From 194e1c0c1277832981aba9c0cf009b21c3328413 Mon Sep 17 00:00:00 2001 From: Giuseppe Longo Date: Thu, 11 Jul 2019 16:19:49 +0200 Subject: [PATCH] tests: add tests for sip keywords --- tests/sip-method/README.md | 1 + tests/sip-method/sip.pcap | Bin 0 -> 111077 bytes tests/sip-method/test.rules | 1 + tests/sip-method/test.yaml | 15 +++++++++++++++ tests/sip-protocol/README.md | 1 + tests/sip-protocol/test.rules | 2 ++ tests/sip-protocol/test.yaml | 25 +++++++++++++++++++++++++ tests/sip-request-line/README.md | 1 + tests/sip-request-line/test.rules | 1 + tests/sip-request-line/test.yaml | 15 +++++++++++++++ tests/sip-response-line/README.md | 1 + tests/sip-response-line/test.rules | 1 + tests/sip-response-line/test.yaml | 15 +++++++++++++++ tests/sip-stat-code/README.md | 1 + tests/sip-stat-code/test.rules | 1 + tests/sip-stat-code/test.yaml | 15 +++++++++++++++ tests/sip-stat-msg/README.md | 1 + tests/sip-stat-msg/test.rules | 1 + tests/sip-stat-msg/test.yaml | 15 +++++++++++++++ tests/sip-uri/README.md | 1 + tests/sip-uri/test.rules | 1 + tests/sip-uri/test.yaml | 15 +++++++++++++++ 22 files changed, 130 insertions(+) create mode 100644 tests/sip-method/README.md create mode 100644 tests/sip-method/sip.pcap create mode 100644 tests/sip-method/test.rules create mode 100644 tests/sip-method/test.yaml create mode 100644 tests/sip-protocol/README.md create mode 100644 tests/sip-protocol/test.rules create mode 100644 tests/sip-protocol/test.yaml create mode 100644 tests/sip-request-line/README.md create mode 100644 tests/sip-request-line/test.rules create mode 100644 tests/sip-request-line/test.yaml create mode 100644 tests/sip-response-line/README.md create mode 100644 tests/sip-response-line/test.rules create mode 100644 tests/sip-response-line/test.yaml create mode 100644 tests/sip-stat-code/README.md create mode 100644 tests/sip-stat-code/test.rules create mode 100644 tests/sip-stat-code/test.yaml create mode 100644 tests/sip-stat-msg/README.md create mode 100644 tests/sip-stat-msg/test.rules create mode 100644 tests/sip-stat-msg/test.yaml create mode 100644 tests/sip-uri/README.md create mode 100644 tests/sip-uri/test.rules create mode 100644 tests/sip-uri/test.yaml diff --git a/tests/sip-method/README.md b/tests/sip-method/README.md new file mode 100644 index 000000000..cde7c6e96 --- /dev/null +++ b/tests/sip-method/README.md @@ -0,0 +1 @@ +Match on SIP method field. diff --git a/tests/sip-method/sip.pcap b/tests/sip-method/sip.pcap new file mode 100644 index 0000000000000000000000000000000000000000..6e47833bd955ade1642a82e8966c43bcf2da8c6a GIT binary patch literal 111077 zc-rlq31Ab&*T6TuprwVD(+h}rAljDQ&F&^C6e+aSaM}a0Th)(DR|2b z%H=KMfue$lD2Q^32*{x#av$YBMdbM2Ow!P#>6mm6;n>TM}XMb9? z=runkfGPjFew|@7@c(=L)^(WpLnt#4ejbS5M_27_VVa7ysUAbbu z#t&ZCnP=cTX27T84r{`35%8r==#&tj(797eLPA1HLidCY37r#?JI0lNcjyKmVKnyv zYwD@mB-RU&}6G&pch*@9LvswcyP!qyD2v&oFE%BlK}x>1X>Lef~xnPn#o{i+Uzx#ofWzncAD${J9a8wFJuQ z3dNw8?WzhAx3j*4B<}XTU1CkhOh#lLyr<)$A2m$5#QufW{9vWTq!uXFq7pxI7W#{Z zg|a_96HF?5A})J__hs`?