tests/bsize Add test cases for bsize

This commit adds several test cases for the `bsize` keyword.

These tests apply to Suricata 7.0.x and newer.

diff --git a/tests/detect-bsize-01/test.rules b/tests/detect-bsize-01/test.rules
new file mode 100644 (file)
index 0000000..c477a18
--- /dev/null
+++ b/tests/detect-bsize-01/test.rules
@@ -0,0 +1,13 @@
+# invalid
+alert http any any -> any any (msg:"bsize: value < content len"; http.uri; content:"abcdefgh123456"; bsize:2; sid:1;)
+alert http any any -> any any (msg:"bsize: value < content len"; http.uri; content:"abcdefgh123456"; bsize:<13; sid:2;)
+alert http any any -> any any (msg:"bsize: value < content len"; http.uri; content:"abcdefgh123456"; bsize:10<>13; sid:3;)
+alert http any any -> any any (msg:"bsize: value < content len";http.uri; content:"abcdefghi123456"; offset:12;  bsize:3; sid:4;)
+alert http any any -> any any (msg:"bsize: value < content len"; http.uri; content:"abc"; offset:3; depth:3; bsize:3; sid:5;)
+alert http any any -> any any (msg:"bsize: value < content len"; http.uri; content:"abcef"; content: "gh"; bsize:1; sid:6;)
+alert http any any -> any any (msg:"bsize test";http.uri; content:"abcef"; content: "g"; bsize:1; sid:8;)
+alert http any any -> any any (msg:"bsize test";http.uri; content:"abcef"; content: "g"; bsize:4; sid:9;)
+# good
+alert http any any -> any any (msg:"bsize test"; http.uri; content:"/index.php"; bsize:>1024; sid:7;)
+alert http any any -> any any (msg:"bsize test"; http.uri; content:"abcdefgh123456"; bsize:<20; sid:10;)
+alert http any any -> any any (msg:"bsize test"; http.uri; content:"abcdefgh123456"; bsize:15<>25; sid:11;)

diff --git a/tests/detect-bsize-01/test.yaml b/tests/detect-bsize-01/test.yaml
new file mode 100644 (file)
index 0000000..8036784
--- /dev/null
+++ b/tests/detect-bsize-01/test.yaml
@@ -0,0 +1,37 @@
+requires:
+    min-version: 7.0.0
+    pcap: false
+
+args:
+    - --engine-analysis
+
+exit-code: 1
+
+checks:
+    - shell:
+        args: grep "signature can.*t match as required content length 14 exceeds bsize value.*2" suricata.log | wc -l | xargs
+        expect: 1
+
+    - shell:
+        args: grep "signature can.*t match as required content length 14 exceeds bsize value.*13" suricata.log | wc -l | xargs
+        expect: 1
+
+    - shell:
+        args: grep "signature can.*t match as required content length 15 exceeds bsize value.*3" suricata.log | wc -l | xargs
+        expect: 1
+
+    - shell:
+        args: grep "signature can.*t match as required content length 14 exceeds bsize range.*10-13" suricata.log | wc -l | xargs
+        expect: 1
+
+    - shell:
+        args: grep "signature can.*t match as required content length 6 exceeds bsize value.*3" suricata.log | wc -l | xargs
+        expect: 1
+
+    - shell:
+        args: grep "signature can.*t match as required content length 5 exceeds bsize value.*1" suricata.log | wc -l | xargs
+        expect: 2
+
+    - shell:
+        args: grep "signature can.*t match as required content length 5 exceeds bsize value.*4" suricata.log | wc -l | xargs
+        expect: 1