sip: adds checks for stat code keyword

Ticket: 7295 Ensures that stat-code and method do not share the same buffer in different directions
OISF · Oct 2, 2024 · b1c778d · b1c778d
1 parent 3be0daf
commit b1c778d
Show file tree

Hide file tree

Showing 4 changed files with 14 additions and 0 deletions.
diff --git a/tests/sip-method/test.rules b/tests/sip-method/test.rules
@@ -1 +1,2 @@
 alert sip any any -> any any (flow:to_server; sip.method; content:"REGISTER"; sid:1;)
+alert sip any any -> any any (sip.stat_code; content:"REGISTER"; sid:2;)
diff --git a/tests/sip-method/test.yaml b/tests/sip-method/test.yaml
@@ -14,3 +14,9 @@ checks:
       count: 18
       match:
         event_type: alert
+  - filter:
+  # only sid 1 triggered the 7 alerts
+      count: 18
+      match:
+        event_type: alert
+        alert.signature_id: 1
diff --git a/tests/sip-stat-code/test.rules b/tests/sip-stat-code/test.rules
@@ -1 +1,2 @@
 alert sip any any -> any any (flow:to_client; sip.stat_code; content:"100"; sid:1;)
+alert sip any any -> any any (sip.method; content:"100"; sid:2;)
diff --git a/tests/sip-stat-code/test.yaml b/tests/sip-stat-code/test.yaml
@@ -14,3 +14,9 @@ checks:
       count: 7
       match:
         event_type: alert
+  - filter:
+  # only sid 1 triggered the 7 alerts
+      count: 7
+      match:
+        event_type: alert
+        alert.signature_id: 1
Original file line number	Diff line number	Diff line change
		@@ -1 +1,2 @@
		alert sip any any -> any any (flow:to_server; sip.method; content:"REGISTER"; sid:1;)
		alert sip any any -> any any (sip.stat_code; content:"REGISTER"; sid:2;)
Original file line number	Diff line number	Diff line change
		@@ -1 +1,2 @@
		alert sip any any -> any any (flow:to_client; sip.stat_code; content:"100"; sid:1;)
		alert sip any any -> any any (sip.method; content:"100"; sid:2;)