From b8d0533f7f5c0b48b3960d6bb9d6ba944b51213f Mon Sep 17 00:00:00 2001
From: QianKai Lin <linqiankai666@outlook.com>
Date: Sun, 29 Sep 2024 09:45:40 +0800
Subject: [PATCH 1/4] mysql: add tests

---
 tests/mysql-command/input.pcap           | Bin 0 -> 5330 bytes
 tests/mysql-command/suricata.yaml        |  15 +++++
 tests/mysql-command/test.rules           |   1 +
 tests/mysql-command/test.yaml            |  11 ++++
 tests/mysql-prepare-statement/README.md  |   6 ++
 tests/mysql-prepare-statement/input.pcap | Bin 0 -> 14066 bytes
 tests/mysql-prepare-statement/test.yaml  |  73 +++++++++++++++++++++++
 tests/mysql-query/README.md              |   6 ++
 tests/mysql-query/input.pcap             | Bin 0 -> 16189 bytes
 tests/mysql-query/test.yaml              |  22 +++++++
 tests/mysql-rows/input.pcap              | Bin 0 -> 5330 bytes
 tests/mysql-rows/suricata.yaml           |  15 +++++
 tests/mysql-rows/test.rules              |   1 +
 tests/mysql-rows/test.yaml               |  10 ++++
 14 files changed, 160 insertions(+)
 create mode 100644 tests/mysql-command/input.pcap
 create mode 100644 tests/mysql-command/suricata.yaml
 create mode 100644 tests/mysql-command/test.rules
 create mode 100644 tests/mysql-command/test.yaml
 create mode 100644 tests/mysql-prepare-statement/README.md
 create mode 100644 tests/mysql-prepare-statement/input.pcap
 create mode 100644 tests/mysql-prepare-statement/test.yaml
 create mode 100644 tests/mysql-query/README.md
 create mode 100644 tests/mysql-query/input.pcap
 create mode 100644 tests/mysql-query/test.yaml
 create mode 100644 tests/mysql-rows/input.pcap
 create mode 100644 tests/mysql-rows/suricata.yaml
 create mode 100644 tests/mysql-rows/test.rules
 create mode 100644 tests/mysql-rows/test.yaml

diff --git a/tests/mysql-command/input.pcap b/tests/mysql-command/input.pcap
new file mode 100644
index 0000000000000000000000000000000000000000..cfec35de27dc2264b60c63bc80fda19d48366184
GIT binary patch
literal 5330
zcmc(j4Qvy27{>qo7#*Xc6k(uD4@le~*=)DT*rFQ(<@-YzN`aYD)^@9G?QFZTAs<6!
z5d{=51Ofyw5fh`1=pdFaH5e5GgG4dT87C82EU2igf@7=C`|sNI?%ImcgogiUukG*N
z=Xu||dwO4<e0RT+safAc%@lZXIjPgW=Y1uci08DF6W`J?m2#p#{rN|enUS&FT|Z7>
z6Z%a#jO_|~&woVg-+N6l^qZZIwe@!?I!$vKQz(*CoK1xb3*IqKB;r{Skys&ah-mZ@
zaZftYh^qDbj}Q&iR1hzPi3N=hO>s7E-`)-4b5;$Tf%<64YJ52GA`!17hilw$P3v#1
zwZDfCvwh0Hu9_C&Tk51HwUX*w{|#+ds8kvv9~F@$wLZ)kk=wWR)w<zYTJxWcpf~N)
z^}G;GE@)i!8PUV!^B~9fHSiLz`A$jAO`soy3xTi;L?klRI-*R&UPkS-LOqJ|b)9ZF
z5zjp&sr4Y$T0czDW7-|+RJhLRprqty>9Y*1Kc40dwvN7U{<0-37z`>|ux$vo^*-*H
z@^r!CO#RAv_S8I9YAG#uILpkQa!a<k%Hr{?aJj9F%F9G~2?THCf(OPB+#OHwArRG=
zQ(CgN2LhXjczI?_;xI*E(V*~XhAcdRmz!R@hl|P#Ym@x%cDcMvC@kJlld*Vb-K1la
zzTOkO;F+~HY5fBC(ZcPcx6aG5``37F9&a2YO0?$E3Wv?<H9IYpwmYY~GH2Hn&zqGw
z+3l#Yxm9MDC#k~Wtgh{EuBxzj?Jjp^lBLo*E>~@?a#%IlhP-_JIK9^FvAOYabGggo
zO)=zUXBoz$Q90!DS0a}s1DmV6hY!Iz$q;n6)|S=4<?irUg@=HMYsxij8hoH78><4{
zy_~o*CUF>uk4MJp6b-8q5QU1kgB%(*8%$a<Zjo*T=X%B5>ndI;aTklZ8pc!v!Xo%u
zz!MDHW`bYQibtcYCawAUK*_MR!irNw+z+A&bXu}un-O@Kh?hHK5;1HhTV&WcQ3r~u
z*tkHL^XP12u~6-`kFQ*oOZ$20sf4zqaa%kRTL!|GjW~*>wzR?)I+2HMd0@GQ;cUm3
zOvLoSD=|fEge}7X516cC5jcQI#4O{a1;P`?`Nh-c&dC@<8a~2q8t^79S!-)`_i+vR
z5)H$lVL#WfP1M>}2v8{Q2T5hM*+J|d*%#9W+1=REtzdXR3DxwF)_yo8B=J)hHYM>*
zR8?JthE2t%Y01Rr2ewdESJaXY?uYm%x%dSU@!!%+kgWp=y9?L^b9_G+`?N&tlMs7A
z(y-5Qe0(cu*oS~uV^6eXHJ1gp68!RcNzDgPb2+d1Sy9cOKM2ZDkFCO1>J`QccDJii
zpmSB0!-_MK!(Jz>D7U$7LgeKmLJ=w4T%%#X;;Xb|?Yy89sED)85{2bZ*uoXwjI{GK
zDb(U+?@*G5EEUk+&MJziqc?--C=+!w3mv7;sHxoKaD9;{N{1Eyv_)(Hcq$bg_yy>E
zf^S5=8hJuH#u)@V#shQHFETeRkY9$4v}8S46xhal&@SmgOIq`dA&}o`@<w{_9p>ir
zNKjI_@X((grpw9E=jgKy`T2PUL$*F!Z!nSTZ7VeF5<W~z=K9yVk=*sK#ID~M0@r)E
z>wiRCKLgjl!_E{+*vPH^S2n8tlZ|TFIEoGDmXhEYVtdUV#ZTNX)Fz5@9X!Nz)kVw>
zX#Mu=B_{!n73JD!dpK|%5RoNU##m7<P?h>qI_MwAh;rm<TbO(pWSTizvH{8M;Md%)
zdP&V6gPtL|*tB6l&QR~SuS^u>d_Pm~Gb~ZPr&=?pR`fnP%JDj*qFf3}RO?-(<5y2G
z#)xvd>H7S%Y4(BvGZ(IilVGU4CX|;zFpmUXYhwtmjwkpF5aUO=ju9mIuVXQZ;wZ;0
zJb|v?T9o_r`UivUN7fxX{>ulGmu?<=$hc#`)z2#P2Gq5rZQbjte&u#Xxr-u~B?Fu5
z`-Km|+ma!uwr7_#NTM7c0_xl7XA(s@->;l_ASO{9<v3A^X%9uYP2k4A1p2OW?mh|k
z8D6P4vozCTg-c*`lzScU1jCj_@UGS3(I{!a@jy02|4{lqd~_WLF@BWm;PIr(9+N1J
za-0}H$`!0iXv=Thmc0^N8eq$Aeg^MLxMa)sl4MW@xC=)!E!j!O(!pa#*Bpt6-LPc~
z-~rRB(B*-^u%&qnD7Tahgx*YGS)C{o_<kpC={F_Xwm{n{uB|T<aBcsP35po~+)S>=
zpT3lLTQfle<d>itS~B<NbO?MXmrC3}Rh8;5g#1pEL+t)gP@*$IGS5fY$S;Z0)+7o7
zzCZXFQEu(MU$Oxg1Aif`{()QF7X-M~w=)PRZz%{Ux#~CT6CU<F{z!vB$q!K8UOy=M
zzSH^(G~aag`y?ST@GALurC+3H{4P;h4|1F@29aN;FM(KxF42-jwB^2Qyfamj&a|U5
z7kOtILQ{bH&f++{kONAvK|NYOzF2RV>hcN}r(kotU2ef`vsiIcMJRPuR#rP5r53Nl
z<rJzcrORzz4@qO|G;AEcPD?h98H`aO?QcY+@zhju5g%rc;jUlzhoM2UgA!kkZWK|@
j@mqjI()#IU*9{*MXYhZP^ZdV)6Y3OxHH74>wlMZL-TVD@

