold: Code coverage for issue 4407
Jeff Lucovsky [Wed, 31 Mar 2021 12:58:42 +0000 (08:58 -0400)] 
tests/threshold: Code coverage for issue 4407

This test insures that the Suricata code added for issue 4407 is
exercised.

4 years agotests: add test for Rust template parser 483/head
Jason Ish [Mon, 29 Mar 2021 16:28:17 +0000 (10:28 -0600)] 
tests: add test for Rust template parser

4 years agotests: add test for C template parser
Jason Ish [Mon, 29 Mar 2021 16:21:32 +0000 (10:21 -0600)] 
tests: add test for C template parser

4 years agoAdds kerberos probing parser test
Philippe Antoine [Thu, 11 Mar 2021 15:17:56 +0000 (16:17 +0100)] 
Adds kerberos probing parser test

4 years agolicense: add a LICENSE.txt (MIT)
Jason Ish [Tue, 16 Mar 2021 17:41:12 +0000 (11:41 -0600)] 
license: add a LICENSE.txt (MIT)

4 years agodns-udp-eve-log-srv: for Suricata v7+ 479/head
Jason Ish [Tue, 16 Mar 2021 04:24:35 +0000 (22:24 -0600)] 
dns-udp-eve-log-srv: for Suricata v7+

Remove file check and just use a version check now that 7 is out.

4 years agodns-udp-eve-log-query-only: add dns eve v2 test
Jason Ish [Mon, 15 Mar 2021 21:58:17 +0000 (15:58 -0600)] 
dns-udp-eve-log-query-only: add dns eve v2 test

4 years agodns-udp-eve-log-mx-only: add dns eve v2 test
Jason Ish [Mon, 15 Mar 2021 21:55:13 +0000 (15:55 -0600)] 
dns-udp-eve-log-mx-only: add dns eve v2 test

4 years agodns-udp-eve-log-answer-only: dns eve v2 test
Jason Ish [Mon, 15 Mar 2021 21:50:01 +0000 (15:50 -0600)] 
dns-udp-eve-log-answer-only: dns eve v2 test

4 years agodns-udp-eve-log-aaaa-only: add dns eve v2 test
Jason Ish [Mon, 15 Mar 2021 21:46:14 +0000 (15:46 -0600)] 
dns-udp-eve-log-aaaa-only: add dns eve v2 test

4 years agodns-udp-double-request-response: add dns eve v2 test
Jason Ish [Mon, 15 Mar 2021 21:38:57 +0000 (15:38 -0600)] 
dns-udp-double-request-response: add dns eve v2 test

4 years agodns-tcp-www-google-com: add dns eve v2 test
Jason Ish [Mon, 15 Mar 2021 21:36:05 +0000 (15:36 -0600)] 
dns-tcp-www-google-com: add dns eve v2 test

4 years agodns-tcp-ts-gap: update for dns eve v2
Jason Ish [Mon, 15 Mar 2021 21:15:53 +0000 (15:15 -0600)] 
dns-tcp-ts-gap: update for dns eve v2

4 years agodns: mark existing dns eve v1 tests for Suricata < 7
Jason Ish [Mon, 15 Mar 2021 21:13:00 +0000 (15:13 -0600)] 
dns: mark existing dns eve v1 tests for Suricata < 7

4 years agodns-udp-unsolicited-response: dns eve v1 and v2 tests
Jason Ish [Mon, 15 Mar 2021 20:56:13 +0000 (14:56 -0600)] 
dns-udp-unsolicited-response: dns eve v1 and v2 tests

4 years agodns-udp-null: use dns v2 logging
Jason Ish [Mon, 15 Mar 2021 20:54:36 +0000 (14:54 -0600)] 
dns-udp-null: use dns v2 logging

Also, instead of file check use min-version of 7.

