test: update tests for suricata.rule lib

Ticket: #7490

diff --git a/tests/lua-match-scrule/lua-scrule-action.lua b/tests/lua-match-scrule/lua-scrule-action.lua
index 57180718b53387c3b6618a15d72ae0f0b52f1231..edb64f4be0a890887d29f8526479c6d5bd075a49 100644 (file)
--- a/tests/lua-match-scrule/lua-scrule-action.lua
+++ b/tests/lua-match-scrule/lua-scrule-action.lua
@@ -1,10 +1,13 @@
+local rule = require("suricata.rule")
+
 function init(args)
     local needs = {}
     return needs
 end
 
 function match(args)
-    action = SCRuleAction()
+    local sig = rule.get_rule()
+    local action = sig:action()
 
     if action == "alert" then
         return 1

diff --git a/tests/lua-match-scrule/lua-scrule-class.lua b/tests/lua-match-scrule/lua-scrule-class.lua
index d9633283b94434b733132d451e925b0882a57cbe..5e6f52063165935b9040588cbaa2514f6f67f6a2 100644 (file)
--- a/tests/lua-match-scrule/lua-scrule-class.lua
+++ b/tests/lua-match-scrule/lua-scrule-class.lua
@@ -1,14 +1,22 @@
+local rule = require("suricata.rule")
+
 function init(args)
     local needs = {}
     return needs
 end
 
 function match(args)
-    msg, prio = SCRuleClass()
+    local sig = rule.get_rule()
+
+    local class_description = sig:class_description()
+    if class_description ~= "Potentially Bad Traffic" then
+       return 0
+    end
 
-    if msg == "Potentially Bad Traffic" and prio == 2 then
-        return 1
-    else
-        return 0
+    local priority = sig:priority()
+    if priority ~= 2 then
+       return 0
     end
+
+    return 1
 end

diff --git a/tests/lua-match-scrule/lua-scrule-ids.lua b/tests/lua-match-scrule/lua-scrule-ids.lua
index 893116110f64cf2a2af7bd12f2bb9c15fd1a029d..9ca0e2bfa73d2be2fafe776de3bbc05a3047faa1 100644 (file)
--- a/tests/lua-match-scrule/lua-scrule-ids.lua
+++ b/tests/lua-match-scrule/lua-scrule-ids.lua
@@ -1,10 +1,15 @@
+local rule = require("suricata.rule")
+
 function init(args)
     local needs = {}
     return needs
 end
 
 function match(args)
-    sid, rev, gid = SCRuleIds()
+    local sig = rule.get_rule()
+    local sid = sig:sid()
+    local rev = sig:rev()
+    local gid = sig:gid()
 
     if sid == 1 and rev == 7 and gid == 1 then
         return 1

diff --git a/tests/lua-match-scrule/lua-scrule-msg.lua b/tests/lua-match-scrule/lua-scrule-msg.lua
index 71757e34d54d4090923ddca95a7ad86728cdfc38..9b1ad777deb5eab75f42290d6b44d1c39fa6ebe8 100644 (file)
--- a/tests/lua-match-scrule/lua-scrule-msg.lua
+++ b/tests/lua-match-scrule/lua-scrule-msg.lua
@@ -1,10 +1,13 @@
+local rule = require("suricata.rule")
+
 function init(args)
     local needs = {}
     return needs
 end
 
 function match(args)
-    msg = SCRuleMsg()
+    local sig = rule.get_rule()
+    local msg = sig:msg()
 
     if msg == "FOO" then
         return 1

diff --git a/tests/lua-match-scrule/test.yaml b/tests/lua-match-scrule/test.yaml
index 9e536a3e821741ad121e24061bc8382b27229d3b..08fd53fa931e54a52fc3250f258ea532dc204609 100644 (file)
--- a/tests/lua-match-scrule/test.yaml
+++ b/tests/lua-match-scrule/test.yaml
@@ -1,7 +1,7 @@
 pcap: ../flowbit-oring/input.pcap
 