literal 0
HcmV?d00001

diff --git a/tests/mysql-command/suricata.yaml b/tests/mysql-command/suricata.yaml
new file mode 100644
index 000000000..4f6e6be34
--- /dev/null
+++ b/tests/mysql-command/suricata.yaml
@@ -0,0 +1,15 @@
+%YAML 1.1
+---
+
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular
+      filename: eve.json
+      types:
+        - alert
+
+app-layer:
+  protocols:
+    mysql:
+      enabled: yes
diff --git a/tests/mysql-command/test.rules b/tests/mysql-command/test.rules
new file mode 100644
index 000000000..a74b8ebd8
--- /dev/null
+++ b/tests/mysql-command/test.rules
@@ -0,0 +1 @@
+alert mysql any any -> any any (msg:"test mysql";mysql.command; pcre:"/(?:[1-9]\d{5})(?:(?:1[89]\d{2}|2\d{3})(?:0[1-9]|1[012])(?:0[1-9]|[12][0-9]|3[01]))\d{2}(?:\d)(?:[0-9xX])/i""; sid:1;)
diff --git a/tests/mysql-command/test.yaml b/tests/mysql-command/test.yaml
new file mode 100644
index 000000000..2a597e84c
--- /dev/null
+++ b/tests/mysql-command/test.yaml
@@ -0,0 +1,11 @@
+args:
+- -k none
+
+
+checks:
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature: "test mysql"
+        
diff --git a/tests/mysql-prepare-statement/README.md b/tests/mysql-prepare-statement/README.md
new file mode 100644
index 000000000..f3c46bf42
--- /dev/null
+++ b/tests/mysql-prepare-statement/README.md
@@ -0,0 +1,6 @@
+# Test Description
+
+Test mysql prepare statement like `select * from xxx where id = ?`.
+
+## PCAP
+This PCAP was generated from flow in my workspace.
diff --git a/tests/mysql-prepare-statement/input.pcap b/tests/mysql-prepare-statement/input.pcap
new file mode 100644
index 0000000000000000000000000000000000000000..b6367a427813bdd99063ab45bfd6c7e09f2c518c
GIT binary patch
literal 14066
zcmeI3eQZ<L8OE<2Cr+FM;*9W-YQua;L#4@px_mV_z(~Va7;yrGuAOlb2TYSVwS5Z{
z1V}Y?!024s!Puk;I;u`%oyJ&O!Mdq~E1@czrfS+>Q<s(&_7U1rD6kGlvgduBT;F?a
zA1prhmn}{>cAO{gInQ%{_ndp3ziKC5wkkFy@vtctJehp_NSk%HLs^bKHS6NnoQl=D
z__4FwSLQ1<ic;m7u~1o<_evXHx6t?A?kno=tsJ$Rl#W<$eAd*6pR(n?ZnNe)&KABi
zkzTjt<k(5M!lX=^as9ZmqLA{32T7IGi~8U0(^Sg~P~UT;ba1y(`RKuu+em#x*#qUp
z_)XN3YIb{Oa?Kq=&3mA}e^-g+dechOXyJNYq)fG*-{VkXP@@(fzoFKi*n6btRfSsj
zQ?0wkTLznc6jvOs)3ppLj=7cY${9*Mx}NUMo69SvKcx%}4Ox|;_sj6w@WUT%v^P(C
za#G%syk@1v-?Ay#xzQKd<e%m1@<$?DLg7|6$-Y-Q;8{H2_7nr|OE=(2P%J_Qs3lF|
zpyy#yJo<7<#qpNw>&Kd>@GPD_|I>0FRK>{Hg#W{#P*idK{?x!nlmGl&cl(z|{c`e)
zeQPgVS@6XN6GQ92)%@yHI~x7BB7x3murttJ(bgW?l4eG}S>$VJ58{o!PJc&WbZw}j
z?%NIZD=U_SgU<xQIlfRNw>{XYZY}V2wfm!Op>Rj8zoT`w+ve*Ew&uAXnK5t9>>^(z
z5XQTGn?jMOW9FP$l{4p5&ZwM4VQ`yfTL`W@_ID1$X(0@Ky_KUIFxvwo@fryODV~Jl
zQp^Xnq<GDb^|9h_Q!0*!qSqWRD?}_gq+9(xhf)VkYDv1)vG-Z`bwT$$S4z6;%(`|(
z$sr*$5?>8*$x-Ge@mDsRBQm-HN7<!xq3eKR6V$0Cg>Jd$5mszSsff@uHJd|M3YDCO
znnu^EMRhd|E;ZUVx1-rjl^5)jPRj>8Ex!?_<r1bPh@;s!E!#mI7p8?^IWjGE5Pura
zsU;1f#WR}+F;5so5Yuu4;@6wD>4TVrglwM<m9ddPd!QxideGGt4t2P~fv43#BpPw8
zTUz6-aRpml3#wi1!H!_mHIqhH^t?m)2`Zu{nr?~3&QSsN&BEwzV04FQbnAbnn@*#f
zR79hr@x@OG$~cJTv<BMniltg9s#b_r`A6_Y$;EsR;@ip`yqn%rY&u%=M+(<F)?h3C
zL1PSQOrbCVjk%fpXyNb?-V$mJ82d#-$}PwYP{m5EqU2>F=4c5A{Lw(G&mT2(QP-Cs
zV(+07Bc$vZNvU0}BT|X3E;SWWn5KN5CNk?GnDqo+q?VMHRh~JVmO3FVhcq>34a~aM
z1RI7=Rh$-JR~g4ckAKO>^Z0{)SM~QD$`*WsT2e5Au@5;I-!%s#XAOdJf`idx4hBRl
zHaN{`xHG47GMQ1MyT-ogbVi9Y*lXzO_6$3nQ34$adktM(YS`&Kb{dx3b;~!vh81vy
zT9V}pJagIdCk4w-XsT^5TfW9@Ii!^d@Pd&XfwY7@^H_SeApMpuefR9yhXUv@rY1&A
zamPNQ0=#dTBWBx+i1iDnMrIF%wjYWTnw{s+`cf*UqZysVvNX%&*fRv%&=oVDpqV8m
zrP+MW-*O>;{hFG4AuY|wEI$7zmi+ktcuv9iHGY?bW*0aZ-!TUx_d;)Fi7iVr{S2&k
z4E7qjqSGm8_6}^2(CksR{Bg78B{og9mkTtTOv@dn8Cgya{{_+#npLs%!-90NE}ftm
zOW(mt>Jt<oq1ivE0Pjh2#O&pWSd~DtZmgsx(~#URNNM&@4($^u70onbMP8fHlx1ml
zKWJ79vm|S?1)RTHA%9hxny(5pqx^OA+KkN7X=bG-cu+9T<9A7D_Ad@bk2x6mDx$Vl
zpcw}vyEe;Y6`q1-H(-N=W*)YDonZM|O)WT<f@a-JGx|af=k9kX&!SH)Y1tR`RI~I%
zLE5KF@6(rkoTe(M+-_fpZK1!j)n(WznKz0PQIQ01|E7w(Z<sSza15C{oDOecD4s<4
zsENxz%duELr`VHHk??jVK1MoP2$+mFI|gb~toSP1dSX|~n+d#&cBMl~;~I-HpeVTD
zi21ki+8cY7j28B(ccmF^B#rwMV_)2>WVV&eXjhtl@5oo6Z&99ukF>+5mXy^d&qB`X
zd?BlcHMP*ihe4M)t1hUFBOi704f2H~dc_`3Ctp{a_M()57dbsU%;_m~A&**?f%-yD
z?--VGhHeHcIuC4+FmMr@-zb=`X=+jYl0;&E%AjHflKI5IT1ZP)bc<QKLXiHGE^S`X
zb>G2?E`S0g$orTI@SZS7tO%DtN^Yh@-Z3aj_NSk4XxFAxOt+#dz-(n#boY*HiT&yC
zV3uS>_jS(SA|Zb_HMRISb1iYTEwQ2_vvjV}^&@&v))%}arP-$(jBVy%6d&)cbe3gl
zrbA5c7!YRYW<axg*dU?V61KeFY`L>cQ%A)wNu;6~Sxyc=4rvL^YFPR~LHaAY^xe};
zMFA3;U7`ZKzcNQ`6fS`{>(bHeBorky`;0?NcVG<nWQP^aG~1ys;0iHYS(@Dsn)Sjg
z3C$kk{LyOLLWad}%{%KfwPc|{vng0{@8JC@nWfW=PTlmNtT+5XO0&xxjIHKilq^Kl
zHVQPOU`)yGPw#Mlx)C-=XjaRXuM#ZZsHx8QC5Z&h*m7Q*k>%uY7o;ULTguX36{Nd#
z=>*MKdOB2Zw?7r`Tkb^x5}IA10=%!8Bj&^<5U02u<%rRc{s=`0%|7SQu1=|#OtUGx
z9WBPVvNXFNG<y$bNocl=^Y^HbKkPY6-%U$1GE1jf9zDT>g3)q7O0%mR4B_KErSBqY
zr?NEDmt=a!upl#ZGgzBF0~;hXTh5lR5G+5Xsbg~4@>Db<%gN!Lke1MF1xrsAq|fNm
zcTck)qW}rbu2BKrpPSh;CKnOAEUe9Rn*9xm5}IA-(9%Z*3~RGt#dI_qjoHf5?0(R!
zA7)8twvzKVSIFOGO)cAymS$v@PBXroHk|e5gHoFPhl3F|2cv95Z)Is=mS#G{^o{{x
zhHeHli^2v8&Fa|lrDn@Z3pI7@fwVLu%ZX;&A^j}+)RL~pMm?)ox<rs3qf75YZsH$k
z<+WKARBpF6yWPEmL#RlCw=bw7@2lp_jXi+OHKxPcIVei*9sHM5{I!&dgts&CG15+k
zb{M=^b7G*`dk2Zz2zrR=I#n$`hIa4Bm$-Lu89vf|18PZGZSs7BvpQYKYNMu(CmLOA
zO58i(th%5wj(pU~H>iw!s?B)sVAl_&47|bV37OL~z7Tobnq{DlKD}cApP{SAXDaN#
z-Z91f)0bd_gn_Hs{2Iaht(rO^en}#+qMJ$wGVf2xd}82XNJ|)4&(g($bdN5bU?5B1
z3kIG-MG^+yq>8*p&6%5kYa*qm1qSW}v8K`(l|xbn-r^KLlv2^mKvrZ1(nnac4E#Sc
z&<P(U4D@nVrwLg-t*Pa23Jj#I?sUPzapa?cfqdHmuNWD42)|YG8Il1`5B(L0VS`Zq
zCh|y^x(C+x=x0z)Pxcz!9bTjR1#FNouz}5AESP^mQy;j<=9?L~lNm_n6Cd7yG|t=H
zlFqI3JdG?Z;`LKqx<2kO(S~vbhZPIS{sFQHkWoP5AKu`<#BzJqu<SCS;?G&uiBtAU
zvn(l|GbtwhiOe7=dXJc+_`pR(@#-$8=}%;IG+r?&Ce^r>YZO=4S5f1~fNfHZ{{!ny
BKxzO0

