From 6f891ca2ffb9d82be18689f62392cee7e16ea4c6 Mon Sep 17 00:00:00 2001
From: Jan Grashoefer <jan.grashoefer@gmail.com>
Date: Wed, 16 Dec 2015 14:51:02 +0100
Subject: [PATCH] Added test-case for intel framework matching email

Addresses #1507
---
 testing/btest/Traces/smtp-multi-addr.pcap     | Bin 0 -> 3620 bytes
 .../policy/frameworks/intel/seen/smtp.bro     |  35 ++++++++++++++++++
 2 files changed, 35 insertions(+)
 create mode 100644 testing/btest/Traces/smtp-multi-addr.pcap
 create mode 100644 testing/btest/scripts/policy/frameworks/intel/seen/smtp.bro

diff --git a/testing/btest/Traces/smtp-multi-addr.pcap b/testing/btest/Traces/smtp-multi-addr.pcap
new file mode 100644
index 0000000000000000000000000000000000000000..5651d045a9a9a0f6116308621b8f367fec960716
GIT binary patch
literal 3620
zcmb7HZERCj7{1*AM@`LGP=*QSWFcnDwsL#dZe2I#?zY0ZwcT91&<SJSwP)L9{a9{q
zHwOF|F&HuafW)XF5fRD65JH2PVI)x!O(hsbmS95sA%;lgLlgX?hKTQbZa;6EMNjvx
z_uPATp7(j)k8@@;nT&%R$9dZ8pEbbu<Mc3a^_)+N%BsANhRFCl@hei0?og!YWSA;s
zmN#3?JQ+{O;Sg!IG{awV9Ik_F)TX~5Kjyf#aAyt7P24K@Xak?)y>NOiKfjuDeV$78
z!5r;j*`wXR-hFtV3$$A+I48%ot5PS|x#mObrHcpOy>xMN_2Dht#wumk*SNrmvet^f
zA8=gRs?`?^<>gPTDyuLqFV%j8&om4@)+?9uuo%k2Cm%c-3u#zlWhb|P&3lIs2l2R#
zhqo+FC$<9Kl@nEjJGGR>sz5BVscAyPLq3QVLSPuk>k?pf!8KYDFRMDvc(v(xT>-p~
zg-R~|$2w5dpz%Q*ZEeK(0t^RYY)++;$Ke`HQ!S6r5pf;k!|V8TAfJV5!>SLCX&4zE
zg20m?Ricr-;c=@Ougt+I;*o<&EFPOsiPPut4-${)auXj_X5}Cy3Y9|hL{f=AK^usj
z^w1y?c#Dk)f}_de;0038TX^1N)cn?K)CB&opiz)%<S3!hG1Tbc$61Ze6l$~pdf-5f
z4g$s~T%#4mVL%NrjOR*XRCDn;NWyd+7>2XgJwPTEDc%^1H->0@I-?U(<QBk?<1Q=)
z7>IxKN-Eh3b2NR74E16a#_0H)x)>dU7~RGg-MCy3qcehyZ!C^cFAaxdWT(Y$H(Tsh
zvqfk%TWl?(CL_M?bG_swHo+>`?HCEXHRu|2x?NtEce^(4@p-iir?*%1b~}4~e$hYd
z>mKNF`qGQ|#Ua1not_06Mel%j#4|AL%ia@*{k__|fktOw&_}#}w@15S?{fJ)E{{{2
zb-BFa&`56H-8<~<&$<$D2D*D~nx7=#>lJ$jb}(&GQ`GiNrmUvz>F-iW1?Ff)u??w|
z#kN8h+uMuNvqu-Ix&51e%*OUC<`2v4ZAvWSXjft}wX;;1I|$0TwYk-XPN6U8(_Szf
z81JW+Q^_50ji!$`=MvYmnp6wpJ$tlD8C?(YF5ev}i1%5D77@%A=(s)_4MG1M=m%iL
zL)<sOa3HSnMk*=eHCT}rJJkuMMP;EDqw7J7MbzTnUs)~Ap%z2kgMQ+VIokI~Q8NlL
z6`P<+XSykLn2bH5Uu1DXAJCW6U^vj1XKtmEufa81kp}z3r<n#_It>;<gErJ4awMz4
zB=pyF84YY?hz8{unMPG6LzB%)e5$0VBqGUSB1dNuY8wHW$egTBk@oH(_qGnR_GL1n
zf9PjrIsAfwe*W`wD*0O($D!#pEBi^EM9ogUuG6dyG`o+Q{ct_2*?G`x61=1GEDbrx
z1SC<(E<tL;v7i*5ip5nZSE0qs!^bjOXELsZowiiMky@x}tGQ*1_Eo2G(^|0{B5If2
zJ#2{&^A>A!6W<2wl<LI1gSTWlan8$H<|a$^tXKctlP$i)ctlp~NX83(HjZ8htt)uJ
zXT0c<RO%?XYk;rWw>&f+mnLbW3p8!VeZ?a1cEQrbn;GvcV(C&f86km5O`jAc+gS!v
zNZ}fim(qBna}u-19E?Re8car#9yNXnA=<9Q5;HXpDHKu~<1;kaN%u;TnJ~q-8%R4l
z5;fw}{0GI$cxYstAxEVMEq=ePft0K=laV!}yob!+%*I?>NDLwe5!pk7D(DK%BP){;
zG?<d(1b!r<A|*x^3m5AE>mmQl^6A>Ex&2swKC+6NSluq@>h^w>GInR7(qMS-PPT3j
zK;53tomr+>#c4Hn3ou|)#nW9;&2cU26zfw$Va<)*$<*8@Et#6DI|wy*z|49OuCM2E
zqUPI`xHuS>U<odFk;{GX9`}8~II_G{cQD80S{|4AZ>}ZJ!5poq&%G~-h;jV)k{Hzn
z!-YSy7$*@!>vPS}>;HeQlbx=p3MV!x><VpdZE0y~Z5C{!<i!L{(2&+2Ct?Z-(J*u<
zWgb*R9(v7|Cce*Uray~YRhh*`cNQPJyEr{J0_U;)_o_3osjmUuPUbX&hRz1|+<}hB
zg(%F>iZpw<FMyi8wXsmMxe>^*yRbJHhVNxG>vu0N)z?^U76RQ7H1o?58cV2TPJ(}3
zqLT#a2E%N#U^@dQ3i_ev{3ZCa!WncA<J_dnN9246IscMApDkb9aFT55cjq|g*HzmK
zc^E}?)i=U8_vknuVw~3*4A(y^<Xjr#tDAWk#j%?%Sy#y8RmS7(bnGr}xSHefFV9r^
AJOBUy

