From 97bba40b363b1e7f70da84388696f8acd06df6f5 Mon Sep 17 00:00:00 2001 From: Jason Ish Date: Wed, 23 Dec 2020 16:56:20 -0600 Subject: [PATCH] smtp-md5: test md5 logging of smtp subject and body --- tests/smtp-md5/input.pcap | Bin 0 -> 27850 bytes tests/smtp-md5/suricata.yaml | 62 +++++++++++++++++++++++++++++++++++ tests/smtp-md5/test.yaml | 24 ++++++++++++++ 3 files changed, 86 insertions(+) create mode 100644 tests/smtp-md5/input.pcap create mode 100644 tests/smtp-md5/suricata.yaml create mode 100644 tests/smtp-md5/test.yaml diff --git a/tests/smtp-md5/input.pcap b/tests/smtp-md5/input.pcap new file mode 100644 index 0000000000000000000000000000000000000000..931b43b3b878dc559b7423df26363bfe75c6a512 GIT binary patch literal 27850 zc-rlK32-CVd1lY0gEnoBYvUa|O6d_2GvtU30tCS!F^31lL2`x%h6HD%v8G0i?gyYn zpd0RP5X3l9Bv-2JsHAM|QM+r)j;$!M;#`(CNmb&+iL!B};?=q$C$$$$IbZ;>*Rbb4e!k{&#K{gHuzeFx!l-Nr{ z>DpV~`rPAJ+o}BnP@4uq)4g~b9XU+AJ>S9G(?Id5+|c#wFTP2Vo&zdxzH~r(1qi&- zi>LoJ{5<8)!ZPd2`5en^ z>s2-to}OiQMA@=wjI&6bt*Q>2j6`NxB$|lC6Y(h~N8*tP8yrA_7dg{RW|$6B>Q33T z^sAgXWzOn0XJ!#z>Nc~Rw!^E;F_~j2hFvo)ht&<+tmrDRp^XbtOfj?x(_)2sWs`9k zjU_xdfJ+}U4oL5SRllQ`0HY(flK`LX7GQzrj$A+c#lw=6Sy)x_ZPHyBESZ*n~xWblJ=NDJpf%)WGKEJe1S8O4(2P>KDCF!Y= zJ4w=i)FJ6lz>;3e9eMo^f2J%+G@m;YQhe#_gVF*JTj(XA#PEwGpbvEj=ry4F$0#5b zB3Udp#V*{vQcQv=LO{bOkD83 zF`vDv#hK>3()=!^7}~!#u$sUB=|8m99>l$-87h8S5?k6u8BF` zbl&9s@)8+TSsZS6d{u^4&FLbOX^1!F^Z^zXPK1Qy^R?i7)bC11Ax(tLa_u_kXWQO?u zPwjl?-wqUKfbYiV*Cc5zmCLjIDsXKn_g~StS%IiHsT*gSO4&5QUj^%bhWXBbj2oJ6 zlvqP|$}AKPF|ZwlRdj>1LX+u^%_~JQ`_2DhKzjL*M4z22IrP^ftGJSH{B6fd=7EC; zazn32zwjRLZ_BJESZLm}9<~lMmqR<-Q{LQ7ZR_>I{aket3=`qtKw5ElLZrYz28>1% zvFSwQIJ+wnk3qm)7HgLm(?C8FiNqpNRhf#!$+*&Z}hNf7}Qz02XPF-2y z+fELixB@fc=hT%*G?ko+&qczK+4%HqEE@?84%{s-Lk8s*tU^~U(>99^TP+rKm9y2l zQ!&j=7M;ZT^JR-Gn!IRed^-U~SId@ob#`v+{`)Uw(tIs?t~{gPRo-Y`Fe6EfG#Jy-Oxo!