literal 0
HcmV?d00001

diff --git a/tests/mysql-prepare-statement/test.yaml b/tests/mysql-prepare-statement/test.yaml
new file mode 100644
index 000000000..38c69293f
--- /dev/null
+++ b/tests/mysql-prepare-statement/test.yaml
@@ -0,0 +1,73 @@
+requires:
+  min-version: 8
+
+args:
+- -k none
+
+checks:
+- filter:
+    count: 1
+    match:
+      event_type: mysql
+      mysql.command: select * from requests WHERE id =1 limit 1
+      mysql.tls: false
+      mysql.version: 8.4.0
+- filter:
+    count: 1
+    match:
+      event_type: mysql
+      mysql.command: select * from requests WHERE id =2 limit 1
+      mysql.tls: false
+      mysql.version: 8.4.0
+- filter:
+    count: 1
+    match:
+      event_type: mysql
+      mysql.command: select * from requests WHERE id=3 and client_code=client2 limit
+        1
+      mysql.tls: false
+      mysql.version: 8.4.0
+- filter:
+    count: 1
+    match:
+      event_type: mysql
+      mysql.command: select * from requests WHERE id =4 limit 1
+      mysql.tls: false
+      mysql.version: 8.4.0
+- filter:
+    count: 1
+    match:
+      event_type: mysql
+      mysql.command: select * from requests WHERE id =5 limit 1
+      mysql.tls: false
+      mysql.version: 8.4.0
+- filter:
+    count: 1
+    match:
+      event_type: mysql
+      mysql.command: select * from requests WHERE id =6 limit 1
+      mysql.tls: false
+      mysql.version: 8.4.0
+- filter:
+    count: 1
+    match:
+      event_type: mysql
+      mysql.command: select * from requests WHERE id =7 limit 1
+      mysql.tls: false
+      mysql.version: 8.4.0
+- filter:
+    count: 1
+    match:
+      event_type: mysql
+      mysql.command: select * from requests WHERE id=8 and client_code=client2 limit
+        1
+      mysql.tls: false
+      mysql.version: 8.4.0
+- filter:
+    count: 1
+    match:
+      event_type: mysql
+      mysql.command: select * from requests WHERE id=9 and client_code=client2 limit
+        1
+      mysql.tls: false
+      mysql.version: 8.4.0
diff --git a/tests/mysql-query/README.md b/tests/mysql-query/README.md
new file mode 100644
index 000000000..1de54b6bc
--- /dev/null
+++ b/tests/mysql-query/README.md
@@ -0,0 +1,6 @@
+# Test Description
+
+Test mysql normal sql statement.
+
+## PCAP
+This PCAP was generated from flow in my workspace.
diff --git a/tests/mysql-query/input.pcap b/tests/mysql-query/input.pcap
new file mode 100644
index 0000000000000000000000000000000000000000..458bc25e8f0cff003ea45ed9091837cbb35edfe7
GIT binary patch
literal 16189
zcmajm3tW};9mnzKa8m(qXlY&owZtomGQ4G|h^VAIN4zv`oe)7u;TVvlRGO}|nz^Lr
z7M0CPQkf>2uIOT8<u+fh)jX6<w_Mqz<!Rm}b;7>CADpN2|MP$S|Ghe;W*^@F-}5}@
zdH8p#tF8WRh!tl2_(z!K!cRWjcs%c(eJ*P{eoQYbdSLnMFXFGie!f#%E6uX*aQB&D
zO^A3nsj5@tmv}9CZGQB3JCY`yrr-QZ$RiIGJa1VcVd4A3LfS@lyCq{Y{kkhOv<;Py
z?ib2vHusy$mNmgjiTLXrs!~1ryVvH|M!m2C_4-$08aF)o{*Pt<Yi&DHJy8B0<w^KT
z^lD{Ja`$EPILTa(dg+=@*7bsoFuIz(R3_`fgD&frh|#Ng{Xy2XS8gTiv2&8Ol&ovI
zyBfERX)dDHiJUac$k7SI6Go1(=C^ZMvnR!N4WBl)kJZ%F6k;`<yotU_^B*%G7?%3e
zCEfaToi#qf%E``Il3%#kQ@kX5glBnnadD})Xb~T!74T_R+>cj0R<Yubq!pKwkyd;a
z#SokX^lCN3OYYmKShiAG>~38zoZ-xni|^v6k8kV2YZ}_JH2H5uUT=vNH|43K7oUvy
zOXRZ`Uv6Jj`bm_hYt^~b$NqL~Q`_lzKQyhqT|EO&v?pg-er{ojr!c!9w`00@=!}(F
z?z@IgF3Mk#TNLW?7Kbm(FMRN!cAn+SvP<&3MFrv61&flC!aU3K7qv-DN={B5lNjwO
z&Mm@k_bl-im$XkDH6kG~IU#X4{!F5Yy!d-z#^U*!bS0L~fiK2O=fFohl2R+zbaLI;
zA0eCr<y7qcw#%A|G0>~kSvB@b92b+7#qO>fZ(eYUopDx`htR<arS22x;sEfgRX61d
zu31QjOWh+ZMYpP6?6$G2P{feuQ|%n$np5p|KGjBxCq`-|F0RiNr&?#?M!n;*?na$n
ztxmP+?*3ftqb%Z7D|oe;OC!L^+c^f2(5$rCaWf~*NXv?Quq1DE!9qTOjrcl2a`^!E
z<+0F368whqImYrH9l(8Gien*pO^tTYxa=_K1Z9y1{U@=ALDR(+7_|Ma%bJIu)2r23
zrn%#lV|fpQ{%Q@4Wt%gW=V&aQ5y4pQN=uy`H#coo*0ju-0|wF>zQvc(Oa&J@)<DNI
zcq(6EDo1%L?+I&oj*83Qb6M;0<>=Mw^jmoaX9(UbFDQ$cO6ToPF$Tx<IgG^Rip5w$
z7v<(5*v`>g(M?u&{K^fNg?}E7^)=G;FvhTm=66^8S~&k2v37mnveNO}>D6kUW84FH
zo^(|N-N{mq)<#wI=Xv7Z)pA#O9`lT$Bh`Vja}H_ehqD*+lP=<l{+Qn}p5Ft)YM-a#
z3n*$XUmSQ82Z{4*DbiWBKrCV$!DrP~#BplytJM^qa}T5`l+{U7IEE=C@)W)or*IES
zfwL+rb!ys-i5|M_;-<{XoDnx|=9J7?GbYZ)spe_^hY8Jpn>{gZ-qf^NX>mdS%J}$V
zynW{v<}UN(E%TOovKJNP7sk^#4t}T|Fpe9>K~Eq-Cul|Dj-<(>c)&OZ=(ypSb;0Sx
z1CIa5Wz|AXuU04MTURgxoS@apA_iQt+9`IWBA=i$TTalJ{6f0BWS8W73q8d-OL7ac
z+Xfcx{2(f5-N8S``Ao;^#$z^I&iULG=W`duaD<aPIWHvmDi$BplH7y%<Q^#=*2$xA
zSgY}_d@bma=MV<f^;3*}&y+A-aWEH0NX6vV#V34$;@TNPQGWl05eJfr!3VNBa3D*2
z1;(CgW9)}c!uZcWwbL1gurbkW{6n4pwN#smAO2Y=%0{djMk*?e<9Y^+tKDQgi{b@5
zR|mbn%134>8>P3M$%;8P!noQ^#ZU1l5mc0oST&5&?Y+X8V-udjnlFeNHa4Po=j!m_
zqHIiH<1phKdyK`gu5nXw&SOGRHe%H<Qc*d_T4#<8e5~6)b3AXhD@tb^#zwl=2EBbN
z=GbEe=Gb6U@z0?`Q8r@LFiLmtALqC}Fvr(N@*I1kxM7U&Rwd7II2(tWjnzIss#JV-
zyik;lST&4PRL(IYFvr)uJjWp@R@6l3=9tLFA!g%$>-?xvao)Q^Q8r@LFj7%z?C8vK
z7te7VikE*9tuu~b<6xt)=OD~+mz#<wl7*sd#HwMWqSEMdjP*Rn3>15oYTt23vXSo6
z`tz}89_CnYQ*r4kp(q=%Y8d7FzH?n~!J`mg*W3HeqW7NpWW3ZyH^(G44m2CL)%j7S
zVvoy0Q8r@LFj7%D#|5_pj2=GL`6w0?w$~Yd!o~q+<Ci}Fc8{Bi6%PtU*@#ucNJXVF
z)-hJFaV3gnJ41EGWH!bdjlFunSmCDP`5K`p8?kB_si-uba*p*eHf}(1_W<F}CBOHK
zVq<@^aW0I<+*JI{K%pobv1%Bps5Djv=2+Q<ubC|<UfSM4H^<RzyxnZv?DL~a#oRZ9
zqHM&fVWgtcxYRLbvau4y&rS<ZDe@f0u<<st@vn9M%1oPz57!Gt*@#ucNJXV_Sm0P!
zKF!Da0E%O>BXx5e%f^02WA8}J@o6^||D7)sWg}J%BNdg#i;nRy&+%gvN53RIrO0y}
z$Hu;9;}jSV+f;mPt5B4UST&4PR2mNkjBkXp@iP?H_7v`1vhfZ!N;?mVXNulyeSTD_
z*uA$<l#N(5j8s$_%N%108^1wu_iu!!6xleQjdA8Vz7J!HO~v%z3Pst7Rl`U{r7^`Z
zma*{?itm0VJf+CSJJ}d(HeQ3V%%<YtFNC6O#HwMWqS6@Z7!R^Bbkp&?b6LWjOE#vk
z@m8bp)?^qD+El!6j!=}1ST&4PR2mO=Yq=M`agmKND2_TRJf+CS32f|bHWtBn(Wc@l
zu_zm{Y8a`gG(H_L?ij|#z9=Sj5bj*EaUvUgnT@-BepIPAu#-@fjaW5|R8$%>9ph3q
zCZf3F7j1R#kCWKg(`@_>#-%nDPdp<OWg}J%BNdg#E;qLv>m8N+9zFrZZz6>|mpsQ*
zHuf+YWBbEc>89e7?S-Oj#HwMWqSAN_|J8w?A9tK$qmAO*`aOWjY`n#6TnOVSHx)PN
z_W-bJ7^$c<Rs`m_GnS9F2gNgg6rNJ#Ii|6(yV>}%&yOk<Yd;c-@*J^h7^$c<dK}{d
zHhNLSzK-sEoWjO#X5(=f7uZxh9U>HEBUTL~6_v(*j&TbcA4M@izXy=c#+!}CxSL_z
zVpH*|Sd@)eHH=hL8tVh+<4zwNH=_9P4dE$8KGsv&c$3*U3r3$!#fgnVQ8r@LFj7%z
z+!ZkH>d3~IP+Xzk1DM9fu4dyiK0m5doIX~2FT|>0q@vR3b&MHotU~edLE$Myp5t^j
zb}<|O0%L|v#Z_+$MR|@`HH=hL8b><D^=zy`@h0&*cG;N0#u%fqPXvtXZ7SXni?R``
zhLMU&V*~bK`TcQMEgO%Z*rrJMj$Jn1#m3HN<0KesZ7QZ03q{$8Rl`U{rLo2_HnH(I
ziizihrxe*ZgN>cc#z$dnvZ?q#u_zm{Y8a`gG_DR9tH!bMKPY;Ogzwm8<4iVoG#lTk
z^P@_|<YJ*H8?kB_si-ujc4;}*Ri%6{yozFxeh(m%jUCL!D?UG}RGhg>``m+7!$?J?
zv5hmweLTmuzr=r{9wOYi<T=`GY;QF79f3LSv#Gdos8E#Wh*iT#MWyjbOkj>@d5+ys
z{9eBY;AUgA*;t4<qDsa}?Q;)S4I>qm#!Z1^{ky?D$9NPQz81b?m*+T(jZtRfPM;rD
zDjqr|6y-T$)i6>~Y0Pqri`kfrVy1o%Ad8KWX5(oX7u!@UU#PtoV%0EGQEBYv7++=M
z6cjV`djPZ9*v@F|*B8cDZ7SaOvi7+LtA>$^O5=&Z`S`n&Y@CDQ>{#K>B_HcKY;0>b
z-dpEKm5Kx6gra<`v1%Bps5EZv+;YwA?#b88A{1-%djNCU*v4#p!RJSnikn~1?g3!c
zFj7%z%n8hK_dK3s35t94djRv;7-2Sk4&ywViuZo5eeS`kVWgtc81ER%*|-kHYx+Ha
zyV)3SG~N~iW4TSmx919XSNT|D)i6>~X*}Z`>rdFY8O7n^ckJ@{_)|89nT<1H{KTeW
zFQ2fhARDo27^$c<?g<$8M6q!jilg;=0Q1=xYBoOQ^P@_|u#Vb$Ayy3|6_v(f$C%E>
zy(kvy_W%~KF~n^A7{+v)iUT%k_W-bJ7^$c<j&h9a*mwxVqxwC7d)VkQ8gCDQah*-Y
z`=Yh?LaZ7_Dk_cFJGH#`?D>F=pQ2c!-vjs=8!fZ(P8dJ1shE?ly%%EDFj7%z{J=3@
zXX8l}FYEUJ?j>Vcli9cm#_Ki}_v-fmuxflngo;Yzx`6S`QEWVmVuOAUz{AEyv+;n>
zk17@4!e>P^p98?EVWgtcnC=*h+1QAp;d21@vGIo4cmc*@n~FEB(S8m9tA>$^N@J8`
z+{4E9&mPZvM85}+&Bp&3jr|i~++$PmUi}^bRt+N+mBvpxwp=rBo?&Be6u0U302Z?G
zy4iR?jAv{rzO3H^z^Y-SqS9C%Fz$_K;}8_9^m_m~Y`kVRZuj|7rQ$2U*FN`P)i6>~
zX`JU6bJ#cz#UJ#a16ahyt7hZZFy`1){8+ySfK|gtMWwN)W8BKd3>3TS_W*L)_=C|H
ze=CezZ7TNF?*U-dFj7%zJlUb;eB672jq_2wL;Q|iex}G{V}sc^AI1|l6|2u{pL?)s
z7^$c<z8WxAcVlBdiktMG16a()D`w-be124^_z$mk4*;u%k%~&=V#k=p#+4|p)$ai;
zVdG`9@hFU0HWlyJ?*U-dFj7%z9PAi3v2g>6JN2If$Y<jvqj5k77&qBeT&VvX09Fkn
z6_v)b?OV>r>LYC2g5ov(9>D!<yl6H~hw+F_#dq|309ZAQR8$)G1&sUJu(1-wFZ7=S
zSjxr=X5$leepIR0<y-A@4^|B$6_v))=$1L|OXcqi51=?+zX!04jpxnAKluEpQqj`y
z0btcIQc-Cf=ge_6&+%gv@6hi76tMA}+1Lo<YMY7~`aJ-w8b&HAjZMxRYuNZ1icji4
z2T;hyvqs~<u`t%yRBY&_y%%EDFj7%ztaXeHZ2Shrz4|=>FB|`BHm-oN!KUI4{T={T
z4I>qm#`OW?{*i3Fgkp_;4`4YPzc(AJeSTD__=A2A0IP<Pib`XKWAw5ybTdBRGf%j4
z$@jts*yuMK@%hL7UYm+<-Ypd6@2|0H7^$c<c8qGduJ<>8{xJr{vHCrLA~v2e8V3!+
z9Cx{?n4sSSz^Y-SqSEMdjP*Rnz9<gU?*SCE@jJ6I55{_%ikHQrJV&e=Mk*?eTLQ+n
z`mr$)#Z~$}fD$(T$86l@^P@_|a{V3vRt+N+mBs~*(Zj|GDAwrr03KxHw`Sv)FnVk%
zPSo!KVAU{EQE7~Ij1_FOQT$N92e5*T^+x019xzteRCG_(-V3p67^$c<o{DU_X5Ko+
zMh}XA*Z;o&rEENHHqNc{qe{i|`u`UItA>$^N@Hca7UO{~e82Xhcrr}*j$MB5d5Dew
zHXAqB`BA0fBjG|(zGkp$7^$c<E_IBVY<v{O&g+El*k$8NHhyC^;`5IOGTl_%A{J#M
zRt+N+mBwL?vHA0l8&UkZeh*+38&4UHLn3|t15dlDc(;BJ0IP<Pib~@}$9R~}$Cpri
zO1}qC#>TJB#wjo!wyC&PzXyO-!$?J?@nFDsFqDl|D88fL19+H?Uzv?-eSTD___%%#
w0IP<Pib`XdV@zRV4T|UWdjOBH@n2@+`!J^1R5a`XVAU{EQE5zZjAd;6KQngxR{#J2