 requires:
-  min-version: 7
+  min-version: 8
   features:
     - HAVE_LUA
 

diff --git a/tests/lua-scrule-ids/lua-scrule-ids.lua b/tests/lua-scrule-ids/lua-scrule-ids.lua
index d68d48ed1fc708fa21217b5dd5f4cc0920b598c0..9558ec3325bc788cd9ff27bd13cc2757bd77c054 100644 (file)
--- a/tests/lua-scrule-ids/lua-scrule-ids.lua
+++ b/tests/lua-scrule-ids/lua-scrule-ids.lua
@@ -1,12 +1,14 @@
 -- lua_pushinteger output test for SCRuleIds and ...
 local packet = require "suricata.packet"
+local rule = require "suricata.rule"
+
 name = "lua-scrule-ids.log"
 
 function init(args)
-    local needs = {}
-    needs["type"] = "packet"
-    needs["filter"] = "alerts"
-    return needs
+    return {
+        type = "packet",
+        filter = "alerts",
+    }
 end
 
 function setup(args)
@@ -18,7 +20,10 @@ end
 function log(args)
     p = packet.get()
     timestring = p:timestring_legacy()
-    sid, rev, gid = SCRuleIds()
+    local sig = rule.get_rule()
+    local sid = sig:sid()
+    local rev = sig:rev()
+    local gid = sig:gid()
 
     file:write ("[**] " .. timestring .. "\nSCRuleIds is\n[**]\nSignature id: " .. sid .. "\nrevision: " .. rev .. "\nGroup id: " .. gid .. "[**]")
     file:flush()

diff --git a/tests/pre8/lua-match-scrule/README.md b/tests/pre8/lua-match-scrule/README.md
new file mode 100644 (file)
index 0000000..872ec68
--- /dev/null
+++ b/tests/pre8/lua-match-scrule/README.md
@@ -0,0 +1 @@
+Tests Lua's SCRule functions for match scripts.

diff --git a/tests/pre8/lua-match-scrule/lua-scrule-action.lua b/tests/pre8/lua-match-scrule/lua-scrule-action.lua
new file mode 100644 (file)
index 0000000..5718071
--- /dev/null
+++ b/tests/pre8/lua-match-scrule/lua-scrule-action.lua
@@ -0,0 +1,14 @@
+function init(args)
+    local needs = {}
+    return needs
+end
+
+function match(args)
+    action = SCRuleAction()
+
+    if action == "alert" then
+        return 1
+    else
+        return 0
+    end
+end

diff --git a/tests/pre8/lua-match-scrule/lua-scrule-class.lua b/tests/pre8/lua-match-scrule/lua-scrule-class.lua
new file mode 100644 (file)
index 0000000..d963328
--- /dev/null
+++ b/tests/pre8/lua-match-scrule/lua-scrule-class.lua
@@ -0,0 +1,14 @@
+function init(args)
+    local needs = {}
+    return needs
+end
+
+function match(args)
+    msg, prio = SCRuleClass()
+
+    if msg == "Potentially Bad Traffic" and prio == 2 then
+        return 1
+    else
+        return 0
+    end
+end

diff --git a/tests/pre8/lua-match-scrule/lua-scrule-ids.lua b/tests/pre8/lua-match-scrule/lua-scrule-ids.lua
new file mode 100644 (file)
index 0000000..8931161
--- /dev/null
+++ b/tests/pre8/lua-match-scrule/lua-scrule-ids.lua
@@ -0,0 +1,14 @@
+function init(args)
+    local needs = {}
+    return needs
+end
+
+function match(args)
+    sid, rev, gid = SCRuleIds()
+
+    if sid == 1 and rev == 7 and gid == 1 then
+        return 1
+    else
+        return 0
+    end
+end

diff --git a/tests/pre8/lua-match-scrule/lua-scrule-msg.lua b/tests/pre8/lua-match-scrule/lua-scrule-msg.lua
new file mode 100644 (file)
index 0000000..71757e3
--- /dev/null
+++ b/tests/pre8/lua-match-scrule/lua-scrule-msg.lua
@@ -0,0 +1,14 @@
+function init(args)
+    local needs = {}
+    return needs
+end
+
+function match(args)
+    msg = SCRuleMsg()
+
+    if msg == "FOO" then
+        return 1
+    else
+        return 0
+    end
+end

