tests/datasets: test absolute and parent directory paths

Test that Suricata fails to load rules that use a state path with an
absolute filename, or contains a traversal into a parent directory is
not allowed.

Ticket: #6118

diff --git a/tests/datasets/datasets-absolute-allowed/README.md b/tests/datasets/datasets-absolute-allowed/README.md
new file mode 100644 (file)
index 0000000..3daacb0
--- /dev/null
+++ b/tests/datasets/datasets-absolute-allowed/README.md
@@ -0,0 +1,2 @@
+Test that the configuration option to allow absolute dataset filenames
+in rules works.

diff --git a/tests/datasets/datasets-absolute-allowed/one-packet.pcap b/tests/datasets/datasets-absolute-allowed/one-packet.pcap
new file mode 100644 (file)
index 0000000..00c2b34
Binary files /dev/null and b/tests/datasets/datasets-absolute-allowed/one-packet.pcap differ

diff --git a/tests/datasets/datasets-absolute-allowed/suricata.yaml b/tests/datasets/datasets-absolute-allowed/suricata.yaml
new file mode 100644 (file)
index 0000000..50171d9
--- /dev/null
+++ b/tests/datasets/datasets-absolute-allowed/suricata.yaml
@@ -0,0 +1,13 @@
+%YAML 1.1
+---
+
+datasets:
+  rules:
+    allow-absolute-filenames: true
+
+logging:
+  outputs:
+    - file:
+        enabled: yes
+        filename: eve.json
+        type: json

diff --git a/tests/datasets/datasets-absolute-allowed/test.rules b/tests/datasets/datasets-absolute-allowed/test.rules
new file mode 100644 (file)
index 0000000..323fe04
--- /dev/null
+++ b/tests/datasets/datasets-absolute-allowed/test.rules
@@ -0,0 +1,3 @@
+alert dns any any -> any any (dns.query; dataset: isnotset, dns-seen, type string, state /tmp/dns-seen.txt; sid:1; rev:1;)
+alert dns any any -> any any (dns.query; dataset: isnotset, dns-seen-save, type string, save /tmp/dns-seen-save.txt; sid:2; rev:1;)
+alert dns any any -> any any (dns.query; dataset: isnotset, dns-seen-parent, type string, state /tmp/../tmp/dns-seen.txt; sid:3; rev:1;)

diff --git a/tests/datasets/datasets-absolute-allowed/test.yaml b/tests/datasets/datasets-absolute-allowed/test.yaml
new file mode 100644 (file)
index 0000000..7df746b
--- /dev/null
+++ b/tests/datasets/datasets-absolute-allowed/test.yaml
@@ -0,0 +1,21 @@
+args:
+  - -vvv
+
+# Due to differences between user-mode and system-mode, these rules
+# will actually fail. Instead we're testing to make sure we got past
+# the check for absolute filenames.
+exit-code: 1
+
+checks:
+  - filter:
+      count: 1
+      match:
+        engine.message: "Allowing absolute filename for dataset rule: /tmp/dns-seen.txt"
+  - filter:
+      count: 1
+      match:
+        engine.message: "Allowing absolute filename for dataset rule: /tmp/dns-seen-save.txt"
+  - filter:
+      count: 1
+      match:
+        engine.message: "Allowing absolute filename for dataset rule: /tmp/../tmp/dns-seen.txt"

diff --git a/tests/datasets/datasets-absolute-path/README.md b/tests/datasets/datasets-absolute-path/README.md
new file mode 100644 (file)
index 0000000..154f6e3
--- /dev/null
+++ b/tests/datasets/datasets-absolute-path/README.md
@@ -0,0 +1,2 @@
+Test that a dataset rule trying to use an absolute path results in an
+initialization error.