_6t{uWlzFoudiO&aZ^JXs2qMd=@*s#B*V04+D9yDg385h zBSPu9ZSxoXICcyw0kp4iU-pVn{C7qZ$prj#_U?ODgrm;_;~6H%Kev!y5$^I12k)fV zu7P*pnpT%|P``KH4`uqmTYcQg{)lxlmi=po>@S1t!f$C^x7?6DU@%lLU~sWH-%U;L zW;6m&o_&=_nSv=_(NH9y^e4+Q6;qbeQ1n0<`eG=#$7m|_nDV|>vBzAq^%zvv>rhsC zzjdndjox>o-#SV)z?G3ph_X(@vVKV;Yg?c!-$lz5=Lx-FFH37_rhjuLO3 z;bI-H0EI2-`Q8@BLD6s;R>S&pyuOw-H%c~}3j*YVe3@ZFZG@q}hB8+8oYh?~9ANK- z?JD%bSD3^BKfJeP3}f#xL<00h)Ek+W;Y^+2>^w!z&d4h)Vi5S}y`jui_!D}$il#Yb zory$i@-~8^PTb(z2H$Fa&Ar$&Au*{}YC=yfs4NCv(GImmo3pgNl2Tgp(QH^qAFCWw z{#)zb@hMu)$VYRMA)1Tk+n5UETqPrRq%k8=Fm=hz=R}Sd40@eDN|01p&xvZqPZ#9p z6%>VqbSlWpiP5%2*kO5A&cI5#_OASPZHnadSR<=5TUa?PBsK4EF9-|iC}(F!CB?^R zMZJONc|C80T1cWj$6kVapF(NCmZL+PoYOGPwn|ZUz zY=DATPN%eMqmIb87N~`>9M7_ChQ_kdA`ALTu)Q0jMQ;P7mpU{?D;c!q>b7y!+@h$i zYHoT_MvN9d)lD7|)hVxFxLja{EA{YB??Sa8DlQ#97o+X27UZEONa>|bO3|id@Q$P>q7Y#Qq0HcO!XpkFyV_auJN!j$xq~M)+Jg2mE?@ z-C9IeIaCxESn=C26{_!p0VG$6ZNb{UI7BbZ&&w@@51Pz+qeWF@RbpA0S511OS*KSO z&@d+$bgZd`&q5Yt;hVT1W*`_pdbxHjO?P|9^1D;W5|ehZJY?ZmR-0N-V$DsjcCccs zRA@#*7hJU2%lJh~#IMDMrce);C*Yy%7U7Ma8aU(p`Y5NxB<)&-%<-)?@ zc?IU1SmzZ2M1yD#5RHZ?k&`9Sq!ZYircEANPfQrTjt9#3=m*LHz#3noVa~x7=iIRl zTHnB|1`gJ<@V$9JMnv6l$MLZCEVB&J65`|FyJLJpd}4g38=Ug*zpYPq=6bJg9qwbQ z{)#{$OZnFk|MH*ihWN-IOYO(-%)oAONnLw&O->!yp=Wa6USPq@m@6SnJj?QeBswk+ zWcl>xzLTO_^txYQJZCu(! zPfPoaT-rOhw3j@Qve7nk;eCv_VGr9JviDANW0*2P_E zvDO7R{#)dT|K>sb*Q)cN6F*hRu3C!nYpLKn)NIvX$;-iE+gK<%^DSc0@8P09_PXdN zq3B1phBEWv1M}U*l&{!g%Ei|!#FX=x@jLdO_zCB2{czsaUC|Is1|qiK1t!SfoLjge zd_|N!2)&yLm{O*>TAsG`@5n^>e6;p)?5!lHAqp0qY02Zj)T<77ir_ri6F6 zx7l=tL8UBhS&zwv0YkR2$ z!_)$8Qm!_kW0E!%+6tOV`vA0Ew7u=3;f+?>un@$a+NvJY39y~qNno&kh$R@~MuIje zx5b^D4ikdjy&&+HAv!F{$tx}l3wa7keZM*5KBJ5zdZ0vuwH)OlQ5z^(n-Z=_S7Xba zDJo0X3NI_*SEaIG!ilxB$8A}lok4{RqtkKPxbg~Wv-8rex!Sy}NNu5-Yu1+J6&Gkh zA^F*Ak*Za5WNWq-O_$WdLakhA`*V5x5p9$16`o-_Ft%4Eoe9>3SZ7bU=u8W>ngBX` zec3jKNr~&#OKWCF$amXH+?h_)mp|6mLoPB-fKnrozOEdssIL()g!g7_uS#VlmIUCk z>bNZn^z~>PuqGWF)mP01rKsA}JZwf_S$4y+Rrsa12o-*)BoIUHcY(ZJ4%zY{jO$?` z_6o0hiy?KQkFYvlbWvv{l=p5*c-)v~BWd!h&M!6v2S>HjrWBj9t%|l&Uba~+h}PQF_w&0%kw3;F zzu-pXH6XI7T;yFa(xfrASEXupDXERC>F-j_HRaWO1T{i%uvUv37)=lhwThgpHRown zXy=lm3_Qz0ps@Fu8wn3rP<%-+1_ir-%F02_T9$*7i!#b7dAZpoC|PN?5gvS>sE|ci zA83U!jSdCwm>X}p$;!YvcgUaiMDix{SIF~%%L+R7^~ zO3$-vtNdpdZ5{fIsI4%ptwS!Dr^+#3oTJuOz+$4dK6M*FAZ>jG+R7@|)`TTQ|56ug ztEr0^UzLlod3r_vGVe>GO6p;i9B?UXWqDb#??73dKs*@B(M%ZmKWJ>9kj!( z+1Xl?sx_-;fEIXcLQ3PSVzkwdnfk3flH-i6?8-iSv4VPB zrD$XQ0!uN}MT!`pe+E(%eLMx?gM`$c+Fsz3dlkt=(IaxQZ3VBsq#?E9GFKhQQ$qroq~FoG{Figb5YP|P}OcoLCRW&5k=OimNDAy zdD_BaB?Au{TChX2wLn#h@(N090(4LHBTO1gZo`JttQ>i0c*tu9@BZR05aKyBX?*Iv z8Uh#c9nV3DP0^%rbBe7ee$ks)%5q%FShuA_Kq<+#QiA*Yku3Ks zT*^q7Htz-s-3M)+IBW*Q$i0(NZCdK`wqI3l5NcF%yK@9?*HTlc)$?c)^O4h}@7K@$ zn0WX(-d!V0C3m>(s{5dBy-*|98HRcRr%lYuGn-0OyM3=(O4QibZhL7jDED+q#KXpB zJ#96MU*<=es@;WaR^O#&r*X|96zOtmMJbDy5o@%FE9JsfVvU;O z8b!F&=nN_e>HTuA@*0&Qhue?1WV;e)Y@c_@4lfvY#@p;LVl7!pT(bQJv!0`8jR%%; zf|&JQg;~$ivnBxR$;Fi0=`^vccU68~D9NqokUNqikG@n?5i zzRmL`{#SwW{X8ON9i}`@LwOx2ix&_n>oH{l4dqRs3|c~@Y`~Q9G?e*3d4402@;#=M z(ojAE%6&iik+vvobZM72&=!UL331y!+oFI7*M9c%Zi~VjOyYMdYReI)Pqq zKs>m>*BcO>1g@C|ueiQ!#Ouo@R%D|jPF4iPDClZneVJg~lp7FDtiZE+ohq5zKjTfC6P-70ih(r} z5$Ozi7{Bx|M2alW%bY?N5ecHqvgZFlM8y67Z`!Qhpj*|ZO-13&f(XT_MxD`U(FqEt z=q);vMdSp5V|BjUw23Ud{m5XZ5mQB7ir?