Skip to content

Commit 5f5682e

Browse files
QianKaiLinQianKaiLin
committed
mysql: add more checks in test
Task #3446
1 parent 833c9cd commit 5f5682e

File tree

8 files changed

+165
-4
lines changed

8 files changed

+165
-4
lines changed

‎tests/mysql-command/test.yaml

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,18 @@ checks:
88
- filter:
99
count: 1
1010
match:
11+
pcap_cnt: 40
12+
src_ip: 172.18.0.1
13+
src_port: 35316
14+
dest_ip: 172.18.0.3
15+
dest_port: 3306
16+
proto: "TCP"
17+
direction: "to_server"
1118
event_type: alert
1219
alert.signature: "test mysql"
20+
alert.signature_id: 1
21+
alert.severity: 3
1322
alert.metadata.mysql[0]: "command"
23+
mysql.command: "select * from test.identify where identify = 33030219971120201X"
24+
mysql.rows[0]: "1,33030219971120201X"
1425

‎tests/mysql-multi-queries/README.md

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
# Test Description
2+
3+
TODO: Simple description of what this test is for.
4+
5+
## PCAP
6+
7+
TODO: What is the source of this PCAP.
8+
9+
## Related issues
10+
11+
TODO: Issue numbers or links to related issues.

‎tests/mysql-multi-queries/input.pcap

15.8 KB
Binary file not shown.

‎tests/mysql-multi-queries/suricata.yaml

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
%YAML 1.1
2+
---
3+
4+
outputs:
5+
- eve-log:
6+
enabled: yes
7+
filetype: regular
8+
filename: eve.json
9+
types:
10+
- mysql
11+
12+
app-layer:
13+
protocols:
14+
mysql:
15+
enabled: yes

‎tests/mysql-multi-queries/test.yaml

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
requires:
2+
min-version: 8
3+
4+
args:
5+
- -k none
6+
7+
checks:
8+
- filter:
9+
count: 1
10+
match:
11+
dest_ip: 172.16.10.104
12+
dest_port: 3306
13+
pcap_cnt: 14
14+
event_type: mysql
15+
mysql.affected_rows: 0
16+
mysql.command: SET NAMES utf8mb4
17+
mysql.tls: false
18+
mysql.version: 8.0.32
19+
proto: TCP
20+
src_ip: 172.16.10.222
21+
src_port: 42074
22+
- filter:
23+
count: 1
24+
match:
25+
dest_ip: 172.16.10.104
26+
dest_port: 3306
27+
event_type: mysql
28+
mysql.command: SELECT VERSION()
29+
mysql.rows[0]: 8.0.32
30+
mysql.tls: false
31+
mysql.version: 8.0.32
32+
proto: TCP
33+
src_ip: 172.16.10.222
34+
src_port: 42074
35+
- filter:
36+
count: 1
37+
match:
38+
dest_ip: 172.16.10.104
39+
dest_port: 3306
40+
pcap_cnt: 20
41+
event_type: mysql
42+
mysql.affected_rows: 0
43+
mysql.command: ping
44+
mysql.tls: false
45+
mysql.version: 8.0.32
46+
proto: TCP
47+
src_ip: 172.16.10.222
48+
src_port: 42074
49+
- filter:
50+
count: 1
51+
match:
52+
dest_ip: 172.16.10.104
53+
dest_port: 3306
54+
event_type: mysql
55+
mysql.command: SELECT SCHEMA_NAME FROM INFORMATION_SCHEMA.SCHEMATA WHERE SCHEMA_NAME='sentinel_flow_admin'
56+
mysql.rows[0]: sentinel_flow_admin
57+
mysql.tls: false
58+
mysql.version: 8.0.32
59+
proto: TCP
60+
src_ip: 172.16.10.222
61+
src_port: 42074

‎tests/mysql-rows/test.yaml

Lines changed: 37 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,9 +6,45 @@ args:
66

77
checks:
88
- filter:
9-
count: 2
9+
count: 1
1010
match:
11+
tx_id: 1
12+
pcap_cnt: 41
13+
src_ip: 172.18.0.3
14+
src_port: 3306
15+
dest_port: 35318
16+
dest_ip: 172.18.0.1
17+
proto: "TCP"
1118
event_type: alert
19+
alert.action: "allowed"
1220
alert.signature: "test mysql"
21+
alert.signature_id: 1
22+
alert.severity: 3
23+
direction: "to_client"
1324
alert.metadata.mysql[0]: "rows"
25+
mysql.version: "9.0.1"
26+
mysql.tls: false
27+
mysql.command: "select * from test.identify where id = 1"
28+
mysql.rows[0]: "1,33030219971120201X"
29+
- filter:
30+
count: 1
31+
match:
32+
tx_id: 3
33+
pcap_cnt: 43
34+
src_ip: 172.18.0.3
35+
src_port: 3306
36+
dest_port: 35316
37+
dest_ip: 172.18.0.1
38+
proto: "TCP"
39+
direction: "to_client"
40+
event_type: alert
41+
alert.action: "allowed"
42+
alert.signature: "test mysql"
43+
alert.signature_id: 1
44+
alert.severity: 3
45+
alert.metadata.mysql[0]: "rows"
46+
mysql.version: "9.0.1"
47+
mysql.tls: false
48+
mysql.command: "select * from test.identify where identify = 33030219971120201X"
49+
mysql.rows[0]: "1,33030219971120201X"
1450

‎tests/mysql-tls/suricata.yaml

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
%YAML 1.1
2+
---
3+
4+
outputs:
5+
- eve-log:
6+
enabled: yes
7+
filetype: regular
8+
filename: eve.json
9+
types:
10+
- mysql
11+
- tls
12+
13+
app-layer:
14+
protocols:
15+
mysql:
16+
enabled: yes
17+
tls:
18+
enabled: yes

‎tests/mysql-tls/test.yaml

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -9,11 +9,20 @@ checks:
99
- filter:
1010
count: 1
1111
match:
12+
src_ip: 172.18.0.1
13+
src_port: 36592
14+
dest_ip: 172.18.0.3
15+
dest_port: 3306
16+
proto: TCP
1217
event_type: mysql
1318
mysql.tls: true
1419
- filter:
1520
count: 1
1621
match:
17-
app_proto: tls
18-
app_proto_orig: mysql
19-
22+
src_ip: 172.18.0.1
23+
src_port: 36592
24+
dest_ip: 172.18.0.3
25+
dest_port: 3306
26+
proto: TCP
27+
event_type: tls
28+
tls.from_proto: mysql

0 commit comments

Comments
 (0)