OISF · glongo · Apr 14, 2024
diff --git a/tests/sip-content-length/README.md b/tests/sip-content-length/README.md
@@ -0,0 +1 @@
+Match on SIP Content-Length header field.
diff --git a/tests/sip-content-length/test.rules b/tests/sip-content-length/test.rules
@@ -0,0 +1,2 @@
+alert sip any any -> any any (flow:to_server; sip.content_length; content:"270"; sid:1;)
+alert sip any any -> any any (flow:to_client; sip.content_length; content:"199"; sid:2;)
diff --git a/tests/sip-content-length/test.yaml b/tests/sip-content-length/test.yaml
@@ -0,0 +1,19 @@
+pcap: ../sip-method/sip.pcap
+
+args:
+- -k none
+
+requires:
+  min-version: 8.0.0
+
+checks:
+  - filter:
+      count: 8
+      match:
+        event_type: alert
+        alert.signature_id: 1
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 2
diff --git a/tests/sip-content-type/README.md b/tests/sip-content-type/README.md
@@ -0,0 +1 @@
+Match on SIP Content-Type header field.
diff --git a/tests/sip-content-type/test.rules b/tests/sip-content-type/test.rules
@@ -0,0 +1,2 @@
+alert sip any any -> any any (flow:to_server; sip.content_type; content:"application/sdp"; sid:1;)
+alert sip any any -> any any (flow:to_client; sip.content_type; content:"application/sdp"; sid:2;)
diff --git a/tests/sip-content-type/test.yaml b/tests/sip-content-type/test.yaml
@@ -0,0 +1,19 @@
+pcap: ../sip-method/sip.pcap
+
+args:
+- -k none
+
+requires:
+  min-version: 8.0.0
+
+checks:
+  - filter:
+      count: 11
+      match:
+        event_type: alert
+        alert.signature_id: 1
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 2
diff --git a/tests/sip-from/README.md b/tests/sip-from/README.md
@@ -0,0 +1 @@
+Match on SIP From header field.
diff --git a/tests/sip-from/test.rules b/tests/sip-from/test.rules
@@ -0,0 +1,2 @@
+alert sip any any -> any any (flow:to_server; sip.from; content:"sip:"; sid:1;)
+alert sip any any -> any any (flow:to_client; sip.from; content:"sip:"; sid:2;)
diff --git a/tests/sip-from/test.yaml b/tests/sip-from/test.yaml
@@ -0,0 +1,19 @@
+pcap: ../sip-method/sip.pcap
+
+args:
+- -k none
+
+requires:
+  min-version: 8.0.0
+
+checks:
+  - filter:
+      count: 47
+      match:
+        event_type: alert
+        alert.signature_id: 1
+  - filter:
+      count: 34
+      match:
+        event_type: alert
+        alert.signature_id: 2
diff --git a/tests/sip-to/README.md b/tests/sip-to/README.md
@@ -0,0 +1 @@
+Match on SIP To header field.
diff --git a/tests/sip-to/test.rules b/tests/sip-to/test.rules
@@ -0,0 +1,2 @@
+alert sip any any -> any any (flow:to_server; sip.to; content:"sip:"; sid:1;)
+alert sip any any -> any any (flow:to_client; sip.to; content:"sip:"; sid:2;)
diff --git a/tests/sip-to/test.yaml b/tests/sip-to/test.yaml
@@ -0,0 +1,19 @@
+pcap: ../sip-method/sip.pcap
+
+args:
+- -k none
+
+requires:
+  min-version: 8.0.0
+
+checks:
+  - filter:
+      count: 47
+      match:
+        event_type: alert
+        alert.signature_id: 1
+  - filter:
+      count: 34
+      match:
+        event_type: alert
+        alert.signature_id: 2
diff --git a/tests/sip-user-agent/README.md b/tests/sip-user-agent/README.md
@@ -0,0 +1 @@
+Match on SIP User-Agent header field.
diff --git a/tests/sip-user-agent/test.rules b/tests/sip-user-agent/test.rules
@@ -0,0 +1 @@
+alert sip any any -> any any (flow:to_server; sip.user_agent; content:"Nero"; sid:1;)
diff --git a/tests/sip-user-agent/test.yaml b/tests/sip-user-agent/test.yaml
@@ -0,0 +1,14 @@
+pcap: ../sip-method/sip.pcap
+
+args:
+- -k none
+
+requires:
+  min-version: 8.0.0
+
+checks:
+  - filter:
+      count: 40
+      match:
+        event_type: alert
+        alert.signature_id: 1
diff --git a/tests/sip-via/README.md b/tests/sip-via/README.md
@@ -0,0 +1 @@
+Match on SIP Via header field.
diff --git a/tests/sip-via/test.rules b/tests/sip-via/test.rules
@@ -0,0 +1,2 @@
+alert sip any any -> any any (flow:to_server; sip.via; content:"SIP/2.0/UDP"; sid:1;)
+alert sip any any -> any any (flow:to_client; sip.via; content:"SIP/2.0/UDP"; sid:2;)
diff --git a/tests/sip-via/test.yaml b/tests/sip-via/test.yaml
@@ -0,0 +1,19 @@
+pcap: ../sip-method/sip.pcap
+
+args:
+- -k none
+
+requires:
+  min-version: 8.0.0
+
+checks:
+  - filter:
+      count: 47
+      match:
+        event_type: alert
+        alert.signature_id: 1
+  - filter:
+      count: 34
+      match:
+        event_type: alert
+        alert.signature_id: 2
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,2 @@
		alert sip any any -> any any (flow:to_server; sip.content_length; content:"270"; sid:1;)
		alert sip any any -> any any (flow:to_client; sip.content_length; content:"199"; sid:2;)
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		alert sip any any -> any any (flow:to_server; sip.user_agent; content:"Nero"; sid:1;)