literal 0
HcmV?d00001

diff --git a/tests/mysql-query/test.yaml b/tests/mysql-query/test.yaml
new file mode 100644
index 000000000..6ef841238
--- /dev/null
+++ b/tests/mysql-query/test.yaml
@@ -0,0 +1,22 @@
+requires:
+  min-version: 8
+
+args:
+- -k none
+
+checks:
+- filter:
+    count: 1
+    match:
+      event_type: mysql
+      mysql.version: 8.0.32
+      mysql.tls: false
+      mysql.command: "SELECT VERSION()"
+      mysql.rows[0]: "8.0.32"
+- filter:
+    count: 1
+    match:
+      event_type: mysql
+      mysql.version: 8.0.32
+      mysql.tls: false
+      mysql.command: "ping"
diff --git a/tests/mysql-rows/input.pcap b/tests/mysql-rows/input.pcap
new file mode 100644
index 0000000000000000000000000000000000000000..cfec35de27dc2264b60c63bc80fda19d48366184
GIT binary patch
literal 5330
zcmc(j4Qvy27{>qo7#*Xc6k(uD4@le~*=)DT*rFQ(<@-YzN`aYD)^@9G?QFZTAs<6!
z5d{=51Ofyw5fh`1=pdFaH5e5GgG4dT87C82EU2igf@7=C`|sNI?%ImcgogiUukG*N
z=Xu||dwO4<e0RT+safAc%@lZXIjPgW=Y1uci08DF6W`J?m2#p#{rN|enUS&FT|Z7>
z6Z%a#jO_|~&woVg-+N6l^qZZIwe@!?I!$vKQz(*CoK1xb3*IqKB;r{Skys&ah-mZ@
zaZftYh^qDbj}Q&iR1hzPi3N=hO>s7E-`)-4b5;$Tf%<64YJ52GA`!17hilw$P3v#1
zwZDfCvwh0Hu9_C&Tk51HwUX*w{|#+ds8kvv9~F@$wLZ)kk=wWR)w<zYTJxWcpf~N)
z^}G;GE@)i!8PUV!^B~9fHSiLz`A$jAO`soy3xTi;L?klRI-*R&UPkS-LOqJ|b)9ZF
z5zjp&sr4Y$T0czDW7-|+RJhLRprqty>9Y*1Kc40dwvN7U{<0-37z`>|ux$vo^*-*H
z@^r!CO#RAv_S8I9YAG#uILpkQa!a<k%Hr{?aJj9F%F9G~2?THCf(OPB+#OHwArRG=
zQ(CgN2LhXjczI?_;xI*E(V*~XhAcdRmz!R@hl|P#Ym@x%cDcMvC@kJlld*Vb-K1la
zzTOkO;F+~HY5fBC(ZcPcx6aG5``37F9&a2YO0?$E3Wv?<H9IYpwmYY~GH2Hn&zqGw
z+3l#Yxm9MDC#k~Wtgh{EuBxzj?Jjp^lBLo*E>~@?a#%IlhP-_JIK9^FvAOYabGggo
zO)=zUXBoz$Q90!DS0a}s1DmV6hY!Iz$q;n6)|S=4<?irUg@=HMYsxij8hoH78><4{
zy_~o*CUF>uk4MJp6b-8q5QU1kgB%(*8%$a<Zjo*T=X%B5>ndI;aTklZ8pc!v!Xo%u
zz!MDHW`bYQibtcYCawAUK*_MR!irNw+z+A&bXu}un-O@Kh?hHK5;1HhTV&WcQ3r~u
z*tkHL^XP12u~6-`kFQ*oOZ$20sf4zqaa%kRTL!|GjW~*>wzR?)I+2HMd0@GQ;cUm3
zOvLoSD=|fEge}7X516cC5jcQI#4O{a1;P`?`Nh-c&dC@<8a~2q8t^79S!-)`_i+vR
z5)H$lVL#WfP1M>}2v8{Q2T5hM*+J|d*%#9W+1=REtzdXR3DxwF)_yo8B=J)hHYM>*
zR8?JthE2t%Y01Rr2ewdESJaXY?uYm%x%dSU@!!%+kgWp=y9?L^b9_G+`?N&tlMs7A
z(y-5Qe0(cu*oS~uV^6eXHJ1gp68!RcNzDgPb2+d1Sy9cOKM2ZDkFCO1>J`QccDJii
zpmSB0!-_MK!(Jz>D7U$7LgeKmLJ=w4T%%#X;;Xb|?Yy89sED)85{2bZ*uoXwjI{GK
zDb(U+?@*G5EEUk+&MJziqc?--C=+!w3mv7;sHxoKaD9;{N{1Eyv_)(Hcq$bg_yy>E
zf^S5=8hJuH#u)@V#shQHFETeRkY9$4v}8S46xhal&@SmgOIq`dA&}o`@<w{_9p>ir
zNKjI_@X((grpw9E=jgKy`T2PUL$*F!Z!nSTZ7VeF5<W~z=K9yVk=*sK#ID~M0@r)E
z>wiRCKLgjl!_E{+*vPH^S2n8tlZ|TFIEoGDmXhEYVtdUV#ZTNX)Fz5@9X!Nz)kVw>
zX#Mu=B_{!n73JD!dpK|%5RoNU##m7<P?h>qI_MwAh;rm<TbO(pWSTizvH{8M;Md%)
zdP&V6gPtL|*tB6l&QR~SuS^u>d_Pm~Gb~ZPr&=?pR`fnP%JDj*qFf3}RO?-(<5y2G
z#)xvd>H7S%Y4(BvGZ(IilVGU4CX|;zFpmUXYhwtmjwkpF5aUO=ju9mIuVXQZ;wZ;0
zJb|v?T9o_r`UivUN7fxX{>ulGmu?<=$hc#`)z2#P2Gq5rZQbjte&u#Xxr-u~B?Fu5
z`-Km|+ma!uwr7_#NTM7c0_xl7XA(s@->;l_ASO{9<v3A^X%9uYP2k4A1p2OW?mh|k
z8D6P4vozCTg-c*`lzScU1jCj_@UGS3(I{!a@jy02|4{lqd~_WLF@BWm;PIr(9+N1J
za-0}H$`!0iXv=Thmc0^N8eq$Aeg^MLxMa)sl4MW@xC=)!E!j!O(!pa#*Bpt6-LPc~
z-~rRB(B*-^u%&qnD7Tahgx*YGS)C{o_<kpC={F_Xwm{n{uB|T<aBcsP35po~+)S>=
zpT3lLTQfle<d>itS~B<NbO?MXmrC3}Rh8;5g#1pEL+t)gP@*$IGS5fY$S;Z0)+7o7
zzCZXFQEu(MU$Oxg1Aif`{()QF7X-M~w=)PRZz%{Ux#~CT6CU<F{z!vB$q!K8UOy=M
zzSH^(G~aag`y?ST@GALurC+3H{4P;h4|1F@29aN;FM(KxF42-jwB^2Qyfamj&a|U5
z7kOtILQ{bH&f++{kONAvK|NYOzF2RV>hcN}r(kotU2ef`vsiIcMJRPuR#rP5r53Nl
z<rJzcrORzz4@qO|G;AEcPD?h98H`aO?QcY+@zhju5g%rc;jUlzhoM2UgA!kkZWK|@
j@mqjI()#IU*9{*MXYhZP^ZdV)6Y3OxHH74>wlMZL-TVD@

literal 0
HcmV?d00001

diff --git a/tests/mysql-rows/suricata.yaml b/tests/mysql-rows/suricata.yaml
new file mode 100644
index 000000000..4f6e6be34
--- /dev/null
+++ b/tests/mysql-rows/suricata.yaml
@@ -0,0 +1,15 @@
+%YAML 1.1
+---
+
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular
+      filename: eve.json
+      types:
+        - alert
+
+app-layer:
+  protocols:
+    mysql:
+      enabled: yes
diff --git a/tests/mysql-rows/test.rules b/tests/mysql-rows/test.rules
new file mode 100644
index 000000000..075d8ba43
--- /dev/null
+++ b/tests/mysql-rows/test.rules
@@ -0,0 +1 @@
+alert mysql any any -> any any (msg:"test mysql";mysql.rows; pcre:"/(?:[1-9]\d{5})(?:(?:1[89]\d{2}|2\d{3})(?:0[1-9]|1[012])(?:0[1-9]|[12][0-9]|3[01]))\d{2}(?:\d)(?:[0-9xX])/i""; sid:1;)
diff --git a/tests/mysql-rows/test.yaml b/tests/mysql-rows/test.yaml
new file mode 100644
index 000000000..2dea04e54
--- /dev/null
+++ b/tests/mysql-rows/test.yaml
@@ -0,0 +1,10 @@
+args:
+- -k none
+
+checks:
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature: "test mysql"
+        

From d987e7e4995fd47176421790cae232a1fa973741 Mon Sep 17 00:00:00 2001
From: QianKai Lin <linqiankai666@outlook.com>
Date: Tue, 8 Oct 2024 11:39:26 +0800
Subject: [PATCH 2/4] mysql: add MySQL upgrade to TLS test Task: #3446

---
 tests/mysql-tls/README.md  |   6 ++++++
 tests/mysql-tls/input.pcap | Bin 0 -> 10213 bytes
 tests/mysql-tls/test.yaml  |  19 +++++++++++++++++++
 3 files changed, 25 insertions(+)
 create mode 100644 tests/mysql-tls/README.md
 create mode 100644 tests/mysql-tls/input.pcap
 create mode 100644 tests/mysql-tls/test.yaml