{o!o{Z~$0_$XX=Uub5Rp z&pL<}PX_ywSi3N5C_Srz|GEx)%j%L?2Qe$dg*9*76>nJ$fi>hZvAqsqRysYa5wOCd ziS2b5vn=$ij=;L_dJut?*%Y%_7uM`?*S%%M1MA6$NVbvL46|DMhGl(?WE+{yF)Ny$ z)d^VZf~s=}0lG3PnDP*U0GlsDWjzOFRUPMNYH^s#Il|QUQJlZA{lJ}`$N7ms>3cDl zM7bMNSQ<(aP?~Fqvb4aI)-;qZK-n2eq}+ok(KM7~psa2|q}+=sQ8bjkKB^deI2M7=(L*N#RVM-E78J5xeOnRx+w?5_^2j&0F{?<}I=!OD3aUk#!bP6*<|v zc?!Xej-G()J>e(h5@^prH%|%4ux~-F(R37K5O&THGB{jrkC|vYlT&lB^G6 zSzFS`Is_;UZzED3!j$`IC>cOewDm}1aioiNEJR~5C!G7$v#}Tv+TUN#yRmp7li1*+ zbH7rJ#R%LkvK}Fam>Gq0h;5y7hjj2 z$szJoImBwY`>Jw?yioxyN*u?_de*3z;6K%MHyb0a>X2?WREh8x+qByc~(%(QVm2IglbpUF{QDC@-d1tL%2JB^DNFpgyP*{-o=?8Gl|FF zzvDNmI1_=B4up|%KJ9UwdCfWJv+k`Li8DDt(itHpi4ydB6=ujBRh%iAMS+#Y|3I86 z{3AJ^Prw+y`-1U0=VRb}p7Rl^6^(h*;BHoQd7Tu+oAf-#Nvz)Y(HP0NX`?ZoH|lwl zk+lc{tLRigHSr>A5O|*+ABgN@qm^__U1l8igW(Q8xCnXMx5cM^^J2#v${qA2QaWHt zJsQelp!75mDIGDTE)8V~P+r^+MwjymvgLeGSzkk0-sgNihbxEW5M_AW{27_W$O(vC93iVo**KM41z59Wm%XN+JtWNGi(HX1P7wz58sZaW<@lvAV z3JdcTE5ujksNOx3?3Y6)VFf+!b_=VQp`?BJkQb#WQ8Y*

pcY*h6X#agpm0Ja7g( z2F_2>@O+hv{N3~6`8%L6Rw5+{Q)<&t)&S-9A|j-4Oxz#4Oqn50X_ ztZVeFZNQo^r!Fb}zV^c9M=lXyVvcPt%?7*)OrQc>Cw7PMuthRB4-z0RuO{?-_WxGMo>lohweOEqI79A_w z>5+t#P8}1vCOiWFrgZAm$?5Mke5`EOxDFi0p^w*FbZTQpi$IOzSlP3ng6!LgI}!T1 znC24X8s;ZF{*7m@0TCW)?&VH|B~0S8D zfYh>OKu}rXf%U490lAKLU*Dx6b%g%7eg1H?&*!Kk>`6*m<#|V70@ihSCYVSWfGHPg zD1JcM6wQ!^ydikVJK-|qJzrYS+aV9J7B?hHBx8wA(@ON-ygDR_Ojx30^b+|4D{U)j z&wr+ZS!MLB0AL+$PSlijAy4~M|JyJ$!rE**Qgx7>O-borlOkWLWE%)pvC>d?#= zNdFt^jr-P}{sUm5nP1CPP@GwuEu%A;vHl}~(vEn3Or{l6j?hpV0A<7nL`o*69HyZ( z0?HSk6De7ka)^dZI`8uG zWS3=3Vxuq4d`HzU5IAn1A2S5PB=m9>&A(@6E)s1$b}Vb-NAy7b!oS_wSxMddB&8x{fX&k90&q`+vq0;55Jo@J(E+^0ZT!DtXzQ5Pi$iYmxL)l0=K;d&M6t3zT&ht%~UIW zS}_|P780i@YCc>n=jUgm^+Nb?>q2w>jpPqH6Or)e^4t(#Ib&znQHA=qbC&^*%g)Xl z9%Gj%QXAK?OQg1ATz81hBefmU;GLc@NcN1>Ca0t(C3o)?sqLPen$#&R60Yc!j51Qg zVxg40SexWXft<)mqT?qXJ_rgCv`&gFM4#7!iDrj|D6#H7Q54Ifj8{&qTx_=HX>};y zt?ikb(mJkBik8(Hv_`#_*XqJT63)wg=}tzJ#rtM7sSb}BlEdBTsuuS#3x@=#FTIwG+h>TBhzt9}FS zdZ6M;b`f65)<#9yA9(_r(pn3()*RF&5B3}D|RcDY|XIpcNN3?3?c0IJOT#yT@kI_OE(L#4LqVaG! zhxMs#(LK*vSfaJ4s@WtfS=u5sI~)3vHs5NF)$x+RYYWt&g9{6k!Pb0d)j9s)(6QE< zI~Z;0_*)kXLU{JUVODvtl3NrT%e6qA^IkB>E*c64lwoH{XZvLi!@0;EF1g5O zO6z-@i{ybdt_AUqli`@P-8ZZU>Jj(ojc{qB<#@k*%pGez%ZVVu&keoYqqm$%JpS1o zYpHS~2wZf#KPgvOf^&sa+~x|=<-a`^K(ecmSTj2un)wRZRe0@(*Lt3lLX^yzq*D(w zAH!|Eg}$wIz-m@Vl<09R(KZ^1MATD85h+h#%1<;DJy4#0mPi?eDO+hMZGghRN~Da& zlr1!rjzD?!od8lF9OKe1U*kR~-Lc-YK8OgTJ_zux4}J}O@Z&qyQ}savj`}2kc@6&b zn!9^ereuyqqJ2NJ;#@~F`sLZSkk?0Zo&U--$EK8;ysrc`*pTH!i+>W^;wFbJu0R&Q z)R6zZ=c6g2tSty7nZ;AsET-Qwi<`nM;-SIbe2-`rRQ|l+~Q|pJErq;PHG{12dnnBxB9g3f5m1@mVVP5rLoI~Sl zWJ%@}(IT-HSye2oPLw%W6-|R5 zEEO6|zlWIQdJ*^IHI9C~5+%8IwSMFW&yrk-5OB!LB-ctN@vHY9`GG3Qg}^h*0!WGG zmvEx_3Ac&nK5+RHBZ;Ow5u5Tew@mq_Fy;QxV09-F8*CD8u%~Y|*iF%3gV4<$Zxb7A zGH$R5w;JrGXs{vBU@yi5l7hY|c(C}&F<5+q&!p8ovB`^*Z-KJBHR&n3nN#uF+ftXc zxACQoyj^>ff%RESqD0fML|@WKged0*lAhI@IUP&1gkB;Ou;xt+AhBj()?(kV?ma;4 zz%y|N9($_;-xM8Kfd<>p6V3f)Z0?`an7bJ$T!#SWIX?!!Dy5&Fu&19{r}VRR?Wt;~ zpZ}woXI11y3PZY;d3Mb_t6-Ynv?F$aS8xYdLel}PK>3~xpxfsaY}@CB%F=KF)!65S zuACoEeE!WWEbC$#S%(7UYOP?