Skip to content

Mime type reload #2606

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 5 commits into
base: master
Choose a base branch
from
Open

Mime type reload #2606

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
5215762
tests: add test for smb mimetype alert
norg Jul 2, 2025
9f795f6
tests: add fileinfo tests to mimetype detection
regit Jul 3, 2025
4782e04
tests: add test for ftp data mimetype alert
norg Jul 7, 2025
68b14af
tests: add test for http mimetype alert
norg Jul 7, 2025
1852564
tests: add test for smtp mimetype alert
norg Jul 7, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Binary file added tests/ftp-mimetype-detection/input.pcap
View file
Open in desktop
Binary file not shown.
1 change: 1 addition & 0 deletions tests/ftp-mimetype-detection/test.rules
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
alert ftp-data any any -> any any (msg:"MIME Type Test"; file.mime_type; content:"pdf"; sid:1338; rev:1;)
19 changes: 19 additions & 0 deletions tests/ftp-mimetype-detection/test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
requires:
features:
- HAVE_MIMETYPE
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@jasonish seeing green CI for this highlights that we need SV coverage ;-)

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please elaborate? What would this look like?

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You seemed to have more ideas than me.

I was just saying that manual runs should be done for releases to ensure that every SV test/check is run.
You were saying that there were tools to do that ;-)

Copy link
Member

@jasonish jasonish Jul 22, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No tools that I know of. I think Victor put out a wish directed my way that tools exist, to which I had no comment :)


# disables checksum verification
args:
- -k none --runmode=single --set outputs.1.eve-log.types.6.files.force-mimetype=yes

checks:
- filter:
count: 1
match:
event_type: alert
alert.signature_id: 1338
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: we could check that the alert event has the mimetype

- filter:
count: 1
match:
event_type: fileinfo
fileinfo.mimetype: application/pdf
Binary file added tests/http-mimetype-detection/input.pcap
View file
Open in desktop
Binary file not shown.
1 change: 1 addition & 0 deletions tests/http-mimetype-detection/test.rules
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
alert http any any -> any any (msg:"MIME Type Test"; file.mime_type; content:"png"; sid:1337; rev:1;)
19 changes: 19 additions & 0 deletions tests/http-mimetype-detection/test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
requires:
features:
- HAVE_MIMETYPE

# disables checksum verification
args:
- -k none --set outputs.1.eve-log.types.6.files.force-mimetype=yes

checks:
- filter:
count: 1
match:
event_type: alert
alert.signature_id: 1337
- filter:
count: 1
match:
event_type: fileinfo
fileinfo.mimetype: image/png
Binary file added tests/smb-mimetype-detection/input.pcap
View file
Open in desktop
Binary file not shown.
2 changes: 2 additions & 0 deletions tests/smb-mimetype-detection/test.rules
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
alert smb any any -> any any (msg:"MIME Type Test"; file.mime_type; content:"executable"; sid:1337; rev:1;)
alert smb any any -> any any (msg:"MIME Type Test"; file.mime_type; content:"download"; sid:1338; rev:1;)
29 changes: 29 additions & 0 deletions tests/smb-mimetype-detection/test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,29 @@
requires:
features:
- HAVE_MIMETYPE

# disables checksum verification
args:
- -k none --set outputs.1.eve-log.types.6.files.force-mimetype=yes

checks:
- filter:
count: 1
match:
event_type: alert
alert.signature_id: 1337
- filter:
count: 1
match:
event_type: alert
alert.signature_id: 1338
- filter:
count: 1
match:
event_type: fileinfo
fileinfo.mimetype: application/vnd.microsoft.portable-executable
- filter:
count: 1
match:
event_type: fileinfo
fileinfo.mimetype: application/x-msdownload
Binary file added tests/smtp-mimetype-detection/input.pcap
View file
Open in desktop
Binary file not shown.
1 change: 1 addition & 0 deletions tests/smtp-mimetype-detection/test.rules
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
alert smtp any any -> any any (msg:"MIME Type Test"; file.mime_type; content:"pdf"; sid:1337; rev:1;)
19 changes: 19 additions & 0 deletions tests/smtp-mimetype-detection/test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
requires:
features:
- HAVE_MIMETYPE

# disables checksum verification
args:
- -k none --set outputs.1.eve-log.types.6.files.force-mimetype=yes

checks:
- filter:
count: 1
match:
event_type: alert
alert.signature_id: 1337
- filter:
count: 1
match:
event_type: fileinfo
fileinfo.mimetype: application/pdf
Loading