Adds test about icmpv6 type and code detection

diff --git a/tests/ipv6-evasion/ipv6-dos-with-ext-headers-5/README.md b/tests/ipv6-evasion/ipv6-dos-with-ext-headers-5/README.md
new file mode 100644 (file)
index 0000000..d250cc3
--- /dev/null
+++ b/tests/ipv6-evasion/ipv6-dos-with-ext-headers-5/README.md
@@ -0,0 +1,11 @@
+# Description
+
+Test detection of DoS attack that tries to increase decoding effort.
+
+# PCAP
+
+Pcap from https://redmine.cs.uni-potsdam.de/projects/pcap/files
+
+# Notes
+
+It might be better to have a dedicated rule that focuses on the DoS aspect.

diff --git a/tests/ipv6-evasion/ipv6-dos-with-ext-headers-5/denial6-5.pcap b/tests/ipv6-evasion/ipv6-dos-with-ext-headers-5/denial6-5.pcap
new file mode 100644 (file)
index 0000000..fefecdb
Binary files /dev/null and b/tests/ipv6-evasion/ipv6-dos-with-ext-headers-5/denial6-5.pcap differ

diff --git a/tests/ipv6-evasion/ipv6-dos-with-ext-headers-5/test.rules b/tests/ipv6-evasion/ipv6-dos-with-ext-headers-5/test.rules
new file mode 100644 (file)
index 0000000..2fe4789
--- /dev/null
+++ b/tests/ipv6-evasion/ipv6-dos-with-ext-headers-5/test.rules
@@ -0,0 +1,2 @@
+alert icmpv6 any any -> any any (itype:4; icode:1; sid:1;)
+

diff --git a/tests/ipv6-evasion/ipv6-dos-with-ext-headers-5/test.yaml b/tests/ipv6-evasion/ipv6-dos-with-ext-headers-5/test.yaml
new file mode 100644 (file)
index 0000000..2596570
--- /dev/null
+++ b/tests/ipv6-evasion/ipv6-dos-with-ext-headers-5/test.yaml
@@ -0,0 +1,11 @@
+
+requires:
+    features:
+        - HAVE_LIBJANSSON
+
+checks:
+    - filter:
+        count: 15
+        match:
+            event_type: alert
+            alert.signature_id: 1