mime: add previous suricata unit tests

OISF · Sep 4, 2023 · c68f201 · c68f201
1 parent e338b7b
commit c68f201
Show file tree

Hide file tree

Showing 30 changed files with 926 additions and 0 deletions.
diff --git a/tests/mime/mime-dec-parse-full-msg-test01/README.md b/tests/mime/mime-dec-parse-full-msg-test01/README.md
@@ -0,0 +1,11 @@
+# Test Description
+
+Test some mimre processing
+
+## PCAP
+
+Previous unit test for MIME in Suricata
+
+## Related issues
+
+https://redmine.openinfosecfoundation.org/issues/3487
diff --git a/tests/mime/mime-dec-parse-full-msg-test01/input.pcap b/tests/mime/mime-dec-parse-full-msg-test01/input.pcap
diff --git a/tests/mime/mime-dec-parse-full-msg-test01/test.yaml b/tests/mime/mime-dec-parse-full-msg-test01/test.yaml
@@ -0,0 +1,75 @@
+# *** Add configuration here ***
+
+args:
+- -k none
+
+checks:
+- filter:
+    count: 1
+    match:
+      anomaly.app_proto: smtp
+      anomaly.event: APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION
+      anomaly.layer: proto_detect
+      anomaly.type: applayer
+      dest_ip: 127.0.0.1
+      dest_port: 39202
+      event_type: anomaly
+      pcap_cnt: 6
+      proto: TCP
+      src_ip: 127.0.0.1
+      src_port: 25
+- filter:
+    count: 1
+    match:
+      dest_ip: 127.0.0.1
+      dest_port: 25
+      email.from: toto <[email protected]>
+      email.status: PARSE_DONE
+      email.to[0]: 172.16.92.2@linuxbox
+      event_type: smtp
+      pcap_cnt: 14
+      proto: TCP
+      smtp.helo: linuxbox
+      smtp.mail_from: <[email protected]>
+      smtp.rcpt_to[0]: <172.16.92.2@linuxbox>
+      src_ip: 127.0.0.1
+      src_port: 39202
+      tx_id: 0
+- filter:
+    count: 1
+    match:
+      dest_ip: 127.0.0.1
+      dest_port: 25
+      event_type: smtp
+      proto: TCP
+      smtp.helo: linuxbox
+      src_ip: 127.0.0.1
+      src_port: 39202
+      tx_id: 1
+- filter:
+    count: 1
+    match:
+      app_proto: smtp
+      app_proto_tc: failed
+      dest_ip: 127.0.0.1
+      dest_port: 25
+      event_type: flow
+      flow.age: 0
+      flow.alerted: false
+      flow.bytes_toclient: 473
+      flow.bytes_toserver: 932
+      flow.pkts_toclient: 8
+      flow.pkts_toserver: 8
+      flow.reason: shutdown
+      flow.state: established
+      proto: TCP
+      src_ip: 127.0.0.1
+      src_port: 39202
+      tcp.ack: true
+      tcp.state: established
+      tcp.syn: true
+      tcp.tc_max_regions: 1
+      tcp.tcp_flags: '12'
+      tcp.tcp_flags_tc: '12'
+      tcp.tcp_flags_ts: '12'
+      tcp.ts_max_regions: 1
diff --git a/tests/mime/mime-dec-parse-full-msg-test02/README.md b/tests/mime/mime-dec-parse-full-msg-test02/README.md
@@ -0,0 +1,11 @@
+# Test Description
+
+Test some mimre processing
+
+## PCAP
+
+Previous unit test for MIME in Suricata
+
+## Related issues
+
+https://redmine.openinfosecfoundation.org/issues/3487
diff --git a/tests/mime/mime-dec-parse-full-msg-test02/input.pcap b/tests/mime/mime-dec-parse-full-msg-test02/input.pcap
diff --git a/tests/mime/mime-dec-parse-full-msg-test02/test.yaml b/tests/mime/mime-dec-parse-full-msg-test02/test.yaml
@@ -0,0 +1,75 @@
+# *** Add configuration here ***
+
+args:
+- -k none
+
+checks:
+- filter:
+    count: 1
+    match:
+      anomaly.app_proto: smtp
+      anomaly.event: APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION
+      anomaly.layer: proto_detect
+      anomaly.type: applayer
+      dest_ip: 127.0.0.1
+      dest_port: 39202
+      event_type: anomaly
+      pcap_cnt: 6
+      proto: TCP
+      src_ip: 127.0.0.1
+      src_port: 25
+- filter:
+    count: 1
+    match:
+      dest_ip: 127.0.0.1
+      dest_port: 25
+      email.from: toto <[email protected]>
+      email.status: PARSE_DONE
+      email.to[0]: 172.16.92.2@linuxbox
+      event_type: smtp
+      pcap_cnt: 14
+      proto: TCP
+      smtp.helo: linuxbox
+      smtp.mail_from: <[email protected]>
+      smtp.rcpt_to[0]: <172.16.92.2@linuxbox>
+      src_ip: 127.0.0.1
+      src_port: 39202
+      tx_id: 0
+- filter:
+    count: 1
+    match:
+      dest_ip: 127.0.0.1
+      dest_port: 25
+      event_type: smtp
+      proto: TCP
+      smtp.helo: linuxbox
+      src_ip: 127.0.0.1
+      src_port: 39202
+      tx_id: 1
+- filter:
+    count: 1
+    match:
+      app_proto: smtp
+      app_proto_tc: failed
+      dest_ip: 127.0.0.1
+      dest_port: 25
+      event_type: flow
+      flow.age: 0
+      flow.alerted: false
+      flow.bytes_toclient: 473
+      flow.bytes_toserver: 951
+      flow.pkts_toclient: 8
+      flow.pkts_toserver: 8
+      flow.reason: shutdown
+      flow.state: established
+      proto: TCP
+      src_ip: 127.0.0.1
+      src_port: 39202
+      tcp.ack: true
+      tcp.state: established
+      tcp.syn: true
+      tcp.tc_max_regions: 1
+      tcp.tcp_flags: '12'
+      tcp.tcp_flags_tc: '12'
+      tcp.tcp_flags_ts: '12'
+      tcp.ts_max_regions: 1
diff --git a/tests/mime/mime-dec-parse-line-test01/README.md b/tests/mime/mime-dec-parse-line-test01/README.md
@@ -0,0 +1,11 @@
+# Test Description
+
+Test some mimre processing
+
+## PCAP
+
+Previous unit test for MIME in Suricata
+
+## Related issues
+
+https://redmine.openinfosecfoundation.org/issues/3487
diff --git a/tests/mime/mime-dec-parse-line-test01/input.pcap b/tests/mime/mime-dec-parse-line-test01/input.pcap
diff --git a/tests/mime/mime-dec-parse-line-test01/test.yaml b/tests/mime/mime-dec-parse-line-test01/test.yaml
@@ -0,0 +1,75 @@
+# *** Add configuration here ***
+
+args:
+- -k none
+
+checks:
+- filter:
+    count: 1
+    match:
+      anomaly.app_proto: smtp
+      anomaly.event: APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION
+      anomaly.layer: proto_detect
+      anomaly.type: applayer
+      dest_ip: 127.0.0.1
+      dest_port: 39202
+      event_type: anomaly
+      pcap_cnt: 6
+      proto: TCP
+      src_ip: 127.0.0.1
+      src_port: 25
+- filter:
+    count: 1
+    match:
+      dest_ip: 127.0.0.1
+      dest_port: 25
+      email.from: toto <[email protected]>
+      email.status: PARSE_DONE
+      email.to[0]: 172.16.92.2@linuxbox
+      event_type: smtp
+      pcap_cnt: 14
+      proto: TCP
+      smtp.helo: linuxbox
+      smtp.mail_from: <[email protected]>
+      smtp.rcpt_to[0]: <172.16.92.2@linuxbox>
+      src_ip: 127.0.0.1
+      src_port: 39202
+      tx_id: 0
+- filter:
+    count: 1
+    match:
+      dest_ip: 127.0.0.1
+      dest_port: 25
+      event_type: smtp
+      proto: TCP
+      smtp.helo: linuxbox
+      src_ip: 127.0.0.1
+      src_port: 39202
+      tx_id: 1
+- filter:
+    count: 1
+    match:
+      app_proto: smtp
+      app_proto_tc: failed
+      dest_ip: 127.0.0.1
+      dest_port: 25
