Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

tests: linktype_name test #2006

Closed
wants to merge 2 commits into from
Closed

tests: linktype_name test #2006

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
4fe8d00
tests: linktype_name test
jlucovsky Apr 25, 2024
bde83b9
test/linktype: Expand linktype_name coverage
jlucovsky Jul 27, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
59 changes: 29 additions & 30 deletions tests/decode-chdlc-01/test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,35 +2,34 @@ requires:

min-version: 6.0.0


checks:

- filter:
count: 1
match:
event_type: http
http.hostname: "view.atdmt.com"
http.status: 200
http.length: 8079

- filter:
count: 1
match:
event_type: fileinfo
fileinfo.state: CLOSED

- filter:
count: 1
match:
event_type: alert
alert.signature_id: 666

- filter:
count: 1
match:
event_type: flow
proto: TCP

- stats:
decoder.ipv4: 17
decoder.chdlc: 17
- filter:
count: 1
match:
event_type: http
http.hostname: "view.atdmt.com"
http.status: 200
http.length: 8079

- filter:
count: 1
match:
event_type: fileinfo
fileinfo.state: CLOSED

- filter:
count: 1
match:
event_type: alert
alert.signature_id: 666

- filter:
count: 1
match:
event_type: flow
proto: TCP

- stats:
decoder.ipv4: 17
decoder.chdlc: 17
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This file is not changed but for white spaces, is it ?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, the only changes were whitespace related.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could we keep it as before then ?

3 changes: 3 additions & 0 deletions tests/decode-chdlc-02/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
Ensure Cisco HDLC packets are decoded and the linktype name is correct


24 changes: 24 additions & 0 deletions tests/decode-chdlc-02/suricata.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
%YAML 1.1
---

outputs:
- eve-log:
enabled: yes
filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
filename: eve.json
types:
- alert:
packet: yes # enable dumping of packet (without stream segments)
- http:
extended: true
- files:
force-magic: no
- flow
- stats
app-layer:
protocols:
http:
enabled: yes
libhtp:
default-config:
response-body-limit: 100kb
1 change: 1 addition & 0 deletions tests/decode-chdlc-02/test.rules
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
alert http any any -> any any (http.method; content:"GET"; sid:666;)
38 changes: 38 additions & 0 deletions tests/decode-chdlc-02/test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,38 @@
requires:

min-version: 8

pcap: ../decode-chdlc-01/hdlc-http_1tx.pcap

checks:

- filter:
count: 1
match:
event_type: http
http.hostname: "view.atdmt.com"
http.status: 200
http.length: 8079

- filter:
count: 1
match:
event_type: fileinfo
fileinfo.state: CLOSED

- filter:
count: 1
match:
event_type: alert
alert.signature_id: 666
packet_info.linktype_name: C_HDLC

- filter:
count: 1
match:
event_type: flow
proto: TCP

- stats:
decoder.ipv4: 17
decoder.chdlc: 17
11 changes: 11 additions & 0 deletions tests/defrag/bug-6887-defrag-ipv6-tcp-02/suricata.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
%YAML 1.1
---

outputs:
- eve-log:
enabled: yes
filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
filename: eve.json
types:
- alert:
packet: yes # enable dumping of packet (without stream segments)
1 change: 1 addition & 0 deletions tests/defrag/bug-6887-defrag-ipv6-tcp-02/test.rules
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
alert tcp any any -> any any (dsize:1000; sid:1;)
14 changes: 14 additions & 0 deletions tests/defrag/bug-6887-defrag-ipv6-tcp-02/test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
requires:
min-version: 8

pcap: ../bug-6887-defrag-ipv6-tcp/frag-ip-tcp.pcap

checks:
- filter:
count: 1
match:
event_type: alert
alert.signature_id: 1
packet: "YAAAAAP8BkAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAATA5H5AAAAABAAAAAFAQIADIrQAAQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQQ=="
packet_info.linktype: 229
packet_info.linktype_name: IPV6
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could you have added a check in tests/defrag/bug-6887-defrag-ipv6-tcp-01 ? Rather than creating a new test ?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes.

13 changes: 13 additions & 0 deletions tests/detect-ipopts-02/README
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
Test the IP options and verify the linktype name value.

There's already a test for the extended security option; the following IP options are tested:
- Record Route "rr"
- Loose source route "lsrr"
- EOL "eol"
- NOP "nop"
- Timestamp "ts"
- Security "sec"
- Strict source route "ssrr"
- Stream id "satid"

