tests: add checks for ip version

Related to
Task #7047

diff --git a/tests/bittorrent-dht/test.yaml b/tests/bittorrent-dht/test.yaml
index fc9abaf7ecb0843d938809ab410c464583655821..79fee6688d42c0f2ca7e43e31d7fbfcd3e0bfb95 100644 (file)
--- a/tests/bittorrent-dht/test.yaml
+++ b/tests/bittorrent-dht/test.yaml
@@ -295,3 +295,37 @@ checks:
       proto: UDP
       src_ip: 190.0.0.1
       src_port: 40000
+- filter:
+    min-version: 8
+    count: 1
+    match:
+      bittorrent_dht.request.id: 6162636465666768696a30313233343536373839
+      bittorrent_dht.request_type: ping
+      bittorrent_dht.transaction_id: '6161'
+      dest_ip: 190.0.0.3
+      dest_port: 30000
+      event_type: bittorrent_dht
+      pcap_cnt: 3
+      pkt_src: wire/pcap
+      proto: UDP
+      src_ip: 190.0.0.1
+      src_port: 20000
+      ip_v: 4
+- filter:
+    min-version: 8
+    count: 1
+    match:
+      anomaly.app_proto: bittorrent-dht
+      anomaly.event: malformed_packet
+      anomaly.layer: proto_parser
+      anomaly.type: applayer
+      dest_ip: 190.0.0.3
+      dest_port: 30000
+      event_type: anomaly
+      pcap_cnt: 15
+      pkt_src: wire/pcap
+      proto: UDP
+      src_ip: 190.0.0.1
+      src_port: 20000
+      tx_id: 12
+      ip_v: 4

diff --git a/tests/bug-4877/test.yaml b/tests/bug-4877/test.yaml
index 4e06f4e09d7c54cc54074f9b6faf48045f0fb56c..06c8de74e1c999e622bbabbf80a4a889d8e55dd0 100644 (file)
--- a/tests/bug-4877/test.yaml
+++ b/tests/bug-4877/test.yaml
@@ -70,3 +70,22 @@ checks:
       proto: TCP
       dest_ip: 192.168.100.230
       dest_port: 20
+- filter:
+    min-version: 8
+    count: 1
+    match:
+      app_proto: ftp-data
+      src_ip: 192.168.100.16
+      src_port: 42987
+      event_type: fileinfo
+      fileinfo.filename: test.pdf
+      fileinfo.gaps: false
+      fileinfo.sha256: 7d400735ff3054837da5d92a10ad2faa8b6825f100dc167a6b008e753015b382
+      fileinfo.size: 118196
+      fileinfo.state: CLOSED
+      fileinfo.stored: true
+      fileinfo.tx_id: 0
+      proto: TCP
+      dest_ip: 192.168.100.230
+      dest_port: 20
+      ip_v: 4

diff --git a/tests/eve-ip-version-4/README.md b/tests/eve-ip-version-4/README.md
new file mode 100644 (file)
index 0000000..f4c9cb3
--- /dev/null
+++ b/tests/eve-ip-version-4/README.md
@@ -0,0 +1,7 @@
+# Test
+
+Specific test for the `ip_v` field on common EVE fields.
+
+## Redmine ticket
+
+https://redmine.openinfosecfoundation.org/issues/7047

diff --git a/tests/eve-ip-version-4/suricata.yaml b/tests/eve-ip-version-4/suricata.yaml
new file mode 100644 (file)
index 0000000..28c863d
--- /dev/null
+++ b/tests/eve-ip-version-4/suricata.yaml
@@ -0,0 +1,24 @@
+%YAML 1.1
+---
+
+logging:
+  default-log-level: notice
+  default-output-filter:
+  outputs:
+  - console:
+      enabled: yes
+
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
+      filename: eve.json
+      types:
+        - alert:
+            payload: yes
+            payload-buffer-size: 4kb
+            payload-printable: yes
+            packet: yes
+            http: yes
+        - http
+        - flow

diff --git a/tests/eve-ip-version-4/test.rules b/tests/eve-ip-version-4/test.rules
new file mode 100644 (file)
index 0000000..9f1307b
--- /dev/null
+++ b/tests/eve-ip-version-4/test.rules
@@ -0,0 +1 @@
+alert ip any any -> any any (msg:"GPL ATTACK_RESPONSE id check returned root"; content:"uid=0|28|root|29|"; classtype:bad-unknown; sid:2100498; rev:7;)

diff --git a/tests/eve-ip-version-4/test.yaml b/tests/eve-ip-version-4/test.yaml
new file mode 100644 (file)
index 0000000..1010905
--- /dev/null
+++ b/tests/eve-ip-version-4/test.yaml
@@ -0,0 +1,24 @@
+requires:
+  min-version: 8
+
+pcap: ../alert-testmyids-async/input.pcap
+
+args:
+- -k none --set stream.midstream=true
+
+checks:
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        ip_v: 4
+  - filter:
+      count: 1
+      match:
+        event_type: http
+        ip_v: 4
+  - filter:
+      count: 1
+      match:
+        event_type: flow
+        ip_v: 4

diff --git a/tests/eve-ip-version-6/README.md b/tests/eve-ip-version-6/README.md
new file mode 100644 (file)
index 0000000..f4c9cb3
--- /dev/null
+++ b/tests/eve-ip-version-6/README.md
@@ -0,0 +1,7 @@
+# Test
+
+Specific test for the `ip_v` field on common EVE fields.
+
+## Redmine ticket
+
+https://redmine.openinfosecfoundation.org/issues/7047

diff --git a/tests/eve-ip-version-6/test.rules b/tests/eve-ip-version-6/test.rules
new file mode 100644 (file)
index 0000000..17d7bcc
--- /dev/null
+++ b/tests/eve-ip-version-6/test.rules
@@ -0,0 +1 @@
+alert ip any any -> any any (ipv6.hdr; content:"|40|"; offset:7; depth:1; sid:1234;)

diff --git a/tests/eve-ip-version-6/test.yaml b/tests/eve-ip-version-6/test.yaml
new file mode 100644 (file)
index 0000000..3504a24
--- /dev/null
+++ b/tests/eve-ip-version-6/test.yaml
@@ -0,0 +1,16 @@
+requires:
+  min-version: 8
+
+pcap: ../ipv6-hdr-keyword-01/input.pcap
+
+checks:
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        ip_v: 6
+  - filter:
+      count: 1
+      match:
+        event_type: flow
+        ip_v: 6