OISF · jasonish · Jun 12, 2023 · May 22, 2023 · Jan 13, 2023 · Feb 3, 2023
diff --git a/tests/bug-6207-1/input.pcap b/tests/bug-6207-1/input.pcap
diff --git a/tests/bug-6207-1/test.yaml b/tests/bug-6207-1/test.yaml
@@ -9,7 +9,6 @@ checks:
     match:
       app_proto: smtp
       email.attachment[0]: smtptest-2021-02-25T13-54-22Z-aefb2fc1308d62f4b6c74769f69b13ddf80e995fd98ae442f3be499ea928c67f..zip
-      email.status: BODY_END_BOUND
       event_type: fileinfo
       fileinfo.filename: smtptest-2021-02-25T13-54-22Z-aefb2fc1308d62f4b6c74769f69b13ddf80e995fd98ae442f3be499ea928c67f..zip
       fileinfo.size: 286

diff --git a/tests/bug-6207-2/input.pcap b/tests/bug-6207-2/input.pcap
diff --git a/tests/detect-bytemath-mult-04/README.md b/tests/detect-bytemath-mult-04/README.md
@@ -0,0 +1,11 @@
+Description
+===========
+Test byte_math multiplication operator
+
+PCAP
+====
+PCAP comes from the suricata verify test[detect-bytemath-01]
+
+Redmine ticket
+==============
+https://redmine.openinfosecfoundation.org/issues/6070
diff --git a/tests/detect-bytemath-mult-04/test.rules b/tests/detect-bytemath-mult-04/test.rules
@@ -0,0 +1,6 @@
+alert tcp any any -> any any (msg:"byte_math multiplication operator"; \
+                    ipv4.hdr; \
+                    byte_extract: 1, 5, extracted_val, relative; \
+                    byte_math: bytes 1, offset 1, oper *,rvalue extracted_val, result var; \
+                    byte_test: 1, = , var, 1; \
+                    sid: 1;)
diff --git a/tests/detect-bytemath-mult-04/test.yaml b/tests/detect-bytemath-mult-04/test.yaml
@@ -0,0 +1,11 @@
+requires:
+  min-version: 6.0.12
+
+pcap: ../detect-bytemath-01/input.pcap
+
+checks:
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 1
diff --git a/tests/filestore-filecontainer-smb1-padding/smb_bug_padding.pcap b/tests/filestore-filecontainer-smb1-padding/smb_bug_padding.pcap
diff --git a/tests/filestore-filecontainer-smb1-padding/suricata.yaml b/tests/filestore-filecontainer-smb1-padding/suricata.yaml
@@ -0,0 +1,22 @@
+%YAML 1.1
+---
+pcap-file:
+  # Possible values are:
+  #  - yes: checksum validation is forced
+  #  - no: checksum validation is disabled
+  #  - auto: Suricata uses a statistical approach to detect when
+  #  checksum off-loading is used. (default)
+  # Warning: 'checksum-validation' must be set to yes to have checksum tested
+  checksum-checks: no
+outputs:
+  - eve-log:
+      enabled: yes
+      types:
+        - files
+        - stats
+  - file-store:
+      version: 2
+      enabled: yes
+      stream-depth: 0
+      write-fileinfo: true
+      force-filestore: yes
diff --git a/tests/filestore-filecontainer-smb1-padding/test.yaml b/tests/filestore-filecontainer-smb1-padding/test.yaml
@@ -0,0 +1,20 @@
+requires:
+  features:
+    - HAVE_NSS
+    - MAGIC
+    - RUST
+  files:
+    - src/output-filestore.c
+  min-version: 7
+
+args:
+  - --set pcap-file.checksum-checks=no
+checks:
+  - filter:
+      count: 1
+      match:
+        fileinfo.sha256: 04f93fbae50680991af90eb8a5a447d7b353d9c09097b3a905745d285d7ba634
+  - filter:
+      count: 1
+      match:
+        fileinfo.sha256: 81ef17f513f4959ba2a8243fa1412fa11b7d8f2c064da1f7ae98429188b6229c
diff --git a/tests/mime/mime-dec-parse-full-msg-test01/README.md b/tests/mime/mime-dec-parse-full-msg-test01/README.md
@@ -0,0 +1,11 @@
+# Test Description
+
+Test some mime processing
+
+## PCAP
+
+Adapted using data from a previous specific unit test for MIME in Suricata MimeDecParseFullMsgTest01.