>1adZ}EOk&;p$X)sI=xSOHi1Nh6Jf#LO(0h>i62ks zeVS?liNK@l2a_g{bMOQ*&+P>A3AntKOw|ADSThS9n)w##pNVL7+H?Jn0?O*{M9LeO z@*xdn3{Z}x5h-tC$_F%*CxLQFB~sqPl=o>U`voGzJ?mw^_>M_zS^7I&zd+z^FB1F3eB3Y0Zu`YVxO~m-U{ZwoE{;&& zbcs;MmfqoQggOcBo2g4Y6?y??y+O~Kj8-)}5ch|^hgq-Fvt9w#ufGv(_NLh#}uhUT80Ls`u zh?I{o92&|OKsnHZNcjv?X46o<1WM~iiIl~dGK+@tH5v_e5qEVj!5(_L zi-#Un+SFSQy#iQ%*NCIs=a@CkH>}4BiP~F=wKtPSdnN&NM(hb~fiI0WujO7w7FVh@+%*2AI8 zm!7LbYU|}#GgBR!S&!QKJ-< zUm#LeV9F#K%4T#IM`$RCvJz7!(olW|%A^LNq<-;@OS^19{i5jd!aqIh7l@E?d#HE) zVgr-dci6%|srm&14{jdHDE{(R2|8AmIkW0fO8IY2ycIb?Fq$hKiA)xtVpbVdNRo_Vl)#%6vxzhRYi_}2 zJvrd`AGiq{X;9D$y!{8A@qg_WY}DmGyPxQ@zQx|;1&25J9{H@KtH1x{xzG9qDEAi! zkUI8vxMMfC)v<4N>{}h%2OS%Axus2r9eXwI*w4{)>|aqN`#7;V3}PPhWALle(t3{VkrdCYsQ5?v@by~>CJ*s5jc+1 zD|(Y&C-b5x>qK4kp7vF~)ZWnw(;OwM^)Mk?XHc~dqz^|0vogNyH){O|AH+JzRM?jer&>+p#GG|h;=8=c*8xei@=y^bxtj>>u$%JM$F zj;}g#o1^Jtf*y; zF@i2e6t#)nQazj-dpI}u$xiQEvu>Zxx{~N$%B6lraJbTS^cYOsY zAD!1QhvD;w-96g#XZzzOQ=J|+`CZE%H|F*_ZQp{t+;nZeTv#|fufVL$E6|$ra%5}n zKQ+1MeK5JNk;%0Ev66ypjuLs9Gf1kA^Z8>XN#4JTnHy^MUElaICD7z0?&i^1nZMzA z^g*Y2bl>8I|E_s-wMI(cHFUXkRy~DA4RKdEv6t`0y}Xd7mtR9q0cuL5{EjIFG!!Oq zU5EIVM9Lma8A?M50LuBcM9N-F$)}-&0wpkk7{=~%X_w6?jQ#WEgV#L^V-aC@XD`Fp z%}nC1%m=Sig|P^nnoN9XGkWvS}zyf%2RmQI5|2wjl@gQLUnVo;fH)7!HG#R}N|$lQ{XQqJ2~j3V|P)Rh#6XE?@`M z#I1ws4woOyC+3DP;=!n|%V0FL^g(Y2qhw&MolDFO|AAS3=vgVi+O&oENP|n5)tjD` z3ar*Ai8lNvwyu5->)MWNxNqo|eV*HJZ=hV;Mx_EO{WZ(i1eG4M6;a=XNx`Rm^ zICcS@Z$aP>8WL|&y^eiLm|Nd66pj4E8E5G1vn) zaPh#|rLDd7z=)N)rY?!q2D9qZvqqzI!Q~JVt1V_l(6gQdR-f@C-;x!JTk1APOYKI! z<)3j!~nMDi_J?T~0qesJqsCcxzro};`)wXSVe zfy(;)x$4}a`XXFuA>Iz1)fu->El2zOjvslhNjl(pPkISWem4;*T`(nxhB65#oqi@# zx?)No4P^>YUOhmhbiY?;QWV^#fO7j zd*G1g`kxP!Z|)#cdSXv}orbaiC{Nu-r1Zj+Yc!PifpUT+Qc^MHDh=gBptRXRy7@S( zH%>=gav8g?pjB#!@mG3z2d>m!tXNhG#ZKipD((zMj) zK$+d$kK|j@Fy)GavJd%|_80aa_RO~+!lS8v-uae&OyWI5_aCP6EeKqzKa8jFr#m_ZuMr-o8MAY7g1_dzn{22VIbhm}Zz9S>jX-CG1jeBqG$l$cSb7lK( zDs+p5*P5#=aLqJog(Y+&YgL@tUG6<%jhRLSRiB}n!g7SgwGUy9p1B%P5H46LY_ zc}`~(b&|reI$mcM4b{87!|jFvWFEtQszvgr1F)yN=tXNG?e8)dFCjQG6+-7(NIwq$#7AZ5I zHN>S|4xn*v=^3;j>&ZBW2pz(_%*-EP5@+XR9;F)R5V%K!+RO&onfRZkOwdr!2^=vs! zRF+>*?P}yS(Us}~qO2;G^*D{JTTt%iYa+#hDaU9izW}A<8e;xD-NiZ%q3B}e3DYsp zq6n^}RZ##wz!#^^^Mz)ZDrjFM$?8dM7e1>gsKSuhn!7FZ3*W1TP*%SrglTK6&I-v%} z$f|9ddW_!M*a%s@zom)$=6!37d+zdf`^f>ef#W_ z$2|A7yMVIjEg~foQx4Nmb_3)!K^*>tlv@2cM53-R#q-%{Z7x?11#N_#Fom#EwzuPr49lmac>ZbQiLhL(NInR zWyrQ5QXEl?DSI50BPfp8U)KJ(XK@4~NWTVo7e^dn5?5Q=AE$~V5V$)ia5Ib>o84t8 zR%H#t_W+-F%2F&eJXI5Mga~5^%t7=~fP7z?6e(TO_Q$ipPmBp4JU%ZWNwG@5;vt3U>R{{CREvj}Hr)Jzt^SiK0z3sbI` zMX;ZQBbm)nV00GItkl5$nxtM!9U&o}QL1l5NTQdrQs4!a+& zMH&}}<8g7j%eW|)#&|m})&*A6T;jU;2+Z2%8&=?c;<|VVX8lCZY74B}&eb8YMq<`h z7uKNCSZ`Uez#60_-5Qql7-nsuXSD-XKq~3hu&l>1YcoA78(0HZlWq;m8jD%qyRgzq zJ5+~tyPoub$gC$ZYXdzi2UzPeiS6|iX04}ZjRjUp-%w^JT(R>8YsidxCkrrZ{Xl#i zdOws|YUQ})YVqKYBm5?zoye`=w^tFZ8xT6icR=5jZ@7w!W3-(fNl59`F`;Y1Bk*rZ zr%s)mKH=FdS3z!WxeBu1a;0JXm?o8Pxe5+Iav?dN=v%4%ZphhvAU=>i&Ek*~>ont@ zNy!y-`ZqFkwe3R%)~eC9Ni2LUdzwnmdJ0(Cp9GLt_;B_#Gd*iO(&1T#WGncz^nQn3 zY~@3+m6U&vtspu5&oLyO;v=flOfEXrPU=}5offAP?GhhUohH+>CIIV)SBQ3rPv}h> zLeF{@Sm%EZAlV8&r?=mJ7h8D`Y^B$~$5xP>!