Next/665/20241210/v4

tests/bug-130/test.yaml

@@ -1,10 +1,8 @@
 requires:
   min-version: 5.0.0
-  features:
-    - HAVE_LIBJANSSON
 
 args:
- - -k none
+ - -k none --set detect.guess-applayer-tx=true
 
 checks:
 - filter:

tests/bug-7199/README.md

@@ -0,0 +1,15 @@
+# Test
+
+Showcase change of behavior from Suricata-7.0.5 to Suricata-7.0.6.
+Before, a non-stream rule that matched traffic associated with an app-layer
+transaction would result in app-layer metadata being logged with the alert, if
+metadata was enabled. Starting with 7.0.6, this will only be achieved if the
+rule is an app-layer/stream one.
+
+### Pcap
+
+Packet capture resulting of a curl to suricata.io.
+
+### Ticket
+
+https://redmine.openinfosecfoundation.org/issues/7199

tests/bug-7199/suricata.yaml

@@ -0,0 +1,22 @@
+%YAML 1.1
+---
+
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular
+      filename: eve.json
+      types:
+        - alert:
+            enabled: true
+            tagged-packets: true
+            metadata: true
+            http-body: true
+        - http:
+            extended: true
+            tagged-packets: true
+        - tls:
+            extended: true
+
+detect:
+  guess-applayer-tx: yes

tests/bug-7199/test.rules

@@ -0,0 +1,3 @@
+reject ip any any -> any any (msg: "Reject by AntreaNetworkPolicy:default/ingress-allow-http-request-to-api-v2"; flow: to_server, established; sid: 1;)
+pass http any any -> any any (msg: "Allow http by AntreaNetworkPolicy:default/ingress-allow-http-request-to-api-v2"; http.uri; content:"/api/v2/"; startswith; http.method; content:"GET"; http.host; content:"foo.bar.com"; startswith; endswith; sid: 2;)
+alert http any any -> any any (msg: "Alert by AntreaNetworkPolicy:default/ingress-allow-http-request-to-api-v2"; http.uri; content:!"/api/v2/"; sid: 3;)

tests/bug-7199/test.yaml

@@ -0,0 +1,33 @@
+requires:
+  features:
+    - LIBNET1.1
+
+args:
+- -k none
+- --set stream.midstream=true
+- --simulate-ips
+
+checks:
+    - filter:
+        count: 4
+        match:
+            event_type: alert
+            alert.signature_id: 1
+    - filter:
+        min-version: 8
+        count: 1
+        match:
+            event_type: alert
+            alert.signature_id: 1
+            has-key: http
+    - filter:
+        count: 0
+        match:
+            event_type: alert
+            alert.signature_id: 2
+    - filter:
+        count: 1
+        match:
+            event_type: alert
+            alert.signature_id: 3
+            has-key: http

tests/firewall/firewall-06-tls-sni-enforce/suricata.yaml

@@ -15,6 +15,10 @@ stats:
   # Add stream events as stats.
   #stream-events: false
 
+detect:
+  stream-tx-log-limit: 4
+  guess-applayer-tx: true
+
 # Configure the type of alert (and other) logging you would like.
 outputs:
   - eve-log:

tests/firewall/firewall-06-tls-sni-enforce/test.yaml

@@ -6,14 +6,35 @@ args:
 
 checks:
 - filter:
+    min-version: 8
+    count: 24
+    match:
+      event_type: alert
+      alert.signature_id: 3
+- filter:
+    min-version: 8
+    count: 24
+    match:
+      event_type: alert
+- filter:
+    lt-version: 7
     count: 26
     match:
       event_type: alert
       alert.signature_id: 3
 - filter:
+    lt-version: 7
     count: 26
     match:
       event_type: alert
+- filter:
+    min-version: 8
+    # check for https://redmine.openinfosecfoundation.org/issues/7350
+    count: 4
+    match:
+      event_type: alert
+      alert.signature_id: 3
+      tls.sni: raw.githubusercontent.com
 - filter:
     count: 1
     match:
@@ -31,6 +52,13 @@ checks:
     match:
       event_type: drop
 - filter:
+    min-version: 8
+    count: 0
+    match:
+      event_type: alert
+      pkt_src: "stream (flow timeout)"
+- filter:
+    lt-version: 7
     count: 2
     match:
       event_type: alert

tests/pgsql/pgsql-7000-ids/suricata.yaml

@@ -15,3 +15,6 @@ app-layer:
   protocols:
     pgsql:
       enabled: yes
+
+detect:
+  guess-applayer-tx: true

