From 2f18df0dd18723f8fcc37fbf74d438ef3c6ffb4a Mon Sep 17 00:00:00 2001
From: Benjamin Wilkins <benjamin.wilkins@uwaterloo.ca>
Date: Tue, 2 Nov 2021 15:24:21 -0400
Subject: [PATCH] lua: Test SCRule* functions for match scripts

---
 tests/lua-match-scrule/README.md             |   1 +
 tests/lua-match-scrule/input.pcap            | Bin 0 -> 1104 bytes
 tests/lua-match-scrule/lua-scrule-action.lua |  14 +++++++
 tests/lua-match-scrule/lua-scrule-class.lua  |  14 +++++++
 tests/lua-match-scrule/lua-scrule-ids.lua    |  14 +++++++
 tests/lua-match-scrule/lua-scrule-msg.lua    |  14 +++++++
 tests/lua-match-scrule/suricata.yaml         |   4 ++
 tests/lua-match-scrule/test.rules            |   8 ++++
 tests/lua-match-scrule/test.yaml             |  38 +++++++++++++++++++
 9 files changed, 107 insertions(+)
 create mode 100644 tests/lua-match-scrule/README.md
 create mode 100644 tests/lua-match-scrule/input.pcap
 create mode 100644 tests/lua-match-scrule/lua-scrule-action.lua
 create mode 100644 tests/lua-match-scrule/lua-scrule-class.lua
 create mode 100644 tests/lua-match-scrule/lua-scrule-ids.lua
 create mode 100644 tests/lua-match-scrule/lua-scrule-msg.lua
 create mode 100644 tests/lua-match-scrule/suricata.yaml
 create mode 100644 tests/lua-match-scrule/test.rules
 create mode 100644 tests/lua-match-scrule/test.yaml

diff --git a/tests/lua-match-scrule/README.md b/tests/lua-match-scrule/README.md
new file mode 100644
index 000000000..872ec683e
--- /dev/null
+++ b/tests/lua-match-scrule/README.md
@@ -0,0 +1 @@
+Tests Lua's SCRule functions for match scripts.
diff --git a/tests/lua-match-scrule/input.pcap b/tests/lua-match-scrule/input.pcap
new file mode 100644
index 0000000000000000000000000000000000000000..8fb6832de69b21a5981f5eab3f5820dec990de8b
GIT binary patch
literal 1104
zc-noE-A~g{7{=f314*%Am>7vyCtS!JY-_tOXc$5iK?b^D4cE0hj3umH+729lfJ9@$
zohZaa5(ytSMx!?-P7`i0+&M3d8n1+yC|;^}dQO`KSe7+;o1XXd{PLXVeLieIUv+^8
z4j&IN<o#y*_T-&zfKhM?PM_hL{(RiMd$4-B8HND*7Vi(hK-0=D>tk9b)}Ad_wje#f
zv;La?{Mcpq9?b%{Jl+=`S2N3+{w~^Q-0l;U{I|so{bWtcVLE)9%mWO7&?IS;O6icU
zY%T4-KS${0!l|{4_R1kwX~~mrh!ax0o=*SblCAS=jm|P5cBXx>cfsr2_6eaZ5Wqq`
zN@?+dO}ST>(hhrP-vJB{$ta9QWH}ucLITH*=%yv1xw*NJg-t78%4N)us^>ZOhKY^f
zU>0j+TP+$h;Y27J3Go~|sH(U?nt^bDV>y<}+WhW?KBB0vo>hL?pjPd>Ypm*=-`QwQ
z`<PV!)#_L&tNg<Yy=1zyYFSK|Y*N;@e|1^yOzLe5K=pD+<au;0#j%$Z3rlDcXS$IP
zL8HYPvLnQiC`wUL;uC0iT;|y8*qFtJga!+WI*mDYOfjwCxSq*P<#0wq<GMyp$Iz&v
zQEmc>5lIlFSj;&+Br917bqGCz+7s<nf?^^V6%&FQn-UZ?s`4FG-+~j0mc^!oZkCAQ
z9D7mMEaGu+3~O0yT0)WD!=79!5ZxBOWre4${0w!wn9C%2zoF~ad6Yf+ZRo{<SzX#g
z`9+Lukhq6-R=yn1%0}zbekDK>caYq4#_{rJL&~yE`COOMMkpH&<!QOOQ9vv^Ak6Wh
jRsw|NOSdtp<dvfV`At|26s_2bKGi7l5nh*luXTX`;&4rh

