From ea37490fb2e70768a24e46c71b272c5bfab8cc89 Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Fri, 7 Jun 2024 14:44:29 +0200 Subject: [PATCH] tests: add stream_size prefilter tests --- tests/streamsize-keyword-02-prefilter/README.md | 3 +++ tests/streamsize-keyword-02-prefilter/test.rules | 1 + tests/streamsize-keyword-02-prefilter/test.yaml | 15 +++++++++++++++ .../README.md | 4 ++++ .../test.rules | 2 ++ .../test.yaml | 14 ++++++++++++++ 6 files changed, 39 insertions(+) create mode 100644 tests/streamsize-keyword-02-prefilter/README.md create mode 100644 tests/streamsize-keyword-02-prefilter/test.rules create mode 100644 tests/streamsize-keyword-02-prefilter/test.yaml create mode 100644 tests/streamsize-keyword-03-prefilter-pseudo/README.md create mode 100644 tests/streamsize-keyword-03-prefilter-pseudo/test.rules create mode 100644 tests/streamsize-keyword-03-prefilter-pseudo/test.yaml diff --git a/tests/streamsize-keyword-02-prefilter/README.md b/tests/streamsize-keyword-02-prefilter/README.md new file mode 100644 index 000000000..223cab407 --- /dev/null +++ b/tests/streamsize-keyword-02-prefilter/README.md @@ -0,0 +1,3 @@ +# Description + +Test stream_size keyword as prefilter. diff --git a/tests/streamsize-keyword-02-prefilter/test.rules b/tests/streamsize-keyword-02-prefilter/test.rules new file mode 100644 index 000000000..32f67283e --- /dev/null +++ b/tests/streamsize-keyword-02-prefilter/test.rules @@ -0,0 +1 @@ +alert tcp any any -> any any (flow:established,to_server; stream_size:server,<,1111; prefilter; content: "EICAR"; sid:1234;) diff --git a/tests/streamsize-keyword-02-prefilter/test.yaml b/tests/streamsize-keyword-02-prefilter/test.yaml new file mode 100644 index 000000000..51198b28f --- /dev/null +++ b/tests/streamsize-keyword-02-prefilter/test.yaml @@ -0,0 +1,15 @@ +pcap: ../smb-eicar-file/input.pcap + +requires: + min-version: 7 + +# disables checksum verification +args: +- -k none + +checks: + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 1234 diff --git a/tests/streamsize-keyword-03-prefilter-pseudo/README.md b/tests/streamsize-keyword-03-prefilter-pseudo/README.md new file mode 100644 index 000000000..cf3748a7f --- /dev/null +++ b/tests/streamsize-keyword-03-prefilter-pseudo/README.md @@ -0,0 +1,4 @@ +# Description + +Test stream_size keyword as prefilter on timeout packet + diff --git a/tests/streamsize-keyword-03-prefilter-pseudo/test.rules b/tests/streamsize-keyword-03-prefilter-pseudo/test.rules new file mode 100644 index 000000000..222bc95f8 --- /dev/null +++ b/tests/streamsize-keyword-03-prefilter-pseudo/test.rules @@ -0,0 +1,2 @@ +alert tls any any -> any any (msg:"SERVER HELLO DATA - to_client"; flow:established,to_client; tls.random; content:"|54 b8 f7 73|"; bsize:>1; stream_size:server,>,1111; prefilter; sid:1234;) + diff --git a/tests/streamsize-keyword-03-prefilter-pseudo/test.yaml b/tests/streamsize-keyword-03-prefilter-pseudo/test.yaml new file mode 100644 index 000000000..64fdc1db7 --- /dev/null +++ b/tests/streamsize-keyword-03-prefilter-pseudo/test.yaml @@ -0,0 +1,14 @@ +pcap: ../tls/tls-random-6989/input.pcap + +requires: + min-version: 8 + +args: +- -k none + +checks: + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 1234 -- 2.47.2