incomplete-hex: -T tests for version 6 and 7

For version 7, incomplete hex should lead to a -T failure.  For
version 6, -T should pass.

diff --git a/tests/content-incomplete-hex-t-version-6/README.md b/tests/content-incomplete-hex-t-version-6/README.md
new file mode 100644 (file)
index 0000000..ef27852
--- /dev/null
+++ b/tests/content-incomplete-hex-t-version-6/README.md
@@ -0,0 +1,6 @@
+Tests the behaviour of -T when a rule contains incomplete hex.
+
+For Suricata 6.0.x, -T should pass unless
+--strict-rule-keywords=content is provided.
+
+For Suricata 7.0+, -T should fail.

diff --git a/tests/content-incomplete-hex-t-version-6/suricata.yaml b/tests/content-incomplete-hex-t-version-6/suricata.yaml
new file mode 100644 (file)
index 0000000..6917d85
--- /dev/null
+++ b/tests/content-incomplete-hex-t-version-6/suricata.yaml
@@ -0,0 +1,2 @@
+%YAML 1.1
+---

diff --git a/tests/content-incomplete-hex-t-version-6/test.rules b/tests/content-incomplete-hex-t-version-6/test.rules
new file mode 100644 (file)
index 0000000..397a5f1
--- /dev/null
+++ b/tests/content-incomplete-hex-t-version-6/test.rules
@@ -0,0 +1 @@
+alert tcp any any -> any any (msg:"incomplete hex test rule"; content:"|22 2 22|"; sid:12346; rev:1;)

diff --git a/tests/content-incomplete-hex-t-version-6/test.yaml b/tests/content-incomplete-hex-t-version-6/test.yaml
new file mode 100644 (file)
index 0000000..8da6517
--- /dev/null
+++ b/tests/content-incomplete-hex-t-version-6/test.yaml
@@ -0,0 +1,10 @@
+requires:
+  min-version: 6
+  lt-version: 7
+
+args:
+  - -T
+
+pcap: false
+
+exit-code: 0

diff --git a/tests/content-incomplete-hex-t-version-7-plus/README.md b/tests/content-incomplete-hex-t-version-7-plus/README.md
new file mode 100644 (file)
index 0000000..ef27852
--- /dev/null
+++ b/tests/content-incomplete-hex-t-version-7-plus/README.md
@@ -0,0 +1,6 @@
+Tests the behaviour of -T when a rule contains incomplete hex.
+
+For Suricata 6.0.x, -T should pass unless
+--strict-rule-keywords=content is provided.
+
+For Suricata 7.0+, -T should fail.

diff --git a/tests/content-incomplete-hex-t-version-7-plus/suricata.yaml b/tests/content-incomplete-hex-t-version-7-plus/suricata.yaml
new file mode 100644 (file)
index 0000000..6917d85
--- /dev/null
+++ b/tests/content-incomplete-hex-t-version-7-plus/suricata.yaml
@@ -0,0 +1,2 @@
+%YAML 1.1
+---

diff --git a/tests/content-incomplete-hex-t-version-7-plus/test.rules b/tests/content-incomplete-hex-t-version-7-plus/test.rules
new file mode 100644 (file)
index 0000000..397a5f1
--- /dev/null
+++ b/tests/content-incomplete-hex-t-version-7-plus/test.rules
@@ -0,0 +1 @@
+alert tcp any any -> any any (msg:"incomplete hex test rule"; content:"|22 2 22|"; sid:12346; rev:1;)

diff --git a/tests/content-incomplete-hex-t-version-7-plus/test.yaml b/tests/content-incomplete-hex-t-version-7-plus/test.yaml
new file mode 100644 (file)
index 0000000..9150403
--- /dev/null
+++ b/tests/content-incomplete-hex-t-version-7-plus/test.yaml
@@ -0,0 +1,9 @@
+requires:
+  min-version: 7.0.0
+
+args:
+  - -T
+
+pcap: false
+
+exit-code: 1