From f44412adcab89bcbf5075f90e43da4b95585bef5 Mon Sep 17 00:00:00 2001 From: jason taylor Date: Wed, 22 May 2019 20:04:55 -0400 Subject: [PATCH] tests: add invalid byte extract depth usage Signed-off-by: jason taylor --- .../suricata.yaml | 10 ++++++++ tests/test-bad-byte-extract-rule-1/test.rules | 1 + tests/test-bad-byte-extract-rule-1/test.yaml | 23 +++++++++++++++++++ .../suricata.yaml | 10 ++++++++ tests/test-bad-byte-extract-rule-2/test.rules | 1 + tests/test-bad-byte-extract-rule-2/test.yaml | 23 +++++++++++++++++++ 6 files changed, 68 insertions(+) create mode 100644 tests/test-bad-byte-extract-rule-1/suricata.yaml create mode 100644 tests/test-bad-byte-extract-rule-1/test.rules create mode 100644 tests/test-bad-byte-extract-rule-1/test.yaml create mode 100644 tests/test-bad-byte-extract-rule-2/suricata.yaml create mode 100644 tests/test-bad-byte-extract-rule-2/test.rules create mode 100644 tests/test-bad-byte-extract-rule-2/test.yaml diff --git a/tests/test-bad-byte-extract-rule-1/suricata.yaml b/tests/test-bad-byte-extract-rule-1/suricata.yaml new file mode 100644 index 000000000..dcaae57fe --- /dev/null +++ b/tests/test-bad-byte-extract-rule-1/suricata.yaml @@ -0,0 +1,10 @@ +%YAML 1.1 +--- + +logging: + default-log-level: info + outputs: + - file: + enabled: yes + filename: eve.json + type: json diff --git a/tests/test-bad-byte-extract-rule-1/test.rules b/tests/test-bad-byte-extract-rule-1/test.rules new file mode 100644 index 000000000..ede658126 --- /dev/null +++ b/tests/test-bad-byte-extract-rule-1/test.rules @@ -0,0 +1 @@ +alert tcp any any -> any any (msg:"Byte_Extract Example Using depth"; content:"Alice"; depth:d; byte_extract:2,1,size; content:"Bob"; sid:1111;) diff --git a/tests/test-bad-byte-extract-rule-1/test.yaml b/tests/test-bad-byte-extract-rule-1/test.yaml new file mode 100644 index 000000000..004036e8a --- /dev/null +++ b/tests/test-bad-byte-extract-rule-1/test.yaml @@ -0,0 +1,23 @@ +requires: + min-version: 5.0.0 + + features: + - HAVE_LIBJANSSON + +command: | + ${SRCDIR}/src/suricata --set classification-file="${SRCDIR}/classification.config" --set reference-config-file="${SRCDIR}/reference.config" -l ${OUTPUT_DIR} -c ${TEST_DIR}/suricata.yaml -r ${TEST_DIR}/ -S ${TEST_DIR}/test.rules + +checks: + # check that we have the following entres in eve.json + # match 1 specific rule load failure reason + - filter: + count: 1 + match: + event_type: engine + engine.message: "unknown byte_extract var seen in depth - d." + + - filter: + count: 1 + match: + event_type: engine + engine.error: "SC_ERR_NO_RULES_LOADED" diff --git a/tests/test-bad-byte-extract-rule-2/suricata.yaml b/tests/test-bad-byte-extract-rule-2/suricata.yaml new file mode 100644 index 000000000..dcaae57fe --- /dev/null +++ b/tests/test-bad-byte-extract-rule-2/suricata.yaml @@ -0,0 +1,10 @@ +%YAML 1.1 +--- + +logging: + default-log-level: info + outputs: + - file: + enabled: yes + filename: eve.json + type: json diff --git a/tests/test-bad-byte-extract-rule-2/test.rules b/tests/test-bad-byte-extract-rule-2/test.rules new file mode 100644 index 000000000..eb9e9b69a --- /dev/null +++ b/tests/test-bad-byte-extract-rule-2/test.rules @@ -0,0 +1 @@ +alert tcp any any -> any any (msg:"bad depth value rule"; content:"first"; depth:-5; byte_extract:2,0,size; sid:111232; rev:1;) diff --git a/tests/test-bad-byte-extract-rule-2/test.yaml b/tests/test-bad-byte-extract-rule-2/test.yaml new file mode 100644 index 000000000..306e1d758 --- /dev/null +++ b/tests/test-bad-byte-extract-rule-2/test.yaml @@ -0,0 +1,23 @@ +requires: + min-version: 5.0.0 + + features: + - HAVE_LIBJANSSON + +command: | + ${SRCDIR}/src/suricata --set classification-file="${SRCDIR}/classification.config" --set reference-config-file="${SRCDIR}/reference.config" -l ${OUTPUT_DIR} -c ${TEST_DIR}/suricata.yaml -r ${TEST_DIR}/ -S ${TEST_DIR}/test.rules + +checks: + # check that we have the following entres in eve.json + # match 1 specific rule load failure reason + - filter: + count: 1 + match: + event_type: engine + engine.message: "invalid value for depth: -5." + + - filter: + count: 1 + match: + event_type: engine + engine.error: "SC_ERR_NO_RULES_LOADED" -- 2.47.2