+
+## Related issues
+
+https://redmine.openinfosecfoundation.org/issues/3487
diff --git a/tests/mime/mime-dec-parse-full-msg-test01/input.pcap b/tests/mime/mime-dec-parse-full-msg-test01/input.pcap
diff --git a/tests/mime/mime-dec-parse-full-msg-test01/test.yaml b/tests/mime/mime-dec-parse-full-msg-test01/test.yaml
@@ -0,0 +1,46 @@
+args:
+- -k none
+
+checks:
+- filter:
+    count: 1
+    match:
+      anomaly.app_proto: smtp
+      anomaly.event: APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION
+      anomaly.layer: proto_detect
+      anomaly.type: applayer
+      dest_ip: 127.0.0.1
+      dest_port: 39202
+      event_type: anomaly
+      pcap_cnt: 6
+      proto: TCP
+      src_ip: 127.0.0.1
+      src_port: 25
+- filter:
+    count: 1
+    match:
+      dest_ip: 127.0.0.1
+      dest_port: 25
+      email.from: toto <toto@gmail.com>
+      email.status: PARSE_DONE
+      email.to[0]: 172.16.92.2@linuxbox
+      event_type: smtp
+      pcap_cnt: 14
+      proto: TCP
+      smtp.helo: linuxbox
+      smtp.mail_from: <toto@gmail.com>
+      smtp.rcpt_to[0]: <172.16.92.2@linuxbox>
+      src_ip: 127.0.0.1
+      src_port: 39202
+      tx_id: 0
+- filter:
+    count: 1
+    match:
+      dest_ip: 127.0.0.1
+      dest_port: 25
+      event_type: smtp
+      proto: TCP
+      smtp.helo: linuxbox
+      src_ip: 127.0.0.1
+      src_port: 39202
+      tx_id: 1
diff --git a/tests/mime/mime-dec-parse-full-msg-test02/README.md b/tests/mime/mime-dec-parse-full-msg-test02/README.md
@@ -0,0 +1,11 @@
+# Test Description
+
+Test some mime processing
+
+## PCAP
+
+Adapted using data from a previous specific unit test for MIME in Suricata MimeDecParseFullMsgTest02.
+
+## Related issues
+
+https://redmine.openinfosecfoundation.org/issues/3487
diff --git a/tests/mime/mime-dec-parse-full-msg-test02/input.pcap b/tests/mime/mime-dec-parse-full-msg-test02/input.pcap
diff --git a/tests/mime/mime-dec-parse-full-msg-test02/test.yaml b/tests/mime/mime-dec-parse-full-msg-test02/test.yaml
@@ -0,0 +1,46 @@
+args:
+- -k none
+
+checks:
+- filter:
+    count: 1
+    match:
+      anomaly.app_proto: smtp
+      anomaly.event: APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION
+      anomaly.layer: proto_detect
+      anomaly.type: applayer
+      dest_ip: 127.0.0.1
+      dest_port: 39202
+      event_type: anomaly
+      pcap_cnt: 6
+      proto: TCP
+      src_ip: 127.0.0.1
+      src_port: 25
+- filter:
+    count: 1
+    match:
+      dest_ip: 127.0.0.1
+      dest_port: 25
+      email.from: toto <toto@gmail.com>
+      email.status: PARSE_DONE
+      email.to[0]: 172.16.92.2@linuxbox
+      event_type: smtp
+      pcap_cnt: 14
+      proto: TCP
+      smtp.helo: linuxbox
+      smtp.mail_from: <toto@gmail.com>
+      smtp.rcpt_to[0]: <172.16.92.2@linuxbox>
+      src_ip: 127.0.0.1
+      src_port: 39202
+      tx_id: 0
+- filter:
+    count: 1
+    match:
+      dest_ip: 127.0.0.1
+      dest_port: 25
+      event_type: smtp
+      proto: TCP
+      smtp.helo: linuxbox
+      src_ip: 127.0.0.1
+      src_port: 39202
+      tx_id: 1
diff --git a/tests/mime/mime-dec-parse-line-test01/README.md b/tests/mime/mime-dec-parse-line-test01/README.md
@@ -0,0 +1,11 @@
+# Test Description
+
+Test some mime processing
+
+## PCAP
+
+Adapted using data from a previous specific unit test for MIME in Suricata MimeDecParseLineTest01.
