From adf2ff4811bcf4ba8b02cb73dcd9f2384bfb276f Mon Sep 17 00:00:00 2001
From: Philippe Antoine <pantoine@oisf.net>
Date: Wed, 24 Sep 2025 21:08:23 +0200
Subject: [PATCH] dnp3: adds tests about dnp3.ind keyword

Ticket: 6724
---
 tests/dnp3/dnp3-ind-keyword/README.md     |  7 ++++++
 tests/dnp3/dnp3-ind-keyword/suricata.yaml | 20 +++++++++++++++
 tests/dnp3/dnp3-ind-keyword/test.rules    | 19 ++++++++++++++
 tests/dnp3/dnp3-ind-keyword/test.yaml     | 30 +++++++++++++++++++++++
 4 files changed, 76 insertions(+)
 create mode 100644 tests/dnp3/dnp3-ind-keyword/README.md
 create mode 100644 tests/dnp3/dnp3-ind-keyword/suricata.yaml
 create mode 100644 tests/dnp3/dnp3-ind-keyword/test.rules
 create mode 100644 tests/dnp3/dnp3-ind-keyword/test.yaml

diff --git a/tests/dnp3/dnp3-ind-keyword/README.md b/tests/dnp3/dnp3-ind-keyword/README.md
new file mode 100644
index 000000000..5d3b6e861
--- /dev/null
+++ b/tests/dnp3/dnp3-ind-keyword/README.md
@@ -0,0 +1,7 @@
+# Description
+
+Test dnp3.ind rule keyword.
+
+# PCAP
+
+reused
diff --git a/tests/dnp3/dnp3-ind-keyword/suricata.yaml b/tests/dnp3/dnp3-ind-keyword/suricata.yaml
new file mode 100644
index 000000000..3011d88dc
--- /dev/null
+++ b/tests/dnp3/dnp3-ind-keyword/suricata.yaml
@@ -0,0 +1,20 @@
+%YAML 1.1
+---
+
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular
+      filename: eve.json
+      types:
+        - alert:
+            payload: yes
+            packet: yes
+            dnp3: yes
+
+app-layer:
+  protocols:
+    dnp3:
+      enabled: yes
+      detection-ports:
+        dp: 20000
diff --git a/tests/dnp3/dnp3-ind-keyword/test.rules b/tests/dnp3/dnp3-ind-keyword/test.rules
new file mode 100644
index 000000000..02130dc86
--- /dev/null
+++ b/tests/dnp3/dnp3-ind-keyword/test.rules
@@ -0,0 +1,19 @@
+# Should match.
+alert dnp3 any any -> any any (msg:"DNP3 ind test_restart string"; \
+      dnp3.ind:device_restart; sid:1; rev:1;)
+
+# Should match.
+alert dnp3 any any -> any any (msg:"DNP3 ind test_restart num"; \
+      dnp3.ind:0x8000; sid:2; rev:1;)
+
+# Should match.
+alert dnp3 any any -> any any (msg:"DNP3 ind not zero"; \
+      dnp3.ind:!0; sid:3; rev:1;)
+
+alert dnp3 any any -> any any (msg:"DNP3 ind test_restart multi"; \
+      dnp3.ind:device_restart,!need_time; sid:4; rev:1;)
+
+# Should not match.
+alert dnp3 any any -> any any (msg:"DNP3 ind need_time"; \
+      dnp3.ind:need_time; sid:5; rev:1;)
+
diff --git a/tests/dnp3/dnp3-ind-keyword/test.yaml b/tests/dnp3/dnp3-ind-keyword/test.yaml
new file mode 100644
index 000000000..0c50bd9cb
--- /dev/null
+++ b/tests/dnp3/dnp3-ind-keyword/test.yaml
@@ -0,0 +1,30 @@
+requires:
+  min-version: 9
+
+pcap: ../dnp3-eve/input.pcap
+
+checks:
+  - filter:
+      count: 2
+      match:
+        alert.signature_id: 1
+        dnp3.response.iin.indicators[0]: device_restart
+        checks:
+  - filter:
+      count: 2
+      match:
+        alert.signature_id: 2
+        dnp3.response.iin.indicators[0]: device_restart
+  - filter:
+      count: 2
+      match:
+        alert.signature_id: 3
+  - filter:
+      count: 2
+      match:
+        alert.signature_id: 4
+        dnp3.response.iin.indicators[0]: device_restart
+  - filter:
+      count: 0
+      match:
+        alert.signature_id: 5
-- 
2.47.3