Project

General

Profile

Actions

Feature #2923

closed

suricata-verify: eve2test util

Added by Victor Julien over 2 years ago. Updated over 1 year ago.

Status:
Closed
Priority:
High
Target version:
Effort:
Difficulty:
Label:

Description

The suricata-verify test.yaml contains a great way to create regression tests. However creating the test files is tedious. It usually involves taking a eve.json record and then manually creating a matching test.yaml.

I would like to have a small util script in python, that converts an eve.json to the test.yaml format.

Something like:

eve2test eve.json > test.yaml


Related issues

Related to Task #3269: Script for creating test with paramsClosedShivani BhardwajActions
Actions #1

Updated by Shivani Bhardwaj over 2 years ago

  • Status changed from New to Assigned
Actions #2

Updated by Shivani Bhardwaj over 2 years ago

If I understand correctly, only the verification filters are run over `eve.json` so this utility should actually create just the `filter` block and write it in a test file. Developer may then provide all other options like min-version of Suricata, requires, etc. Please let me know.

Actions #3

Updated by Victor Julien over 2 years ago

Lets start that way, yes. We can consider adding more logic later, but this is the most valuable first step I think.

Actions #4

Updated by Shivani Bhardwaj over 2 years ago

  • Status changed from Assigned to Feedback
Actions #5

Updated by Peter Manev over 2 years ago

Some very good reassembly/defrag/vlan corner cases could be found here - https://github.com/pevma/PtP/blob/master/Examples/Example with the actual pcaps and rules located here - https://github.com/pevma/PtP/blob/master/Examples/PacifyOneHttpRequest.tar.gz . I think the utility would make it much easier to add those form the respective resulting eve.jsons into the suricata-verify.

Actions #6

Updated by Shivani Bhardwaj about 2 years ago

Unmerged, open for testing: https://github.com/shivan1b/eve2test

Actions #7

Updated by Victor Julien about 2 years ago

  • Target version changed from TBD to QA
Actions #8

Updated by Victor Julien almost 2 years ago

  • Priority changed from Normal to High
Actions #9

Updated by Shivani Bhardwaj over 1 year ago

  • Related to Task #3269: Script for creating test with params added
Actions #10

Updated by Shivani Bhardwaj over 1 year ago

  • Status changed from Feedback to In Review
Actions #11

Updated by Shivani Bhardwaj over 1 year ago

  • Status changed from In Review to Closed
Actions

Also available in: Atom PDF