tests: add firewall ftp tests for nlst on the data channel

diff --git a/tests/firewall/ruletype-firewall-111.2-ftp-download-active/README.md b/tests/firewall/ruletype-firewall-111.2-ftp-download-active/README.md
new file mode 100644 (file)
index 0000000..f31fde7
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-111.2-ftp-download-active/README.md
@@ -0,0 +1 @@
+FTP active download tests for firewall.

diff --git a/tests/firewall/ruletype-firewall-111.2-ftp-download-active/firewall.rules b/tests/firewall/ruletype-firewall-111.2-ftp-download-active/firewall.rules
new file mode 100644 (file)
index 0000000..661b7a9
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-111.2-ftp-download-active/firewall.rules
@@ -0,0 +1,14 @@
+# Allow all TCP handshakes.
+accept:hook tcp:all any any -> any any (flow:not_established; sid:1000;)
+accept:hook tcp:all any any <> any any (flow:established; sid:1001;)
+
+accept:hook ftp:request_started any any -> any any (sid:2000;)
+accept:hook ftp:request_complete any any -> any any (sid:2010;)
+
+accept:hook ftp:response_started any any -> any any (sid:3000;)
+accept:hook ftp:response_complete any any -> any any (sid:3010;)
+
+accept:flow,alert ftp-data:request_started any any -> any any (sid:4000; \
+       ftpdata_command: retr;)
+accept:flow,alert ftp-data:request_started any any -> any any (sid:4002; \
+       ftpdata_command: nlst;)

diff --git a/tests/firewall/ruletype-firewall-111.2-ftp-download-active/suricata.yaml b/tests/firewall/ruletype-firewall-111.2-ftp-download-active/suricata.yaml
new file mode 100644 (file)
index 0000000..7cb3519
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-111.2-ftp-download-active/suricata.yaml
@@ -0,0 +1,20 @@
+%YAML 1.1
+---
+
+stats:
+  enabled: yes
+  interval: 8
+
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular
+      filename: eve.json
+      types:
+        - flow
+        - alert
+        - ftp
+        - files
+        - drop:
+            alerts: yes
+            flows: all

diff --git a/tests/firewall/ruletype-firewall-111.2-ftp-download-active/test.yaml b/tests/firewall/ruletype-firewall-111.2-ftp-download-active/test.yaml
new file mode 100644 (file)
index 0000000..cf12be4
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-111.2-ftp-download-active/test.yaml
@@ -0,0 +1,39 @@
+requires:
+  min-version: 9
+
+pcap: ../../ftp/ftp-download-active/input.pcap
+
+args:
+  - --simulate-ips
+  - --runmode=single
+  - -k none
+
+checks:
+
+  - filter:
+      count: 1
+      match:
+        event_type: fileinfo
+
+  - filter:
+      count: 3
+      match:
+        event_type: ftp_data
+
+  # We expect no drops.
+  - filter:
+      count: 0
+      match:
+        event_type: drop
+
+  # There are 2 NLST data channels.
+  - filter:
+      count: 2
+      match:
+        alert.signature_id: 4002
+
+  # We don't expect any drops.
+  - filter:
+      count: 0
+      match:
+        event_type: drop

diff --git a/tests/firewall/ruletype-firewall-112.2-ftp-download-passive/README.md b/tests/firewall/ruletype-firewall-112.2-ftp-download-passive/README.md
new file mode 100644 (file)
index 0000000..034b783
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-112.2-ftp-download-passive/README.md
@@ -0,0 +1 @@
+FTP passive download tests for firewall.

diff --git a/tests/firewall/ruletype-firewall-112.2-ftp-download-passive/firewall.rules b/tests/firewall/ruletype-firewall-112.2-ftp-download-passive/firewall.rules
new file mode 100644 (file)
index 0000000..9ba146d
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-112.2-ftp-download-passive/firewall.rules
@@ -0,0 +1,18 @@
+# Allow all TCP handshakes.
+accept:hook tcp:all any any -> any any (flow:not_established; sid:1000;)
+accept:hook tcp:all any any <> any any (flow:established; sid:1001;)
+
+accept:hook ftp:request_started any any -> any any (sid:2000;)
+accept:hook ftp:request_complete any any -> any any (sid:2010;)
+
+accept:hook ftp:response_started any any -> any any (sid:3000;)
+accept:hook ftp:response_complete any any -> any any (sid:3010;)
+
+# For passive FTP, the request is never started.
+accept:hook,alert ftp-data:request_started any any -> any any (sid:4000;)
+accept:hook,alert ftp-data:request_complete any any -> any any (sid:4010;)
+
+accept:flow,alert ftp-data:response_started any any -> any any (sid:5000; \
+    ftpdata_command: retr;)
+accept:flow,alert ftp-data:response_started any any -> any any (sid:5001; \
+    ftpdata_command: nlst;)

