quic: gquic tests for cyu hash and alerts

pcaps taken from this redmine attachement:
https://redmine.openinfosecfoundation.org/issues/3440#note-8

diff --git a/tests/quic-alerts/input.pcap b/tests/quic-alerts/input.pcap
new file mode 100644 (file)
index 0000000..3b9fe3a
Binary files /dev/null and b/tests/quic-alerts/input.pcap differ

diff --git a/tests/quic-alerts/suricata.yaml b/tests/quic-alerts/suricata.yaml
new file mode 100644 (file)
index 0000000..2ba41b9
--- /dev/null
+++ b/tests/quic-alerts/suricata.yaml
@@ -0,0 +1,16 @@
+%YAML 1.1
+---
+
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular
+      filename: eve.json
+      types:
+        - quic
+        - alert
+
+app-layer:
+  protocols:
+    quic:
+      enabled: yes

diff --git a/tests/quic-alerts/test.rules b/tests/quic-alerts/test.rules
new file mode 100644 (file)
index 0000000..03d2809
--- /dev/null
+++ b/tests/quic-alerts/test.rules
@@ -0,0 +1,3 @@
+alert quic any any -> any any (msg:"QUIC CYU HASH"; quic.cyu.hash; content:"7b3ceb1adc974ad360cfa634e8d0a730"; sid:1;)
+alert quic any any -> any any (msg:"QUIC CYU STRING"; quic.cyu.string; content:"46,PAD-SNI-VER-CCS-UAID-TCID-PDMD-SMHL-ICSL-NONP-MIDS-SCLS-CSCT-COPT-IRTT-CFCW-SFCW"; sid:2;)
+alert quic any any -> any any (msg:"QUIC VERSION"; quic.version:1362113590; sid:3;)

diff --git a/tests/quic-alerts/test.yaml b/tests/quic-alerts/test.yaml
new file mode 100644 (file)
index 0000000..a23c804
--- /dev/null
+++ b/tests/quic-alerts/test.yaml
@@ -0,0 +1,39 @@
+requires:
+  features:
+    - HAVE_LIBJANSSON
+  min-version: 6.0.0
+
+checks:
+  - filter:
+      count: 1
+      match:
+        event_type: quic
+        pcap_cnt: 1
+        quic.cyu[0].hash: "910a5e3a4d51593bd59a44611544f209"
+        quic.cyu[0].string: "46,PAD-SNI-VER-CCS-UAID-TCID-PDMD-SMHL-ICSL-NONP-MIDS-SCLS-CSCT-COPT-IRTT-CFCW-SFCW"
+
+  - filter:
+      count: 1
+      match:
+        event_type: quic
+        pcap_cnt: 5
+        quic.cyu[0].hash: "7b3ceb1adc974ad360cfa634e8d0a730"
+        quic.cyu[0].string: "46,PAD-SNI-STK-SNO-VER-CCS-NONC-AEAD-UAID-SCID-TCID-PDMD-SMHL-ICSL-NONP-PUBS-MIDS-SCLS-KEXS-XLCT-CSCT-COPT-CCRT-IRTT-CFCW-SFCW"
+
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature: QUIC CYU HASH
+
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature: QUIC CYU STRING
+
+  - filter:
+      count: 6
+      match:
+        event_type: alert
+        alert.signature: QUIC VERSION

diff --git a/tests/quic-cyu/input.pcap b/tests/quic-cyu/input.pcap
new file mode 100644 (file)
index 0000000..11f22e1
Binary files /dev/null and b/tests/quic-cyu/input.pcap differ

diff --git a/tests/quic-cyu/test.yaml b/tests/quic-cyu/test.yaml
new file mode 100644 (file)
index 0000000..7667c2b
--- /dev/null
+++ b/tests/quic-cyu/test.yaml
@@ -0,0 +1,13 @@
+requires:
+  features:
+    - HAVE_LIBJANSSON
+  min-version: 6.0.0
+
+checks:
+  - filter:
+      count: 1
+      match:
+        event_type: quic
+        pcap_cnt: 1
+        quic.cyu[0].hash: "a46560d4548108cf99308319b3b85346"
+        quic.cyu[0].string: "46,PAD-SNI-STK-VER-CCS-NONC-AEAD-UAID-SCID-TCID-PDMD-SMHL-ICSL-NONP-PUBS-MIDS-SCLS-KEXS-XLCT-CSCT-COPT-CCRT-IRTT-CFCW-SFCW"