diff --git a/tests/mysql-tls/README.md b/tests/mysql-tls/README.md
new file mode 100644
index 000000000..c5e1ba166
--- /dev/null
+++ b/tests/mysql-tls/README.md
@@ -0,0 +1,6 @@
+# Test Description
+
+Check MySQL protocol upgrade to TLS protocol.
+
+## PCAP
+From my desktop's docker.
diff --git a/tests/mysql-tls/input.pcap b/tests/mysql-tls/input.pcap
new file mode 100644
index 0000000000000000000000000000000000000000..c07b5992124be177cc321229d3aa81a1b54550ee
GIT binary patch
literal 10213
zcmch7cRZH;`~G#i?Y;LV%HFrVGqWjslf6llEfU!xd(Uh_k&KKKSs^7OWJFfk-|O;x
z9-k-meSW{!?~k9?>-6HjZ^wC_$8o&R`@F8(XlHFM5`YZ+_X`<-fxmPXBj3~{#RF8p
zpP@jKtsn&8NV0u&XrIu5s{kNg@>3d+Miog1ABREDJ>0}zu~UzphmdlR4mR~~fPaOI
zQjd&;jwxfQG6+2mgTv7v<e*=WA<Vz<|3U@;2zf3MLWR(=R~~L|7CIGx=nFZ7Cz1a|
z_Md?nLg;@ZCxFPZU?wPjt689A|E%V`3pFo*=!HS}uswYZutwNfy+aT(R4XMp9uNzn
zLGf4r|EM(>kp&@^RbQyJ5UMqZ9Co6g@fYHM>KsxAQ7}cgc(`~09Pmdhn1Hk+t*I4o
zdU}ckoX(JdkNxLMOiP~eu9p)1B}RU4z{<kP&fevwnWvovpP8G5r{^tK59>3L*unDt
zrQw6KhI9YW@Yes<@HQnLU<(!j#cveqmmHoU-uWXUIY^=BIfd__rs=_72M^27n)-b9
z{r7JW&FEDB?BjwZ1Q6M0G#_1{dCN{c1|96<<Zt1?j7Fdx-a&}gG<X09=w&D__5q_U
zIf4*{8-DF01|77*7AV}Ffygg?7?HwZz!wl{77q8Wm*wHL(YjsPkiDg(B<K>#nqx^W
zb~pJg^@$K!g1sdD#0)#XR(qAOb-k>yZu$!YAr$uFh5~P=32a*w)M*9;z)S=qLL!2<
zbGNg%^R#meln#`%W3&^sW403m89*k$4G035U@|X&3;<4H(22wZ&;e9{27G`VzygrK
zN0>k&aR6d~5E+h+j0{78qobg}&{0ug;FJ6S3&0G%nm&hlaB-HA-^bU2Et^YNWRa2q
zd;Yi*c`%ym6ALa~CJVp`V!;4*00SM442Q#!;4p|gPmsI+y6QJIa?aE^{DT^htB(Jq
zh9xZ?PzY8G#c#*x5hC{t@zEa<$w9>0^J8QT=}QWS1Nuk+pbLi&GCcA6^4Nl)jV2n2
z)}|@GBaeX8?^(1dS{BA!ZwY_K|4|JhkV|Zk0VFsw$Qu$sMht?(&S;ot!~=A|r=j@G
zLRU+U&ny&k!9rV`h0c0s7BWA#&<JQu<G*mh(qX8eq)7iijg<WVZX`u;+LHk?$R60W
zk^y#eNirkeDc*t~4=k)rZtAc#>3gib+?Tc)HkT1d&r{YdzQctjNHf_*O^aViZGx7T
zuq<|r{HWr1-RFOCnhqNtFpLhI#YJDBcOmj1iu3G$^@X#Zoq8-Br1;Q$=G+%%pf5%s
zU!;S+cm#*n)!q(lWaw}DE+ocZ`IDmjO73!MtJ1Yi6e>&3FPTx5|5v`yIQPY0BvhK_
z(Y<VYw{-0;gN-Hgd-xB_4o(yXwnuaw8wS*$iB^NU0Qa04iBlgrch^(*dlo&7?!zx%
z@Z3yDlpxKlLk%JW>my6d>J%(G#?`NkFS~rRJhTbeRheE!y#_reX<fd36T_x_B|ozC
zp7LP5E(OusttI@ViUw}sA@d=<)NXEyW4#@rqw7vWBI+IQ`ZwkJ8gdA<3D#)Vt|PvH
z5U2t%ID~!$h=_c*?p5C?-@`3__L+C@rP|1S?#bz_C}z_6ynMkd6u93LVaXic7UMY%
zyg(9Kaw>heJf72pVIqds8nxwy;ltzRw3ZjiUn1P{EfXb^{_ViMSnn5TQH2i7WOpYE
z*h0vAb~<|cZntQZGA>g;nQNXD+&SP(nOmGMf2b^~xX+xS<KC;Xf~$UY&fMnqd`)Pd
z2HSD7mXN#ijqi9PrE)D~6x%HrVm$R!xquqI$l_q8&w*OY5L%D!KBpt=Ts_qeod`8c
zDzT^C^8L^d64!6H^h0QRY|(+SJ??#+c8kk&h(e4bkDTkFH`^%75=|-{%J{`9?|m<@
zq86sD@5&8hwY8v`Cl21`pgWB$Por~16Dt2YOEAo0k8&i&+Ox!i+km;=#!Kg>zPajM
zo_`7Tfs3?t7%OWCtxwJKJ(RIUx^Bl!m>yaTZCm7Ov_=zOx^`Jnc9su`P}DSI7h>4D
zi+#pfsp49SLPbhd{AQZ(8V?!Ya3U@B2GQ*ME6yRCIi#uN0lq0@Yu(P#4EBT82^gh!
z*2_u=V^H2C$=teHU#xH+7<Q@GP?Pp~U)dh6(D89?hC)w%I$Rem*y#;rXrLJX>dEW$
zdU4SQXtCC#SP7!X5j10j{dDsW@Y=8p3mSrnl{mR(nj5NhNVNkcPaWH&d0LNcqq7Ee
z4Y&}!q6*iVahKKA>%KH7nPa&<DFePIouJ&mR79)b{=u*ZYalWh@A?A|p=-{<Xoa{-
z+yf=k+0tVwZNZfoK@M?2gdQER=tQTmF8tGk;92uWS3-Jr=iuYgOVwrKA%>bnuW`Mi
zMDvn_Uk*vF<u*!)s}YA=uU0Td?3w*c-Zd2rbHYgZ8s9shtd6>FUKD6L9Hh8+prnb)
zh#9x&=tF<+Kr_dKSAm)FlYf!bO$C<cL_D#2Dbyce4Ahb&q<|j*Z$wf#zd`+BE@Op0
zs^bF<nn$S$o^!cat(F4hP3|A*gS8bI_%@;>?M6T6z2t3UpX;(B&zGb5lxJ4^K6u-n
zJUKG^J?W`YP42zdt?#$zGt#P#yWDXeNT|XG^;iYejQKH!B3U(}W(?ay;*Cw;q>Tk~
zQc(8bs@5Ae=!ZlaF`@{N8}_BEvfE(UcC}v>l&01SMsmG7`)bbk`=KPtLB7eiZL;yu
z($FjBEk_f>9-Ol)`f#*$**(f*B-7XNql8ahtvuCwiYAIu>JYu-d}l4J0oZjJLuxlY
zz|+U$-rSfl@ab{D!$B{DKcPY$O8hDu%@rjPPl9P7$b4${$mk_^z_(t_r`u(>SE$Wv
z;By~H;}2UKm}D|qIMUFxd#?sA!dF!{PBR5LL`$)?e=xoF!TVAE_^uDDvDBrP!3V6;
zV$nHw<X$^lZ0PRTWV3Kj5~Sw#l71qfYV1qH%&Pn_Bn)r5qV1=XvS4mOh<hu@PF`T1
zINEn<W%$A8EA>}N8o2u{$yTYuUT+7OW(5qe2DVMbXOzGPNEA;99(M<1*`LylJmQ`v
z&Wq|d<K6VWW06GjX;kZmO_VKew&cue&sUCbw=Rzj1rv;?>C5<p8BB@%kS|^G-!YN`
zL^3Iom64N0EvT55T)1fj6@2VOrnL&H->Ue%Zu{nZY&s&@dSJ{XgU5HXquGaeO_gkR
zoz&$Rm15$atCr1|v{N&xD>sJHRpo4Hg)-7ztm;`rMUA=@6*1AC*I08imx*zFu_s^o
zs+!T?&PbCYv}XCamTRtPW+J-b(?XbRL^*x$17wrw075}4N|yJEC{?Vp!&!d2RLZqO
z6}D5DMyI0oQ`9v-xPke)1pO@hvYKmgY!CWw@uEfSp;98q3PMn)mv3)OZV?$FEtA|N
z4D1=v?xhVW9u-evxc0ffTL0NqEtX)^cb<yzmrH%kT(FtS&=p0lB;)16+vR1jE~yQr
zqheNMjr&sK4zAyMY&Jhd?Vi5l!1&4dQ|Q5qsvvX5l27+UGxRv8<=vEn23<{ShrK3W
zez7`<89e}UKdEHN2&P6<SaXglju#|}knO2<n(==;{8$wtXm3Twez|*hdQ(bWsU3;`
z4o=Yt>48I^4L<o%$6#}Vu%9N?G>-b=hSak>lV+E2QJEORfl-d!g6c0HpTc&#!8Z;V
zg-LI0S~vgex7;!JV>WGVT+3RU4MG)PHoQRDath~tab4A!-kUTGUtDf;4@Zw}Dj4(2
zE5vi(Y@$;yQ_V50)>?Ob4^0JlJn~Qf%R?in>vf4YI96ZX_^@s@Q<*d-MizraMLT6+
z!x|S~b=&hXN_Wqdw_JphIj7Vsjpl0Ajl1=Cx@1bFZeAlq_0ad|M24kpQ}On=p^9}#
z7j%Tl8b`4#*mEB05I4DOn8Y5D1!SeT50b*dMeWHK=k%Pc_P>j*XHKb&Oq58x>dIg&
z^iznu@8M5-l!Lx*vVt~>HhvPD`}0scam+v*!_||?;TF$P?TpDOVsKr~Lph(c=P93h
zgVi>U-z<HJ<h7-!x6)>L8&guA{VTQkN6<U7pbLHe#|(OQPd04<S@Gd$eu8N>UJJl6
z$P`B#-CIW{{6M&_7w={^)7$YKY=O_?ah-*gDyq;fP0jw#T^ibC{&5*CP;vroI3k(9
zE|IbD%|h=l;4Z!U_bv@?H)G%uX$B#7bKwCS;2sUd#kCZeEjc|~OE><ANDd+%ov)?i
z5F*r_L?scN`>6uybz4UElw5~-*MNAY#V%K?YPV<hs)A2EeSaEG=5pm2PQhr~le_M9
zOiuWdGbaQP?~n~A%tt~9wtWFJ(z+T{3LC6_b|!QkydIlWxN+Bw^tDc-6J0c!zX>5<
zX8(ZXNwX%ODWNAqh5HPDsV;U;=i%Y2<q7rycbOttv^x(I$i|{lmfeAE3N}f(tp~@G
z=_|R><s<<gG~69{t5YQKq4pcO@c>?MBZuPR$_QgZ6hQ5lq5rxvdVc{|#%ge7JTQ<v
zUm49oQpcg<S4Po@dJVePLw~j<vkO)|oOF=aQ+UV6>7Z6TYV+gdQT;6&xhJ&vJ+8q!
z4-M=C*D0;+?#JnU6_O>`Y)5FE;^NkQTo|!Aoc&3P=J}!4Hn>pBOH%NbM7<<aF2jUS
z<>IJ~f+#S!**1PfN+`y8=W4#pTQ;(!BfS;5+B|OeA6{$D$O=Y5#G@~K3$pY^a!ye~
zY16z{X*l?=q>H&ZY<xRSRzK+9opee%jKHVzAYa}8dFS;H7i4uqG!l*j(cqmcpHvlU
z4H}ih??yKrIWN#feoz{z7Cc^%uB3})YUc<cp1sYn94wE<c0~vxaQ)v2EIcC+?N<VQ
zM*o#Sy5(HsjAA8;ytp~0$VSq7N{p24_0{?{SDJ~(%B!zeZhpM2&lsy5uqDo~IsM(a
zEltvMWcd3?3(loBU&f}#oO7ZNZfxgsN9uB1(s=bvr%ePof+AAY2rJM~i~2chw?nRG
zVblYPY`=$^oBAVa)C&HSmF8a3<*7v2(e8)tB;GJXqkhKf+7GKA^6VO)tB{K~jUVWf
zwqh<@r>)c=OIzSHbbg(a*v+5%fb(F%-_j${-I%2Rz8liB_@vOznJ5FL^n-qqo~nmx
z@8ClB*+^`={7ET4Q`)Zy?l~EYzBL)te-*wmcjL;Blp%;fdLBF=5<GlRTy!AdhbTHD
zu<BO=Z*~4npnmf24wPYibE&||xRAQ$OUr<xY~61EP8@6h(KiG2m8j09pidq?8#%h`
z4@#9CYt}XrQb+DRraR%emiHMMQOjXA*?t}EtgaBSuK!-PL;3$XYDxj9u8Vi<Vyia`
zeK9VK8fY+>L!Dyt;Q@ERE}{5s)VP$w&JfMPO#iqC_#Z@Q)Z9NGHSZxr=&T8<@7nNX
zJi$*Q^}Fse3aCFRu)hE1$*w~_T}0&03T|hAJg-)KFDoq*+C2Yz3gVS7SZaIY3{WjO
zU@fL#9Z>wnx+bFdjP;3MS@*>NSzm$9y}si)>lWa-e-G6{Cehwr?N=`LxPfwm$ydfR
z#ueLp|Jv41DBB2_%?iu}#c$d45G7~XhA(8hbe_%a_iWVGp6hRhZ7=;y9C4dxRp+ja
zT4}z=^70z3N%D$2loE^oU*$tOBRlN^*(;!Y3K!&q$hLqG#|7{J53m6!ev{9-6n=(i
z_eVrXzQAAPvw$dLzdd@xF329o*YiEvcG|m*Z){k3_@&wdi%c^Sw(pTGw|&r@4Q)TE
zhE@rXLKUnC;sHrub|`+M@gAb|jK-V`G%DDs$5Eb%mU~X4<=>*Iq58d@O_};yUHitk
zkG%ye_Db6HJO#$`iS#Yjm_pv;*4HyRb;0)j%K3Glli>2&BmIsUE?ze&OUV7|S=xTQ
zqAcm%cYXH7Jkcmt5Y?;;tdS@6uN%hD(fN%ffl}l%mY{o6|1fzRCCGc~ue_@wfxKHn
zi0wEq0QB2g{Dx>!igJeN{6|EHci+ExSEYv#A>Nta$jH%fE8eyAjEy#ze;#Omw?fQd
z7EYC0Snc%FuDfsYI&$L-lzNB&27ComL-8Bo9}s0{gsWU2JQXBd?u_ugbHdAIELG{D
z)Omrk&e|IWd;3%``}kHbId@XyvapsseAg{YU5Xvj$|fM(A<c8WZ?cs%W~n8xia@*P
zExqB2ivyvFL%Z>je)d?x6PWDibx~~3nV>8W6}3ak6z2*SMw%&)j?wO~Iy)XZ6Zv^)
zN7K{VLiZj#$}$SKkM!ubP&kRH7B^CA=C~_S>t6AAS2*Gw5sLzY-ROvtbQo_v(wOP}
z!le1d$jE4$D;-edGhpNYGW<}_I8VO7x!h*qZK(??GJu?yLx>TKFaQ@^GN8DqA`B=+
zgAj##|A+{xXh3zY;w1<XqOxa&4Ns~vX8O7bhSmvNp{B_&YnyxO3j@z|mJB(jI;8lS
z&IETLT6~DHvn~<ylPT2=3;M)Ik60|J`j@KStLnA48+NBVe9Pe3m-i8S(7)Qz%uWAp
zK}vE%GECdlk7>r`u~8>auWBXxhpe0SbY!Be3C*b4SZl|4R|g`W_MsFPvycJ(G9%65
z(W!dV_oXDh?qJ{t!jiKE3Sh-}V!C0i+;It0b)LgjPdP)jTh|y8QYcOiCp-OWKkvr(
zQ5<kIJ{fn&wjx77>`<}7fGW^rQ2b`JTtxYq(L#SU+HEO2^>{qcX#4ul&y7|M8toFq
zj$P?Pn`54eiWs7HlRJaULmV4&H3#Amq&wUt31bm`E){-Uo(xYSGWiqoQv8K9Va1Pj
z%{-=`2R1pB5FNz&6V1Sz2^jqefwdPx9cj`Pt=|y#xh?NT`OW>JyrsR$lDyV?o7$CF
zelS4gTS>xzMX+=zE{Y3Gl%k)Bdtr%=#{=zB0hYh3zkMz)2PkeeRDQN4HlsJIVK~|_
zzeo{v|K;~`Evxt5iIhpTHcHKXn_b|dv73<+7u{{qG?G%3n&z55?cGF}Yga!}j?ugp
zQbLZlm<0PM)U(Eg^mCzqa;%&uEm&m&k5zs6vb9PC6Oueh*R8R)?VtP}$kJNF+$Z@s
z7m`B-o*!MB*okCFh$?(M8racvOFA+9-O;n>;enxtlDRU$s@mpUQhXy>@Hn~GP}gFz
zFrX6b7>eIS%RyB9QM3wBv^ucspZd?vMSBX0#sPJGb4tiJE)7ZXP&@ii9o0ygm6%QA
z8Be}P1BPB_FseNgL8g@DsGPRRWqzy&SJCpf>V%^NUE_4qLY_yA_*X|%ait9S47^fJ
zp%bjJy1%X8wwh#X+h4mJSeq`2QamN>Qse-;&1Z?r0acH#0t48PfU~%$84`6V22?$w
z?AHSsU$<H4M-FLbh&b1b8`SJ6SUqf>ImyVWV*Q<hK&Tk$WjJhh(4ika#O7)>@?!Lz
zFXfgL*ZfcsUYdch?a%9z-&<U5JHAJ0-pSZD5MCH%(@YN}nvS{Qgb{dHHPzBti#=HW
zdd?3g>BzsTIm1%UJSjpb3rB`S-;Pg{BK0{j`|Qr$F7_~Vn=Otx#mQDTuOEjBJ73q3
z%^QOUMBK95xKCDo%sy4|G*0FAO{`Q1ixTtt*4$E|z+I$tiuoz`8PR-FVH;+l&tx>x
zR=s_V5TDERaWb+(&trDLrYm(5?q6P5kN$*&-cqkj@2!%9_c$Ytbl~WB9;`5_u>Or@
z;<u?3CM9O-p_Mc3E}Mx63T+JYVN+mJPwd3A@<qx=Y`@I1a5=7Ho}t$rMR8&y+>UCM
zX@GYB?qaW`$m7j5t?V{zHetMW0!+iomV37llEwvd<sLh9;?~Q>YewPT3U%h(VIPK&
zzw=dXajqrpWY_~dc|-Qa;X4>)ow<D~<SE{qc3w0_-L~P<KfhW$+3LGKfJ5XMJcTcS
znfbiqhr;JI-?Xc(qO0XTT8n#)c8qTVS5qkB_#fy|N74m}V4k!*7u4#rU7NV>rLNRy
z#AI?$P*uBaTo4@-dkQ~0b0wlSX)F3hrc`TfjfU-x+Uq!9-zd^fNySpgIT`9OU<e%J
zP+asqtOM}`a!x6<$Nu9JXFqZ~^~7|@IR+okecuB5o*Qz`eO@=>^qC~;XG@6_1DAFD
zUWyl_o+=7$;0#0#+^pfQyMr-HO+~<M7+H7YRih2MSqNDc$z*K6K<cn!m@O*xG}qF=
z8y`pE_e*zQ884V#Nq?v#<AExoPqoi}lMbDh+$fTRKDR%Dd^o4o6sfP3Wzj}V!#C)m
zE?ewTz1Bf?djH;IjLqH-dX7?h^O&o5YrZkRa%%A^+kHtQ>$%V*tYT=jcsa&xfnO;K
z+43W6@LIC>n16l?S0;VHMC?9$WU;SF0!#FOTj(Ob)xz|h+3l(WpAFI&=1=G!t-rCf
zS6WDX$7&TPAPorFF_#HsQN-5ptR*6@LL?lyi58^hdXSpfXt>1Uk47DOAc)_44qGP_
z9*{hl>u%r(zB^O5_U5zNy_P_EHh?sb7>|ZasQ78YjIh}2k_R_#;01kqd94Krt}BSX
z)%*H@oRVyYVKDXG+^FHOPN;loq|hyy_f)i=d|xK?<rnBxiYhZ_#nk6BV|D0Y#QC$)
z1@Q1oM<hRTTZ|(ZQbuNb;uWzVeWmqafGr&S&>D=3lL4+@iV5i}bYbC2Oy4Z@FM{+n
zI{(mGl@FW@Eug+|y1N2P{0v80wI9~q`R=M^1#}!68@)4$wJh?ue5jR$x18pC^6a$4
z9d9qgRXtbQJ@GN6{Ud?vGYtab-|eq3e0_tmwl%h^qwyULAtU_ovP=ZqZs<pK57VCB
z!}Lcfo>;n~!n*ERSUNmL_c*bi<T}%b$zYNkX5HIQE%l_>Xw9NO-3%D&+@<e#$ncR^
zUu+CS5}wf2ihD!nu&BfAH=d9;E3pfB(F}X1yLlKp!3&z{gNJCp>nG=SjH~~=KdF~i
zY#MM!B$i3&p?7K9_VRYCSf2EBF}q|ig?TDjd%NS)t)>^=yP;+zpKla--qGE0r;<6I
zgrO<pU>hb?#Aog8+|L%04&1z9m`K~&n*I638wNfmo~j^|!Ukp<1ZD`qr|;Tg;mm<6
z-}RhjH&=9Ls9(OaiSJdaJD@j2$eNb{^6E>?O5;-*GT6(mB8^ST7TV8wS;QZb_dgPR
z+Oo?luCK~_gnyk%<SJ&~h;PWN;4D0j-c@(Uy;`h{4QUl8uN@nD;S{8)l*e5<<i}Dh
z*7fU)8Wj{zbC_*{aQFvSqvsP1-c%|(*NU)xOJW`<*Kh@<F3~s|Fy|$%Rc`a(rYpD=
zE(Y9a|FoiVU;ig*hNASejb3MFX8l;yG~)f{Ot0#JIiLHG!g7)LSB_{h>KOE_^|Tf>
z64kj62S_8{Q#JDxrl_Kiq866zZT-#ko-T;EFAV4`<I(%@2Y=a@&%?uraq6VD>3Ec6
zWHV@hHSQbe){|be8M3HFR<X6NwZu@6sA1KZOdJztuTyzTg{Dn)K>%<>$lp?0%x{<8
z6+j*56UQt@0uHf(7{%0TluO+9i%9sJq!RMxLn0FNC(*OHC1U&CuE#`obS^V)I-&Y9
zQ@u21QNThU#=tqKW6;vQaZ1waFid|fb|Ol*v(O52$}+Yx%F-CF)1yTu_!GC;xa#>&
z+j+j{m}O0tVX~J4`(0fMu=ySLX&B@TQ!v_tnjg|q7*n!oZd~8oSKg`?6^QSo@yekJ
zx4q`0!}(Ttp;v54mp2u*t>%;7%*++5!4r_s_J#^o2JdzUt*k^3bn0#!!hk7oqC)Z8
zR2@K6o=sJ~U#F^nk)3+V3-Hu!7%ZJn)mCt-@<CHIQMn%PT?PeOQFVY8O1?sye4Rr^
z1h+DOBG6qL_eh+<|N4Z68qw##6a1T8F&H5VbW~VDuTINqEM261Ll$GAH&Y+V<92m8
z*ubnq65d-dC_XIAnPk_vk*i!-5LgjyfXzr0l<<n6t94aG{dPE9>}tTxn39}q90esD
zq90Y=_QiQM-XE7p7KHEPeh3J^dc^4?t3vqA_N$}p>lew%<=Y&RM*Yc4NnbOy#@Y!x
zsyPbA@#x21ZliP`H5Tn?p`Y$K`W^TvbYzHJ&(fJ8WHDZ@C2ntX@rq#xcX;d^(ED|x
zt3JvvknmIUipSj~u4h4s_nUb5_XV#GWlkR--V*5lUPEv34By(bV5~HdP}>gKtCFTT
z0e^8#KtC3BTuF|=B3tYw?c;YZ2b#Xy-(lffcCfXIE5WHy?kR9XASoOoz9<ek!=ngw
zv?XXO0=@cZ@@U`m3B;(1e@%r&xB2h8`E@*gAZ*1XFVpXHobiDlU#cbxu{UUDritw#
zHA>a99Q?&)_K6q)hV7;0yu@J6FZ`j7dXUnyKmPUN3JX$NB<|PEE9J#z;a$lK7gxsM
zd~JONB3iGZ04CrT3dO~V4QP~NpCNkv5fR$I9sb_sbfI0Y74!~3Dzz65u!oVE|Ij?y
z_<$YvT%dd5+n6Mj%yb>)AJ>Mz{Xa_;l&oy+SEJsQ1dTcsL;&0P`yRai3}&;8r7kyw
zxaEin7=ook@mu-VN^#E0_qkC16iA2^^oFB<^Spdb2o)-y=tXT+15y42PEUS%m9M&L
rz0a#@C=<04Dj)=Af#TvJ11<w+H}&R<FVrptz8KI1|F2K&Cjk5p6!{OZ

