Adds passing test for IPv6 evasion atomic fragment

diff --git a/tests/ipv6-evasion/ipv6-atomic-fragments-toobig/README.md b/tests/ipv6-evasion/ipv6-atomic-fragments-toobig/README.md
new file mode 100644 (file)
index 0000000..43a1962
--- /dev/null
+++ b/tests/ipv6-evasion/ipv6-atomic-fragments-toobig/README.md
@@ -0,0 +1,7 @@
+# Description
+
+Test an attack causing atomic fragments and therefore a DOS attack as described in RFC8021
+
+# PCAP
+
+Pcap from https://redmine.cs.uni-potsdam.de/projects/pcap/files

diff --git a/tests/ipv6-evasion/ipv6-atomic-fragments-toobig/test.rules b/tests/ipv6-evasion/ipv6-atomic-fragments-toobig/test.rules
new file mode 100644 (file)
index 0000000..b684194
--- /dev/null
+++ b/tests/ipv6-evasion/ipv6-atomic-fragments-toobig/test.rules
@@ -0,0 +1 @@
+alert pkthdr any any -> any any (msg:"SURICATA IPv6 atomic fragment"; icmpv6.mtu:<1280; sid:1;)

diff --git a/tests/ipv6-evasion/ipv6-atomic-fragments-toobig/test.yaml b/tests/ipv6-evasion/ipv6-atomic-fragments-toobig/test.yaml
new file mode 100644 (file)
index 0000000..0f1f776
--- /dev/null
+++ b/tests/ipv6-evasion/ipv6-atomic-fragments-toobig/test.yaml
@@ -0,0 +1,10 @@
+requires:
+    features:
+        - HAVE_LIBJANSSON
+
+checks:
+    - filter:
+        count: 1
+        match:
+            event_type: alert
+            alert.signature_id: 1

diff --git a/tests/ipv6-evasion/ipv6-atomic-fragments-toobig/toobig.pcap b/tests/ipv6-evasion/ipv6-atomic-fragments-toobig/toobig.pcap
new file mode 100644 (file)
index 0000000..1766edf
Binary files /dev/null and b/tests/ipv6-evasion/ipv6-atomic-fragments-toobig/toobig.pcap differ