mqtt: add test case for protocol string keyword

Ticket: OISF#6396
victorjulien · Nov 17, 2023 · 18d337f · 18d337f
1 parent 41114b1
commit 18d337f
Show file tree

Hide file tree

Showing 4 changed files with 83 additions and 0 deletions.
diff --git a/tests/mqtt-connect-rules/mqtt5_pub_jpeg.pcap b/tests/mqtt-connect-rules/mqtt5_pub_jpeg.pcap
diff --git a/tests/mqtt-connect-rules/suricata.yaml b/tests/mqtt-connect-rules/suricata.yaml
@@ -0,0 +1,16 @@
+%YAML 1.1
+---
+
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular
+      filename: eve.json
+      types:
+        - mqtt
+        - alert
+
+app-layer:
+  protocols:
+    mqtt:
+      enabled: yes
diff --git a/tests/mqtt-connect-rules/test.rules b/tests/mqtt-connect-rules/test.rules
@@ -0,0 +1,4 @@
+alert mqtt any any -> any any (msg:"MQTT CONNECT protocol string SUCCESS"; mqtt.connect.protocol_string; content:"MQTT"; sid:1;)
+alert mqtt any any -> any any (msg:"MQTT CONNECT protocol string SUCCESS2"; mqtt.connect.protocol_string; content:"M"; sid:2;)
+alert mqtt any any -> any any (msg:"MQTT CONNECT protocol string FAIL"; mqtt.connect.protocol_string; content:"Foobar"; sid:3;)
+
diff --git a/tests/mqtt-connect-rules/test.yaml b/tests/mqtt-connect-rules/test.yaml
@@ -0,0 +1,63 @@
+requires:
+  files:
+    - src/detect-mqtt-connect-protocol-string.c
+
+args:
+  - -k none
+
+checks:
+
+  - filter:
+      count: 1
+      match:
+        event_type: mqtt
+        mqtt.connect.protocol_string: MQTT
+        mqtt.connect.protocol_version: 5
+        mqtt.connect.flags.username: true
+        mqtt.connect.flags.password: true
+        mqtt.connect.flags.will: false
+        mqtt.connect.flags.will_retain: false
+        mqtt.connect.flags.clean_session: true
+        mqtt.connect.client_id: ""
+        mqtt.connect.username: user
+        mqtt.connect.password: pass
+        mqtt.connect.properties.receive_maximum: 20
+        mqtt.connack.session_present: false
+        mqtt.connack.return_code: 0
+        mqtt.connack.properties.topic_alias_maximum: 10
+
+  - filter:
+      count: 1
+      match:
+        event_type: mqtt
+        mqtt.publish.qos: 0
+        mqtt.publish.retain: false
+        mqtt.publish.dup: false
+        mqtt.publish.topic: topicX
+
+  - filter:
+      count: 1
+      match:
+        event_type: mqtt
+        mqtt.disconnect.qos: 0
+        mqtt.disconnect.retain: false
+        mqtt.disconnect.dup: false
+        mqtt.disconnect.reason_code: 0
+
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature: MQTT CONNECT protocol string SUCCESS
+
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature: MQTT CONNECT protocol string SUCCESS2
+
+  - filter:
+      count: 0
+      match:
+        event_type: alert
+        alert.signature: MQTT CONNECT protocol string FAIL