From 486e4b6218e8681fccd366e812142f738434cff9 Mon Sep 17 00:00:00 2001
From: Jason Ish <jason.ish@oisf.net>
Date: Tue, 4 Oct 2022 16:02:31 -0600
Subject: [PATCH] tests: add tests for real bittorrent-dht traffic

---
 tests/bittorrent-dht/input.pcap | Bin 0 -> 2180 bytes
 tests/bittorrent-dht/test.yaml  | 297 ++++++++++++++++++++++++++++++++
 2 files changed, 297 insertions(+)
 create mode 100644 tests/bittorrent-dht/input.pcap
 create mode 100644 tests/bittorrent-dht/test.yaml

diff --git a/tests/bittorrent-dht/input.pcap b/tests/bittorrent-dht/input.pcap
new file mode 100644
index 0000000000000000000000000000000000000000..d805f988a54013ea59f7a29c3e28e1b16a5cfbc1
GIT binary patch
literal 2180
zc-p;{-)qxA9Kg@&!}%aG1RsV%{Rc{uc3FGARAKmwZAIo_j#1O(+Ga~H?KPRJPNX10
zALd|F(77QK5oEIAbRy^!wtqm-xBUb9BKqQs;JkFVE$L1>9WGGXCJmp@_tS9qae00^
z0QQ0PV|5jPJ?#Bv_TZ((YY?Q_=XCA7djw8CZ2|!Z+5qTsf0k(adHXH9fxQBgiRC0n
zRERDiRhN;W%VDIZH63TNIio);$&qM_(i)3n2^FKLV34eYY#FJlgv#s`c8U9|5cDuw
zkBE4V6Q^97OI=P*CP3?<E=Hv5#5}PIMOw0*!OKJCD{D~f1<@KPeQO(|jq}m=b_AU;
zNF1Hr$!KTBAn0SXJ`u5#6Ysh-m+FK&g5dbV0wZG6ki!y|Bj`l%6egG&TCj~$iv~M2
zhf=Kj#=|w(=Q|LLGSH|9R^hOWZ@j$nrqOr`vQ?VJ_U|(n<0xYgJw+^!)nF7|=n6}o
z7Lf@EY^G+5^fFwp;%jk!soDECZ%S>7wjdW<iX--&T?>UmVu!US;Oi6wV~js0a=5`A
zG+&~^t1pcb#gRcWRw}2Ka(}GEDy9k;(^8$G?5Xr=8iEmKHzG2;&JA<EN(0&>ZzYjo
z3$m>NOkzm2uu~#-PC<jJ>EM#7Aa$r8ha837oU=(D*X5IBPd@W81XU(h70F%Ya;7g|
z_J#WY@@-W6@dSclCN(S)BV4TPt9J3>;l|bKpRFw&1*^=lSqNsB$Bf8jio2ZkMXKIA
zvhzr64YH_hD6yD?MV>_|f>c5*hiJIgacjos&$h7=Px>;p&W-=WO1$zCf<*>d6oKYA
zDCTQ)znpK>NMhIW1=GNKs+K~+yHc(B^)6LA@D74r2I&=n+Bs;#S1tbS``_$e8#B!>
qLD0=G-6GU!j(XsmDf<4y`o<N(l7iY*Gh@*_)`Lk^8^Ctmj`a&2Orwkd

literal 0
Hc-jL100001

diff --git a/tests/bittorrent-dht/test.yaml b/tests/bittorrent-dht/test.yaml
new file mode 100644
index 000000000..fc9abaf7e
--- /dev/null
+++ b/tests/bittorrent-dht/test.yaml
@@ -0,0 +1,297 @@
+requires:
+  min-version: 7
+
+args:
+- -k none
+
+checks:
+- filter:
+    count: 1
+    match:
+      bittorrent_dht.request.id: 6162636465666768696a30313233343536373839
+      bittorrent_dht.request_type: ping
+      bittorrent_dht.transaction_id: '6161'
+      dest_ip: 190.0.0.3
+      dest_port: 30000
+      event_type: bittorrent_dht
+      pcap_cnt: 3
+      pkt_src: wire/pcap
+      proto: UDP
+      src_ip: 190.0.0.1
+      src_port: 20000
+- filter:
+    count: 1
+    match:
+      bittorrent_dht.request.id: 6162636465666768696a30313233343536373839
+      bittorrent_dht.request_type: ping
+      bittorrent_dht.transaction_id: '6161'
+      dest_ip: 190.0.0.2
+      dest_port: 50000
+      event_type: bittorrent_dht
+      pcap_cnt: 1
+      pkt_src: wire/pcap
+      proto: UDP
+      src_ip: 190.0.0.1
+      src_port: 40000
+- filter:
+    count: 1
+    match:
+      bittorrent_dht.error.msg: A Generic Error Ocurred
+      bittorrent_dht.error.num: 201
+      bittorrent_dht.transaction_id: '6161'
+      dest_ip: 190.0.0.1
+      dest_port: 20000
+      event_type: bittorrent_dht
+      pcap_cnt: 4
+      pkt_src: wire/pcap
+      proto: UDP
+      src_ip: 190.0.0.3
+      src_port: 30000
+- filter:
+    count: 1
+    match:
+      bittorrent_dht.response.id: 6d6e6f707172737475767778797a313233343536
+      bittorrent_dht.transaction_id: '6161'
+      dest_ip: 190.0.0.1
+      dest_port: 40000
+      event_type: bittorrent_dht
+      pcap_cnt: 2
+      pkt_src: wire/pcap
+      proto: UDP
+      src_ip: 190.0.0.2
+      src_port: 50000
+- filter:
+    count: 1
+    match:
