proto-mismatch-http-ssh: test app-layer mismatch

Tests that an app-layer mismatch is detected.

diff --git a/proto-mismatch-http-ssh/app-layer-events.rules b/proto-mismatch-http-ssh/app-layer-events.rules
new file mode 100644 (file)
index 0000000..4d2ac28
--- /dev/null
+++ b/proto-mismatch-http-ssh/app-layer-events.rules
@@ -0,0 +1,14 @@
+# App layer event  rules
+#
+# SID's fall in the 2260000+ range. See http://doc.emergingthreats.net/bin/view/Main/SidAllocation
+#
+# These sigs fire at most once per connection.
+#
+# A flowint applayer.anomaly.count is incremented for each match. By default it will be 0.
+#
+alert ip any any -> any any (msg:"SURICATA Applayer Mismatch protocol both directions"; flow:established; app-layer-event:applayer_mismatch_protocol_both_directions; flowint:applayer.anomaly.count,+,1; classtype:protocol-command-decode; sid:2260000; rev:1;)
+alert ip any any -> any any (msg:"SURICATA Applayer Wrong direction first Data"; flow:established; app-layer-event:applayer_wrong_direction_first_data; flowint:applayer.anomaly.count,+,1; classtype:protocol-command-decode; sid:2260001; rev:1;)
+alert ip any any -> any any (msg:"SURICATA Applayer Detect protocol only one direction"; flow:established; app-layer-event:applayer_detect_protocol_only_one_direction; flowint:applayer.anomaly.count,+,1; classtype:protocol-command-decode; sid:2260002; rev:1;)
+alert ip any any -> any any (msg:"SURICATA Applayer Protocol detection skipped"; flow:established; app-layer-event:applayer_proto_detection_skipped; flowint:applayer.anomaly.count,+,1; classtype:protocol-command-decode; sid:2260003; rev:1;)
+
+#next sid is 2260004

diff --git a/proto-mismatch-http-ssh/check.sh b/proto-mismatch-http-ssh/check.sh
new file mode 100755 (executable)
index 0000000..252d1bf
--- /dev/null
+++ b/proto-mismatch-http-ssh/check.sh
@@ -0,0 +1,25 @@
+#! /bin/sh
+
+failed=no
+
+# We should get a "SURICATA Applayer Mismatch protocol both
+# directions" alert.
+n=$(cat output/eve.json | jq -c 'select(.alert.signature_id == 2260000)' | wc -l)
+if [ "$n" != 1 ]; then
+    echo "expected 1 event with SID 2260000"
+    failed=yes
+fi
+
+# We should have a flow event with app_proto = http and app_proto_tc = ssh.
+n=$(cat output/eve.json | jq -c 'select(.event_type == "flow") | select(.app_proto == "http") | select(.app_proto_tc == "ssh")' | wc -l)
+if [ "$n" != 1 ]; then
+    echo "expected 1 event with app_proto http and app_proto_tc ssh"
+    failed=yes
+fi
+
+if [ "${failed}" = "yes" ]; then
+    exit 1
+fi
+
+exit 0
+

diff --git a/proto-mismatch-http-ssh/input.pcap b/proto-mismatch-http-ssh/input.pcap
new file mode 100644 (file)
index 0000000..d50be33
Binary files /dev/null and b/proto-mismatch-http-ssh/input.pcap differ