From: Shivani Bhardwaj <shivanib134@gmail.com>
Date: Fri, 23 Aug 2024 07:06:50 +0000 (+0530)
Subject: flow/pkt: add test for either dir
X-Git-Tag: suricata-7.0.9~82
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=refs%2Fpull%2F2228%2Fhead;p=thirdparty%2Fsuricata-verify.git

flow/pkt: add test for either dir
---

diff --git a/tests/detect-flow-pkts-either/README.md b/tests/detect-flow-pkts-either/README.md
new file mode 100644
index 000000000..89bdf91cd
--- /dev/null
+++ b/tests/detect-flow-pkts-either/README.md
@@ -0,0 +1,13 @@
+Test
+====
+
+Test `flow.pkts:either`.. and `flow.bytes:either`.. keywords
+
+PCAP
+====
+
+From existing s-v test.
+
+Related tickets
+==============
+https://redmine.openinfosecfoundation.org/issues/5646
diff --git a/tests/detect-flow-pkts-either/test.rules b/tests/detect-flow-pkts-either/test.rules
new file mode 100644
index 000000000..95b63004a
--- /dev/null
+++ b/tests/detect-flow-pkts-either/test.rules
@@ -0,0 +1,5 @@
+alert ip any any -> any any (msg:"Flow has more than 3000 bytes and 10 pkts in either direction";flow.pkts:either,=10;flow.bytes:either,>3000; sid:1;)
+alert ip any any -> any any (msg:"Flow has 10 pkts in toserver direction";flow.pkts:toserver,=10;prefilter;sid:2;)
+alert ip any any -> any any (msg:"Flow has 10 pkts in toclient direction";flow.pkts:toclient,=10;sid:3;)
+alert ip any any -> any any (msg:"Flow has more than 3000 bytes in toserver direction";flow.bytes:toserver,>3000;sid:4;)
+alert ip any any -> any any (msg:"Flow has more than 3000 bytes in toclient direction";flow.bytes:toclient,>3000; threshold: type backoff, track by_flow, count 2, multiplier 10; sid:5;)
diff --git a/tests/detect-flow-pkts-either/test.yaml b/tests/detect-flow-pkts-either/test.yaml
new file mode 100644
index 000000000..634b6a034
--- /dev/null
+++ b/tests/detect-flow-pkts-either/test.yaml
@@ -0,0 +1,38 @@
+requires:
+  min-version: 8
+
+pcap: ../decode-teredo-01/input.pcap
+
+args:
+- -k none
+
+checks:
+- filter:
+    count: 3
+    match:
+      event_type: alert
+      alert.signature_id: 1
+
+- filter:
+    count: 3
+    match:
+      event_type: alert
+      alert.signature_id: 2
+
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 3
+
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 4
+
+- filter:
+    count: 2
+    match:
+      event_type: alert
+      alert.signature_id: 5