tests: add invalid hex usage

Signed-off-by: jason taylor <jtfas90@gmail.com>

diff --git a/tests/test-bad-hex-rule-1/suricata.yaml b/tests/test-bad-hex-rule-1/suricata.yaml
new file mode 100644 (file)
index 0000000..dcaae57
--- /dev/null
+++ b/tests/test-bad-hex-rule-1/suricata.yaml
@@ -0,0 +1,10 @@
+%YAML 1.1
+---
+
+logging:
+  default-log-level: info
+  outputs:
+  - file:
+      enabled: yes
+      filename: eve.json
+      type: json

diff --git a/tests/test-bad-hex-rule-1/test.rules b/tests/test-bad-hex-rule-1/test.rules
new file mode 100644 (file)
index 0000000..1c79176
--- /dev/null
+++ b/tests/test-bad-hex-rule-1/test.rules
@@ -0,0 +1 @@
+alert tcp any any -> any any (msg:"invalid hex test rule"; content:"|l0 01 01|"; sid:12345; rev:1;)

diff --git a/tests/test-bad-hex-rule-1/test.yaml b/tests/test-bad-hex-rule-1/test.yaml
new file mode 100644 (file)
index 0000000..8978278
--- /dev/null
+++ b/tests/test-bad-hex-rule-1/test.yaml
@@ -0,0 +1,23 @@
+requires:
+  min-version: 5.0.0
+
+  features:
+    - HAVE_LIBJANSSON
+
+command: |
+  ${SRCDIR}/src/suricata --set classification-file="${SRCDIR}/classification.config" --set reference-config-file="${SRCDIR}/reference.config" -l ${OUTPUT_DIR} -c ${TEST_DIR}/suricata.yaml -r ${TEST_DIR}/ -S ${TEST_DIR}/test.rules
+
+checks:
+  # check that we have the following entres in eve.json
+  # match 1 specific rule load failure reason
+  - filter:
+      count: 1
+      match:
+        event_type: engine
+        engine.message: "Invalid hex code in content - |l0 01 01|, hex l. Invalidating signature."
+
+  - filter:
+      count: 1
+      match:
+        event_type: engine
+        engine.error: "SC_ERR_NO_RULES_LOADED"

diff --git a/tests/test-bad-hex-rule-2/suricata.yaml b/tests/test-bad-hex-rule-2/suricata.yaml
new file mode 100644 (file)
index 0000000..dcaae57
--- /dev/null
+++ b/tests/test-bad-hex-rule-2/suricata.yaml
@@ -0,0 +1,10 @@
+%YAML 1.1
+---
+
+logging:
+  default-log-level: info
+  outputs:
+  - file:
+      enabled: yes
+      filename: eve.json
+      type: json

diff --git a/tests/test-bad-hex-rule-2/test.rules b/tests/test-bad-hex-rule-2/test.rules
new file mode 100644 (file)
index 0000000..4c38679
--- /dev/null
+++ b/tests/test-bad-hex-rule-2/test.rules
@@ -0,0 +1 @@
+alert tcp any any -> any any (msg:"invalid hex test rule"; content:"|01 10 0j|"; sid:12346; rev:1;)

diff --git a/tests/test-bad-hex-rule-2/test.yaml b/tests/test-bad-hex-rule-2/test.yaml
new file mode 100644 (file)
index 0000000..021eeba
--- /dev/null
+++ b/tests/test-bad-hex-rule-2/test.yaml
@@ -0,0 +1,23 @@
+requires:
+  min-version: 5.0.0
+
+  features:
+    - HAVE_LIBJANSSON
+
+command: |
+  ${SRCDIR}/src/suricata --set classification-file="${SRCDIR}/classification.config" --set reference-config-file="${SRCDIR}/reference.config" -l ${OUTPUT_DIR} -c ${TEST_DIR}/suricata.yaml -r ${TEST_DIR}/ -S ${TEST_DIR}/test.rules
+
+checks:
+  # check that we have the following entres in eve.json
+  # match 1 specific rule load failure reason
+  - filter:
+      count: 1
+      match:
+        event_type: engine
+        engine.message: "Invalid hex code in content - \u0001\u00101 10 0j|, hex j. Invalidating signature."
+
+  - filter:
+      count: 1
+      match:
+        event_type: engine
+        engine.error: "SC_ERR_NO_RULES_LOADED"

diff --git a/tests/test-bad-hex-rule-3/suricata.yaml b/tests/test-bad-hex-rule-3/suricata.yaml
new file mode 100644 (file)
index 0000000..dcaae57
--- /dev/null
+++ b/tests/test-bad-hex-rule-3/suricata.yaml
@@ -0,0 +1,10 @@
+%YAML 1.1
+---
+
+logging:
+  default-log-level: info
+  outputs:
+  - file:
+      enabled: yes
+      filename: eve.json
+      type: json

diff --git a/tests/test-bad-hex-rule-3/test.rules b/tests/test-bad-hex-rule-3/test.rules
new file mode 100644 (file)
index 0000000..0578171
--- /dev/null
+++ b/tests/test-bad-hex-rule-3/test.rules
@@ -0,0 +1 @@
+alert tcp any any -> any any (msg:"invalid hex test rule 3"; content:"|1"; sid:1232222; rev:1;)

diff --git a/tests/test-bad-hex-rule-3/test.yaml b/tests/test-bad-hex-rule-3/test.yaml
new file mode 100644 (file)
index 0000000..2f839a3
--- /dev/null
+++ b/tests/test-bad-hex-rule-3/test.yaml
@@ -0,0 +1,23 @@
+requires:
+  min-version: 5.0.0
+
+  features:
+    - HAVE_LIBJANSSON
+
+command: |
+  ${SRCDIR}/src/suricata --set classification-file="${SRCDIR}/classification.config" --set reference-config-file="${SRCDIR}/reference.config" -l ${OUTPUT_DIR} -c ${TEST_DIR}/suricata.yaml -r ${TEST_DIR}/ -S ${TEST_DIR}/test.rules
+
+checks:
+  # check that we have the following entres in eve.json
+  # match 1 specific rule load failure reason
+  - filter:
+      count: 1
+      match:
+        event_type: engine
+        engine.message: "Invalid hex code assembly in content - |1.  Invalidating signature."
+
+  - filter:
+      count: 1
+      match:
+        event_type: engine
+        engine.error: "SC_ERR_NO_RULES_LOADED"