tests/transform: from_base64 test

Issue: 6487
jlucovsky · Feb 27, 2024 · 651c607 · 651c607
1 parent c0f84a0
commit 651c607
Show file tree

Hide file tree

Showing 3 changed files with 30 additions and 0 deletions.
diff --git a/tests/from_base64-01/README.md b/tests/from_base64-01/README.md
@@ -0,0 +1 @@
+from_base64 transform tests
diff --git a/tests/from_base64-01/test.rules b/tests/from_base64-01/test.rules
@@ -0,0 +1,5 @@
+# input pcap contains a query to http://home.regit.org/?arg=dGhpc2lzYXRlc3QK
+# "dGhpc2lzYXRlc3QK" is "thisisatest"
+alert http any any -> any any (msg:"from_base64: offset #1"; http.uri; content:"/?arg=dGhpc2lzYXRlc3QK"; from_base64: offset 6 ; content:"thisisatest"; sid:1; rev:1;)
+alert http any any -> any any (msg:"from_base64: offset #2"; http.uri; content:"/?arg=dGhpc2lzYXRlc3QK"; from_base64: offset 10 ; content:"sisatest"; sid:2; rev:1;)
+alert http any any -> any any (msg:"from_base64: bytes, offset #1"; http.uri; content:"/?arg=dGhpc2lzYXRlc3QK"; from_base64: bytes 6, offset 6 ; content:"this"; sid:3; rev:1;)
diff --git a/tests/from_base64-01/test.yaml b/tests/from_base64-01/test.yaml
@@ -0,0 +1,24 @@
+requires:
+  min-version: 8
+
+pcap: ../base64/input.pcap
+
+args:
+  - -k none
+
+checks:
+  - filter:
+      count: 1
+      match:
+         event_type: alert
+         alert.signature_id: 1
+  - filter:
+      count: 1
+      match:
+         event_type: alert
+         alert.signature_id: 2
+  - filter:
+      count: 1
+      match:
+         event_type: alert
+         alert.signature_id: 3