enip: Add test for logger

diff --git a/tests/enip-log-identity/README.md b/tests/enip-log-identity/README.md
new file mode 100644 (file)
index 0000000..2059f84
--- /dev/null
+++ b/tests/enip-log-identity/README.md
@@ -0,0 +1,8 @@
+# Description
+
+Test ENIP logging
+And enip_command keyword with enumeration string
+
+# PCAP
+
+The pcap comes from https://redmine.openinfosecfoundation.org/issues/3886

diff --git a/tests/enip-log-identity/suricata.yaml b/tests/enip-log-identity/suricata.yaml
new file mode 100644 (file)
index 0000000..8c46778
--- /dev/null
+++ b/tests/enip-log-identity/suricata.yaml
@@ -0,0 +1,19 @@
+%YAML 1.1
+---
+
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
+      filename: eve.json
+
+      types:
+        - alert
+        - anomaly
+        - enip
+        - flow
+
+app-layer:
+  protocols:
+    enip:
+      enabled: yes

diff --git a/tests/enip-log-identity/test.rules b/tests/enip-log-identity/test.rules
new file mode 100644 (file)
index 0000000..62a9aa1
--- /dev/null
+++ b/tests/enip-log-identity/test.rules
@@ -0,0 +1 @@
+alert enip any any -> any any (msg:"SURICATA enip test command string";enip_command:list_identity ; sid:1;)

diff --git a/tests/enip-log-identity/test.yaml b/tests/enip-log-identity/test.yaml
new file mode 100644 (file)
index 0000000..9a6d007
--- /dev/null
+++ b/tests/enip-log-identity/test.yaml
@@ -0,0 +1,27 @@
+requires:
+  min-version: 8
+
+pcap:  ../enip-alert/enip_test1.pcap
+
+# disables checksum verification
+args:
+- -k none
+
+checks:
+  - filter:
+      count: 2
+      match:
+        event_type: alert
+        alert.signature_id: 1
+        # check enip metadata in alert
+        enip.request.command: list_identity
+  - filter:
+      count: 1
+      match:
+        event_type: enip
+        enip.request.command: list_identity
+        enip.response.status: success
+        # quote because this is a string, not a yaml float
+        enip.response.identity.revision: "4.3"
+        enip.response.identity.product_name: "1756-ENBT/A"
+        enip.response.identity.vendor_id: "Rockwell Automation/Allen-Bradley"