Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bug 7318/v3 #2148

Closed
wants to merge 6 commits into from
Closed

Bug 7318/v3 #2148

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
81d95d8
tests: add bug 5443 test
victorjulien Nov 28, 2024
5d0f652
test: update for no SIG_TYPE_APPLAYER matches on stream end packets
victorjulien Nov 28, 2024
52d39da
tests: update firewall test for pkt sigs not alerting on ffr packets
victorjulien Nov 28, 2024
4904b68
add test for extra tls alert
inashivb Oct 7, 2024
01f19b4
WIP
victorjulien Nov 24, 2024
45b19c6
tests: add alproto detection on unacked data
victorjulien Nov 28, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions tests/bug-5443/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
PCAP
====

https://redmine.openinfosecfoundation.org/issues/5443
Binary file added tests/bug-5443/input.pcap
View file
Open in desktop
Binary file not shown.
22 changes: 22 additions & 0 deletions tests/bug-5443/test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,22 @@
requires:
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

actually this is an unrelated test

min-version: 7
#features:
#- TLC

args:
- -k none
- --runmode=single
- --set stream.midstream=true

# 2 or 3 flows depending on tcp reuse behavior, see ticket 5843
checks:
- filter:
lt-version: 7
count: 3
match:
event_type: flow
- filter:
min-version: 8
count: 3
match:
event_type: flow
16 changes: 16 additions & 0 deletions tests/bug-5464-verdict-06/test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,22 @@ args:

checks:
- filter:
min-version: 8
count: 25
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The rule here is

alert http any any -> any any (sid: 1;)

Should it match on the stream end packets?

@catenacyber are there cases where only at the end of the stream, with the pseudo packets we detect the app protocol? I guess we could, if data stays un-ack'd, then stream terminates, FFR will force handling of un-ACK'd data, detect protocol.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I also guess we could indeed...

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

45b19c6

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It matched in master on sid 2, in OISF/suricata#12169 it won't match.

match:
event_type: alert
alert.signature_id: 1
verdict.action: alert
- filter:
min-version: 8
count: 0
match:
event_type: alert
alert.signature_id: 1
verdict.action: alert
has-not-key: pcap_cnt
- filter:
lt-version: 7
count: 28
match:
event_type: alert
Expand Down
Binary file added tests/detect-alproto-04-unacked-data/input.pcap
View file
Open in desktop
Binary file not shown.
2 changes: 2 additions & 0 deletions tests/detect-alproto-04-unacked-data/test.rules
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
alert http any any -> any any (sid:1;)
alert ssh any any -> any any (sid:2;)
Empty file added tests/detect-alproto-04-unacked-data/test.yaml
View file
Open in desktop
Empty file.
12 changes: 12 additions & 0 deletions tests/detect-alproto-04-unacked-data/writepcap.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
#!/usr/bin/env python
from scapy.all import *

pkts = []

pkts += Ether(dst='05:04:03:02:01:00', src='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(src='1.1.1.1', dst='2.2.2.2')/TCP(dport=8080,sport=12345,flags='S',seq=1,options=[('WScale', 14)])
pkts += Ether(src='05:04:03:02:01:00', dst='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(dst='1.1.1.1', src='2.2.2.2')/TCP(sport=8080,dport=12345,flags='SA',seq=1000,ack=2,options=[('WScale', 14)],window=65535)
pkts += Ether(dst='05:04:03:02:01:00', src='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(src='1.1.1.1', dst='2.2.2.2')/TCP(dport=8080,sport=12345,flags='A',seq=2,ack=1001,window=65535)
pkts += Ether(src='05:04:03:02:01:00', dst='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(dst='1.1.1.1', src='2.2.2.2')/TCP(sport=8080,dport=12345,flags='A',seq=1001,ack=2,window=65535)/"GET / HTTP/1.0\r\n\r\n"
pkts += Ether(dst='05:04:03:02:01:00', src='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(src='1.1.1.1', dst='2.2.2.2')/TCP(dport=8080,sport=12345,flags='A',seq=2,ack=1001,window=65535)/"SSH-2.0 XXX\r\n"

wrpcap('input.pcap', pkts)
20 changes: 20 additions & 0 deletions tests/firewall/firewall-06-tls-sni-enforce/test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,11 +6,24 @@ args:

checks:
- filter:
min-version: 8
count: 24
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this I think makes sense, the sig is

drop ip any any -> any any (msg:"Drop all else"; flow:stateless; sid:3;)

If there are no "real" packets, why raise alerts?

match:
event_type: alert
alert.signature_id: 3
- filter:
min-version: 8
count: 24
match:
event_type: alert
- filter:
lt-version: 7
count: 26
match:
event_type: alert
alert.signature_id: 3
- filter:
lt-version: 7
count: 26
match:
event_type: alert
Expand All @@ -31,6 +44,13 @@ checks:
match:
event_type: drop
- filter:
min-version: 8
count: 0
match:
event_type: alert
pkt_src: "stream (flow timeout)"
- filter:
lt-version: 7
count: 2
match:
event_type: alert
Expand Down
5 changes: 5 additions & 0 deletions tests/tls-extra-alert-app/test.rules
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
alert tcp any any -> any 443 (flow: to_server; flags: S,CE; flowbits:set, tls_tracker; flowbits: noalert; sid:09901001; )
alert tcp any any -> any 443 (flowbits:isset, tls_tracker; content: "|15 03 01 00 02 02|"; startswith; flowbits:set, tls_error; sid:09901031; rev:1; msg:"TLS 1.2 Fatal Alert (outgoing packet)"; )
alert tcp any 443 -> any any (flowbits:isset, tls_tracker; content: "|15 03 01 00 02 02|"; startswith; flowbits:set, tls_error; sid:09901032; rev:1; msg:"TLS 1.2 Fatal Alert (incoming packet)"; )
alert tcp any any -> any 443 (app-layer-protocol:tls; flow: to_server; flowbits:isset, tls_error; sid:09901033; rev:1; msg:"Allow TLS error handling (outgoing packet)"; )
alert tcp any 443 -> any any (app-layer-protocol:tls; flow: to_client; flowbits:isset, tls_error; sid:09901034; rev:1; msg:"Allow TLS error handling (incoming packet)"; )
19 changes: 19 additions & 0 deletions tests/tls-extra-alert-app/test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
requires:
min-version: 8