+#<6KYSu(+8`I5Hl5VlTb(|K;;t|a ziG|NwOncNftfD80c8SkBOdCkgdJ$N6t|ZzeKJ_qdfHONBZ!L-Kg%2Z4OQUDa2G*7jh&i}%IA&Pq5;OEEP4G5mK&)ELh&i}Ym)o?f z&6)$OMLmc)xbc{^hMu(?SmB(;u?pzKy0M~oV->J`MG;>)MyDaKMOIifyirDlwa5mx zwMbOfD^OM+sCyrGOI43#O>m0-G)z3xQ6tovq|pR1K{=s@@^wxpCughCf96YhvX>%i z{9|j`bs1XAY`dwxM;-X9{paYmwY&A|l&Te@S$&A6o_|nebnE7KKZH(bL0S%s(Jf?Suf#*l_8BKfka@ zF7Q|Ka_|Dk2`D>0g;@4PT=oX<%RU8Vj~zfPdlD{tz4v9GhO+zRGR(V-?Nw>%XO?a0 zXYsWPOFu`M2_GgLIX-rbJ)HM*U-pVn+tQF-dJ;qY18@Adq03xhHW^HtUC zpQ{!z75)_DpIfL~5x1h9?c%_COhCIwSF~A?cH{SLzxDLH02S|_!O-njYG{iQP+8As zFxA+vbP=vx9_UAEn#s6n);XG{3^mP&tpiV1Xqw9Fejw`~LFiOLhE({;46AJr$R|#`}6-g0eqYO|17cT=r`3>-{I{W@LR&$7O%#eZ4P3+3PnG z>pcUP{jK-){tL=Bg%j&N6PLZp`+B3Ye>Vm(W8f2G+;!ms`|54W3SIaZGid!A`%XE! za1~{jcVSH=6M$E!?EMseNBxvr5$^I1zakvfXKlI8{LQ83*BhD3P;o)+T%W&DXG}+tX z@+z=ebSBOfXJgjK^sH;Z`u+)GcrypHKJpE#%S*(Tnu}ZN6PlJ{YOU+AmiS=4ta+HS zh=vjXl%Cy*lvgq3V;V{*Q1XnVCtPH`hAE#qC@0Vkl(erm)c5fCP9Qw^u$ND`IKd>g zZL^_1-SM3Oo{|ts+R6Gl-pM-0c_(YL$eP%J!W#^FK{7~Df+(6zCbN-h2MT907)^@V z+Z`yp(SU9m&_}_n)WqsVzCC`26*>Dmri%Md^408`--5#ZBRg4C8r*FE?p`ZG8P2@y7c%unYXq;Q~)0M|*aazJceCwk}XU zf1OBq6H`8*p@aj)??WQxElhczhEg9W-Io$6Z)3`PG?d0bS-6Qvc?VM#&`_EI<>U_H zfe7PGIY2+ceuP-(7&O+bY?#;)hKPI~@r;IVQ&L$A^%ccJO-)$8r{4(`aW?#Eq-^Eq=}@;OPRJ-yB6L;-7g5^?|Z zN0>E-o)rx&^$Fts>5nmMHa)8~u=Y14-uJV}rKQfGpmV|Ekxe`cIuT*jJzn1TbB0NL zfgjm~D(FPu!>xiyS(i_6*5!HUtjklM*GSMQ8PRiq!SCpeszGPrD1%NDD{;bqAn4Tn zBUu+@3!nc^OwWIc&3ul-%+Df+bjO$Vnt1Mz5as7~wY|>mta`?`xgA|KM|#g~%H6Q7 zXVDY7OtNIs`Th_vQum?G?MRBC7gSaeOrlva3#{J4>rG~}>dRY{S+I?7ek5ApXV?N~ z(^w!6l)_y^%3@5JMMDvQGQ4gO-LiNi+p;(+Yd)0a{jxZ^@{dDAS(jj0U!jrJ02J;j zk@7jFyi7xB50rj^#6!ZCx>(0KGz_m>G~jm6hG9e)Q^(6g!p<>???(@~ooX0H;FS@z z8O5K$FIUn0duM%tb3e^04#WO&{g3$g5xg<(9g84Hl7P<#GAj~i7Cm|n@87vny(n{L zbG4qs3l%cxbw=>&g3)B*W!Bwucsa+@GpjKidiaFd>O2P5`SG9b;)Zta#&q94ht}4l zJa7MjGyJbThZc3Y*e%4Phn8V)GTq@#&Lf{yw&da4z4KWgW`!`1L8SATyY09+wrJ;> z6&0f$zqCf08_|wlE8iHlk(m~#LyN&U&42e8+P~{1o<4?_BRq!I(@uWlQP|atKlCO+ zHA#vjnI*x@nt0YC%B)GXRPzwhns_X(Bg&K6C{Cvsd0Eo)p7`5pgn9&zTt#q&OfmGa z5M~sZ?kIOtz5J{%-5j_)a8&^PvvEDO5>HLHW`;1|HFKtt&P6zehKS#kKj z#V!*alnW@x?7eW)9i9c5h|uGVmuJOYU=j@vZMuUh$VA`;e*}{j81ZeA4c~NLU~D$K zMshtmN#uDQOjae6$f|mUF4rR&RB-wKfn1MpGb}JxXR=?_0;5p{P3i=TkrO48(ISdw zgHBdBlVUaqCRx<`Zh;XQ_+!5l_Y>lKbGtn2=(`t@hj{0cC-3ymLwuPS%0xgHif|Xw z`P&m%4>~2VPBmTX=}9tPWU++mWwE^IEftTEDIe?WGr0Q5sZ{qYuvk$XaJ<%r3Ux{XjZ=LS)42>D40wwYgk%DiU?(#GZr4LZD z&k!m2cIhq?Xej;BvR-f<5(VEV-DNxtWdM?euSZ%k!na6w9_zAX6kpoc+a;rczwCkz>lc4AiOb1|Drw(Ho2qpvwP>v^4L?rrpSi)qF%>o%C6i zTLw*fqmeb4c+M<}dfqIFdQJs`(V$3XJ!@%Ey}Wol4(Gb%Q$o7gSY!{oV#$$OtnJ8q@reVUd>-sUn-bk{qvBQ0?_(#yzQ8`quIc<~%(plq4Q zFrR5`uS%N`-m%Z&#yid7rcD3D-6qk0CJWE|APeuatheuHeFR@##XJi&;yb@F%wdh~ zRjCnwwl`v`QzL%&P3nz_xK7)*ATKvvn=cm@4$mtvYx4@U=DZx)n)^T5tZvSXl{tNs zs5c8nooW$pmS%tcIKz}^Y_Ce|7+G0A<1K4Poz^k>z99X()-kFT?)a{u%dNBOB@EOM zi?u{o{R?*0!)aXgFrYAzM9Qz2GK_{Y0x0bohSBZTX>8lAgUZT>vb^7|gRZ<^Pn2~R zmbI8h*2mHI=42w}H%uv_p^O8{pQ*$d(QX&(_zTU5zF*nT&$Ag3B7EQ9%NfyMOya`W zetuLlA_QJIIE<7j_#I~oqTFT*o`cJK{YK2!?7{h(9G84eTxoxA^EJ-{t8p#jvBi5a zE1RD60K=Zc+wj{!IhISL9Ke(u z8p?b$vmZ&M9K@7t8p;B+>#>wbIfN-$G?Wj45;2=dIgBZpG?c|aIkl9yA^(U=yIe)S zW!zV<`g`VE5Mle*UT(<0$|R=8yy{QoTM#&8br91JD%#K8PQcDtM{&00veQmL>DT)z zWLxZEif=aoa-6|n;Ee_dWeloLuh;t`+hP(WRZ=T2M3M6>P!*%VqbCgrI$kzf47axb zd6{Rxjj7YI_8)lt|5}~_^|Omn!Avm(8^!KcantP^^Hw`;%%YB1z~&3<{4j?Sq*@7zYa7O=Z=rGCY;t?KG9`vBXk7mG!