Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Filestore 6388 v2 #1416

Closed
wants to merge 2 commits into from
Closed

Filestore 6388 v2 #1416

wants to merge 2 commits into from

Conversation

catenacyber
Copy link
Collaborator

@catenacyber
Adds a test about filestore
e3cf463 
That it does not store too many files
@catenacyber
Adds a test for filestore keyword with one direction
45d6fd2 
And a flow scope, to check that the files are indeed stored
@catenacyber catenacyber added the requires suricata pr Depends on a PR in Suricata label Oct 10, 2023
@catenacyber catenacyber mentioned this pull request Oct 10, 2023
Closed
@catenacyber
Copy link
Collaborator Author

I guess I need the test to not test the eve.json but rather that there is no stored file with a wrong hash.

@inashivb how can I do that ?

@catenacyber
Copy link
Collaborator Author

If there is a file output//filestore/eb/eb076a2ec6ced9ee2e823e098446513cf5b2bb60fbcb04e6c85dc23dedaa414a its hash must be eb076a2ec6ced9ee2e823e098446513cf5b2bb60fbcb04e6c85dc23dedaa414a (and its size 2048 bytes), when on master6 it is 0 bytes

@inashivb
Copy link
Member

I guess I need the test to not test the eve.json but rather that there is no stored file with a wrong hash.

@inashivb how can I do that ?

You can use shell checks with test command. Example: https://github.com/OISF/suricata-verify/blob/master/tests/filestore-alert-log/test.yaml#L12

@catenacyber catenacyber mentioned this pull request Oct 16, 2023
Closed
@catenacyber
Copy link
Collaborator Author

Thanks Shivani Replaced by #1427

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
requires suricata pr Depends on a PR in Suricata
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@catenacyber @inashivb