From d857694e2d9114088d340c63a19e4b192b470d3a Mon Sep 17 00:00:00 2001
From: Jeff Lucovsky <jeff@lucovsky.org>
Date: Sat, 5 Dec 2020 09:43:12 -0500
Subject: [PATCH] threshold-config: New test for issue in 2190

This commit adds a test case for large IP address handling in the
threshold.config file.
---
 tests/bug-2190/input.pcap       | Bin 0 -> 100 bytes
 tests/bug-2190/test.rules       |   1 +
 tests/bug-2190/test.yaml        |  15 +++++++++++++++
 tests/bug-2190/threshold.config |   1 +
 4 files changed, 17 insertions(+)
 create mode 100644 tests/bug-2190/input.pcap
 create mode 100644 tests/bug-2190/test.rules
 create mode 100644 tests/bug-2190/test.yaml
 create mode 100644 tests/bug-2190/threshold.config

diff --git a/tests/bug-2190/input.pcap b/tests/bug-2190/input.pcap
new file mode 100644
index 0000000000000000000000000000000000000000..170b5e89d7cd3ac080ee79fbc8298b43e888f22c
GIT binary patch
literal 100
zc-p&ic+)~A1{MYcU}0bck{pwZoMzi{G1vgvAp9Q;7`R<GfB(b5;L5<DvhXeg10&<s
YEWUscCy*Q`!{kIpCI&7Lp8*8`00CbZjQ{`u

literal 0
Hc-jL100001

diff --git a/tests/bug-2190/test.rules b/tests/bug-2190/test.rules
new file mode 100644
index 0000000..4c0d517
--- /dev/null
+++ b/tests/bug-2190/test.rules
@@ -0,0 +1 @@
+alert http any any -> any any (http.request_body; url_decode; content:"mail=test@oisf.net"; sid:1;)
diff --git a/tests/bug-2190/test.yaml b/tests/bug-2190/test.yaml
new file mode 100644
index 0000000..8101392
--- /dev/null
+++ b/tests/bug-2190/test.yaml
@@ -0,0 +1,15 @@
+requires:
+    min-version: 6
+
+exit-code: 0
+
+command: |
+  ${SRCDIR}/src/suricata --set classification-file="${SRCDIR}/etc/classification.config"    \
+      --set reference-config-file="${SRCDIR}/etc/reference.config" -l ${OUTPUT_DIR}         \
+      --set threshold-file="${TEST_DIR}/threshold.config"                                   \
+      -c "${SRCDIR}/suricata.yaml" -r ${TEST_DIR}/input.pcap -S ${TEST_DIR}/test.rules 
+
+checks:
+    - shell:
+        args: grep "SC_ERR_PCRE_" suricata.log | wc -l | xargs
+        expect: 0
diff --git a/tests/bug-2190/threshold.config b/tests/bug-2190/threshold.config
new file mode 100644
index 0000000..fb8e9d7
--- /dev/null
+++ b/tests/bug-2190/threshold.config
@@ -0,0 +1 @@
+suppress gen_id 0, sig_id 0, track by_src, ip [123.123.123.123/32,123.123.123.123/32,123.123.123.123/32,123.123.123.123/32,123.123.123.123/32,123.123.123.123/32,123.123.123.123/32,123.123.123.123/32,123.123.123.123/32,123.123.123.123/32,123.123.123.123/32,123.123.123.123/32,123.123.123.123/32,123.123.123.123/32,123.123.123.123/32,123.123.123.123/32,123.123.123.123/32,123.123.123.123/32,123.123.123.123/32,123.123.123.123/32,123.123.123.123/32,123.123.123.123/32,123.123.123.123/32,123.123.123.123/32,123.123.123.123/32,123.123.123.123/32,123.123.123.123/32,123.123.123.123/32,123.123.123.123/32,123.123.123.123/32,123.123.123.123/32,123.123.123.123/32,123.123.123.123/32,123.123.123.123/32,123.123.123.123/32,123.123.123.123/32,123.123.123.123/32,123.123.123.123/32,123.123.123.123/32,123.123.123.123/32,123.123.123.123/32,123.123.123.123/32,123.123.123.123/32,123.123.123.123/32,123.123.123.123/32,123.123.123.123/32,123.123.123.123/32,123.123.123.123/32,123.123.123.123/32,123.123.123.123/32,123.123.123.123/32,123.123.123.123/32,123.123.123.123/32]
-- 
2.47.3