From 939211c2cc9033079102cf32f009aed2401a6ddd Mon Sep 17 00:00:00 2001
From: Jeff Lucovsky <jeff@lucovsky.org>
Date: Sun, 21 Jul 2019 12:33:32 -0400
Subject: [PATCH] tests: add test cases for FTP logging

---
 tests/output-eve-ftp/input.pcap | Bin 0 -> 4536 bytes
 tests/output-eve-ftp/test.yaml  |  68 ++++++++++++++++++++++++++++++++
 2 files changed, 68 insertions(+)
 create mode 100644 tests/output-eve-ftp/input.pcap
 create mode 100644 tests/output-eve-ftp/test.yaml

diff --git a/tests/output-eve-ftp/input.pcap b/tests/output-eve-ftp/input.pcap
new file mode 100644
index 0000000000000000000000000000000000000000..50815c5535dfd7e68c5aabb38d9002a6f447904c
GIT binary patch
literal 4536
zc-pO)YiyHM7{||U?W~l5fjDpEY(=wWZRu^@7P_&Gu8hIDvI|Tdj;?*j%6hYJy9>*(
zibN9;i~)%gF9B38gGK2DkPssKpouYL(Jw;0esSEQlP^L9pL5!6ukX%YqtK-3N!R!P
zd;b6DIp=MsP%0HKBZL|(#gAsd>)rGt3l$@?Nz>^G;|(6aJJ84DQrygidOa=<JDjc_
ztXJdCh{x;3rDmNTWg`u;Mtnh+Gl=!tGOZaGHm|qiCaxEo%Je1!?g|Bbcv(0U@%L!p
z14StHAZ)^YHT`<`E<%~efZDAbLABc*wvIuY)nv6*8}*u%=9&_XsjR$IQ&v+_uBoxs
z+G@>4Lus|nJcQ5#pdbT{dH=C?l;)Fb-RZhE{g9159bOu%fi-#FO#VE)ez1Gv%Gdt<
zJ{Q#@WXdnBLQz?p>HJ}&gr{QS7Fv91bf1!39nHij_!BtE&WUAYWo2e$WM`(d#f;JT
z3?rqUBBdAzRiP@`>2{(|IB4<2tqx!D>%f^GeW*P5t1r?F&<BouhS4TqJe6D;GsD`<
z@==&yM18Cf`Irx!U5*90sPZ66>k(bAK-ZhKJXR0udRFZg)nQWm-VsslyNI?U5AnZd
zBV;h>aA7ZRYjL=-L2J~O6e$%chS<aIWtCDM)YOB8;o*Q|f&6ymp1C|k>no)^9HAbL
z{eKU_UVjNJiFwjc56f5{qTpfjdDtNtISRrj@6GhOTflhl;qjOa);1QSEZ;{M8?G{Q
z%9GztypK?8b8QoL`UCy}Um(I0FWroOBrN08{g{<oq3S5j?VKpL1HfA1Sb%ujJYhfj
z1-h48$75~jzs=IER~@6e?=W?tA9v0pWHjor!^=5&4)a0I<>?y0;cgBGojl(c2)VUN
zML)yOyKjCgHD7+3+bvOUOMpEF^EFx7BlIKeN7L>#afyB$qPj7rZk~Md_$vrGs+*ht
zy&u~%>~V>HjL_W9igFtRmX`FR_B&zyL4od2nIqmn?hh>86{_P@_YhMT`r(FAHyCwz
zZD6y<kNJqp#qoSs#H%GXC`at0XQ(+Y(T5LdUKd1pX@PkO`f#nXel8z>xm%@toS;4q
z-kT5MUa#a@;}U!QW9lQ$@&SAO+V7{P_xc!lZ)UFxJ$=+(o^Zh0!D7_pU#AQwGpjuL
zwb3`=%EqP^tS>jH_2x3QPOUep4Mvk%uTv_54Bq}77Af8h%G-4Rc&e{!rFg$l-gEbl
zx4fWDf>-ba+}CCM^!Jaqx_65duZZ%Vyf@xX0dLVSeF+b&J*++Otm-7)122j8z$IYT
zkv%Y62YW!L!<6X?_<T;kTeubQ%7CBuxVaFH@E-qW4CmJR)c)9+uBBa2%SmN_!UAgx
z%e%HfN4*<F-s?JiYPj#pf7}g`+1EC=C>8CDGi2hi{)EI?7^6O8|MaPz5Bhd`76yf9
zNK~M^VO4)(Bdj;FbQ@K1s=Je^3;F3(2<c07xQ+{PBtMR)_a(O{#JR$O&;a&&_%H;Q
z$}Gy5mlwA8C+x7cv-nl21mzEl_$5>P7e>i<6*IO@19=WQ*tmuQS!eOh?K3&fK8p)V
zXpfAd9@&A}0B7;Vif`sRizgqHB_-ybBf4)*Fm?0f7f<BPHTMPsd+skjB1=lleUj$3
zO_W;$FuO@^Zzt|`?uFk67A==0flA1;y_XhrQSX0<ymv!AQSg4@L?c2?wJl9J%=v=a
zaDSL`roIpC7jWvHktMgndMnGbS9OYd_KG}5fz?Mmx9&;JYGaV|6Hhg(?bS_BV_(1x
z1M3VsAqT%7rpOcU<E}txx*S}n*PBhab0Ey|MKpx{jQ%hFT%MGe<I}XZeWKdNrfQ1}
zrslXM<n;4h5IgiF=;gxPoO9d>Jc&8pLNmW3%DfMlmtl@aDyoEYEIh;NN;;AfXV?I9
zj#IjM@{zsU5L(x|T5yI5zduy;btJ8@wz4uZtIp7jJ`iPe8T5x}|8|g!^mtVu;O-nC
z$*_JGT3+ms%4I99|AwgkA>dqbER-Lq&<b-A>YhF}qsusdKclrD7u9}+*1iz&R`*=G
zx)I5G2Wh?6MfGk2?W@qoBNdvtba#wP)_a!qJ63&_Xp{Se)itG?Bl>N5X5G<b26`N=
z3`G24F2v(tD9{Thg&Q^qcBlSXl8JKZXNz;reUg=4lk2i!ZOch%<-l6_AdJ5O3HuPk

