Adds test about ipv6 unknown dst opts

used as way to have a covert channel

diff --git a/tests/ipv6-evasion/ipv6-covert-dstopts/README.md b/tests/ipv6-evasion/ipv6-covert-dstopts/README.md
new file mode 100644 (file)
index 0000000..e88e8d0
--- /dev/null
+++ b/tests/ipv6-evasion/ipv6-covert-dstopts/README.md
@@ -0,0 +1,7 @@
+# Description
+
+Test detection of covert channel within IPv6 Destination Options Header
+
+# PCAP
+
+Pcap from https://redmine.cs.uni-potsdam.de/projects/pcap/files

diff --git a/tests/ipv6-evasion/ipv6-covert-dstopts/covert_send6.pcap b/tests/ipv6-evasion/ipv6-covert-dstopts/covert_send6.pcap
new file mode 100644 (file)
index 0000000..9b94e47
Binary files /dev/null and b/tests/ipv6-evasion/ipv6-covert-dstopts/covert_send6.pcap differ

diff --git a/tests/ipv6-evasion/ipv6-covert-dstopts/test.rules b/tests/ipv6-evasion/ipv6-covert-dstopts/test.rules
new file mode 100644 (file)
index 0000000..b371664
--- /dev/null
+++ b/tests/ipv6-evasion/ipv6-covert-dstopts/test.rules
@@ -0,0 +1,2 @@
+# DST option that we don't understand
+alert pkthdr any any -> any any (msg:"SURICATA IPv6 DSTOPTS unknown option"; decode-event:ipv6.dstopts_unknown_opt; classtype:protocol-command-decode; sid:2200088; rev:2;)

diff --git a/tests/ipv6-evasion/ipv6-covert-dstopts/test.yaml b/tests/ipv6-evasion/ipv6-covert-dstopts/test.yaml
new file mode 100644 (file)
index 0000000..db73fd5
--- /dev/null
+++ b/tests/ipv6-evasion/ipv6-covert-dstopts/test.yaml
@@ -0,0 +1,10 @@
+requires:
+    features:
+        - HAVE_LIBJANSSON
+
+checks:
+    - filter:
+        count: 18
+        match:
+            event_type: alert
+            alert.signature_id: 2200088