]> git.ipfire.org Git - thirdparty/suricata-verify.git/commitdiff
tests: Add test for threshold.config validation
authorJeff Lucovsky <jeff@lucovsky.org>
Sun, 28 Feb 2021 19:42:00 +0000 (14:42 -0500)
committerJason Ish <jason.ish@oisf.net>
Fri, 30 Apr 2021 18:09:17 +0000 (12:09 -0600)
This commit adds a test case to insure that "-T" stops execution when
threshold.config is not valid.

tests/threshold-config-validate/test.rules [new file with mode: 0644]
tests/threshold-config-validate/test.yaml [new file with mode: 0644]
tests/threshold-config-validate/threshold.config [new file with mode: 0644]

diff --git a/tests/threshold-config-validate/test.rules b/tests/threshold-config-validate/test.rules
new file mode 100644 (file)
index 0000000..91f5607
--- /dev/null
@@ -0,0 +1,4 @@
+alert tcp any any -> any 25 (msg:"ET POLICY Inbound Frequent Emails - Possible Spambot Inbound"; \
+     flow:established; content:"mail from|3a|"; nocase;                                          \
+          threshold: type threshold, track by_src, count 10, seconds 60;                              \
+               reference:url,doc.emergingthreats.net/2002087; classtype:misc-activity; sid:2002087; rev:10;)
diff --git a/tests/threshold-config-validate/test.yaml b/tests/threshold-config-validate/test.yaml
new file mode 100644 (file)
index 0000000..58edd85
--- /dev/null
@@ -0,0 +1,16 @@
+requires:
+    min-version: 7
+
+command: |
+  ${SRCDIR}/src/suricata --set threshold-file="${TEST_DIR}/threshold.config" -l ${OUTPUT_DIR} -c ${SRCDIR}/suricata.yaml -S ${TEST_DIR}/test.rules -T
+
+exit-code: 1
+
+checks:
+    - shell:
+        args: grep "Error loading threshold configuration" suricata.log | wc -l | xargs
+        expect: 1
+
+    - shell:
+        args: grep "SC_WARN_THRESH_CONFIG" suricata.log | wc -l | xargs
+        expect: 1
diff --git a/tests/threshold-config-validate/threshold.config b/tests/threshold-config-validate/threshold.config
new file mode 100644 (file)
index 0000000..93f5624
--- /dev/null
@@ -0,0 +1 @@
+this is not correct