literal 0
HcmV?d00001

diff --git a/testing/btest/scripts/policy/frameworks/intel/seen/smtp.bro b/testing/btest/scripts/policy/frameworks/intel/seen/smtp.bro
new file mode 100644
index 0000000000..fd21e0f73a
--- /dev/null
+++ b/testing/btest/scripts/policy/frameworks/intel/seen/smtp.bro
@@ -0,0 +1,35 @@
+# @TEST-EXEC: bro -r $TRACES/smtp-multi-addr.pcap %INPUT
+# @TEST-EXEC: btest-diff intel.log
+
+@TEST-START-FILE intel.dat
+#fields	indicator	indicator_type	meta.source	meta.desc	meta.url
+jan.grashoefer@gmail.com	Intel::EMAIL	source1	test entry	http://some-data-distributor.com/100000
+jan.grashoefer@cern.ch	Intel::EMAIL	source1	test entry	http://some-data-distributor.com/100000
+jan.grashofer@cern.ch	Intel::EMAIL	source1	test entry	http://some-data-distributor.com/100000
+addr-spec@example.com	Intel::EMAIL	source1	test entry	http://some-data-distributor.com/100000
+angle-addr@example.com	Intel::EMAIL	source1	test entry	http://some-data-distributor.com/100000
+name-addr@example.com	Intel::EMAIL	source1	test entry	http://some-data-distributor.com/100000
+@TEST-END-FILE
+
+@load base/frameworks/intel
+@load frameworks/intel/seen
+
+redef Intel::read_files += { "intel.dat" };
+
+event bro_init()
+	{
+	suspend_processing();
+	}
+
+event Input::end_of_data(name: string, source: string)
+	{
+	continue_processing();
+	}
+
+event SMTP::log_smtp(rec: SMTP::Info)
+	{
+	for ( adr in rec$to )
+		{
+		print fmt("Addr: '%s'", adr);
+		}
+	}