+      bittorrent_dht.client_version: '55543031'
+      bittorrent_dht.request.id: 6162636465666768696a30313233343536373839
+      bittorrent_dht.request.target: 6d6e6f707172737475767778797a313233343536
+      bittorrent_dht.request_type: find_node
+      bittorrent_dht.transaction_id: '6161'
+      dest_ip: 190.0.0.3
+      dest_port: 30000
+      event_type: bittorrent_dht
+      pcap_cnt: 5
+      pkt_src: wire/pcap
+      proto: UDP
+      src_ip: 190.0.0.1
+      src_port: 20000
+- filter:
+    count: 1
+    match:
+      bittorrent_dht.client_version: '55543031'
+      bittorrent_dht.response.id: 303132333435363738396162636465666768696a
+      bittorrent_dht.transaction_id: '6161'
+      dest_ip: 190.0.0.1
+      dest_port: 20000
+      event_type: bittorrent_dht
+      pcap_cnt: 6
+      pkt_src: wire/pcap
+      proto: UDP
+      src_ip: 190.0.0.3
+      src_port: 30000
+- filter:
+    count: 1
+    match:
+      bittorrent_dht.client_version: '55543032'
+      bittorrent_dht.request.id: 6162636465666768696a30313233343536373839
+      bittorrent_dht.request.info_hash: 6d6e6f707172737475767778797a313233343536
+      bittorrent_dht.request_type: get_peers
+      bittorrent_dht.transaction_id: '6161'
+      dest_ip: 190.0.0.3
+      dest_port: 30000
+      event_type: bittorrent_dht
+      pcap_cnt: 7
+      pkt_src: wire/pcap
+      proto: UDP
+      src_ip: 190.0.0.1
+      src_port: 20000
+- filter:
+    count: 1
+    match:
+      bittorrent_dht.client_version: '55543132'
+      bittorrent_dht.response.id: 6162636465666768696a30313233343536373839
+      bittorrent_dht.response.token: 616f6575736e7468
+      bittorrent_dht.response.values[0].ip: 97.120.106.101
+      bittorrent_dht.response.values[0].port: 11893
+      bittorrent_dht.response.values[1].ip: 105.100.104.116
+      bittorrent_dht.response.values[1].port: 28269
+      bittorrent_dht.transaction_id: '6161'
+      dest_ip: 190.0.0.1
+      dest_port: 20000
+      event_type: bittorrent_dht
+      pcap_cnt: 8
+      pkt_src: wire/pcap
+      proto: UDP
+      src_ip: 190.0.0.3
+      src_port: 30000
+- filter:
+    count: 1
+    match:
+      bittorrent_dht.request.id: 6162636465666768696a30313233343536373839
+      bittorrent_dht.request.info_hash: 6d6e6f707172737475767778797a313233343536
+      bittorrent_dht.request_type: get_peers
+      bittorrent_dht.transaction_id: '6161'
+      dest_ip: 190.0.0.3
+      dest_port: 30000
+      event_type: bittorrent_dht
+      pcap_cnt: 9
+      pkt_src: wire/pcap
+      proto: UDP
+      src_ip: 190.0.0.1
+      src_port: 20000
+- filter:
+    count: 1
+    match:
+      bittorrent_dht.response.id: 6162636465666768696a30313233343536373839
+      bittorrent_dht.response.token: 616f6575736e7468
+      bittorrent_dht.transaction_id: '6161'
+      dest_ip: 190.0.0.1
+      dest_port: 20000
+      event_type: bittorrent_dht
+      pcap_cnt: 10
+      pkt_src: wire/pcap
+      proto: UDP
+      src_ip: 190.0.0.3
+      src_port: 30000
+- filter:
+    count: 1
+    match:
+      bittorrent_dht.request.id: 6162636465666768696a30313233343536373839
+      bittorrent_dht.request.info_hash: 6d6e6f707172737475767778797a313233343536
+      bittorrent_dht.request.port: 6881
+      bittorrent_dht.request.token: 616f6575736e7468
+      bittorrent_dht.request_type: announce_peer
+      bittorrent_dht.transaction_id: '6161'
+      dest_ip: 190.0.0.3
+      dest_port: 30000
+      event_type: bittorrent_dht