^*Y|E-8mleCrwOak^)e78M=gCtnnOvJ>$+WV-=4$#XOHIv3Svp#} z$g(SQQI^eZuCc6f*G0CFP372vanD(HcJ;W;&ef~a>|E2i$dp_b;# z$$2w*cVlidIlqxCH0JDNdNH}2Og8Yla(=F!%p{ZiJU&;#`&-G>RPrA8JKcwMoLD#Q zvJ$YQrd3s(Fg`BJH*8Hi+o)23 z5MV%}*y6ibY7}Y5ds^xa-0U=>lN$$yOw=lhZXgS4S+Q*HoC?)#S+P}J4+Wk_^jYMV zoH0}rgH?hZFX#@=Pe==2F#NK}Y=~y8&g`mFV>J~bOc8vE?qzkjg9uk~97Qcxfv`Vr zKDYk=XE|l3TKQ+J=3R9Y@`YTpbi+{!6^^W&L|SaSS~2Xz)~Q%JRJV+Tt(JLJvE`~4 z8f1W*iLGiS#LxukVYC0kCdCr>TVPmYhhZ4`C;LbK97X`gF>V5UaB3ntIbl|VD-MiqG#cSXENoh(iTv8cS|%l< z6sIDg(?X;WFyYn7k_B0DppB15)ly<#Fbny9S5u@44xRRIe3G(w4rECL?Iam-fKyLSPzYd zY;ZT(=9XRzA)iVDu+8Q;vtdOz^#Ul|!nbI4+muNK=!;MkJI%!GEIG7UF|9O)O?*CnwrSo$h7>S#x6>yeybnlT`ra0g=p#ys?gG zeiJUxeA$+JA?!P6USQLd zt???{V<~_$ghm68D|JYC5bjkbp2wR>O@ljjU;${OAsx$k%-$ik$(snR@ZpQRuu+3Z z!kJw*>lKX|W`kLrhU$jxD3yxn6TyU_ovO`>P@J=zqHcm{y=CD#>@u@ei*ti`1`{?_ zT@2L$;Ixb0rOd5fD(V#8@!pG?Po>yt77I_}?KDRMTM7Ug;1Y@?i@PhaQHomK!rp}e zR?0Mb)P~9lrXUe04uDCGUGPU^yBiV;WKs*FoWN%=(j&UbYeF$~lAOjGWmq+!KHb3r z&2Zak9@7SISQz;|7Y$Vp&UT@_#nSFeD~ zxvB%)WmRwtY{QJ|v6<;{rccq=IDSQ*rtw7$JAU=5|3a=-xBUxHivN1je--mzO^v&3 zGPVh{HmBuD`WnN?f3bh$U!%zXjrPdTRWI^?^| zN_w9C_Xq&q08@oi3c+0NPt06$zdO@!MD#ZPlDg@PHlkRLOn8jhGitiSl8^B7)2}*b| zYU!mi*my-(H$_jcf&S1MgkrRL1sx%@Ea(&M5UoBfNT&IgoVx2SmennYlzF`h;cC?= z>ZQ5>qfB7KaTLF0GgUFjlhm>aI1?EvaHoN>qfWvA0ih34CS(Q6Y``d?PmG`FOchRK zi(GN);N;;O2_#c}Whd;Q3DbZE)k+;E(scBH(`x!rl;+3!uEl~1?uRj*72vkTDIh40 zFOeci1j3!=)N5@)uyZX$s68e(^h$*Ug~n5djA1s6imBiVfPPNdw9(q!sqV#~Og4oI z_E;Y$xp~~Q0t^n+_?B9$h2hQcTrzcTBS*%kmrxcQ!y5~D16nGiTnF`6(QSvC!DYlt zm`LGj7t4*|{Z*qwFbZ?TJ+4+926TdTGh_zzW)g!mPSsps3t{;|+yN>_@wa zAi*}k4b-{~*&L?d3p%;V9@9gp0BRxq*}{O9yO$ZGPdMAz8)9f9|mXX=T4epB=jl&+I>wd7C7?V_!*r z=9k2YfddCW4JiN6=e#|D2X6Z2j(Y&Ne|>Kc;D>n+0IlmiU|r7xrg**=uK3)@I^l|M z?_@#ii9HM2+eO;jMcUg%+S^6?*RYF(5r6(eeeuNG2~Ui-@Wi1{`gkHocw)z$r7!&S z-pS=U`H>$-#c)^(n&Ysc<&^Xa|r^$&CR8m%kwcwg(fjjZcf z%ep>u*0-)TvaTIFWXE3H>yZ60cgX%6tm_-^-`DR%^DA_o?