From 81517e51148ec6100482f14da6a14ba08943c802 Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Wed, 23 Dec 2020 16:49:08 +0100 Subject: [PATCH] tests: add more midstream test variants --- tests/alert-testmyids-midstream3/input.pcap | Bin 0 -> 866 bytes .../alert-testmyids-midstream3/suricata.yaml | 37 ++++++++++++++++++ tests/alert-testmyids-midstream3/test.rules | 1 + tests/alert-testmyids-midstream3/test.yaml | 30 ++++++++++++++ tests/alert-testmyids-midstream5/input.pcap | Bin 0 -> 1014 bytes .../alert-testmyids-midstream5/suricata.yaml | 37 ++++++++++++++++++ tests/alert-testmyids-midstream5/test.rules | 1 + tests/alert-testmyids-midstream5/test.yaml | 31 +++++++++++++++ 8 files changed, 137 insertions(+) create mode 100644 tests/alert-testmyids-midstream3/input.pcap create mode 100644 tests/alert-testmyids-midstream3/suricata.yaml create mode 100644 tests/alert-testmyids-midstream3/test.rules create mode 100644 tests/alert-testmyids-midstream3/test.yaml create mode 100644 tests/alert-testmyids-midstream5/input.pcap create mode 100644 tests/alert-testmyids-midstream5/suricata.yaml create mode 100644 tests/alert-testmyids-midstream5/test.rules create mode 100644 tests/alert-testmyids-midstream5/test.yaml diff --git a/tests/alert-testmyids-midstream3/input.pcap b/tests/alert-testmyids-midstream3/input.pcap new file mode 100644 index 0000000000000000000000000000000000000000..00604d55eded0e05c7524cf1b04e1bbb4260fca0 GIT binary patch literal 866 zc-noE&1(}u7{+I98_L$D=|L=>hF*-Ro9t}9n!!kd#@43MrEckY-At1}vKw|M#`F(R z5TVCvdnzbRdl3b%QRt=O&3F*?s726v)T7R92>l>r;a%o~`SHBZ`+VGcwRHvzgQIU4 z2<-o6@4@o3vqRt^Tk`_v&P%?(pWZ(@+`2IevH&#Ko}@wAxA|D~3uBAVUv6}EfwsE8 z-CjTVa8a8C-!HraU^c76Fr3qMEsR1)66b7}V%TUjLX^0)+AJ5`kZD&Xamgi)oGB8E zU7K~M5>AAok&q&Z8Pg;+b{Gr?B~cQ&teqbt;0ja3t1GB0&XX0;oisqcgCQ=7O9NVG zmrGjRZ;fkyA$RpwuTjow{~Q5H)-SKqEMZ!AIqTcMzN|?h_jU|`UUN`Y6nHx)iPsHE zFkB{u%MeB2e7(YMP#mf%j;dHmz}dVmiFb%|k2n}+YKB=NlDJ^FRL$UKa4d%(Wa;9^C?As#+&x~+6Lf1Q7Q-m literal 0 Hc-jL100001 diff --git a/tests/alert-testmyids-midstream3/suricata.yaml b/tests/alert-testmyids-midstream3/suricata.yaml new file mode 100644 index 000000000..2c7f4cc6d --- /dev/null +++ b/tests/alert-testmyids-midstream3/suricata.yaml @@ -0,0 +1,37 @@ +%YAML 1.1 +--- + +logging: + default-log-level: notice + default-output-filter: + outputs: + - console: + enabled: yes + +outputs: + - fast: + enabled: yes + filename: fast.log + append: yes + + - eve-log: + enabled: yes + filetype: regular #regular|syslog|unix_dgram|unix_stream|redis + filename: eve.json + types: + - alert: + payload: yes + payload-buffer-size: 4kb + payload-printable: yes + packet: yes + http: yes + tls: yes + ssh: yes + smtp: yes + xff: + enabled: yes + mode: extra-data + deployment: reverse + header: X-Forwarded-For + - flow + - http diff --git a/tests/alert-testmyids-midstream3/test.rules b/tests/alert-testmyids-midstream3/test.rules new file mode 100644 index 000000000..9f1307bdb --- /dev/null +++ b/tests/alert-testmyids-midstream3/test.rules @@ -0,0 +1 @@ +alert ip any any -> any any (msg:"GPL ATTACK_RESPONSE id check returned root"; content:"uid=0|28|root|29|"; classtype:bad-unknown; sid:2100498; rev:7;) diff --git a/tests/alert-testmyids-midstream3/test.yaml b/tests/alert-testmyids-midstream3/test.yaml new file mode 100644 index 000000000..9cef3c776 --- /dev/null +++ b/tests/alert-testmyids-midstream3/test.yaml @@ -0,0 +1,30 @@ +requires: + features: + - HAVE_LIBJANSSON + +args: +- --set stream.midstream=true + +checks: + + # Check that we only have one alert event type in eve. + - filter: + count: 1 + match: + event_type: alert + src_port: 80 + - filter: + count: 1 + match: + event_type: flow + dest_port: 80 + - filter: + count: 1 + match: + event_type: http + dest_port: 80 + + # Check how many lines were logged to fast.log. + - shell: + args: cat fast.log | wc -l | xargs + expect: 1 diff --git a/tests/alert-testmyids-midstream5/input.pcap b/tests/alert-testmyids-midstream5/input.pcap new file mode 100644 index 0000000000000000000000000000000000000000..7a89ef1727926127879095cbf66118a64006501c GIT binary patch literal 1014 zc-no^!B5jr90%}U*@mREVVD?+rxy+~huhk2W2|Awq7!6H7p&o2yT`T!+NJHB;}4L; zm~celL?U5uF&e#im?m5>-kb-c#*-{2ibwUP?{!&#Wm%KgyuRjr@_XO+`>^+Xvj?1T z^f-Yb@7H_x=l{ALFhS;Ye0=xdaPu0RJ;(L_>4PKy4=@QrucXawJzHlzj2klb-L=O1 z3(Nc4wc?qrto90^$LV^(I2@;_7C-HPQ6kaNbeg8Ec~{paVX}AQE0w5N--Qg7h&Y__ zz`O@ST9z|GAs}$c9Luq^tex*J7$+5tcZ$j@ z8#Jnhqb;i8<^5`Z#>1p0ZnVOuR_%uiV&o3!Xt$UV*`(IDe;utsCiTV*&^jCvc^=(N zaqLya!V;Rt*-J#7EIoTISeW*tm-g2_=e(n#UYFtC*HQt!E1h z1)P;oTGz<#2%1qe>PC?mk_17DM4G#kvXYa~kT52wW8s+M7o+~L7!}mWf}p5jl^<&5 z=ATov95y9%r$Pef*ekkbk&OMbSj$;?358-uYjUMX>bCGbE10*I7HQh0LN?BO4PCb` zqTKPhp_htg>(joJUnIyb9rxJol`kiIrP{yNsQXCA9maQ>*YWaaS7qH+K6g|Gh*E7T vPiuYM8pN_2ggJSsbsv#DnE@shzka+yeiN%pMH_ZSpV}(&5O2gj*EYa^IN~-+ literal 0 Hc-jL100001 diff --git a/tests/alert-testmyids-midstream5/suricata.yaml b/tests/alert-testmyids-midstream5/suricata.yaml new file mode 100644 index 000000000..2c7f4cc6d --- /dev/null +++ b/tests/alert-testmyids-midstream5/suricata.yaml @@ -0,0 +1,37 @@ +%YAML 1.1 +--- + +logging: + default-log-level: notice + default-output-filter: + outputs: + - console: + enabled: yes + +outputs: + - fast: + enabled: yes + filename: fast.log + append: yes + + - eve-log: + enabled: yes + filetype: regular #regular|syslog|unix_dgram|unix_stream|redis + filename: eve.json + types: + - alert: + payload: yes + payload-buffer-size: 4kb + payload-printable: yes + packet: yes + http: yes + tls: yes + ssh: yes + smtp: yes + xff: + enabled: yes + mode: extra-data + deployment: reverse + header: X-Forwarded-For + - flow + - http diff --git a/tests/alert-testmyids-midstream5/test.rules b/tests/alert-testmyids-midstream5/test.rules new file mode 100644 index 000000000..9f1307bdb --- /dev/null +++ b/tests/alert-testmyids-midstream5/test.rules @@ -0,0 +1 @@ +alert ip any any -> any any (msg:"GPL ATTACK_RESPONSE id check returned root"; content:"uid=0|28|root|29|"; classtype:bad-unknown; sid:2100498; rev:7;) diff --git a/tests/alert-testmyids-midstream5/test.yaml b/tests/alert-testmyids-midstream5/test.yaml new file mode 100644 index 000000000..8f28e5852 --- /dev/null +++ b/tests/alert-testmyids-midstream5/test.yaml @@ -0,0 +1,31 @@ +requires: + features: + - HAVE_LIBJANSSON + min-version: 5.0.0 + +args: +- --set stream.midstream=true + +checks: + + # Check that we only have one alert event type in eve. + - filter: + count: 1 + match: + event_type: alert + src_port: 80 + - filter: + count: 1 + match: + event_type: flow + dest_port: 80 + - filter: + count: 1 + match: + event_type: http + dest_port: 80 + + # Check how many lines were logged to fast.log. + - shell: + args: cat fast.log | wc -l | xargs + expect: 1 -- 2.47.2