4 years agodns-udp-nxdomain-soa: v1 and v2 dns eve tests
Jason Ish [Mon, 15 Mar 2021 20:50:50 +0000 (14:50 -0600)] 
dns-udp-nxdomain-soa: v1 and v2 dns eve tests

4 years agodns-eve: dns eve v1 and v2 versions
Jason Ish [Fri, 12 Mar 2021 23:31:38 +0000 (17:31 -0600)] 
dns-eve: dns eve v1 and v2 versions

4 years agodns-tcp-multirequest-buffer: versions for v1 and v2 DNS logging
Jason Ish [Fri, 12 Mar 2021 23:27:01 +0000 (17:27 -0600)] 
dns-tcp-multirequest-buffer: versions for v1 and v2 DNS logging

4 years agodns-udp-dns-log-unanswered: remove
Jason Ish [Fri, 12 Mar 2021 23:21:20 +0000 (17:21 -0600)] 
dns-udp-dns-log-unanswered: remove

This test was specific to the non-Rust DNS parser which is no
longer supported.

4 years agodns-single-request: split into dns v1 and v2 test
Jason Ish [Fri, 12 Mar 2021 23:15:08 +0000 (17:15 -0600)] 
dns-single-request: split into dns v1 and v2 test

Update dns-single-request to v2 format, rename old test to
dns-single-request-v1.

4 years agogithub-ci: use github action checkout@v2 for build test
Jason Ish [Fri, 3 Apr 2020 17:34:43 +0000 (11:34 -0600)] 
github-ci: use github action checkout@v2 for build test

4 years agogithub-ci: move pcapng check to github
Jason Ish [Fri, 3 Apr 2020 17:20:35 +0000 (11:20 -0600)] 
github-ci: move pcapng check to github

4 years agostream/tcp: Test verifies the behavior when direction of TCP flow is changed by the... 474/head
Ilya Bakhtin [Sat, 1 Aug 2020 17:26:41 +0000 (19:26 +0200)] 
stream/tcp: Test verifies the behavior when direction of TCP flow is changed by the probing parser

pcap file contains 2 http transactions. The request is missing for the first one.
The second transaction is fully complete. So eve.json must contain one and only anomaly event.

Also common flow details are verified.
It must be http, to port 80 with specified number of bytes_toclient and bytes_toserver

4 years agotests/tcp: test for tcp invalid option fp
Victor Julien [Sat, 26 Dec 2020 07:39:57 +0000 (08:39 +0100)] 
tests/tcp: test for tcp invalid option fp

4 years agoMove checks about HTTP2 keywords in separate tests
Philippe Antoine [Tue, 23 Feb 2021 09:06:25 +0000 (10:06 +0100)] 
Move checks about HTTP2 keywords in separate tests

so as to have min-version 7 for them

4 years agoAdds check with http.stat_msg keyword and HTTP2 traffic
Philippe Antoine [Thu, 17 Dec 2020 15:03:30 +0000 (16:03 +0100)] 
Adds check with http.stat_msg keyword and HTTP2 traffic

4 years agoAdds check with http.user_agent keyword and HTTP2 traffic
Philippe Antoine [Thu, 17 Dec 2020 14:21:14 +0000 (15:21 +0100)] 
Adds check with http.user_agent keyword and HTTP2 traffic

4 years agoAdds checks with http.uri keyword and HTTP2 traffic
Philippe Antoine [Mon, 7 Dec 2020 11:33:01 +0000 (12:33 +0100)] 
Adds checks with http.uri keyword and HTTP2 traffic

4 years agoAdd test for uricontent matching regression
Shivani Bhardwaj [Sat, 22 Jun 2019 09:08:43 +0000 (14:38 +0530)] 
Add test for uricontent matching regression

Closes redmine ticket #3055.

4 years agoAdd test for http_uri matching regression
Shivani Bhardwaj [Sat, 22 Jun 2019 09:07:44 +0000 (14:37 +0530)] 
Add test for http_uri matching regression

Related to redmine ticket #78. This test has been added since uricontent
has been deprecated by http_uri.