_(Y3`5u4_cr7;+y5$q! z!C{|yRlXf*z3~J4`qfo=s;jPbWYTM%HNNn=B=t`5dl_}_tj6A1jlHuPduKI%kj`pg z#Q*XB5r2as{pIZtlRYj__V~Mw>h+wLJsx^5RIfXn9@(pE z_s)Ino%`53_px{G;|J&52S)tqyZT1_i@kn+^ZxI85&!SMElInb9tojxt7xC}^P|3j zjnV3sOsL&J*}f*i-KrqGco9=MxgOG0PzmG0TU~bq8$q}Qg)o8(5R+q*S>Q9Ud{-Ax zhZlhjjX@z+gR;(dq3&r(FR3!rVeq&Ic#+pm%nsAc;4(Q$!G z*SKxgEfstZvq=y;A=VI>ohPPr!8v5ULPj_(rBAu$aSQ0x8D&@Qr`?#8KJI%?&Tjy&Q;ARTjQoOX4xrlpHu zJ?f6Z4qCw`hAjjqs5yHqXlo!D2W6dV%ZxQ$r7Xy(r(+WmpjG0mD77U#z<~e;yC=J> zIljyNsg}!;vHL#^-og}ivsy4KHl`lPIF6+-&F>o`6siI9uoz$ne^*GEfV1a02_~nn zTuEoOx zyGYCvpBUxUMnJXh55b6k@!`Jp!Z)a1c(S`*;OBBfGr#>`U&CQPcK6{gA}#)K-|TUB zub%;}Jwe&y$m>ygNRn8Htek^9u=*}2B(y9Zbbt(ai`M4W5lXb_G)e53?{{al5;+b7S#pEvcDSL%z$X2wK`P}J`ac`_lfrn=w9lTj`@qquEzPWpAT;~mrS zspC^qW8E_ZDhi)^+j~LEK3SNe2jvxxD_5W@*;oW?$HdSJU9{}o?OC~HFFoTmp91sAIwTO$Z1fOg2=l2@ouBQP2t2 zU9d6M2CBqF7}OoFpaV~|z(r9g;;tb)N_abQ73vVlL>3Z0#0E$?svcuT4Q!*LoW z1zt;@{KjXFs=Ay?Wtee<4X-{X#LZ2WCU= zjt+Cxgn|vRQ8!akXE;#JOr+p;hby`pHV6WQ7Y5Bb%oas2&}$bGg46V3ky~z|B;Yxe zNK|=(|M-rC7D7!0ALA8ZBEm(GYPmt$355j%p)r_?s#v%}dSy&L@Y)JwYDBQ93+o=_ z9>@Fa=uxPtHj%?dxha0@S{d>V*gFs_D>X3sa5&t`1K9KS@HFZ^U_ZeJI`1uF$&C)u z(F$!5D`H)P36`R?OACbn(QcOz9?aW4!?@>1E^HI(8V$OO1p#480i9gPtgSDut}L!( zS6$!njD?(qFd+)qa$S2YxKD6*j^)d+OuL;p_Uug~CB$yC>2L(>(9nyxpFnFs`^PS= zSeH$((x2Czw0%b5PN>aL#RPwLlPkPNYw(=V4lW+vP)csss|5>0-esfI^`YRY6vl#W z4#d=!VjBX70#jfbez7J-i@MXriSUgr=>-b{Td;xIBbV$LZ>B{_8nhXkD;A)3AmmrI zw%!=4uu|7dZ!Slg1Zmg4RC}@WSlfevIArpHb;Bhdq*G+75UT?6? zxMJ&2tB&$;Da=Z$Do=)I<0NUkh=nJENZO6!AZY6Bf(}u()ZC#6E0U92|5r`q19CDT z4cFo^Y~Yp^b1j#^oNEmV4TO8tdTAFb72?5Qm|j|9;NcbTH@1~cYQl{ReCnGBE7n<&jKlu$+E@r_rGZwT>~X2r&yT*_KiPZhHA!mQIy;(39CaB7DPxR5 zL?F)YPz=&U0UZ=?n;a-1D&Ligew9i>R4}-;+0kQ`t$IMgnz`L9aYLMGApwwTfopIGDmcgS)iRk* z*0%u>^8Fj$z9WRxtBR!sFcbPbc6eY>6V%+c9i>X;KL(PC9C7Jjr_Qtr~(;qodt^yVY{v;Bp8KQ zahid`iXFx+0E<#N)N5p0E{vhu7$e*|uGQUj$2Yu?Lk&-c?rT%W9XInJ*@p2a-c&B& zB6UD*zw4&B`=M3r(Ynp#QKjOP&3dVfu*N-NP~aphYH{Gs=QwL{ukBURx7>yqk`&t! zSh|SCqbc|c0tTo+$B2KWf5d+$Mf_LWBmP5AdJ*5)kR*$Tcat>2i?)C>=I*t0gdxNS zxVsd_C0yhcz}v8Ruz#C&ooIb#=cq6Qnwo19rWf^biwY0Hje9BIZR>%E0kK1kkJ$id zS4^YiZrtGJpj@wwQ_Xm!P&=K)8a0irV+W22QAB?aim=WeCD$R zQ74&O9LADIObhv@u|3h)?s^*c4T?ywu`NQCJd3Y(p{^I)S# zsiI>jio0OvCls)dcGN?