+
+## Related issues
+
+https://redmine.openinfosecfoundation.org/issues/3487
diff --git a/tests/mime/mime-dec-parse-line-test01/input.pcap b/tests/mime/mime-dec-parse-line-test01/input.pcap
diff --git a/tests/mime/mime-dec-parse-line-test01/test.yaml b/tests/mime/mime-dec-parse-line-test01/test.yaml
@@ -0,0 +1,46 @@
+args:
+- -k none
+
+checks:
+- filter:
+    count: 1
+    match:
+      anomaly.app_proto: smtp
+      anomaly.event: APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION
+      anomaly.layer: proto_detect
+      anomaly.type: applayer
+      dest_ip: 127.0.0.1
+      dest_port: 39202
+      event_type: anomaly
+      pcap_cnt: 6
+      proto: TCP
+      src_ip: 127.0.0.1
+      src_port: 25
+- filter:
+    count: 1
+    match:
+      dest_ip: 127.0.0.1
+      dest_port: 25
+      email.from: toto <toto@gmail.com>
+      email.status: PARSE_DONE
+      email.to[0]: 172.16.92.2@linuxbox
+      event_type: smtp
+      pcap_cnt: 14
+      proto: TCP
+      smtp.helo: linuxbox
+      smtp.mail_from: <toto@gmail.com>
+      smtp.rcpt_to[0]: <172.16.92.2@linuxbox>
+      src_ip: 127.0.0.1
+      src_port: 39202
+      tx_id: 0
+- filter:
+    count: 1
+    match:
+      dest_ip: 127.0.0.1
+      dest_port: 25
+      event_type: smtp
+      proto: TCP
+      smtp.helo: linuxbox
+      src_ip: 127.0.0.1
+      src_port: 39202
+      tx_id: 1
diff --git a/tests/mime/mime-dec-parse-line-test02/README.md b/tests/mime/mime-dec-parse-line-test02/README.md
@@ -0,0 +1,11 @@
+# Test Description
+
+Test some mime processing
+
+## PCAP
+
+Adapted using data from a previous specific unit test for MIME in Suricata MimeDecParseLineTest02.
+
+## Related issues
+
+https://redmine.openinfosecfoundation.org/issues/3487
diff --git a/tests/mime/mime-dec-parse-line-test02/input.pcap b/tests/mime/mime-dec-parse-line-test02/input.pcap
diff --git a/tests/mime/mime-dec-parse-line-test02/test.yaml b/tests/mime/mime-dec-parse-line-test02/test.yaml
@@ -0,0 +1,47 @@
+args:
+- -k none
+
+checks:
+- filter:
+    count: 1
+    match:
+      anomaly.app_proto: smtp
+      anomaly.event: APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION
+      anomaly.layer: proto_detect
+      anomaly.type: applayer
+      dest_ip: 127.0.0.1
+      dest_port: 39202
+      event_type: anomaly
+      pcap_cnt: 6
+      proto: TCP
+      src_ip: 127.0.0.1
+      src_port: 25
+- filter:
+    count: 1
+    match:
+      dest_ip: 127.0.0.1
+      dest_port: 25
+      email.from: toto <toto@gmail.com>
+      email.status: PARSE_DONE
+      email.to[0]: 172.16.92.2@linuxbox
+      email.url[0]: www.test.com/malware.exe?hahah
+      event_type: smtp
+      pcap_cnt: 14
+      proto: TCP
+      smtp.helo: linuxbox
+      smtp.mail_from: <toto@gmail.com>
+      smtp.rcpt_to[0]: <172.16.92.2@linuxbox>
+      src_ip: 127.0.0.1
+      src_port: 39202
+      tx_id: 0
+- filter:
+    count: 1
+    match:
+      dest_ip: 127.0.0.1
+      dest_port: 25
+      event_type: smtp
+      proto: TCP
+      smtp.helo: linuxbox
+      src_ip: 127.0.0.1
+      src_port: 39202
+      tx_id: 1
diff --git a/tests/mime/mime-dec-parse-long-filename01/README.md b/tests/mime/mime-dec-parse-long-filename01/README.md
@@ -0,0 +1,11 @@
+# Test Description
+
+Test some mime processing
+
+## PCAP
+
+Adapted using data from a previous specific unit test for MIME in Suricata MimeDecParseLongFilename01.
+
+## Related issues
+
+https://redmine.openinfosecfoundation.org/issues/3487
diff --git a/tests/mime/mime-dec-parse-long-filename01/input.pcap b/tests/mime/mime-dec-parse-long-filename01/input.pcap