udp: add tests for bug 5379

diff --git a/tests/udp-5379/udp-hlen-invalid-non-strict/README.md b/tests/udp-5379/udp-hlen-invalid-non-strict/README.md
new file mode 100644 (file)
index 0000000..c71aa1d
--- /dev/null
+++ b/tests/udp-5379/udp-hlen-invalid-non-strict/README.md
@@ -0,0 +1,7 @@
+Description
+===========
+Test to check that the use of decoder event udp.hlen_invalid in rule issues warning.
+
+PCAP
+====
+Created with Scapy.

diff --git a/tests/udp-5379/udp-hlen-invalid-non-strict/input.pcap b/tests/udp-5379/udp-hlen-invalid-non-strict/input.pcap
new file mode 100644 (file)
index 0000000..3e93280
Binary files /dev/null and b/tests/udp-5379/udp-hlen-invalid-non-strict/input.pcap differ

diff --git a/tests/udp-5379/udp-hlen-invalid-non-strict/test.rules b/tests/udp-5379/udp-hlen-invalid-non-strict/test.rules
new file mode 100644 (file)
index 0000000..7c21ca9
--- /dev/null
+++ b/tests/udp-5379/udp-hlen-invalid-non-strict/test.rules
@@ -0,0 +1 @@
+alert pkthdr any any -> any any (msg:"SURICATA UDP invalid header length"; decode-event:udp.hlen_invalid; classtype:protocol-command-decode; sid:2200040; rev:2;)

diff --git a/tests/udp-5379/udp-hlen-invalid-non-strict/test.yaml b/tests/udp-5379/udp-hlen-invalid-non-strict/test.yaml
new file mode 100644 (file)
index 0000000..33e466a
--- /dev/null
+++ b/tests/udp-5379/udp-hlen-invalid-non-strict/test.yaml
@@ -0,0 +1,19 @@
+exit-code: 0
+
+command: |
+  ${SRCDIR}/src/suricata --set classification-file="${SRCDIR}/etc/classification.config"    \
+      --set reference-config-file="${SRCDIR}/etc/reference.config" -l ${OUTPUT_DIR}         \
+      --set threshold-file="${TEST_DIR}/threshold.config"                                   \
+      -c "${SRCDIR}/suricata.yaml" -r ${TEST_DIR}/input.pcap -S ${TEST_DIR}/test.rules 
+
+checks:
+    - shell:
+        version: 7
+        args: |-
+          grep "Warning: detect: decode-event keyword no longer supports event \"decoder.udp.hlen_invalid\"" suricata.log | wc -l
+        expect: 1
+    - shell:
+        version: 6
+        args: |-
+          grep "\[ERRCODE: SC_WARN_DEPRECATED(203)\] - decode-event keyword no longer supports event \"decoder.udp.hlen_invalid\"" suricata.log | wc -l
+        expect: 1

diff --git a/tests/udp-5379/udp-hlen-invalid-strict/README.md b/tests/udp-5379/udp-hlen-invalid-strict/README.md
new file mode 100644 (file)
index 0000000..c946489
--- /dev/null
+++ b/tests/udp-5379/udp-hlen-invalid-strict/README.md
@@ -0,0 +1,7 @@
+Description
+===========
+Test to check that the use of decoder event udp.hlen_invalid in rule issues an error.
+
+PCAP
+====
+Created with Scapy.

diff --git a/tests/udp-5379/udp-hlen-invalid-strict/input.pcap b/tests/udp-5379/udp-hlen-invalid-strict/input.pcap
new file mode 100644 (file)
index 0000000..3e93280
Binary files /dev/null and b/tests/udp-5379/udp-hlen-invalid-strict/input.pcap differ

diff --git a/tests/udp-5379/udp-hlen-invalid-strict/test.rules b/tests/udp-5379/udp-hlen-invalid-strict/test.rules
new file mode 100644 (file)
index 0000000..7c21ca9
--- /dev/null
+++ b/tests/udp-5379/udp-hlen-invalid-strict/test.rules
@@ -0,0 +1 @@
+alert pkthdr any any -> any any (msg:"SURICATA UDP invalid header length"; decode-event:udp.hlen_invalid; classtype:protocol-command-decode; sid:2200040; rev:2;)

