-
Notifications
You must be signed in to change notification settings - Fork 89
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
mime: add tests for bug 6207 #1313
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Good :-)
=Mg | ||
== | ||
``` | ||
should ideally get decoded to `42` as demonstrated in this test. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
as NA==Mg==
gets decoded into 42
as well (whatever the line feeds)
default < (content:"250 2.1.5 Ok\x0d\x0a";); | ||
default > (content:"DATA\x0d\x0a";); | ||
default < (content:"354 End data with <CR><LF>.<CR><LF>\x0d\x0a";); | ||
default > (content:"Subject: SMTPbelka-test_sans_name2021-03-08-17:28:53-221a0d8d17b3b41e28ec113dcabb55da7bdb03a8c0bb5d3de252f5d69347aa4d.zip\x0d\x0a";); |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We could change the dummy subject
default > (content:"\x0d\x0a";); | ||
default > (content:"\x0d\x0a";); | ||
default > (content:"--KkK170891tpbkKk__FV_KKKkkkjjwq\x0d\x0a";); | ||
default > (content:"Content-Type: application/zip;\x0d\x0a";); |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This is no longer a zip ;-)
@@ -0,0 +1 @@ | |||
alert tcp any any -> any any (msg: "Test file content"; file.data; content:"42"; sid:1;) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Can we add filesize: 2
keyword to ensure the file is exactly 42 ant not having 42 as a substring ?
Merged in #1315, thanks! |
Ticket
If your pull request is related to a Suricata ticket, please provide
the full URL to the ticket here so this pull request can monitor
changes to the ticket status:
Redmine ticket: https://redmine.openinfosecfoundation.org/issues/6207
Previous PR: #1312
Changes since v4:
file.data
rule to match on file content for testbug-6207-2