literal 0
Hc-jL100001

diff --git a/tests/lua-match-scrule/lua-scrule-action.lua b/tests/lua-match-scrule/lua-scrule-action.lua
new file mode 100644
index 000000000..57180718b
--- /dev/null
+++ b/tests/lua-match-scrule/lua-scrule-action.lua
@@ -0,0 +1,14 @@
+function init(args)
+    local needs = {}
+    return needs
+end
+
+function match(args)
+    action = SCRuleAction()
+
+    if action == "alert" then
+        return 1
+    else
+        return 0
+    end
+end
diff --git a/tests/lua-match-scrule/lua-scrule-class.lua b/tests/lua-match-scrule/lua-scrule-class.lua
new file mode 100644
index 000000000..d9633283b
--- /dev/null
+++ b/tests/lua-match-scrule/lua-scrule-class.lua
@@ -0,0 +1,14 @@
+function init(args)
+    local needs = {}
+    return needs
+end
+
+function match(args)
+    msg, prio = SCRuleClass()
+
+    if msg == "Potentially Bad Traffic" and prio == 2 then
+        return 1
+    else
+        return 0
+    end
+end
diff --git a/tests/lua-match-scrule/lua-scrule-ids.lua b/tests/lua-match-scrule/lua-scrule-ids.lua
new file mode 100644
index 000000000..893116110
--- /dev/null
+++ b/tests/lua-match-scrule/lua-scrule-ids.lua
@@ -0,0 +1,14 @@
+function init(args)
+    local needs = {}
+    return needs
+end
+
+function match(args)
+    sid, rev, gid = SCRuleIds()
+
+    if sid == 1 and rev == 7 and gid == 1 then
+        return 1
+    else
+        return 0
+    end
+end
diff --git a/tests/lua-match-scrule/lua-scrule-msg.lua b/tests/lua-match-scrule/lua-scrule-msg.lua
new file mode 100644
index 000000000..71757e34d
--- /dev/null
+++ b/tests/lua-match-scrule/lua-scrule-msg.lua
@@ -0,0 +1,14 @@
+function init(args)
+    local needs = {}
+    return needs
+end
+
+function match(args)
+    msg = SCRuleMsg()
+
+    if msg == "FOO" then
+        return 1
+    else
+        return 0
+    end
+end
diff --git a/tests/lua-match-scrule/suricata.yaml b/tests/lua-match-scrule/suricata.yaml
new file mode 100644
index 000000000..e27e9967f
--- /dev/null
+++ b/tests/lua-match-scrule/suricata.yaml
@@ -0,0 +1,4 @@
+%YAML 1.1
+---
+
+include: ../../etc/suricata-4.0.3.yaml
\ No newline at end of file
diff --git a/tests/lua-match-scrule/test.rules b/tests/lua-match-scrule/test.rules
new file mode 100644
index 000000000..ee3294c11
--- /dev/null
+++ b/tests/lua-match-scrule/test.rules
@@ -0,0 +1,8 @@
+alert ip any any -> any any (msg:"GPL ATTACK_RESPONSE id check returned root"; content:"uid=0|28|root|29|"; classtype:bad-unknown; lua:lua-scrule-ids.lua; sid:1; rev:7;)
+alert ip any any -> any any (msg:"GPL ATTACK_RESPONSE id check returned root"; content:"uid=0|28|root|29|"; classtype:bad-unknown; lua:lua-scrule-ids.lua; sid:2; rev:7;)
+alert ip any any -> any any (msg:"GPL ATTACK_RESPONSE id check returned root"; content:"uid=0|28|root|29|"; classtype:bad-unknown; lua:lua-scrule-action.lua; sid:3; rev:7;)
+drop ip any any -> any any (msg:"GPL ATTACK_RESPONSE id check returned root"; content:"uid=0|28|root|29|"; classtype:bad-unknown; lua:lua-scrule-action.lua; sid:4; rev:7;)
+alert ip any any -> any any (msg:"FOO"; content:"uid=0|28|root|29|"; classtype:bad-unknown; lua:lua-scrule-msg.lua; sid:5; rev:7;)
+alert ip any any -> any any (msg:"BAR"; content:"uid=0|28|root|29|"; classtype:bad-unknown; lua:lua-scrule-msg.lua; sid:6; rev:7;)
+alert ip any any -> any any (msg:"GPL ATTACK_RESPONSE id check returned root"; content:"uid=0|28|root|29|"; classtype:bad-unknown; lua:lua-scrule-class.lua; sid:7; rev:7;)
+alert ip any any -> any any (msg:"GPL ATTACK_RESPONSE id check returned root"; content:"uid=0|28|root|29|"; classtype:not-suspicious; lua:lua-scrule-class.lua; sid:8; rev:7;)
diff --git a/tests/lua-match-scrule/test.yaml b/tests/lua-match-scrule/test.yaml
new file mode 100644
index 000000000..c1d12a16e
--- /dev/null
+++ b/tests/lua-match-scrule/test.yaml
@@ -0,0 +1,38 @@
+requires:
+  min-version: 7
+  features:
+    - HAVE_LUA
+
+checks:
+  - filter:
+      count: 1
+      match:
+        alert.signature_id: 1
+  - filter:
+      count: 0
+      match:
+        alert.signature_id: 2
+  - filter:
+      count: 1
+      match:
+        alert.signature_id: 3
+  - filter:
+      count: 0
+      match:
+        alert.signature_id: 4
+  - filter:
+      count: 1
+      match:
+        alert.signature_id: 5
+  - filter:
+      count: 0
+      match:
+        alert.signature_id: 6
+  - filter:
+      count: 1
+      match:
+        alert.signature_id: 7
+  - filter:
+      count: 0
+      match:
+        alert.signature_id: 8
-- 
2.47.3