diff --git a/tests/firewall/ruletype-firewall-112.2-ftp-download-passive/suricata.yaml b/tests/firewall/ruletype-firewall-112.2-ftp-download-passive/suricata.yaml
new file mode 100644 (file)
index 0000000..46df914
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-112.2-ftp-download-passive/suricata.yaml
@@ -0,0 +1,21 @@
+%YAML 1.1
+---
+
+stats:
+  enabled: yes
+  interval: 8
+
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular
+      filename: eve.json
+      types:
+        - stats
+        - flow
+        - alert
+        - ftp
+        - files
+        - drop:
+            alerts: yes
+            flows: all

diff --git a/tests/firewall/ruletype-firewall-112.2-ftp-download-passive/test.yaml b/tests/firewall/ruletype-firewall-112.2-ftp-download-passive/test.yaml
new file mode 100644 (file)
index 0000000..a26aee3
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-112.2-ftp-download-passive/test.yaml
@@ -0,0 +1,47 @@
+requires:
+  min-version: 9
+
+pcap: ../../ftp/ftp-download-passive/input.pcap
+
+args:
+  - --simulate-ips
+  - --runmode=single
+  - -k none
+
+checks:
+
+  # ftp-data:request_started never reach in passive mode
+  - filter:
+      count: 0
+      match:
+        alert.signature_id: 4000
+
+  # ftp-data:request_complete never reach in passive mode
+  - filter:
+      count: 0
+      match:
+        alert.signature_id: 4010
+
+  - filter:
+      count: 1
+      match:
+        event_type: ftp_data
+        ftp_data.command: RETR
+
+  - filter:
+      count: 2
+      match:
+        event_type: ftp_data
+        ftp_data.command: NLST
+
+  # ftpdata_command: retr matches in ftp-data:response_started
+  - filter:
+      count: 1
+      match:
+        alert.signature_id: 5000
+
+  # Should see no drops.
+  - filter:
+      count: 0
+      match:
+        event_type: drop

diff --git a/tests/firewall/ruletype-firewall-113.2-ftp-upload-active/README.md b/tests/firewall/ruletype-firewall-113.2-ftp-upload-active/README.md
new file mode 100644 (file)
index 0000000..2376b89
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-113.2-ftp-upload-active/README.md
@@ -0,0 +1 @@
+FTP active upload tests for firewall.

diff --git a/tests/firewall/ruletype-firewall-113.2-ftp-upload-active/firewall.rules b/tests/firewall/ruletype-firewall-113.2-ftp-upload-active/firewall.rules
new file mode 100644 (file)
index 0000000..1dc0fef
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-113.2-ftp-upload-active/firewall.rules
@@ -0,0 +1,16 @@
+# Allow all TCP handshakes.
+accept:hook tcp:all any any -> any any (flow:not_established; sid:1000;)
+accept:hook tcp:all any any <> any any (flow:established; sid:1001;)
+
+accept:hook ftp:request_started any any -> any any (sid:2000;)
+accept:hook ftp:request_complete any any -> any any (sid:2010;)
+
+accept:hook ftp:response_started any any -> any any (sid:3000;)
+accept:hook ftp:response_complete any any -> any any (sid:3010;)
+
+# Only allow NLST as a data request.
+accept:flow,alert ftp-data:request_started any any -> any any (sid:4002; \
+       ftpdata_command: nlst;)
+
+accept:flow,alert ftp-data:response_started any any -> any any (sid:5000; \
+       ftpdata_command: stor;)

diff --git a/tests/firewall/ruletype-firewall-113.2-ftp-upload-active/suricata.yaml b/tests/firewall/ruletype-firewall-113.2-ftp-upload-active/suricata.yaml
new file mode 100644 (file)
index 0000000..7cb3519
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-113.2-ftp-upload-active/suricata.yaml
@@ -0,0 +1,20 @@
+%YAML 1.1
+---
+
+stats:
+  enabled: yes
+  interval: 8
+
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular
+      filename: eve.json
+      types:
+        - flow
+        - alert
+        - ftp
+        - files
+        - drop:
+            alerts: yes
+            flows: all