{WSKBl^HP@OMN_^7Jf4>h8 zHNidp#L3Vx97b?mpk%O?m~Qw3QwBLG*U^+< z))&tNdNw6Mgy-+~GTm^UNgO3T6G$~BKwu^+jOi7?;8&#u*o3T0NVNK=ofcrZ1+V&U zN>JH_vz#F4^+FUBDq4&N_9mYV{J*TaRx3EFYSq=CQ#pw>SR}JiHtP(cQ7@&fFLFvfRk;uaK0~7oBHKohA@YeuhV?&S zz7A*BP6=dkp~Z9ErCx?)UB;=Gtxl$2e zXc)-i=dTG0($uS4H`Jf06~y@a2i4L91O?sM{H_S=5L2Uw@P?TU8V#|^PZaeWkhUXn zV4t47`77clqGy4QDQH+IZmdH@%7mcNlQ-^w}$WPR=-T zwr~IBZpG=NpRlM!#T`da=jAnQnB63zL3oq!yP7u*4{sbE-u$lS zw>P^jyh;6r*`^#Nvr(fax$5wO_CNkn_{1nvx+$|!W|Ky0$D#exMh&ryEGS4)M-CbB zXnY4GrGGwA%4=9ki?fuwo(CyEVwj-Ykd#A5-H}A<3gJGA#B)qX~!_d zB#+1&Q82`stE8mmt2t&lUCqpls2?8Qpjq?gO`Bvk%D8Ap!JC_8xh@S)?EFRvIeQa0xgNguJ{)Ty%L(c4Bk_T(IRtGGpq|OMfKy>zKMJ4!7ly7fDiPGgwNqvy|)WgOrOHrdB^BW&9KQ zeRf~Ccy`apy=PX97-2Tck0+<54c@$I&xyn54uEo}PCK#h_?b(W4jnkRX5-Z>S1+GG zd}80^vi*CHAKt(B^7Y*-R&;p0%a0o`^eujL*Sa%%jvhUDdgFK76FQ`uN2JT6M`jdk zzkKM((Y<>PpI&`sRge5`D=#0~xZ&W*!gT zXvH$Zk{!`BA~Q2@Nd5>U<)e*jk)+gMDHUfahtCHoKLIH(At_bW(y-}WfdRE@1>D)Z z@en1))G#xnQIotT4WKVIZ5$EaxJg8Kqm0ZP@byZ=#^KGI)oczSM8n2;7E6wtlhG)m>FswlZQk_GJDb7(ZoBjLh(@`Y4eQ?-7;szQolP4w&K^0m z(@@otVJ#R|klCO?MEwR0GtIp=tUGh*#O3{$H*EUp{N=&Pn+J3mom8B<;o70&NXl=U z5~cLRQktBleD`&b@>7PXJrhZJ;OE_4k{(yAjZAqNjq-AGaun5EP&gvbl9`c_sbq{S z>{gUMa#Y$ck0xx~{L|)Nf8KEX%&sekPR^J%ZN`j~NB6Hfcm9tH=k{JXcVXi<7Y`o1 zeC}fZq@s)*OL~|5#MB?tx+Rb5zjDL5m5KT0bW66m5IRJ`h~hQ-ub(;7t#Zwv&NN<8#i-q>8x?%X3d^HV+N9P#YaRb{jrp?vy_XU0x3UZ zm|z2vvaIa*p~F)rPMI-n()6jvr%l~+>Bz~w8;gHkz2@ANeR~ca{$<6POW$2)E zQ~OVq9X+u3()C|={=DPb!Tozr9EToMc6{HtO+7B8Y}&o<;Mx5%Ce4^Ud(w;}WmBe4 zoK|*Z-@d)jzo*VPTDJe%#fuv*L4lX9{&9B0#Y2}aA2@z=>a?lTjvhI3>O|S}NmHiG zo-%3j#3@rI&45ljapLr&Wk-)svq{XiNoj5pS^Nr+N8;I$4wYFbJC<4b0$umKI6##sYj+yf{)DubC7qfz(Y+eJ5@Gm&b*h$&73nADn0f1p39dm?%i|#;H3jc%8nkqaB$y= zYrD3kUcU_PXzJ976Q`X#cnGZG}I!1f1+n%5m9&SjsmXQgUzO*}ZXPg*j>;_v|;e~1;PHq)u6c?HEhUY?o8=!`L=8~eL>>wN+b)kul zHli~pUn5d#VM=Ej%4T$S=3*kHHl`%eP<{r=h~@r-?09{|Fo#5Wrl9KV5b=Q8}L722WI+Zoks({9r>(oZ4V87$laH zz_v}CU{Q5chc+1WMm;D02hMB||B>@KktNiL4q`%JKn-zsa^@9#qJncuR2<=U`1a&X zv07&ic+uDuXPAP0hN&2%II}FXCPDH2T?hoLraf^$Hko*#Y8+RBs&pPLTD)afYRX)BIOZG38tZxq0J>%Lr8;P5~hSYD7Dex*W~@MI-U)F zh;YBZclYE2Bk^*}usT$O9|9Kz*I_n+yW8aM$fA|mo$--HEu4-l`XG60O$>gLBpM97 zfE*$#8YxewmPDg$vit`IKj|hou&7#Iw#oyGc#BbBd0A9dNs?HjPE<@BFA6d%$Re+k zeRp6HGVj==Fs2V!ejj&B50BVK^n*?#x^VY*zIs-PRIRbxE8F$)SWW1JRg8{E%kzuE zn5&@StM0UX%C6;hPFntTTJxLvNhNeGSK|*VG3f1qo2rk}OBRz}FdD_1#29u?s7u)S zmfZ#KeDibJ`DQFNdAsxN7_jPp5bvmtc* zSZ}lKV?|{#=R&HnkM%TMxp5Iu)*e_^hDO%&K&iWqNa=~~@j4CVPjpoK{4nMmeD<6> z8#$QW3)_g|u#sosdvpKO5p_%Px&r*R3|UD+d>njtj8BM9jPG>AKFYuU){eR}*L!vA za353kR|KkY`PUKu@}KSo_4s3X{TQAZ*ex!pYp<@!sRKLoOzztYh9zdql@KPLWqI&! zj>`iX|8Rz>r|G?bxdJM9{l@@O+@I=Vx*;g;pZ4}kbv=vw5us#zfOm0!2$MLX#Y=Um z;(i3~_iF&*4%_VBI7hq0?H#tYYp?6@P9*6uQQ3X43I65KOdVu`@y{G&JvYH%pmZTV z&n~+!rd+0>)B(zy_Yf)lFy&7gN*GY~M-wS&m~x4R5&@Jx2}DYNO!Lf2}S+l$e6agXZ->Zy7vn7u3v;QiR-Vl<*E7w0=MoLNa_~@aliP;ZNIn^F5ekL zdT3Vmqu6Plb{SZO(sXYJR>bNupBQKj!mLyDth<19`B!2HG#Il^(zEUZ*0T9T8yx{#?!jKK8jr&pOxeebBlsl#pDKe&5OjT4T_txp|?gs*)c`LvQ=F6MeoawhO%3%Bx=Wk z%RWYQDtW^KyEklE!5h|P1`TP`O&mK0dqcmf z%3cv_^Ol-OCIHXQ!