literal 0
Hc-jL100001

diff --git a/tests/output-eve-ftp/test.yaml b/tests/output-eve-ftp/test.yaml
new file mode 100644
index 000000000..edcc6304b
--- /dev/null
+++ b/tests/output-eve-ftp/test.yaml
@@ -0,0 +1,68 @@
+requires:
+  features:
+    - HAVE_LIBJANSSON
+
+  files:
+    - src/output-json-ftp.c
+
+checks:
+  - filter:
+      count: 8
+      match:
+        event_type: ftp
+
+  - filter:
+      count: 1
+      match:
+        event_type: ftp
+        ftp.command: USER
+
+  - filter:
+      count: 1
+      match:
+        event_type: ftp
+        ftp.command: PASS
+
+  - filter:
+      count: 1
+      match:
+        event_type: ftp
+        ftp.command: NLST
+
+  - filter:
+      count: 2
+      match:
+        event_type: ftp
+        ftp.command: PORT
+
+  - filter:
+      count: 1
+      match:
+        event_type: ftp
+        ftp.command: RETR
+
+  - filter:
+      count: 1
+      match:
+        event_type: ftp
+        ftp.command: QUIT
+
+  - filter:
+      count: 1
+      match:
+        event_type: ftp
+        ftp.command: PASS
+        ftp.command_data: anonymous
+        ftp.reply: ['Login successful.']
+        ftp.completion_code: ['230']
+
+  - filter:
+      count: 1
+      match:
+        event_type: ftp
+        ftp.command: NLST
+        ftp.reply: [
+          "Here comes the directory listing.\r\n",
+          "Directory send OK.",
+          "PORT command successful. Consider using PASV."]
+        ftp.dynamic_port: 59926
-- 
2.47.2