literal 0
HcmV?d00001

diff --git a/tests/mysql-tls/test.yaml b/tests/mysql-tls/test.yaml
new file mode 100644
index 000000000..76e72662d
--- /dev/null
+++ b/tests/mysql-tls/test.yaml
@@ -0,0 +1,19 @@
+# *** Add configuration here ***
+requires:
+  min-version: 8
+
+args:
+- -k none
+
+checks:
+- filter:
+    count: 1
+    match:
+      event_type: mysql
+      mysql.tls: true
+- filter:
+    count: 1
+    match:
+      app_proto: tls
+      app_proto_orig: mysql
+

From fbcefeb89ffbec65972b4697dae137fe5d4aa316 Mon Sep 17 00:00:00 2001
From: QianKai Lin <linqiankai666@outlook.com>
Date: Wed, 9 Oct 2024 10:22:55 +0800
Subject: [PATCH 3/4] mysql: add suricata.yaml in tests Task #3446

---
 tests/mysql-command/README.md               |  2 ++
 tests/mysql-command/test.rules              |  2 +-
 tests/mysql-command/test.yaml               |  5 ++++-
 tests/mysql-prepare-statement/suricata.yaml | 15 +++++++++++++++
 tests/mysql-query/suricata.yaml             | 15 +++++++++++++++
 tests/mysql-rows/README.md                  |  2 ++
 tests/mysql-rows/test.rules                 |  2 +-
 tests/mysql-rows/test.yaml                  |  6 +++++-
 8 files changed, 45 insertions(+), 4 deletions(-)
 create mode 100644 tests/mysql-command/README.md
 create mode 100644 tests/mysql-prepare-statement/suricata.yaml
 create mode 100644 tests/mysql-query/suricata.yaml
 create mode 100644 tests/mysql-rows/README.md

diff --git a/tests/mysql-command/README.md b/tests/mysql-command/README.md
new file mode 100644
index 000000000..b2703e415
--- /dev/null
+++ b/tests/mysql-command/README.md
@@ -0,0 +1,2 @@
+# Description
+Test sql query statement like `select * from xxx where xxx = yyy` args contents.
diff --git a/tests/mysql-command/test.rules b/tests/mysql-command/test.rules
index a74b8ebd8..1aa830fe2 100644
--- a/tests/mysql-command/test.rules
+++ b/tests/mysql-command/test.rules
@@ -1 +1 @@
-alert mysql any any -> any any (msg:"test mysql";mysql.command; pcre:"/(?:[1-9]\d{5})(?:(?:1[89]\d{2}|2\d{3})(?:0[1-9]|1[012])(?:0[1-9]|[12][0-9]|3[01]))\d{2}(?:\d)(?:[0-9xX])/i""; sid:1;)
+alert mysql any any -> any any (msg:"test mysql";mysql.command; content:"33030219971120201X"; metadata: mysql command; sid:1;)
diff --git a/tests/mysql-command/test.yaml b/tests/mysql-command/test.yaml
index 2a597e84c..8f5b7f17c 100644
--- a/tests/mysql-command/test.yaml
+++ b/tests/mysql-command/test.yaml
@@ -1,11 +1,14 @@
+requires:
+  min-version: 8
+
 args:
 - -k none
 
