From e8f00f583e87cd0f66f333c8e5039a93f846437a Mon Sep 17 00:00:00 2001
From: Philippe Antoine <contact@catenacyber.fr>
Date: Fri, 26 Aug 2022 09:26:59 +0200
Subject: [PATCH] Adds test for http file to server

---
 tests/http-post-file/README.md  |  10 ++++++++++
 tests/http-post-file/input.pcap | Bin 0 -> 5393 bytes
 tests/http-post-file/mm.go      |  23 +++++++++++++++++++++++
 tests/http-post-file/test.rules |   1 +
 tests/http-post-file/test.yaml  |  13 +++++++++++++
 5 files changed, 47 insertions(+)
 create mode 100644 tests/http-post-file/README.md
 create mode 100644 tests/http-post-file/input.pcap
 create mode 100644 tests/http-post-file/mm.go
 create mode 100644 tests/http-post-file/test.rules
 create mode 100644 tests/http-post-file/test.yaml

diff --git a/tests/http-post-file/README.md b/tests/http-post-file/README.md
new file mode 100644
index 000000000..51768825e
--- /dev/null
+++ b/tests/http-post-file/README.md
@@ -0,0 +1,10 @@
+# Description
+
+Test HTTP file to server.
+
+# PCAP
+
+The pcap comes from running server
+`docker run --name mattermost-preview -d --publish 8065:8065 mattermost/mattermost-preview -m=4G`
+
+And client from mm.go (you need to setup credentials and channel Id)
diff --git a/tests/http-post-file/input.pcap b/tests/http-post-file/input.pcap
new file mode 100644
index 0000000000000000000000000000000000000000..1ba2be5754c7e5d72a2f72c68ce43fa08efe6a16
GIT binary patch
literal 5393
zc-qC7U2NOd6~`$#wH><J(xMLnRxGTLWoc*G`r?Pw0<-Fm*r<~jjuIH@Fy@N9lxR`B
z6hAD<g@FZak@TU(usw7GHlTjm2lfyQ!+>;7AF@6SNVYXV&^@>a3al-*Jr6C=hh^td
zq9xi%YsUs6fCBH~<?kGxd-y*Wyz}SZuSc0fOz+n@zvT`qjSC~p1f0|3+i+Zb{F@B(
z)ZhdY{zbNrk6yZYanrp1$@T9puP+>l|DAcd!+RTe^DtpP;KgDL!+kyP=Eb9zC<~aM
z{^&^jCUXLekzw}b&xhZ7<Hp@D{t9gOPXpmtN7&uQ+B)}>W7E@bed~7+>jyMe%6l7l
zp;!+M?Jm~V(MyyC%o&LFZV+qY={Mhb=gOBqzYXloUq8ky!Q`cY9UWnq(Ot0Dj$Ycl
zJp3XZT#eql$K)6$dg%M_M+OE4sgEnMjlcOT7-bmhNBGS)Kat0F<p*-Iwtnr8C&Aa`
z)hBoQu|N9Y6Y4AQGX;J^xuVa*?fQ8p!PhM0>YqWbD4Y7A>{Hv>^clEaKf^5L_p^i8
zDf=F<S-6uPTXEmrW886Ie-@5=;mp|*H;ycQd?h#TIoNi_4N}ofZnjif7*CI-W9%$(
z+yZA11sPR(Dy0NI#-4+@$zlbYaP1^XR$bRhDuxc@&RvtlbYYO3$7aQ?7PxFa#?EQU
z)5OHdQ^-}o6l05uf-N^WZ7M|7%}Rl*tm;;bjj^vJ{3v8yO%xI?aY<q{VIjw95<9Sf
zZH;E;so(B5>xUzd^^fnD^$Y(RWS#?&p+~?T_}?Dc@%YDw1_SnOfwF_-a+y?$JM&U6
zTcx&z3mmd6LsyWi6LWmoA!dv%ks3A&T)N^^iIg?nY`Io%*Qz{fn@yp%T4~4F^T=)&
zxNRAYu}jHC-0-mDCg;=wm)BN3BxaSCD^*p^R@8jDrASJpq0pJ<Vfn$QKT{k_jitvr
z|57=d&5C7I#%ekx@qAgqsZ2`Y5fTMe6VhWEG8`OZr;rQL&)E7Xml3$4SApltWVn=A
z$Yct<$elb@+F2N4n(wT*zt)n**V6g2n$;ystCial@3rhkUZ^yo0u&pA2N}7ELRt{g
zSs^b;d0rAn6P~4RzXI2Iel($C19z{aU>;PhiR!plRmgLzGTe;76bxa~imu>}1=o>o
z(D}NnPtd<H%?7inE43~OMw)IruG||NC^WQ)qtn&wjBH|H2Tq-~<KnuE)H=Lx-2n}d
zhG7__Dc6x*!!9giqTt#d2B*Z;wYF^8!~(!838jim6Z_G@b($ekuS0Sv-NY+CO2tmi
zB^Frd6&l2rO?HT9s=d1dvs;Bks}urp^rxUR%^&WV6iR_#5Mb=Olxw){bW`Cu)le+d
zAUiH{J)hM??Z6oJu-46LAOmt|&3BZ7FH|%JOzEy($E%<@G+VH?qz-SDQra@oi0a7n
zkP)`QG8FGK+fM)lqUsJR8(3~)12T@~Zi4)$USp|pc%U2)-)9a-)~~&L98~E}ug_fP
zsCrQLfB!wmY`~oxeZ3&^<2|zD@jH>9h1ua=U>O9Gf8c!}Ev7*C;VmP!zUoU{fqQYf
zxH!G|mFl*a*5L~YU3(DI&RL&ubVWc8CUsw-&RA@=p@7o@$x3cntKf>BZY<k;mbCo>
zH*mMSF{rcMHOY>?3N}IN4vD5YxZ}vibpmb!S2k|Q{*;cv?_LA{8Qe$rdiVI|Wwrrz
zvf1liw8LEIDBFw-F#_y+=n=4^>>k<i_-6FUE%pnP-PgU++@zmc_3K;MuKJUiL-oAS
z@~WEYxy!th6&o#EYBlrrBkNC@Tz`Mk9cejN793HRvUv=3f?Cabi?>X>S8&L6ky51!
zx3g#E@)9qKIg#%#!>?|7kFG#{CHpB<(Zeel+gQK0aRe&#R-cj`r<Fw6SE56V40p=?
zN|xOtJ08Ckc|Od(pOTF~c<ByY<OJzqH12_tw#1)#X5l*%#f6u1KUlc1#OF>d{P0<E
za`IVm?b!6(WN|Thwp2VlRa~4(7EhPv&d)8LJDV&`pDiV4=H{oLIX3&f+2?4we-Rzp
zhuCZ!*}OdR8Z709ePTle;W%Y~@%#`o1wu2`FE;T#vg7d&qudtzCCc9OR(V%CgOqGT
zw3?=^wTW&@%4)8ru9CDVJi2{wM#%N)j7dB`r+J>RtZB;)M2ORBn#~5vw-XPi91oPD
z`)r^4u7tPG+tdZO;0c_qeQi%?>ab;!d+itYw>oTE@rsU{iGt}F#t!L0wo=tsuo~J#
zedC4wNYBV?>(|~JhI)O!PkMM-SCswBi34Ci5n>Ag`|8Ag-m~|Hf&cop_iUc>Df|4)
z0kEG4u}=r=S7-K>lh=WNcw4?D%HIU`ujGUKKu3AE<%9k}H+h17p!*2ef4FgQALuCW
QA2$yA1KnQ=^aI`h0YG~*qyPW_

