From 3c73aa3be694bc91f79068b6771781edc4b5fe56 Mon Sep 17 00:00:00 2001
From: Juliana Fajardini <jufajardini@gmail.com>
Date: Fri, 14 Feb 2025 20:06:23 -0300
Subject: [PATCH] tests: add test for pgsql event

Related to
Task #5566
---
 tests/pgsql/pgsql-events/README.md           |  11 +++++++++
 tests/pgsql/pgsql-events/UnknownMessage.pcap | Bin 0 -> 865 bytes
 tests/pgsql/pgsql-events/suricata.yaml       |  23 +++++++++++++++++++
 tests/pgsql/pgsql-events/test.rules          |   1 +
 tests/pgsql/pgsql-events/test.yaml           |  13 +++++++++++
 5 files changed, 48 insertions(+)
 create mode 100644 tests/pgsql/pgsql-events/README.md
 create mode 100644 tests/pgsql/pgsql-events/UnknownMessage.pcap
 create mode 100644 tests/pgsql/pgsql-events/suricata.yaml
 create mode 100644 tests/pgsql/pgsql-events/test.rules
 create mode 100644 tests/pgsql/pgsql-events/test.yaml

diff --git a/tests/pgsql/pgsql-events/README.md b/tests/pgsql/pgsql-events/README.md
new file mode 100644
index 000000000..677d229ac
--- /dev/null
+++ b/tests/pgsql/pgsql-events/README.md
@@ -0,0 +1,11 @@
+# Test
+
+Showcase/ test PGSQL events.
+
+# Pcap
+
+Provided by Victor Julien.
+
+# Ticket
+
+https://redmine.openinfosecfoundation.org/issues/5566
diff --git a/tests/pgsql/pgsql-events/UnknownMessage.pcap b/tests/pgsql/pgsql-events/UnknownMessage.pcap
new file mode 100644
index 0000000000000000000000000000000000000000..a249b708b8e7c0085c6db645b561d9d28997576a
GIT binary patch
literal 865
zc-n2y%_{_P7zglYcE;Kk?ToCQ**M^WlrS4*V=r=0{sW3^j<U2%lr8(_s$Ar-4suaj
zqO6-pRt_u&h2r2MhxJxcyFAZto7GG+H7`y5K7GI6o8#S03kdLk3E;=){mJ#%xU~|z
z_)Yf!zGBNhP_5C~?eA!>y^Z&$gU+7A^sPvzl9sKB!U2FqDBBS%Hv4m?;gSAxJZ~rK
zP1IWeKIpS@-{g?z>`4ce%bHsBq-1p=F<8f}J+gAC{tNQZDkrO@*#Rm#YSB_-5teJg
zkV`_(6&9g&<`i>ql&NuyEHZ}B&~=M4BVcOC&^nze8RKN&F&q5CFIk~ZeV*()b!)FO
zbaSDnghehtU01YnDc?GIWK4M-;KB2rqT$JYFr&iMkhy%5R5CWm7=A!x4S4-9F;;5c
zP)b2areOm0TB)WEf?m;Bx-uAXX3QB3Su?uhnlW;w8AnDV!Hke;4hfA&$;fC%;ZAR4
zKTQXbwNcf5ZIHzd>O;ollfn36hTX()hb1omBbSUW%0fo%YMH*v3hNRybaA7j&>lZ8
KT9?sta{d70w+<-)

literal 0
Hc-jL100001

diff --git a/tests/pgsql/pgsql-events/suricata.yaml b/tests/pgsql/pgsql-events/suricata.yaml
new file mode 100644
index 000000000..e55017e86
--- /dev/null
+++ b/tests/pgsql/pgsql-events/suricata.yaml
@@ -0,0 +1,23 @@
+%YAML 1.1
+---
+
+outputs:
+   - eve-log:
+       enabled: yes
+       filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
+       filename: eve.json
+       types:
+         - pgsql:
+             enabled: yes
+         - alert
+         - flow
+         - stats
+
+app-layer:
+  protocols:
+    pgsql:
+      enabled: yes
+      # Stream reassembly size for PostgreSQL. By default, track it completely.
+      stream-depth: 0
+      # Maximum number of live PostgreSQL transactions per flow
+      # max-tx: 1024
diff --git a/tests/pgsql/pgsql-events/test.rules b/tests/pgsql/pgsql-events/test.rules
new file mode 100644
index 000000000..f78f18d55
--- /dev/null
+++ b/tests/pgsql/pgsql-events/test.rules
@@ -0,0 +1 @@
+alert pgsql any any -> any any (msg:"PGSQL unknown/ malformed message"; app-layer-event:pgsql.malformed_request; flow:to_server; sid:1;)
diff --git a/tests/pgsql/pgsql-events/test.yaml b/tests/pgsql/pgsql-events/test.yaml
new file mode 100644
index 000000000..fd4b1878e
--- /dev/null
+++ b/tests/pgsql/pgsql-events/test.yaml
@@ -0,0 +1,13 @@
+requires:
+    min-version: 8
+
+args:
+- -k none --set stream.midstream=true --set stream.inline=true
+
+checks:
+    - filter:
+        filename: eve.json
+        count: 1
+        match:
+            event_type: alert
+            alert.signature_id: 1
-- 
2.47.2