args:
- -k none
- --simulate-ips

checks:
- filter:
count: 2
match:
event_type: alert
alert.signature_id: 9901033
pkt_src: wire/pcap
- filter:
count: 0
match:
event_type: alert
not-has-key: pcap_cnt
5 changes: 5 additions & 0 deletions tests/tls-extra-alert-app3/test.rules
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
alert tcp any any -> any 443 (flow: to_server; flags: S,CE; flowbits:set, tls_tracker; flowbits: noalert; sid:09901001; )
alert tcp any any -> any 443 (flowbits:isset, tls_tracker; content: "|15 03 01 00 02 02|"; startswith; flowbits:set, tls_error; sid:09901031; rev:1; msg:"TLS 1.2 Fatal Alert (outgoing packet)"; )
alert tcp any 443 -> any any (flowbits:isset, tls_tracker; content: "|15 03 01 00 02 02|"; startswith; flowbits:set, tls_error; sid:09901032; rev:1; msg:"TLS 1.2 Fatal Alert (incoming packet)"; )
alert tls any any -> any 443 (flow: to_server; flowbits:isset, tls_error; sid:09901033; rev:1; msg:"Allow TLS error handling (outgoing packet)"; )
alert tls any 443 -> any any (flow: to_client; flowbits:isset, tls_error; sid:09901034; rev:1; msg:"Allow TLS error handling (incoming packet)"; )
19 changes: 19 additions & 0 deletions tests/tls-extra-alert-app3/test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
requires:
min-version: 8

args:
- -k none
- --simulate-ips

checks:
- filter:
count: 2
match:
event_type: alert
alert.signature_id: 9901033
pkt_src: wire/pcap
- filter:
count: 0
match:
event_type: alert
not-has-key: pcap_cnt
5 changes: 5 additions & 0 deletions tests/tls-extra-alert-app4/test.rules
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
alert tcp any any -> any 443 (flow: to_server; flags: S,CE; flowbits:set, tls_tracker; flowbits: noalert; sid:09901001; )
alert tcp any any -> any 443 (flowbits:isset, tls_tracker; content: "|15 03 01 00 02 02|"; startswith; flowbits:set, tls_error; sid:09901031; rev:1; msg:"TLS 1.2 Fatal Alert (outgoing packet)"; )
alert tcp any 443 -> any any (flowbits:isset, tls_tracker; content: "|15 03 01 00 02 02|"; startswith; flowbits:set, tls_error; sid:09901032; rev:1; msg:"TLS 1.2 Fatal Alert (incoming packet)"; )
alert tls any any -> any 443 (sid:09901033; rev:1; msg:"Allow TLS error handling (outgoing packet)"; )
alert tls any 443 -> any any (sid:09901034; rev:1; msg:"Allow TLS error handling (incoming packet)"; )
19 changes: 19 additions & 0 deletions tests/tls-extra-alert-app4/test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
requires:
min-version: 8

args:
- -k none
- --simulate-ips

checks:
- filter:
count: 3
match:
event_type: alert
alert.signature_id: 9901033
pkt_src: wire/pcap
- filter:
count: 0
match:
event_type: alert
not-has-key: pcap_cnt
7 changes: 7 additions & 0 deletions tests/tls-extra-alert-engine-analysis/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
# Test Description

engine analysis complementary test for tls-extra-alert.

## Related issues

None so far. State: Trying to establish what's the issue.
5 changes: 5 additions & 0 deletions tests/tls-extra-alert-engine-analysis/test.rules
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
alert tcp any any -> any 443 (flow: to_server; flags: S,CE; flowbits:set, tls_tracker; flowbits: noalert; sid:09901001; )
alert tcp any any -> any 443 (flowbits:isset, tls_tracker; content: "|15 03 01 00 02 02|"; startswith; flowbits:set, tls_error; sid:09901031; rev:1; msg:"TLS 1.2 Fatal Alert (outgoing packet)"; )
alert tcp any 443 -> any any (flowbits:isset, tls_tracker; content: "|15 03 01 00 02 02|"; startswith; flowbits:set, tls_error; sid:09901032; rev:1; msg:"TLS 1.2 Fatal Alert (incoming packet)"; )
alert tcp any any -> any 443 (flow: to_server; flowbits:isset, tls_error; sid:09901033; rev:1; msg:"Allow TLS error handling (outgoing packet)"; )
alert tcp any 443 -> any any (flow: to_client; flowbits:isset, tls_error; sid:09901034; rev:1; msg:"Allow TLS error handling (incoming packet)"; )
Loading
Loading