The pcap was generated using detect-ipopts/ipopt.py
11 changes: 11 additions & 0 deletions tests/detect-ipopts-02/suricata.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
%YAML 1.1
---

outputs:
- eve-log:
enabled: yes
filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
filename: eve.json
types:
- alert:
packet: yes # enable dumping of packet (without stream segments)
10 changes: 10 additions & 0 deletions tests/detect-ipopts-02/test.rules
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
alert ip any any -> any any (msg:"RR option set"; ipopts:rr; sid: 1;)
alert ip any any -> any any (msg:"LSRR option set"; ipopts:lsrr; sid: 2;)
alert ip any any -> any any (msg:"EOL option set"; ipopts:eol; sid: 3;)
alert ip any any -> any any (msg:"NOP option set"; ipopts:nop; sid: 4;)
alert ip any any -> any any (msg:"TS option set"; ipopts:ts; sid: 5;)
alert ip any any -> any any (msg:"SEC option set"; ipopts:sec; sid: 6;)
alert ip any any -> any any (msg:"SSRR option set"; ipopts:ssrr; sid: 7;)
alert ip any any -> any any (msg:"SID option set"; ipopts:satid; sid: 8;)
# covered in ipopts-sec
#alert ip any any <> any any (msg:"ESEC option set"; ipopts:esec; sid: 42;)
64 changes: 64 additions & 0 deletions tests/detect-ipopts-02/test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,64 @@
requires:
min-version: 8

args:
- --set stream.midstream=true -k none

pcap: ../detect-ipopts/input.pcap

checks:
- filter:
count: 1
match:
event_type: alert
pcap_cnt: 1
alert.signature_id: 1
packet_info.linktype_name: IPV4
- filter:
count: 1
match:
event_type: alert
pcap_cnt: 2
alert.signature_id: 2
packet_info.linktype_name: IPV4
- filter:
count: 6
match:
event_type: alert
alert.signature_id: 3
packet_info.linktype_name: IPV4
- filter:
count: 1
match:
event_type: alert
pcap_cnt: 4
alert.signature_id: 4
packet_info.linktype_name: IPV4
- filter:
count: 1
match:
event_type: alert
pcap_cnt: 5
alert.signature_id: 5
packet_info.linktype_name: IPV4
- filter:
count: 1
match:
event_type: alert
pcap_cnt: 6
alert.signature_id: 6
packet_info.linktype_name: IPV4
- filter:
count: 1
match:
event_type: alert
pcap_cnt: 7
alert.signature_id: 7
packet_info.linktype_name: IPV4
- filter:
count: 1
match:
event_type: alert
pcap_cnt: 8
alert.signature_id: 8
packet_info.linktype_name: IPV4
7 changes: 7 additions & 0 deletions tests/dnp3-dnp3_obj-alert-02/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
# Description

Test dnp3_obj rule keyword and that the linktype name is valid.

# PCAP

The pcap comes from dnp3-dnp3_data-alert
20 changes: 20 additions & 0 deletions tests/dnp3-dnp3_obj-alert-02/suricata.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,20 @@
%YAML 1.1
---

outputs:
- eve-log:
enabled: yes
filetype: regular
filename: eve.json
types:
- alert:
payload: yes
packet: yes
dnp3: yes

app-layer:
protocols:
dnp3:
enabled: yes
detection-ports:
dp: 20000
2 changes: 2 additions & 0 deletions tests/dnp3-dnp3_obj-alert-02/test.rules
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
alert dnp3 any any -> any any (msg:"SURICATA DNP3 Object Test"; dnp3_obj:22,01; sid:1; rev:1;)
alert dnp3 any any -> any any (msg:"SURICATA DNP3 Object Test"; dnp3_obj:29,01; sid:2; rev:1;)
17 changes: 17 additions & 0 deletions tests/dnp3-dnp3_obj-alert-02/test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
pcap: ../dnp3-eve/input.pcap

requires:
min-version: 8

checks:
- filter:
count: 4
match:
event_type: alert
alert.signature_id: 1
packet_info.linktype_name: EN10MB
- filter:
count: 0
match:
event_type: alert
alert.signature_id: 2
12 changes: 12 additions & 0 deletions tests/tcp-fastopen-12/suricata.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
%YAML 1.1
---

outputs:
- eve-log:
enabled: yes
filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
filename: eve.json
types:
- alert:
packet: yes # enable dumping of packet (without stream segments)
- flow
1 change: 1 addition & 0 deletions tests/tcp-fastopen-12/test.rules
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
alert tcp any any -> any any (content:"Hello!"; sid:1;)
20 changes: 20 additions & 0 deletions tests/tcp-fastopen-12/test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,20 @@
pcap: ../tcp-fastopen-05/tfo.pcap

requires:
min-version: 8

args:
- -k none

checks:
- filter:
count: 2
match:
event_type: alert
alert.signature_id: 1
packet_info.linktype_name: LINUX_SLL
- filter:
count: 2
match:
event_type: flow
proto: TCP
7 changes: 7 additions & 0 deletions tests/vxlan-decoder-04/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
# Description

Test basic VXLAN decoding

# PCAP

https://github.com/the-tcpdump-group/tcpdump/blob/master/tests/vxlan.pcap
12 changes: 12 additions & 0 deletions tests/vxlan-decoder-04/suricata.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
%YAML 1.1
---

outputs:
- eve-log:
enabled: yes
filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
filename: eve.json
types:
- alert:
packet: yes # enable dumping of packet (without stream segments)
- flow
1 change: 1 addition & 0 deletions tests/vxlan-decoder-04/test.rules
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
alert icmp any any -> any any (itype:8; sid:1;)
Loading
Loading