From 8b078ab0dae40f32e3e1c838c4ce0e1a111dce0d Mon Sep 17 00:00:00 2001 From: Jason Ish Date: Wed, 13 Nov 2019 16:27:41 -0600 Subject: [PATCH] base64 tests: update to work on 4.1 --- tests/base64/test.rules | 6 +++--- tests/base64/test.yaml | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/tests/base64/test.rules b/tests/base64/test.rules index 50217b044..df8c89508 100644 --- a/tests/base64/test.rules +++ b/tests/base64/test.rules @@ -1,6 +1,6 @@ # input pcap contains a query to http://home.regit.org/?arg=dGhpc2lzYXRlc3QK # "dGhpc2lzYXRlc3QK" is "thisisatest" -alert http any any -> any any (msg:"Example"; http.uri; content:"arg"; base64_decode:bytes 17, offset 1, relative; base64_data; content:"thisisatest"; sid:1; rev:1;) +alert http any any -> any any (msg:"Example"; content:"arg"; http_uri; base64_decode:bytes 17, offset 1, relative; base64_data; content:"thisisatest"; sid:1; rev:1;) alert http any any -> any any (msg:"Example"; content:"arg"; http_uri; base64_decode:bytes 17, offset 1, relative; base64_data; content:"thisisatest"; sid:2; rev:1;) -alert http any any -> any any (msg:"Example"; http.uri; content:"arg"; base64_decode:bytes 10, offset 1, relative; base64_data; content:"test"; sid:3; rev:1;) -alert http any any -> any any (msg:"Example"; http.uri; content:"arg"; base64_decode:bytes 17, offset 1, relative; base64_data; content:"toast"; sid:4; rev:1;) +alert http any any -> any any (msg:"Example"; content:"arg"; http_uri; base64_decode:bytes 10, offset 1, relative; base64_data; content:"test"; sid:3; rev:1;) +alert http any any -> any any (msg:"Example"; content:"arg"; http_uri; base64_decode:bytes 17, offset 1, relative; base64_data; content:"toast"; sid:4; rev:1;) diff --git a/tests/base64/test.yaml b/tests/base64/test.yaml index 7bc37ceba..bbc85d381 100644 --- a/tests/base64/test.yaml +++ b/tests/base64/test.yaml @@ -1,7 +1,7 @@ requires: features: - HAVE_LIBJANSSON - min-version: 5.0.0 + min-version: 4.1 args: - -k none -- 2.47.2