4 years agoikev1: improve ikev1 tests
frank honza [Fri, 27 Mar 2020 15:18:24 +0000 (16:18 +0100)] 
ikev1: improve ikev1 tests

(Fixed commit by Victor Julien after accidental merge of wrong PR)

4 years agoikev1: add ikev1 test
frank honza [Fri, 27 Mar 2020 15:18:24 +0000 (16:18 +0100)] 
ikev1: add ikev1 test

4 years agoAdds test about decoder against too many layers
Philippe Antoine [Tue, 23 Feb 2021 13:50:44 +0000 (14:50 +0100)] 
Adds test about decoder against too many layers

4 years agoframework: add python requirements.txt 424/head
Aaron Bungay [Thu, 28 Jan 2021 17:21:37 +0000 (17:21 +0000)] 
framework: add python requirements.txt

4 years agobug-4199: need to pass on suri 6 463/head
Victor Julien [Fri, 26 Feb 2021 07:17:28 +0000 (08:17 +0100)] 
bug-4199: need to pass on suri 6

4 years agotests: add more complex tests for bug 4199
Victor Julien [Fri, 26 Feb 2021 07:15:10 +0000 (08:15 +0100)] 
tests: add more complex tests for bug 4199

4 years agobug-4199: Add test for forum-reported issue 460/head
Jeff Lucovsky [Sat, 23 Jan 2021 20:26:33 +0000 (15:26 -0500)] 
bug-4199: Add test for forum-reported issue

4 years agobug-4199: Tests for shared http request body
Jeff Lucovsky [Sat, 12 Dec 2020 15:04:25 +0000 (10:04 -0500)] 
bug-4199: Tests for shared http request body

4 years agotests: dcerpc/zerologon now passes on 6
Victor Julien [Wed, 24 Feb 2021 08:04:54 +0000 (09:04 +0100)] 
tests: dcerpc/zerologon now passes on 6

4 years agodcerpc: limit test for bug 4198 to 7 for now 459/head
Victor Julien [Tue, 23 Feb 2021 20:14:42 +0000 (21:14 +0100)] 
dcerpc: limit test for bug 4198 to 7 for now

4 years agodcerpc: test for bug 4198
Shivani Bhardwaj [Sat, 20 Feb 2021 14:46:31 +0000 (20:16 +0530)] 
dcerpc: test for bug 4198

4 years agosmb: lock new tests for 7 for now
Victor Julien [Tue, 23 Feb 2021 19:54:35 +0000 (20:54 +0100)] 
smb: lock new tests for 7 for now

4 years agoAdds test for SMB AndX evasion 458/head
Philippe Antoine [Wed, 25 Nov 2020 15:04:55 +0000 (16:04 +0100)] 
Adds test for SMB AndX evasion

4 years agoAdds test for smb padding evasion
Philippe Antoine [Tue, 14 Apr 2020 12:05:16 +0000 (14:05 +0200)] 
Adds test for smb padding evasion

4 years agoAdds smb overlap evasion test
Philippe Antoine [Tue, 14 Apr 2020 11:46:02 +0000 (13:46 +0200)] 
Adds smb overlap evasion test

4 years agohttp: increase time limit for sticky start test 441/head 456/head
Philippe Antoine [Wed, 17 Feb 2021 15:37:17 +0000 (16:37 +0100)] 
http: increase time limit for sticky start test

4 years agotests: add midstream protocol detection test 451/head
Ilya Bakhtin [Mon, 15 Feb 2021 18:04:39 +0000 (19:04 +0100)] 
tests: add midstream protocol detection test

In midstream protocol detection, the protocol must be detected
if the server message is split

4 years agodatasets: add test for loading 1m StringSets 450/head
Shivani Bhardwaj [Mon, 7 Sep 2020 07:03:02 +0000 (12:33 +0530)] 
datasets: add test for loading 1m StringSets