test/transform: Tests for case changing transforms

Issue: 6439 Tests for case-changing transforms: - to_lowercase - to_uppercase
jlucovsky · Nov 11, 2023 · 18b6253 · 18b6253
1 parent b592bfc
commit 18b6253
Show file tree

Hide file tree

Showing 4 changed files with 30 additions and 0 deletions.
diff --git a/tests/detect-to_lowercase-01/input.rules b/tests/detect-to_lowercase-01/input.rules
@@ -0,0 +1 @@
+alert http any any -> any any (msg:"lower-case 1"; flow:established; file_data; to_lowercase; content:"at patpoopy, we have"; sid:1;)
diff --git a/tests/detect-to_lowercase-01/test.yaml b/tests/detect-to_lowercase-01/test.yaml
@@ -0,0 +1,14 @@
+pcap: ../bug-3616-ips/input.pcap
+
+requires:
+    min-version: 7.0.3
+    pcap: false
+
+exit-code: 0
+
+checks:
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 1
diff --git a/tests/detect-to_uppercase-01/input.rules b/tests/detect-to_uppercase-01/input.rules
@@ -0,0 +1 @@
+alert http any any -> any any (msg:"lower-case 1"; flow:established; file_data; to_uppercase; content:"AT PATPOOPY, WE HAVE"; sid:1;)
diff --git a/tests/detect-to_uppercase-01/test.yaml b/tests/detect-to_uppercase-01/test.yaml
@@ -0,0 +1,14 @@
+pcap: ../bug-3616-ips/input.pcap
+
+requires:
+    min-version: 7.0.3
+    pcap: false
+
+exit-code: 0
+
+checks:
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 1
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		alert http any any -> any any (msg:"lower-case 1"; flow:established; file_data; to_lowercase; content:"at patpoopy, we have"; sid:1;)