diff --git a/tests/firewall/ruletype-firewall-113.2-ftp-upload-active/test.yaml b/tests/firewall/ruletype-firewall-113.2-ftp-upload-active/test.yaml
new file mode 100644 (file)
index 0000000..18e568b
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-113.2-ftp-upload-active/test.yaml
@@ -0,0 +1,45 @@
+requires:
+  min-version: 9
+
+pcap: ../../ftp/ftp-upload-active/input.pcap
+
+args:
+  - --simulate-ips
+  - --runmode=single
+
+checks:
+
+  - filter:
+      count: 1
+      match:
+        event_type: ftp_data
+        ftp_data.command: STOR
+
+  # This pcap has 2 NLST commands.
+  - filter:
+      count: 2
+      match:
+        event_type: ftp_data
+        ftp_data.command: NLST
+
+  # ftpdata_command: stor matches in ftp-data:response_started
+  - filter:
+      count: 1
+      match:
+        alert.signature_id: 5000
+
+  - filter:
+      count: 1
+      match:
+        event_type: fileinfo
+
+  - filter:
+      count: 2
+      match:
+        alert.signature_id: 4002
+
+  # There should be no drops.
+  - filter:
+      count: 0
+      match:
+        event_type: drop

diff --git a/tests/firewall/ruletype-firewall-114.2-ftp-upload-passive/README.md b/tests/firewall/ruletype-firewall-114.2-ftp-upload-passive/README.md
new file mode 100644 (file)
index 0000000..4eb7675
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-114.2-ftp-upload-passive/README.md
@@ -0,0 +1 @@
+FTP passive upload tests for firewall.

diff --git a/tests/firewall/ruletype-firewall-114.2-ftp-upload-passive/firewall.rules b/tests/firewall/ruletype-firewall-114.2-ftp-upload-passive/firewall.rules
new file mode 100644 (file)
index 0000000..b2d804b
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-114.2-ftp-upload-passive/firewall.rules
@@ -0,0 +1,17 @@
+# Allow all TCP handshakes.
+accept:hook tcp:all any any -> any any (flow:not_established; sid:1000;)
+accept:hook tcp:all any any <> any any (flow:established; sid:1001;)
+
+accept:hook ftp:request_started any any -> any any (sid:2000;)
+accept:hook ftp:request_complete any any -> any any (sid:2010;)
+
+accept:hook ftp:response_started any any -> any any (sid:3000;)
+accept:hook ftp:response_complete any any -> any any (sid:3010;)
+
+# Accept STOR on the request data channel.
+accept:flow,alert ftp-data:request_started any any -> any any (sid:4000; \
+       ftpdata_command: stor;)
+
+# Accept NLST on the response data channel.
+accept:flow,alert ftp-data:response_started any any -> any any (sid: 4010; \
+  ftpdata_command: nlst;)

diff --git a/tests/firewall/ruletype-firewall-114.2-ftp-upload-passive/suricata.yaml b/tests/firewall/ruletype-firewall-114.2-ftp-upload-passive/suricata.yaml
new file mode 100644 (file)
index 0000000..7cb3519
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-114.2-ftp-upload-passive/suricata.yaml
@@ -0,0 +1,20 @@
+%YAML 1.1
+---
+
+stats:
+  enabled: yes
+  interval: 8
+
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular
+      filename: eve.json
+      types:
+        - flow
+        - alert
+        - ftp
+        - files
+        - drop:
+            alerts: yes
+            flows: all

diff --git a/tests/firewall/ruletype-firewall-114.2-ftp-upload-passive/test.yaml b/tests/firewall/ruletype-firewall-114.2-ftp-upload-passive/test.yaml
new file mode 100644 (file)
index 0000000..1c956cc
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-114.2-ftp-upload-passive/test.yaml
@@ -0,0 +1,39 @@
+requires:
+  min-version: 9
+
+pcap: ../../ftp/ftp-upload-passive/input.pcap
+
+args:
+  - --simulate-ips
+  - --runmode=single
+
+checks:
+
+  - filter:
+      count: 1
+      match:
+        event_type: ftp_data
+        ftp_data.command: STOR
+
+  # ftpdata_command: stor matches in ftp-data:request_started
+  - filter:
+      count: 1
+      match:
+        alert.signature_id: 4000
+
+  # ftpdata_command: nlst matches in ftp-data:response_started
+  - filter:
+      count: 2
+      match:
+        alert.signature_id: 4010
+
+  - filter:
+      count: 1
+      match:
+        event_type: fileinfo
+
+  # There should be no drops.
+  - filter:
+      count: 0
+      match:
+        event_type: drop