Skip to content

Commit

Permalink
transform/base64: Test error case
Browse files Browse the repository at this point in the history
Issue: 7114

Add test cases using the "set_error" keyword
- Content that can't be base64 decoded (ensure error buffer is set)
- Content that can be base64 decoded (ensure error buffer not set)
  • Loading branch information
jlucovsky committed Nov 3, 2024
1 parent 760b402 commit 82e4002
Show file tree
Hide file tree
Showing 2 changed files with 17 additions and 0 deletions.
2 changes: 2 additions & 0 deletions tests/from_base64-01/test.rules
Original file line number Diff line number Diff line change
Expand Up @@ -6,3 +6,5 @@ alert http any any -> any any (msg:"from_base64: bytes, offset #1 [mode rfc4648]
alert http any any -> any any (msg:"from_base64: offset #3, mode rfc2045 - will succeed"; http.uri; content:"/?arg=dGhpc2lzYXRlc3QK"; from_base64: offset 6, mode rfc2045 ; content:"thisisatest"; sid:4; rev:1;)
alert http any any -> any any (msg:"from_base64: offset #3, mode rfc4648 - will succeed"; http.uri; content:"/?arg=dGhpc2lzYXRlc3QK"; from_base64: offset 6, mode rfc4648 ; content:"thisisatest"; sid:5; rev:1;)
alert http any any -> any any (msg:"from_base64: offset #4, mode strict - will succeed"; http.uri; content:"/?arg=dGhpc2lzYXRlc3QK"; from_base64: offset 6, mode strict ; content:"thisisatest"; sid:6; rev:1;)
alert http any any -> any any (msg:"from_base64: error condition on non-b64 content"; file.data; content:"To Linux and beyond"; from_base64: set_error; content:"BASE64_ECODE_BUF"; sid:7; rev:1;)
alert http any any -> any any (msg:"from_base64: error condition not set on b64 content"; http.uri; content:"/?arg=dGhpc2lzYXRlc3QK"; from_base64: offset 6, mode strict, set_error ; content:!"BASE64_ECODE_BUF"; content:"thisisatest"; sid:8; rev:1;)
15 changes: 15 additions & 0 deletions tests/from_base64-01/test.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -32,3 +32,18 @@ checks:
match:
event_type: alert
alert.signature_id: 5
- filter:
count: 1
match:
event_type: alert
alert.signature_id: 6
- filter:
count: 1
match:
event_type: alert
alert.signature_id: 7
- filter:
count: 1
match:
event_type: alert
alert.signature_id: 8

0 comments on commit 82e4002

Please sign in to comment.