+      pcap_cnt: 11
+      pkt_src: wire/pcap
+      proto: UDP
+      src_ip: 190.0.0.1
+      src_port: 20000
+- filter:
+    count: 1
+    match:
+      bittorrent_dht.response.id: 6d6e6f707172737475767778797a313233343536
+      bittorrent_dht.transaction_id: '6161'
+      dest_ip: 190.0.0.1
+      dest_port: 20000
+      event_type: bittorrent_dht
+      pcap_cnt: 12
+      pkt_src: wire/pcap
+      proto: UDP
+      src_ip: 190.0.0.3
+      src_port: 30000
+- filter:
+    count: 1
+    match:
+      bittorrent_dht.request.id: 6162636465666768696a30313233343536373839
+      bittorrent_dht.request.implied_port: 1
+      bittorrent_dht.request.info_hash: 6d6e6f707172737475767778797a313233343536
+      bittorrent_dht.request.port: 6881
+      bittorrent_dht.request.token: 616f6575736e7468
+      bittorrent_dht.request_type: announce_peer
+      bittorrent_dht.transaction_id: '6161'
+      dest_ip: 190.0.0.3
+      dest_port: 30000
+      event_type: bittorrent_dht
+      pcap_cnt: 13
+      pkt_src: wire/pcap
+      proto: UDP
+      src_ip: 190.0.0.1
+      src_port: 20000
+- filter:
+    count: 1
+    match:
+      bittorrent_dht.response.id: 6d6e6f707172737475767778797a313233343536
+      bittorrent_dht.transaction_id: '6161'
+      dest_ip: 190.0.0.1
+      dest_port: 20000
+      event_type: bittorrent_dht
+      pcap_cnt: 14
+      pkt_src: wire/pcap
+      proto: UDP
+      src_ip: 190.0.0.3
+      src_port: 30000
+- filter:
+    count: 1
+    match:
+      anomaly.app_proto: bittorrent-dht
+      anomaly.event: malformed_packet
+      anomaly.layer: proto_parser
+      anomaly.type: applayer
+      dest_ip: 190.0.0.3
+      dest_port: 30000
+      event_type: anomaly
+      pcap_cnt: 15
+      pkt_src: wire/pcap
+      proto: UDP
+      src_ip: 190.0.0.1
+      src_port: 20000
+      tx_id: 12
+- filter:
+    count: 1
+    match:
+      bittorrent_dht.request.id: 6162636465666768696a30313233343536373839
+      bittorrent_dht.request_type: ping
+      bittorrent_dht.transaction_id: ''
+      dest_ip: 190.0.0.3
+      dest_port: 30000
+      event_type: bittorrent_dht
+      pcap_cnt: 15
+      pkt_src: wire/pcap
+      proto: UDP
+      src_ip: 190.0.0.1
+      src_port: 20000
+- filter:
+    count: 1
+    match:
+      bittorrent_dht.error.msg: Malformed Packet
+      bittorrent_dht.error.num: 203
+      bittorrent_dht.transaction_id: '6161'
+      dest_ip: 190.0.0.1
+      dest_port: 20000
+      event_type: bittorrent_dht
+      pcap_cnt: 16
+      pkt_src: wire/pcap
+      proto: UDP
+      src_ip: 190.0.0.3
+      src_port: 30000
+- filter:
+    count: 1
+    match:
+      app_proto: bittorrent-dht
+      dest_ip: 190.0.0.3
+      dest_port: 30000
+      event_type: flow
+      flow.age: 0
+      flow.alerted: false
+      flow.bytes_toclient: 738
+      flow.bytes_toserver: 975
+      flow.pkts_toclient: 7
+      flow.pkts_toserver: 7
+      flow.reason: shutdown
+      flow.state: established
+      proto: UDP
+      src_ip: 190.0.0.1
+      src_port: 20000
+- filter:
+    count: 1
+    match:
+      app_proto: bittorrent-dht
+      dest_ip: 190.0.0.2
+      dest_port: 50000
+      event_type: flow
+      flow.age: 0
+      flow.alerted: false
+      flow.bytes_toclient: 89
+      flow.bytes_toserver: 98
+      flow.pkts_toclient: 1
+      flow.pkts_toserver: 1
+      flow.reason: shutdown
+      flow.state: established
+      proto: UDP
+      src_ip: 190.0.0.1
+      src_port: 40000
-- 
2.47.2