tests/pgsql/pgsql-7000-ids/test.yaml

@@ -1,3 +1,5 @@
+requires:
+    min-version: 8
 args:
 - -k none
 
@@ -24,6 +26,7 @@ checks:
       pgsql.tx_id: 6
       stream: 1
       tx_id: 5
+      tx_guessed: true
 # check 3
 - filter:
     count: 1
@@ -40,6 +43,7 @@ checks:
       pgsql.tx_id: 7
       stream: 1
       tx_id: 6
+      tx_guessed: true
 # check 4
 - filter:
     count: 1
@@ -56,6 +60,7 @@ checks:
       pgsql.tx_id: 8
       stream: 1
       tx_id: 7
+      tx_guessed: true
 # check 5
 - filter:
     count: 1
@@ -72,6 +77,7 @@ checks:
       pgsql.tx_id: 9
       stream: 1
       tx_id: 8
+      tx_guessed: true
 # check 6
 - filter:
     count: 1
@@ -94,6 +100,7 @@ checks:
       pgsql.tx_id: 14
       stream: 1
       tx_id: 13
+      tx_guessed: true
 # check 7
 - filter:
     count: 1
@@ -117,6 +124,7 @@ checks:
       pgsql.tx_id: 17
       stream: 1
       tx_id: 16
+      tx_guessed: true
 # check 8
 - filter:
     count: 1
@@ -139,6 +147,7 @@ checks:
       pgsql.tx_id: 23
       stream: 1
       tx_id: 22
+      tx_guessed: true
 # check 9
 - filter:
     count: 1
@@ -158,6 +167,7 @@ checks:
       pgsql.tx_id: 26
       stream: 1
       tx_id: 25
+      tx_guessed: true
 # check 10
 - filter:
     count: 1
@@ -171,11 +181,4 @@ checks:
         [email protected].....\[email protected]...'[email protected]...)[email protected]...,[email protected]...'[email protected]...)[email protected][email protected]...\r\
         SELECT 8.Z....I"
       pcap_cnt: 87
-      pgsql.request.simple_query: SELECT * FROM new_table;
-      pgsql.response.command_completed: SELECT 8
-      pgsql.response.data_rows: 8
-      pgsql.response.data_size: 236
-      pgsql.response.field_count: 2
-      pgsql.tx_id: 26
       stream: 1
-      tx_id: 25

tests/pgsql/pgsql-bug-6983-ips/suricata.yaml

@@ -16,3 +16,6 @@ app-layer:
   protocols:
     pgsql:
       enabled: yes
+
+detect:
+  guess-applayer-tx: true

tests/pgsql/pgsql-bug-6983-ips/test.yaml

@@ -1,5 +1,5 @@
 requires:
-  min-version: 7.0
+  min-version: 8.0
 
 pcap: ../pgsql-ssl-rejected-md5-auth-simple-query/input.pcap
 
@@ -19,9 +19,11 @@ checks:
     match:
       event_type: alert
       alert.signature_id: 1
+      tx_guessed: true
 - filter:
     count: 1
     match:
       event_type: alert
       alert.signature_id: 1
+      tx_guessed: true
       pgsql.request.simple_query: "select * from rules where sid = 2021701;"

tests/tls-extra-alert-engine-analysis/README.md

@@ -0,0 +1,7 @@
+# Test Description
+
+engine analysis complementary test for tls-extra-alert.
+
+## Related issues
+
+None so far. State: Trying to establish what's the issue.

tests/tls-extra-alert-engine-analysis/test.rules

@@ -0,0 +1,5 @@
+alert tcp any any -> any 443 (flow: to_server; flags: S,CE; flowbits:set, tls_tracker; flowbits: noalert; sid:09901001; )
+alert tcp any any -> any 443 (flowbits:isset, tls_tracker; content: "|15 03 01 00 02 02|"; startswith; flowbits:set, tls_error; sid:09901031; rev:1; msg:"TLS 1.2 Fatal Alert (outgoing packet)"; )
+alert tcp any 443 -> any any (flowbits:isset, tls_tracker; content: "|15 03 01 00 02 02|"; startswith; flowbits:set, tls_error; sid:09901032; rev:1; msg:"TLS 1.2 Fatal Alert (incoming packet)"; )
+alert tcp any any -> any 443 (flow: to_server; flowbits:isset, tls_error; sid:09901033; rev:1; msg:"Allow TLS error handling (outgoing packet)"; )
+alert tcp any 443 -> any any (flow: to_client; flowbits:isset, tls_error; sid:09901034; rev:1; msg:"Allow TLS error handling (incoming packet)"; )