-
 checks:
   - filter:
       count: 1
       match:
         event_type: alert
         alert.signature: "test mysql"
+        alert.metadata.mysql[0]: "command"
         
diff --git a/tests/mysql-prepare-statement/suricata.yaml b/tests/mysql-prepare-statement/suricata.yaml
new file mode 100644
index 000000000..070848120
--- /dev/null
+++ b/tests/mysql-prepare-statement/suricata.yaml
@@ -0,0 +1,15 @@
+%YAML 1.1
+---
+
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular
+      filename: eve.json
+      types:
+        - mysql
+
+app-layer:
+  protocols:
+    mysql:
+      enabled: yes
diff --git a/tests/mysql-query/suricata.yaml b/tests/mysql-query/suricata.yaml
new file mode 100644
index 000000000..070848120
--- /dev/null
+++ b/tests/mysql-query/suricata.yaml
@@ -0,0 +1,15 @@
+%YAML 1.1
+---
+
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular
+      filename: eve.json
+      types:
+        - mysql
+
+app-layer:
+  protocols:
+    mysql:
+      enabled: yes
diff --git a/tests/mysql-rows/README.md b/tests/mysql-rows/README.md
new file mode 100644
index 000000000..d43c04e34
--- /dev/null
+++ b/tests/mysql-rows/README.md
@@ -0,0 +1,2 @@
+# Description
+Test sql query 's result like `id,1,2,3,4,5` content
diff --git a/tests/mysql-rows/test.rules b/tests/mysql-rows/test.rules
index 075d8ba43..a7626282c 100644
--- a/tests/mysql-rows/test.rules
+++ b/tests/mysql-rows/test.rules
@@ -1 +1 @@
-alert mysql any any -> any any (msg:"test mysql";mysql.rows; pcre:"/(?:[1-9]\d{5})(?:(?:1[89]\d{2}|2\d{3})(?:0[1-9]|1[012])(?:0[1-9]|[12][0-9]|3[01]))\d{2}(?:\d)(?:[0-9xX])/i""; sid:1;)
+alert mysql any any -> any any (msg:"test mysql";mysql.rows; content:"33030219971120201X"; metadata: mysql rows; sid:1;)
diff --git a/tests/mysql-rows/test.yaml b/tests/mysql-rows/test.yaml
index 2dea04e54..371fe4bdd 100644
--- a/tests/mysql-rows/test.yaml
+++ b/tests/mysql-rows/test.yaml
@@ -1,10 +1,14 @@
+requires:
+  min-version: 8
+
 args:
 - -k none
 
 checks:
   - filter:
-      count: 1
+      count: 2
       match:
         event_type: alert
         alert.signature: "test mysql"
+        alert.metadata.mysql[0]: "rows"
         

From cc4a27559df2e2d515a4152885bed4ee25dfeb5c Mon Sep 17 00:00:00 2001
From: QianKai Lin <linqiankai666@outlook.com>
Date: Thu, 17 Oct 2024 12:53:56 +0800
Subject: [PATCH 4/4] mysql: add more checks in test

Task #3446
---
 tests/mysql-command/test.yaml           |  11 +++++
 tests/mysql-multi-queries/README.md     |  11 +++++
 tests/mysql-multi-queries/input.pcap    | Bin 0 -> 16189 bytes
 tests/mysql-multi-queries/suricata.yaml |  15 ++++++
 tests/mysql-multi-queries/test.yaml     |  61 ++++++++++++++++++++++++
 tests/mysql-rows/test.yaml              |  38 ++++++++++++++-
 tests/mysql-tls/suricata.yaml           |  18 +++++++
 tests/mysql-tls/test.yaml               |  15 ++++--
 8 files changed, 165 insertions(+), 4 deletions(-)
 create mode 100644 tests/mysql-multi-queries/README.md
 create mode 100644 tests/mysql-multi-queries/input.pcap
 create mode 100644 tests/mysql-multi-queries/suricata.yaml
 create mode 100644 tests/mysql-multi-queries/test.yaml
 create mode 100644 tests/mysql-tls/suricata.yaml

diff --git a/tests/mysql-command/test.yaml b/tests/mysql-command/test.yaml
index 8f5b7f17c..143306cf1 100644
--- a/tests/mysql-command/test.yaml
+++ b/tests/mysql-command/test.yaml
@@ -8,7 +8,18 @@ checks:
   - filter:
       count: 1
       match:
+        pcap_cnt: 40
+        src_ip: 172.18.0.1
+        src_port: 35316
+        dest_ip: 172.18.0.3
+        dest_port: 3306
+        proto: "TCP"
+        direction: "to_server"
         event_type: alert
         alert.signature: "test mysql"
+        alert.signature_id: 1
+        alert.severity: 3
         alert.metadata.mysql[0]: "command"
+        mysql.command: "select * from test.identify where identify = 33030219971120201X"
+        mysql.rows[0]: "1,33030219971120201X"
         
diff --git a/tests/mysql-multi-queries/README.md b/tests/mysql-multi-queries/README.md
new file mode 100644
index 000000000..a9bfb3ff7
--- /dev/null
+++ b/tests/mysql-multi-queries/README.md
@@ -0,0 +1,11 @@
+# Test Description
+
+TODO: Simple description of what this test is for.
+
+## PCAP
+
+TODO: What is the source of this PCAP.
+
+## Related issues
+
+TODO: Issue numbers or links to related issues.
diff --git a/tests/mysql-multi-queries/input.pcap b/tests/mysql-multi-queries/input.pcap
new file mode 100644
index 0000000000000000000000000000000000000000..458bc25e8f0cff003ea45ed9091837cbb35edfe7
GIT binary patch
literal 16189
zcmajm3tW};9mnzKa8m(qXlY&owZtomGQ4G|h^VAIN4zv`oe)7u;TVvlRGO}|nz^Lr
z7M0CPQkf>2uIOT8<u+fh)jX6<w_Mqz<!Rm}b;7>CADpN2|MP$S|Ghe;W*^@F-}5}@
zdH8p#tF8WRh!tl2_(z!K!cRWjcs%c(eJ*P{eoQYbdSLnMFXFGie!f#%E6uX*aQB&D
zO^A3nsj5@tmv}9CZGQB3JCY`yrr-QZ$RiIGJa1VcVd4A3LfS@lyCq{Y{kkhOv<;Py
z?ib2vHusy$mNmgjiTLXrs!~1ryVvH|M!m2C_4-$08aF)o{*Pt<Yi&DHJy8B0<w^KT
z^lD{Ja`$EPILTa(dg+=@*7bsoFuIz(R3_`fgD&frh|#Ng{Xy2XS8gTiv2&8Ol&ovI
zyBfERX)dDHiJUac$k7SI6Go1(=C^ZMvnR!N4WBl)kJZ%F6k;`<yotU_^B*%G7?%3e
zCEfaToi#qf%E``Il3%#kQ@kX5glBnnadD})Xb~T!74T_R+>cj0R<Yubq!pKwkyd;a
z#SokX^lCN3OYYmKShiAG>~38zoZ-xni|^v6k8kV2YZ}_JH2H5uUT=vNH|43K7oUvy
zOXRZ`Uv6Jj`bm_hYt^~b$NqL~Q`_lzKQyhqT|EO&v?pg-er{ojr!c!9w`00@=!}(F
z?z@IgF3Mk#TNLW?7Kbm(FMRN!cAn+SvP<&3MFrv61&flC!aU3K7qv-DN={B5lNjwO
z&Mm@k_bl-im$XkDH6kG~IU#X4{!F5Yy!d-z#^U*!bS0L~fiK2O=fFohl2R+zbaLI;
zA0eCr<y7qcw#%A|G0>~kSvB@b92b+7#qO>fZ(eYUopDx`htR<arS22x;sEfgRX61d
zu31QjOWh+ZMYpP6?6$G2P{feuQ|%n$np5p|KGjBxCq`-|F0RiNr&?#?M!n;*?na$n
ztxmP+?*3ftqb%Z7D|oe;OC!L^+c^f2(5$rCaWf~*NXv?Quq1DE!9qTOjrcl2a`^!E
z<+0F368whqImYrH9l(8Gien*pO^tTYxa=_K1Z9y1{U@=ALDR(+7_|Ma%bJIu)2r23
zrn%#lV|fpQ{%Q@4Wt%gW=V&aQ5y4pQN=uy`H#coo*0ju-0|wF>zQvc(Oa&J@)<DNI
zcq(6EDo1%L?+I&oj*83Qb6M;0<>=Mw^jmoaX9(UbFDQ$cO6ToPF$Tx<IgG^Rip5w$
z7v<(5*v`>g(M?u&{K^fNg?}E7^)=G;FvhTm=66^8S~&k2v37mnveNO}>D6kUW84FH
zo^(|N-N{mq)<#wI=Xv7Z)pA#O9`lT$Bh`Vja}H_ehqD*+lP=<l{+Qn}p5Ft)YM-a#
z3n*$XUmSQ82Z{4*DbiWBKrCV$!DrP~#BplytJM^qa}T5`l+{U7IEE=C@)W)or*IES
zfwL+rb!ys-i5|M_;-<{XoDnx|=9J7?GbYZ)spe_^hY8Jpn>{gZ-qf^NX>mdS%J}$V
zynW{v<}UN(E%TOovKJNP7sk^#4t}T|Fpe9>K~Eq-Cul|Dj-<(>c)&OZ=(ypSb;0Sx
z1CIa5Wz|AXuU04MTURgxoS@apA_iQt+9`IWBA=i$TTalJ{6f0BWS8W73q8d-OL7ac
z+Xfcx{2(f5-N8S``Ao;^#$z^I&iULG=W`duaD<aPIWHvmDi$BplH7y%<Q^#=*2$xA
zSgY}_d@bma=MV<f^;3*}&y+A-aWEH0NX6vV#V34$;@TNPQGWl05eJfr!3VNBa3D*2
z1;(CgW9)}c!uZcWwbL1gurbkW{6n4pwN#smAO2Y=%0{djMk*?e<9Y^+tKDQgi{b@5
zR|mbn%134>8>P3M$%;8P!noQ^#ZU1l5mc0oST&5&?Y+X8V-udjnlFeNHa4Po=j!m_
zqHIiH<1phKdyK`gu5nXw&SOGRHe%H<Qc*d_T4#<8e5~6)b3AXhD@tb^#zwl=2EBbN
z=GbEe=Gb6U@z0?`Q8r@LFiLmtALqC}Fvr(N@*I1kxM7U&Rwd7II2(tWjnzIss#JV-
zyik;lST&4PRL(IYFvr)uJjWp@R@6l3=9tLFA!g%$>-?xvao)Q^Q8r@LFj7%z?C8vK
z7te7VikE*9tuu~b<6xt)=OD~+mz#<wl7*sd#HwMWqSEMdjP*Rn3>15oYTt23vXSo6
z`tz}89_CnYQ*r4kp(q=%Y8d7FzH?n~!J`mg*W3HeqW7NpWW3ZyH^(G44m2CL)%j7S
zVvoy0Q8r@LFj7%D#|5_pj2=GL`6w0?w$~Yd!o~q+<Ci}Fc8{Bi6%PtU*@#ucNJXVF
z)-hJFaV3gnJ41EGWH!bdjlFunSmCDP`5K`p8?kB_si-uba*p*eHf}(1_W<F}CBOHK
zVq<@^aW0I<+*JI{K%pobv1%Bps5Djv=2+Q<ubC|<UfSM4H^<RzyxnZv?DL~a#oRZ9
zqHM&fVWgtcxYRLbvau4y&rS<ZDe@f0u<<st@vn9M%1oPz57!Gt*@#ucNJXV_Sm0P!
zKF!Da0E%O>BXx5e%f^02WA8}J@o6^||D7)sWg}J%BNdg#i;nRy&+%gvN53RIrO0y}
z$Hu;9;}jSV+f;mPt5B4UST&4PR2mNkjBkXp@iP?H_7v`1vhfZ!N;?mVXNulyeSTD_
z*uA$<l#N(5j8s$_%N%108^1wu_iu!!6xleQjdA8Vz7J!HO~v%z3Pst7Rl`U{r7^`Z
zma*{?itm0VJf+CSJJ}d(HeQ3V%%<YtFNC6O#HwMWqS6@Z7!R^Bbkp&?b6LWjOE#vk
z@m8bp)?^qD+El!6j!=}1ST&4PR2mO=Yq=M`agmKND2_TRJf+CS32f|bHWtBn(Wc@l
zu_zm{Y8a`gG(H_L?ij|#z9=Sj5bj*EaUvUgnT@-BepIPAu#-@fjaW5|R8$%>9ph3q
zCZf3F7j1R#kCWKg(`@_>#-%nDPdp<OWg}J%BNdg#E;qLv>m8N+9zFrZZz6>|mpsQ*
zHuf+YWBbEc>89e7?S-Oj#HwMWqSAN_|J8w?A9tK$qmAO*`aOWjY`n#6TnOVSHx)PN
z_W-bJ7^$c<Rs`m_GnS9F2gNgg6rNJ#Ii|6(yV>}%&yOk<Yd;c-@*J^h7^$c<dK}{d
zHhNLSzK-sEoWjO#X5(=f7uZxh9U>HEBUTL~6_v(*j&TbcA4M@izXy=c#+!}CxSL_z
zVpH*|Sd@)eHH=hL8tVh+<4zwNH=_9P4dE$8KGsv&c$3*U3r3$!#fgnVQ8r@LFj7%z
z+!ZkH>d3~IP+Xzk1DM9fu4dyiK0m5doIX~2FT|>0q@vR3b&MHotU~edLE$Myp5t^j
zb}<|O0%L|v#Z_+$MR|@`HH=hL8b><D^=zy`@h0&*cG;N0#u%fqPXvtXZ7SXni?R``
zhLMU&V*~bK`TcQMEgO%Z*rrJMj$Jn1#m3HN<0KesZ7QZ03q{$8Rl`U{rLo2_HnH(I
ziizihrxe*ZgN>cc#z$dnvZ?q#u_zm{Y8a`gG_DR9tH!bMKPY;Ogzwm8<4iVoG#lTk
z^P@_|<YJ*H8?kB_si-ujc4;}*Ri%6{yozFxeh(m%jUCL!D?UG}RGhg>``m+7!$?J?
zv5hmweLTmuzr=r{9wOYi<T=`GY;QF79f3LSv#Gdos8E#Wh*iT#MWyjbOkj>@d5+ys
z{9eBY;AUgA*;t4<qDsa}?Q;)S4I>qm#!Z1^{ky?D$9NPQz81b?m*+T(jZtRfPM;rD
zDjqr|6y-T$)i6>~Y0Pqri`kfrVy1o%Ad8KWX5(oX7u!@UU#PtoV%0EGQEBYv7++=M
z6cjV`djPZ9*v@F|*B8cDZ7SaOvi7+LtA>$^O5=&Z`S`n&Y@CDQ>{#K>B_HcKY;0>b
z-dpEKm5Kx6gra<`v1%Bps5EZv+;YwA?#b88A{1-%djNCU*v4#p!RJSnikn~1?g3!c
zFj7%z%n8hK_dK3s35t94djRv;7-2Sk4&ywViuZo5eeS`kVWgtc81ER%*|-kHYx+Ha
zyV)3SG~N~iW4TSmx919XSNT|D)i6>~X*}Z`>rdFY8O7n^ckJ@{_)|89nT<1H{KTeW
zFQ2fhARDo27^$c<?g<$8M6q!jilg;=0Q1=xYBoOQ^P@_|u#Vb$Ayy3|6_v(f$C%E>
zy(kvy_W%~KF~n^A7{+v)iUT%k_W-bJ7^$c<j&h9a*mwxVqxwC7d)VkQ8gCDQah*-Y
z`=Yh?LaZ7_Dk_cFJGH#`?D>F=pQ2c!-vjs=8!fZ(P8dJ1shE?ly%%EDFj7%z{J=3@
zXX8l}FYEUJ?j>Vcli9cm#_Ki}_v-fmuxflngo;Yzx`6S`QEWVmVuOAUz{AEyv+;n>
zk17@4!e>P^p98?EVWgtcnC=*h+1QAp;d21@vGIo4cmc*@n~FEB(S8m9tA>$^N@J8`
z+{4E9&mPZvM85}+&Bp&3jr|i~++$PmUi}^bRt+N+mBvpxwp=rBo?&Be6u0U302Z?G
zy4iR?jAv{rzO3H^z^Y-SqS9C%Fz$_K;}8_9^m_m~Y`kVRZuj|7rQ$2U*FN`P)i6>~
zX`JU6bJ#cz#UJ#a16ahyt7hZZFy`1){8+ySfK|gtMWwN)W8BKd3>3TS_W*L)_=C|H
ze=CezZ7TNF?*U-dFj7%zJlUb;eB672jq_2wL;Q|iex}G{V}sc^AI1|l6|2u{pL?)s
z7^$c<z8WxAcVlBdiktMG16a()D`w-be124^_z$mk4*;u%k%~&=V#k=p#+4|p)$ai;
zVdG`9@hFU0HWlyJ?*U-dFj7%z9PAi3v2g>6JN2If$Y<jvqj5k77&qBeT&VvX09Fkn
z6_v)b?OV>r>LYC2g5ov(9>D!<yl6H~hw+F_#dq|309ZAQR8$)G1&sUJu(1-wFZ7=S
zSjxr=X5$leepIR0<y-A@4^|B$6_v))=$1L|OXcqi51=?+zX!04jpxnAKluEpQqj`y
z0btcIQc-Cf=ge_6&+%gv@6hi76tMA}+1Lo<YMY7~`aJ-w8b&HAjZMxRYuNZ1icji4
z2T;hyvqs~<u`t%yRBY&_y%%EDFj7%ztaXeHZ2Shrz4|=>FB|`BHm-oN!KUI4{T={T
z4I>qm#`OW?{*i3Fgkp_;4`4YPzc(AJeSTD__=A2A0IP<Pib`XKWAw5ybTdBRGf%j4
z$@jts*yuMK@%hL7UYm+<-Ypd6@2|0H7^$c<c8qGduJ<>8{xJr{vHCrLA~v2e8V3!+
z9Cx{?n4sSSz^Y-SqSEMdjP*Rnz9<gU?*SCE@jJ6I55{_%ikHQrJV&e=Mk*?eTLQ+n
z`mr$)#Z~$}fD$(T$86l@^P@_|a{V3vRt+N+mBs~*(Zj|GDAwrr03KxHw`Sv)FnVk%
zPSo!KVAU{EQE7~Ij1_FOQT$N92e5*T^+x019xzteRCG_(-V3p67^$c<o{DU_X5Ko+
zMh}XA*Z;o&rEENHHqNc{qe{i|`u`UItA>$^N@Hca7UO{~e82Xhcrr}*j$MB5d5Dew
zHXAqB`BA0fBjG|(zGkp$7^$c<E_IBVY<v{O&g+El*k$8NHhyC^;`5IOGTl_%A{J#M
zRt+N+mBwL?vHA0l8&UkZeh*+38&4UHLn3|t15dlDc(;BJ0IP<Pib~@}$9R~}$Cpri
zO1}qC#>TJB#wjo!wyC&PzXyO-!$?J?@nFDsFqDl|D88fL19+H?Uzv?-eSTD___%%#
w0IP<Pib`XdV@zRV4T|UWdjOBH@n2@+`!J^1R5a`XVAU{EQE5zZjAd;6KQngxR{#J2