diff --git a/tests/udp-5379/udp-hlen-invalid-strict/test.yaml b/tests/udp-5379/udp-hlen-invalid-strict/test.yaml
new file mode 100644 (file)
index 0000000..7d9fbe7
--- /dev/null
+++ b/tests/udp-5379/udp-hlen-invalid-strict/test.yaml
@@ -0,0 +1,20 @@
+exit-code: 0
+
+command: |
+  ${SRCDIR}/src/suricata --set classification-file="${SRCDIR}/etc/classification.config"    \
+      --set reference-config-file="${SRCDIR}/etc/reference.config" -l ${OUTPUT_DIR}         \
+      --set threshold-file="${TEST_DIR}/threshold.config"                                   \
+      -c "${SRCDIR}/suricata.yaml" -r ${TEST_DIR}/input.pcap -S ${TEST_DIR}/test.rules      \
+      --strict-rule-keywords=all
+
+checks:
+    - shell:
+        version: 7
+        args: |-
+          grep "Error: detect: decode-event keyword no longer supports event \"decoder.udp.hlen_invalid\"" suricata.log | wc -l
+        expect: 1
+    - shell:
+        version: 6
+        args: |-
+          grep "\[ERRCODE: SC_WARN_DEPRECATED(203)\] - decode-event keyword no longer supports event \"decoder.udp.hlen_invalid\"" suricata.log | wc -l
+        expect: 1

diff --git a/tests/udp-5379/udp-len-invalid/README.md b/tests/udp-5379/udp-len-invalid/README.md
new file mode 100644 (file)
index 0000000..641e7ca
--- /dev/null
+++ b/tests/udp-5379/udp-len-invalid/README.md
@@ -0,0 +1,8 @@
+Description
+===========
+Test to check that the new decoder event udp.len_invalid actually matches on network data
+that fulfill the criteria: Packet length in UDP header < 8 Bytes.
+
+PCAP
+====
+Created with Scapy and edited to fit the usecase.

diff --git a/tests/udp-5379/udp-len-invalid/input.pcap b/tests/udp-5379/udp-len-invalid/input.pcap
new file mode 100644 (file)
index 0000000..ec9b755
Binary files /dev/null and b/tests/udp-5379/udp-len-invalid/input.pcap differ

diff --git a/tests/udp-5379/udp-len-invalid/test.rules b/tests/udp-5379/udp-len-invalid/test.rules
new file mode 100644 (file)
index 0000000..23c4dab
--- /dev/null
+++ b/tests/udp-5379/udp-len-invalid/test.rules
@@ -0,0 +1 @@
+alert pkthdr any any -> any any (msg:"SURICATA UDP invalid length field in the header"; decode-event:udp.len_invalid; classtype:protocol-command-decode; sid:2200220; rev:2;)

diff --git a/tests/udp-5379/udp-len-invalid/test.yaml b/tests/udp-5379/udp-len-invalid/test.yaml
new file mode 100644 (file)
index 0000000..9d28550
--- /dev/null
+++ b/tests/udp-5379/udp-len-invalid/test.yaml
@@ -0,0 +1,16 @@
+args:
+- -k none
+- --set stats.decoder-events=true
+
+checks:
+- filter:
+    count: 1
+    match:
+      event_type: stats
+      stats.decoder.event.udp.len_invalid: 1
+
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 2200220

diff --git a/tests/udp-5379/udp-trailing-data/README.md b/tests/udp-5379/udp-trailing-data/README.md
new file mode 100644 (file)
index 0000000..16a169e
--- /dev/null
+++ b/tests/udp-5379/udp-trailing-data/README.md
@@ -0,0 +1,8 @@
+Description
+===========
+Given that the packet has several trailing bytes, it fails to be processed properly.
+It should ideally not match the rule and alert.
+
+PCAP
+====
+PCAP comes from the redmine ticket [5379](https://redmine.openinfosecfoundation.org/issues/5379)

diff --git a/tests/udp-5379/udp-trailing-data/input.pcap b/tests/udp-5379/udp-trailing-data/input.pcap
new file mode 100644 (file)
index 0000000..e996826
Binary files /dev/null and b/tests/udp-5379/udp-trailing-data/input.pcap differ

diff --git a/tests/udp-5379/udp-trailing-data/test.rules b/tests/udp-5379/udp-trailing-data/test.rules
new file mode 100644 (file)
index 0000000..8daf1e9
--- /dev/null
+++ b/tests/udp-5379/udp-trailing-data/test.rules
@@ -0,0 +1 @@
+alert udp $EXTERNAL_NET :1024 <> $HOME_NET 0 (msg:"UDP Port 0"; sid:1;)

diff --git a/tests/udp-5379/udp-trailing-data/test.yaml b/tests/udp-5379/udp-trailing-data/test.yaml
new file mode 100644 (file)
index 0000000..af32dec
--- /dev/null
+++ b/tests/udp-5379/udp-trailing-data/test.yaml
@@ -0,0 +1,8 @@
+args:
+- -k none
+
+checks:
+- filter:
+    count: 0
+    match:
+      alert.signature_id: 1