From 18b62537e3b05b97254887783c0244887c21c122 Mon Sep 17 00:00:00 2001 From: Jeff Lucovsky Date: Sat, 11 Nov 2023 03:50:21 -0500 Subject: [PATCH] test/transform: Tests for case changing transforms Issue: 6439 Tests for case-changing transforms: - to_lowercase - to_uppercase --- tests/detect-to_lowercase-01/input.rules | 1 + tests/detect-to_lowercase-01/test.yaml | 14 ++++++++++++++ tests/detect-to_uppercase-01/input.rules | 1 + tests/detect-to_uppercase-01/test.yaml | 14 ++++++++++++++ 4 files changed, 30 insertions(+) create mode 100644 tests/detect-to_lowercase-01/input.rules create mode 100644 tests/detect-to_lowercase-01/test.yaml create mode 100644 tests/detect-to_uppercase-01/input.rules create mode 100644 tests/detect-to_uppercase-01/test.yaml diff --git a/tests/detect-to_lowercase-01/input.rules b/tests/detect-to_lowercase-01/input.rules new file mode 100644 index 000000000..9c5ef937d --- /dev/null +++ b/tests/detect-to_lowercase-01/input.rules @@ -0,0 +1 @@ +alert http any any -> any any (msg:"lower-case 1"; flow:established; file_data; to_lowercase; content:"at patpoopy, we have"; sid:1;) diff --git a/tests/detect-to_lowercase-01/test.yaml b/tests/detect-to_lowercase-01/test.yaml new file mode 100644 index 000000000..fbaae82f0 --- /dev/null +++ b/tests/detect-to_lowercase-01/test.yaml @@ -0,0 +1,14 @@ +pcap: ../bug-3616-ips/input.pcap + +requires: + min-version: 7.0.3 + pcap: false + +exit-code: 0 + +checks: + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 1 diff --git a/tests/detect-to_uppercase-01/input.rules b/tests/detect-to_uppercase-01/input.rules new file mode 100644 index 000000000..3b0900aff --- /dev/null +++ b/tests/detect-to_uppercase-01/input.rules @@ -0,0 +1 @@ +alert http any any -> any any (msg:"lower-case 1"; flow:established; file_data; to_uppercase; content:"AT PATPOOPY, WE HAVE"; sid:1;) diff --git a/tests/detect-to_uppercase-01/test.yaml b/tests/detect-to_uppercase-01/test.yaml new file mode 100644 index 000000000..fbaae82f0 --- /dev/null +++ b/tests/detect-to_uppercase-01/test.yaml @@ -0,0 +1,14 @@ +pcap: ../bug-3616-ips/input.pcap + +requires: + min-version: 7.0.3 + pcap: false + +exit-code: 0 + +checks: + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 1