#Q&csid?*6z*qs(Tx{8Pj1#^2`;60&hm=B9%+*rc$0rMh6 z#$s_y=nzpjpeKlrBpn4U-_lxTi^~f*Qliy1P`z%aZKCaIx@H_j<{iJDsatr&lUC0# ztqV0!$e^t&;b5LdgR4B+-t~3MOKcxsz#d8!E9s85jfNdfly0hGs+-K-qzz98IOSTX zRS`B63)8`HYcPe9b{RvkhqNjRChBgQRW6W_TfJ(gsFl$TX{3vC!rj4@64M6pzmgxv zpOB_g9n6^X^vI~sk7Am89n6m^+CGJg|stf&a2CrFk zFGgxC`tMybRfVk9zm*J3o`%WCx)%^@frZRA{_0I+SWslUIl0>R@QtTPB?W^wyE3#|yUY0?qN*yC* zO92c*kP($cr*1^I(%){@|LFx4R|1zcCsy{W_yLsmTtQ36_C8wRid3G zV8fujTJd|DabE>je4>YyMmvjd>cA0(&CnU}2`_GeA1&mUmqLEU6znhL^_thp)D)-= z#0ku>zwzN6k5E{k_lnZw+cl6K;z`ZKIB3_DhCvdigNT4M%8st4;@ z?`n)3JJs?(FlK6;az~s}Xy?6XwnWg0s6rXhOE8UzoPU@hBn&A;J*eROy&NV2QiU%C z{5hKVSb{jqZFsea`&&lDjv64A8p@l*oHx@ZquPbgI)pJliuv6Rf&p~`nWCLUX{c2p zdp3&PiaqnW*7p56o+Nh<-T1HxD9xwmgqq#`m_U2YYp1)%i0C|=?m9<-mlbfmy5$+X ztcvp=%s(=!vXg;K(@IR#L|<37Ty42L*-gVywp(XNSjjTQ8M0j9$N@f&n?N|W)#4(2 zh>dZ-L%qXMjCO5Jg`)v&!4>L@$~8r7tCUogVYf_VF%WN2Y&HgpPV`aX4HGr*L>hr8 zSiz{fJv!ELz{h82hx6m!vP=DL=ZxK9z+Zef_OV9AtjgH}tMr>aTFv*R~J6h_v2b>`Ut!(R#d_)_d1; zLqG8+lV8AL-+Ja18EKvTR9{-(CR!iqruE46+|c{j@SowZg_lYnMOt6`bYEJ3PqaSV zP3zIyh}Li6u)%--=+7ao&p&%WT7&DgUbND~-yvG>=}GIz``ANY^8Tg-)3sC4WvGNr z8Gm6*x+HHHg9A9j8(u!t?~nc5N5=Rc+l}$j+hCRt0Q~roUwJ~3z5rC7e)0|d{@4R2 zD(~w_<;d$lasce@{KjH_Z~$q2P4`*QSuiKE9lIC>T- zku@qf?AVznmA}Lvwf&g^=^9*Lqd((?AJYDJys8`~j$WMpN&ItNuWCT&-@xZ}>0$Wy z*%Lo{c>jZ6#`oarcO{8sRx)R^nbb-;oynx<)7f-3Gnbi5C(~y$@R3SNEW41&WmB1@ z%mRGPWwY62D)4V^MY_JeJU1fk{Bc;4hW(4bIpDn-mM%yK=nseOmnNlq@$b5 + smtp.rcpt_to[0]: + email.subject_md5: "c2239a92bde29f0a9f9173193cc2fe00" + email.body_md5: "199a623779019799f24fcf61204c55a8" + + + # Check the stats. A stats check is a specialization of a filter + # that only checks the last stats entry. + - stats: + decoder.pkts: 60 + decoder.bytes: 26866 + decoder.invalid: 0 -- 2.47.2