{M{G--G;f3%M2HF7NOw!bPahgI6eT8oS*VY@@OUT&d1YV-j3B zy(8(2g6s^e@e>Y>*F&Sw$`VELY!pI-$w}UwQ2>m@H!dg=)hL9(pLGu+jY3wZ6?ErO rr~_QyWDeaBk2))P@#q6ICX6Ri@-Sr|4dwp;tS}m- literal 0 Hc-jL100001 diff --git a/tests/sip-method/test.rules b/tests/sip-method/test.rules new file mode 100644 index 000000000..1fd849f78 --- /dev/null +++ b/tests/sip-method/test.rules @@ -0,0 +1 @@ +alert sip any any -> any any (flow:to_server; sip.method; content:"REGISTER"; sid:1;) diff --git a/tests/sip-method/test.yaml b/tests/sip-method/test.yaml new file mode 100644 index 000000000..e65182548 --- /dev/null +++ b/tests/sip-method/test.yaml @@ -0,0 +1,15 @@ +requires: + features: + - HAVE_LIBJANSSON + min-version: 5.0.0 + +args: + - -k none + +pcap: sip.pcap + +checks: + - filter: + count: 36 + match: + event_type: alert diff --git a/tests/sip-protocol/README.md b/tests/sip-protocol/README.md new file mode 100644 index 000000000..2d175aa3e --- /dev/null +++ b/tests/sip-protocol/README.md @@ -0,0 +1 @@ +Match on SIP version field. diff --git a/tests/sip-protocol/test.rules b/tests/sip-protocol/test.rules new file mode 100644 index 000000000..b68e37811 --- /dev/null +++ b/tests/sip-protocol/test.rules @@ -0,0 +1,2 @@ +alert sip any any -> any any (flow:to_server; sip.protocol; content:"SIP/2.0"; sid:1;) +alert sip any any -> any any (flow:to_client; sip.protocol; content:"SIP/2.0"; sid:2;) diff --git a/tests/sip-protocol/test.yaml b/tests/sip-protocol/test.yaml new file mode 100644 index 000000000..9a6ec7d8c --- /dev/null +++ b/tests/sip-protocol/test.yaml @@ -0,0 +1,25 @@ +requires: + features: + - HAVE_LIBJANSSON + min-version: 5.0.0 + +args: + - -k none + +pcap: ../sip-method/sip.pcap + +checks: + - filter: + count: 81 + match: + event_type: alert + - filter: + count: 47 + match: + event_type: alert + alert.signature_id: 1 + - filter: + count: 34 + match: + event_type: alert + alert.signature_id: 2 diff --git a/tests/sip-request-line/README.md b/tests/sip-request-line/README.md new file mode 100644 index 000000000..7881b9897 --- /dev/null +++ b/tests/sip-request-line/README.md @@ -0,0 +1 @@ +Match on the whole SIP request line. diff --git a/tests/sip-request-line/test.rules b/tests/sip-request-line/test.rules new file mode 100644 index 000000000..d525a5762 --- /dev/null +++ b/tests/sip-request-line/test.rules @@ -0,0 +1 @@ +alert sip any any -> any any (flow:to_server; sip.request_line; content:"REGISTER sip:sip.cybercity.dk SIP/2.0"; sid:1;) diff --git a/tests/sip-request-line/test.yaml b/tests/sip-request-line/test.yaml new file mode 100644 index 000000000..47b981e44 --- /dev/null +++ b/tests/sip-request-line/test.yaml @@ -0,0 +1,15 @@ +requires: + features: + - HAVE_LIBJANSSON + min-version: 5.0.0 + +args: + - -k none + +pcap: ../sip-method/sip.pcap + +checks: + - filter: + count: 36 + match: + event_type: alert diff --git a/tests/sip-response-line/README.md b/tests/sip-response-line/README.md new file mode 100644 index 000000000..136ca58ae --- /dev/null +++ b/tests/sip-response-line/README.md @@ -0,0 +1 @@ +Match on the whole SIP response line. diff --git a/tests/sip-response-line/test.rules b/tests/sip-response-line/test.rules new file mode 100644 index 000000000..01dfd77ad --- /dev/null +++ b/tests/sip-response-line/test.rules @@ -0,0 +1 @@ +alert sip any any -> any any (flow:to_client; sip.response_line; content:"SIP/2.0 200 OK"; sid:1;) diff --git a/tests/sip-response-line/test.yaml b/tests/sip-response-line/test.yaml new file mode 100644 index 000000000..15d0118c7 --- /dev/null +++ b/tests/sip-response-line/test.yaml @@ -0,0 +1,15 @@ +requires: + features: + - HAVE_LIBJANSSON + min-version: 5.0.0 + +args: + - -k none + +pcap: ../sip-method/sip.pcap + +checks: + - filter: + count: 5 + match: + event_type: alert diff --git a/tests/sip-stat-code/README.md b/tests/sip-stat-code/README.md new file mode 100644 index 000000000..e96cf40e9 --- /dev/null +++ b/tests/sip-stat-code/README.md @@ -0,0 +1 @@ +Match on SIP stat code field. diff --git a/tests/sip-stat-code/test.rules b/tests/sip-stat-code/test.rules new file mode 100644 index 000000000..0a2e46c0f --- /dev/null +++ b/tests/sip-stat-code/test.rules @@ -0,0 +1 @@ +alert sip any any -> any any (flow:to_client; sip.stat_code; content:"100"; sid:1;) diff --git a/tests/sip-stat-code/test.yaml b/tests/sip-stat-code/test.yaml new file mode 100644 index 000000000..cba09883f --- /dev/null +++ b/tests/sip-stat-code/test.yaml @@ -0,0 +1,15 @@ +requires: + features: + - HAVE_LIBJANSSON + min-version: 5.0.0 + +args: + - -k none + +pcap: ../sip-method/sip.pcap + +checks: + - filter: + count: 7 + match: + event_type: alert diff --git a/tests/sip-stat-msg/README.md b/tests/sip-stat-msg/README.md new file mode 100644 index 000000000..56ba3ba2c --- /dev/null +++ b/tests/sip-stat-msg/README.md @@ -0,0 +1 @@ +Match on SIP stat msg field. diff --git a/tests/sip-stat-msg/test.rules b/tests/sip-stat-msg/test.rules new file mode 100644 index 000000000..81705fccc --- /dev/null +++ b/tests/sip-stat-msg/test.rules @@ -0,0 +1 @@ +alert sip any any -> any any (flow:to_client; sip.stat_msg; content:"Trying"; sid:1;) diff --git a/tests/sip-stat-msg/test.yaml b/tests/sip-stat-msg/test.yaml new file mode 100644 index 000000000..20a0de9e3 --- /dev/null +++ b/tests/sip-stat-msg/test.yaml @@ -0,0 +1,15 @@ +requires: + features: + - HAVE_LIBJANSSON + min-version: 5.0.0 + +args: + - -k none + +pcap: ../sip-method/sip.pcap + +checks: + - filter: + count: 6 + match: + event_type: alert diff --git a/tests/sip-uri/README.md b/tests/sip-uri/README.md new file mode 100644 index 000000000..c1c134a6d --- /dev/null +++ b/tests/sip-uri/README.md @@ -0,0 +1 @@ +Match on SIP URI field. diff --git a/tests/sip-uri/test.rules b/tests/sip-uri/test.rules new file mode 100644 index 000000000..f6ca14dbf --- /dev/null +++ b/tests/sip-uri/test.rules @@ -0,0 +1 @@ +alert sip any any -> any any (flow:to_server; sip.uri; content:"sip:sip.cybercity.dk"; sid:1;) diff --git a/tests/sip-uri/test.yaml b/tests/sip-uri/test.yaml new file mode 100644 index 000000000..47b981e44 --- /dev/null +++ b/tests/sip-uri/test.yaml @@ -0,0 +1,15 @@ +requires: + features: + - HAVE_LIBJANSSON + min-version: 5.0.0 + +args: + - -k none + +pcap: ../sip-method/sip.pcap + +checks: + - filter: + count: 36 + match: + event_type: alert -- 2.47.2