+      event_type: flow
+      flow.age: 0
+      flow.alerted: false
+      flow.bytes_toclient: 473
+      flow.bytes_toserver: 983
+      flow.pkts_toclient: 8
+      flow.pkts_toserver: 8
+      flow.reason: shutdown
+      flow.state: established
+      proto: TCP
+      src_ip: 127.0.0.1
+      src_port: 39202
+      tcp.ack: true
+      tcp.state: established
+      tcp.syn: true
+      tcp.tc_max_regions: 1
+      tcp.tcp_flags: '12'
+      tcp.tcp_flags_tc: '12'
+      tcp.tcp_flags_ts: '12'
+      tcp.ts_max_regions: 1
diff --git a/tests/mime/mime-dec-parse-line-test02/README.md b/tests/mime/mime-dec-parse-line-test02/README.md
@@ -0,0 +1,11 @@
+# Test Description
+
+Test some mimre processing
+
+## PCAP
+
+Previous unit test for MIME in Suricata
+
+## Related issues
+
+https://redmine.openinfosecfoundation.org/issues/3487
diff --git a/tests/mime/mime-dec-parse-line-test02/input.pcap b/tests/mime/mime-dec-parse-line-test02/input.pcap
diff --git a/tests/mime/mime-dec-parse-line-test02/test.yaml b/tests/mime/mime-dec-parse-line-test02/test.yaml
@@ -0,0 +1,76 @@
+# *** Add configuration here ***
+
+args:
+- -k none
+
+checks:
+- filter:
+    count: 1
+    match:
+      anomaly.app_proto: smtp
+      anomaly.event: APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION
+      anomaly.layer: proto_detect
+      anomaly.type: applayer
+      dest_ip: 127.0.0.1
+      dest_port: 39202
+      event_type: anomaly
+      pcap_cnt: 6
+      proto: TCP
+      src_ip: 127.0.0.1
+      src_port: 25
+- filter:
+    count: 1
+    match:
+      dest_ip: 127.0.0.1
+      dest_port: 25
+      email.from: toto <[email protected]>
+      email.status: PARSE_DONE
+      email.to[0]: 172.16.92.2@linuxbox
+      email.url[0]: www.test.com/malware.exe?hahah
+      event_type: smtp
+      pcap_cnt: 14
+      proto: TCP
+      smtp.helo: linuxbox
+      smtp.mail_from: <[email protected]>
+      smtp.rcpt_to[0]: <172.16.92.2@linuxbox>
+      src_ip: 127.0.0.1
+      src_port: 39202
+      tx_id: 0
+- filter:
+    count: 1
+    match:
+      dest_ip: 127.0.0.1
+      dest_port: 25
+      event_type: smtp
+      proto: TCP
+      smtp.helo: linuxbox
+      src_ip: 127.0.0.1
+      src_port: 39202
+      tx_id: 1
+- filter:
+    count: 1
+    match:
+      app_proto: smtp
+      app_proto_tc: failed
+      dest_ip: 127.0.0.1
+      dest_port: 25
+      event_type: flow
+      flow.age: 0
+      flow.alerted: false
+      flow.bytes_toclient: 473
+      flow.bytes_toserver: 1035
+      flow.pkts_toclient: 8
+      flow.pkts_toserver: 8
+      flow.reason: shutdown
+      flow.state: established
+      proto: TCP
+      src_ip: 127.0.0.1
+      src_port: 39202
+      tcp.ack: true
+      tcp.state: established
+      tcp.syn: true
+      tcp.tc_max_regions: 1
+      tcp.tcp_flags: '12'
+      tcp.tcp_flags_tc: '12'
+      tcp.tcp_flags_ts: '12'
+      tcp.ts_max_regions: 1
diff --git a/tests/mime/mime-dec-parse-long-filename01/README.md b/tests/mime/mime-dec-parse-long-filename01/README.md
@@ -0,0 +1,11 @@
+# Test Description
+
+Test some mimre processing
+
+## PCAP
+
+Previous unit test for MIME in Suricata
+
+## Related issues
+
+https://redmine.openinfosecfoundation.org/issues/3487
diff --git a/tests/mime/mime-dec-parse-long-filename01/input.pcap b/tests/mime/mime-dec-parse-long-filename01/input.pcap