literal 0
HcmV?d00001

diff --git a/tests/mysql-multi-queries/suricata.yaml b/tests/mysql-multi-queries/suricata.yaml
new file mode 100644
index 000000000..070848120
--- /dev/null
+++ b/tests/mysql-multi-queries/suricata.yaml
@@ -0,0 +1,15 @@
+%YAML 1.1
+---
+
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular
+      filename: eve.json
+      types:
+        - mysql
+
+app-layer:
+  protocols:
+    mysql:
+      enabled: yes
diff --git a/tests/mysql-multi-queries/test.yaml b/tests/mysql-multi-queries/test.yaml
new file mode 100644
index 000000000..cd83e99bf
--- /dev/null
+++ b/tests/mysql-multi-queries/test.yaml
@@ -0,0 +1,61 @@
+requires:
+  min-version: 8
+
+args:
+- -k none
+
+checks:
+- filter:
+    count: 1
+    match:
+      dest_ip: 172.16.10.104
+      dest_port: 3306
+      pcap_cnt: 14
+      event_type: mysql
+      mysql.affected_rows: 0
+      mysql.command: SET NAMES utf8mb4
+      mysql.tls: false
+      mysql.version: 8.0.32
+      proto: TCP
+      src_ip: 172.16.10.222
+      src_port: 42074
+- filter:
+    count: 1
+    match:
+      dest_ip: 172.16.10.104
+      dest_port: 3306
+      event_type: mysql
+      mysql.command: SELECT VERSION()
+      mysql.rows[0]: 8.0.32
+      mysql.tls: false
+      mysql.version: 8.0.32
+      proto: TCP
+      src_ip: 172.16.10.222
+      src_port: 42074
+- filter:
+    count: 1
+    match:
+      dest_ip: 172.16.10.104
+      dest_port: 3306
+      pcap_cnt: 20
+      event_type: mysql
+      mysql.affected_rows: 0
+      mysql.command: ping
+      mysql.tls: false
+      mysql.version: 8.0.32
+      proto: TCP
+      src_ip: 172.16.10.222
+      src_port: 42074
+- filter:
+    count: 1
+    match:
+      dest_ip: 172.16.10.104
+      dest_port: 3306
+      event_type: mysql
+      mysql.command: SELECT SCHEMA_NAME FROM INFORMATION_SCHEMA.SCHEMATA WHERE SCHEMA_NAME='sentinel_flow_admin'
+      mysql.rows[0]: sentinel_flow_admin
+      mysql.tls: false
+      mysql.version: 8.0.32
+      proto: TCP
+      src_ip: 172.16.10.222
+      src_port: 42074
diff --git a/tests/mysql-rows/test.yaml b/tests/mysql-rows/test.yaml
index 371fe4bdd..a9d2e7e10 100644
--- a/tests/mysql-rows/test.yaml
+++ b/tests/mysql-rows/test.yaml
@@ -6,9 +6,45 @@ args:
 
 checks:
   - filter:
-      count: 2
+      count: 1
       match:
+        tx_id: 1
+        pcap_cnt: 41
+        src_ip: 172.18.0.3
+        src_port: 3306
+        dest_port: 35318
+        dest_ip: 172.18.0.1
+        proto: "TCP"
         event_type: alert
+        alert.action: "allowed"
         alert.signature: "test mysql"
+        alert.signature_id: 1
+        alert.severity: 3
+        direction: "to_client"
         alert.metadata.mysql[0]: "rows"
+        mysql.version: "9.0.1"
+        mysql.tls: false
+        mysql.command: "select * from test.identify where id = 1"
+        mysql.rows[0]: "1,33030219971120201X"
+  - filter:
+      count: 1
+      match:
+        tx_id: 3
+        pcap_cnt: 43
+        src_ip: 172.18.0.3
+        src_port: 3306
+        dest_port: 35316
+        dest_ip: 172.18.0.1
+        proto: "TCP"
+        direction: "to_client"
+        event_type: alert
+        alert.action: "allowed"
+        alert.signature: "test mysql"
+        alert.signature_id: 1
+        alert.severity: 3
+        alert.metadata.mysql[0]: "rows"
+        mysql.version: "9.0.1"
+        mysql.tls: false
+        mysql.command: "select * from test.identify where identify = 33030219971120201X"
+        mysql.rows[0]: "1,33030219971120201X"
         
diff --git a/tests/mysql-tls/suricata.yaml b/tests/mysql-tls/suricata.yaml
new file mode 100644
index 000000000..36b63fcb3
--- /dev/null
+++ b/tests/mysql-tls/suricata.yaml
@@ -0,0 +1,18 @@
+%YAML 1.1
+---
+
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular
+      filename: eve.json
+      types:
+        - mysql
+        - tls
+
+app-layer:
+  protocols:
+    mysql:
+      enabled: yes
+    tls:
+      enabled: yes
diff --git a/tests/mysql-tls/test.yaml b/tests/mysql-tls/test.yaml
index 76e72662d..990f539bc 100644
--- a/tests/mysql-tls/test.yaml
+++ b/tests/mysql-tls/test.yaml
@@ -9,11 +9,20 @@ checks:
 - filter:
     count: 1
     match:
+      src_ip: 172.18.0.1
+      src_port: 36592
+      dest_ip: 172.18.0.3
+      dest_port: 3306
+      proto: TCP
       event_type: mysql
       mysql.tls: true
 - filter:
     count: 1
     match:
-      app_proto: tls
-      app_proto_orig: mysql
-
+      src_ip: 172.18.0.1
+      src_port: 36592
+      dest_ip: 172.18.0.3
+      dest_port: 3306
+      proto: TCP
+      event_type: tls
+      tls.from_proto: mysql
\ No newline at end of file