literal 0
Hc-jL100001

diff --git a/tests/http-post-file/mm.go b/tests/http-post-file/mm.go
new file mode 100644
index 000000000..0e9ed86f8
--- /dev/null
+++ b/tests/http-post-file/mm.go
@@ -0,0 +1,23 @@
+package main
+
+import (
+	"bytes"
+	"encoding/hex"
+	"fmt"
+	"github.com/mattermost/mattermost-server/v5/model"
+)
+
+func main() {
+	Client := model.NewAPIv4Client("http://localhost:8065/")
+	Client.Login("toto", "tototo")
+	data, _ := hex.DecodeString("58354f2150254041505b345c505a58353428505e2937434329377d2445494341522d5354414e444152442d414e544956495255532d544553542d46494c452124482b482a")
+	us := &model.UploadSession{
+		ChannelId: "7wynam16o38tbfgegi1qjr53oy",
+		Filename:  "eicar",
+		FileSize:  int64(len(data)),
+	}
+	us, response := Client.CreateUpload(us)
+	fmt.Printf("lol %s %#+v\n", us, response)
+	info, err2 := Client.UploadData(us.Id, bytes.NewReader(data))
+	fmt.Printf("lol %s %#+v\n", err2, info)
+}
diff --git a/tests/http-post-file/test.rules b/tests/http-post-file/test.rules
new file mode 100644
index 000000000..225de0dc5
--- /dev/null
+++ b/tests/http-post-file/test.rules
@@ -0,0 +1 @@
+alert http any any -> any any (msg:"EICAR file"; flow:to_server; file_data; content:"|58354f2150254041505b345c505a58353428505e2937434329377d2445494341522d5354414e444152442d414e544956495255532d544553542d46494c452124482b482a|"; sid:1; rev:1;)
diff --git a/tests/http-post-file/test.yaml b/tests/http-post-file/test.yaml
new file mode 100644
index 000000000..66335ef9d
--- /dev/null
+++ b/tests/http-post-file/test.yaml
@@ -0,0 +1,13 @@
+requires:
+  min-version: 7
+
+# disables checksum verification
+args:
+- -k none
+
+checks:
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 1
-- 
2.47.2