diff --git a/tests/pre8/lua-match-scrule/suricata.yaml b/tests/pre8/lua-match-scrule/suricata.yaml
new file mode 100644 (file)
index 0000000..34ebc57
--- /dev/null
+++ b/tests/pre8/lua-match-scrule/suricata.yaml
@@ -0,0 +1,4 @@
+%YAML 1.1
+---
+
+include: ../../../etc/suricata-4.0.3.yaml

diff --git a/tests/pre8/lua-match-scrule/test.rules b/tests/pre8/lua-match-scrule/test.rules
new file mode 100644 (file)
index 0000000..ee3294c
--- /dev/null
+++ b/tests/pre8/lua-match-scrule/test.rules
@@ -0,0 +1,8 @@
+alert ip any any -> any any (msg:"GPL ATTACK_RESPONSE id check returned root"; content:"uid=0|28|root|29|"; classtype:bad-unknown; lua:lua-scrule-ids.lua; sid:1; rev:7;)
+alert ip any any -> any any (msg:"GPL ATTACK_RESPONSE id check returned root"; content:"uid=0|28|root|29|"; classtype:bad-unknown; lua:lua-scrule-ids.lua; sid:2; rev:7;)
+alert ip any any -> any any (msg:"GPL ATTACK_RESPONSE id check returned root"; content:"uid=0|28|root|29|"; classtype:bad-unknown; lua:lua-scrule-action.lua; sid:3; rev:7;)
+drop ip any any -> any any (msg:"GPL ATTACK_RESPONSE id check returned root"; content:"uid=0|28|root|29|"; classtype:bad-unknown; lua:lua-scrule-action.lua; sid:4; rev:7;)
+alert ip any any -> any any (msg:"FOO"; content:"uid=0|28|root|29|"; classtype:bad-unknown; lua:lua-scrule-msg.lua; sid:5; rev:7;)
+alert ip any any -> any any (msg:"BAR"; content:"uid=0|28|root|29|"; classtype:bad-unknown; lua:lua-scrule-msg.lua; sid:6; rev:7;)
+alert ip any any -> any any (msg:"GPL ATTACK_RESPONSE id check returned root"; content:"uid=0|28|root|29|"; classtype:bad-unknown; lua:lua-scrule-class.lua; sid:7; rev:7;)
+alert ip any any -> any any (msg:"GPL ATTACK_RESPONSE id check returned root"; content:"uid=0|28|root|29|"; classtype:not-suspicious; lua:lua-scrule-class.lua; sid:8; rev:7;)

diff --git a/tests/pre8/lua-match-scrule/test.yaml b/tests/pre8/lua-match-scrule/test.yaml
new file mode 100644 (file)
index 0000000..727f35e
--- /dev/null
+++ b/tests/pre8/lua-match-scrule/test.yaml
@@ -0,0 +1,44 @@
+pcap: ../../flowbit-oring/input.pcap
+
+requires:
+  min-version: 7
+  lt-version: 8
+  features:
+    - HAVE_LUA
+
+args:
+  - --set security.lua.allow-rules=true
+
+checks:
+  - filter:
+      count: 1
+      match:
+        alert.signature_id: 1
+  - filter:
+      count: 0
+      match:
+        alert.signature_id: 2
+  - filter:
+      count: 1
+      match:
+        alert.signature_id: 3
+  - filter:
+      count: 0
+      match:
+        alert.signature_id: 4
+  - filter:
+      count: 1
+      match:
+        alert.signature_id: 5
+  - filter:
+      count: 0
+      match:
+        alert.signature_id: 6
+  - filter:
+      count: 1
+      match:
+        alert.signature_id: 7
+  - filter:
+      count: 0
+      match:
+        alert.signature_id: 8