diff --git a/tests/datasets/datasets-absolute-path/one-packet.pcap b/tests/datasets/datasets-absolute-path/one-packet.pcap
new file mode 100644 (file)
index 0000000..00c2b34
Binary files /dev/null and b/tests/datasets/datasets-absolute-path/one-packet.pcap differ

diff --git a/tests/datasets/datasets-absolute-path/suricata.yaml b/tests/datasets/datasets-absolute-path/suricata.yaml
new file mode 100644 (file)
index 0000000..83bfeef
--- /dev/null
+++ b/tests/datasets/datasets-absolute-path/suricata.yaml
@@ -0,0 +1,9 @@
+%YAML 1.1
+---
+
+logging:
+  outputs:
+    - file:
+        enabled: yes
+        filename: eve.json
+        type: json

diff --git a/tests/datasets/datasets-absolute-path/test.rules b/tests/datasets/datasets-absolute-path/test.rules
new file mode 100644 (file)
index 0000000..4aed124
--- /dev/null
+++ b/tests/datasets/datasets-absolute-path/test.rules
@@ -0,0 +1,2 @@
+alert dns any any -> any any (dns.query; dataset: isnotset, dns-seen, type string, state /dns-seen.txt; sid:1; rev:1;)
+alert dns any any -> any any (dns.query; dataset: isnotset, dns-seen-save, type string, save /dns-seen-save.txt; sid:2; rev:1;)

diff --git a/tests/datasets/datasets-absolute-path/test.yaml b/tests/datasets/datasets-absolute-path/test.yaml
new file mode 100644 (file)
index 0000000..5caf690
--- /dev/null
+++ b/tests/datasets/datasets-absolute-path/test.yaml
@@ -0,0 +1,11 @@
+exit-code: 1
+
+checks:
+  - filter:
+      count: 1
+      match:
+        engine.message: "Absolute paths not allowed: /dns-seen.txt"
+  - filter:
+      count: 1
+      match:
+        engine.message: "Absolute paths not allowed: /dns-seen-save.txt"

diff --git a/tests/datasets/datasets-parent-path/README.md b/tests/datasets/datasets-parent-path/README.md
new file mode 100644 (file)
index 0000000..07b4809
--- /dev/null
+++ b/tests/datasets/datasets-parent-path/README.md
@@ -0,0 +1,2 @@
+Test that a dataset rule trying to traverse into a parent directory
+results in an initialization error.

diff --git a/tests/datasets/datasets-parent-path/one-packet.pcap b/tests/datasets/datasets-parent-path/one-packet.pcap
new file mode 100644 (file)
index 0000000..00c2b34
Binary files /dev/null and b/tests/datasets/datasets-parent-path/one-packet.pcap differ

diff --git a/tests/datasets/datasets-parent-path/suricata.yaml b/tests/datasets/datasets-parent-path/suricata.yaml
new file mode 100644 (file)
index 0000000..83bfeef
--- /dev/null
+++ b/tests/datasets/datasets-parent-path/suricata.yaml
@@ -0,0 +1,9 @@
+%YAML 1.1
+---
+
+logging:
+  outputs:
+    - file:
+        enabled: yes
+        filename: eve.json
+        type: json

diff --git a/tests/datasets/datasets-parent-path/test.rules b/tests/datasets/datasets-parent-path/test.rules
new file mode 100644 (file)
index 0000000..7b6909f
--- /dev/null
+++ b/tests/datasets/datasets-parent-path/test.rules
@@ -0,0 +1,3 @@
+alert dns any any -> any any (dns.query; dataset: isnotset, dns-seen, type string, state ../dns-seen.txt; sid:1; rev:1;)
+alert dns any any -> any any (dns.query; dataset: isnotset, dns-seen-1, type string, state namespace/../dns-seen-1.txt; sid:1; rev:2;)
+alert dns any any -> any any (dns.query; dataset: isnotset, dns-seen-save, type string, save namespace/../dns-seen-save.txt; sid:1; rev:2;)

diff --git a/tests/datasets/datasets-parent-path/test.yaml b/tests/datasets/datasets-parent-path/test.yaml
new file mode 100644 (file)
index 0000000..ec1846a
--- /dev/null
+++ b/tests/datasets/datasets-parent-path/test.yaml
@@ -0,0 +1,15 @@
+exit-code: 1
+
+checks:
+  - filter:
+      count: 1
+      match:
+        engine.message: "Directory traversals not allowed: ../dns-seen.txt"
+  - filter:
+      count: 1
+      match:
+        engine.message: "Directory traversals not allowed: namespace/../dns-seen-1.txt"
+  - filter:
+      count: 1
+      match:
+        engine.message: "Directory traversals not allowed: namespace/../dns-seen-save.txt"