]> git.ipfire.org Git - thirdparty/suricata-verify.git/commitdiff
projects / thirdparty / suricata-verify.git / commitdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (parent: 87dbc81)
detect-pcre: add assorted tests 1605/head
authorModupe Falodun <falodunmodupeola@gmail.com>
Fri, 4 Mar 2022 10:41:30 +0000 (11:41 +0100)
committerVictor Julien <victor@inliniac.net>
Tue, 23 Jan 2024 18:00:28 +0000 (19:00 +0100)
Bring previously Suricata unit tests as suricata-verify tests.

Conversions mapping:
- detect-pcre-01: DetectPcreModifPTest04
- detect-pcre-02: DetectPcreModifPTest05
- detect-pcre-03: DetectPcreTestSig01-03
- detect-pcre-04: DetectPcreTestSig09-16
- detect-pcre-05: DetectPcreFlowvarCapture01- 03

Task #6147

25 files changed:
tests/detect-pcre/detect-pcre-01/README.md [new file with mode: 0644] patch | blob
tests/detect-pcre/detect-pcre-01/input.pcap [new file with mode: 0644] patch | blob
tests/detect-pcre/detect-pcre-01/test.rules [new file with mode: 0644] patch | blob
tests/detect-pcre/detect-pcre-01/test.yaml [new file with mode: 0644] patch | blob
tests/detect-pcre/detect-pcre-01/writepcap.py [new file with mode: 0644] patch | blob
tests/detect-pcre/detect-pcre-02/README.md [new file with mode: 0644] patch | blob
tests/detect-pcre/detect-pcre-02/input.pcap [new file with mode: 0644] patch | blob
tests/detect-pcre/detect-pcre-02/test.rules [new file with mode: 0644] patch | blob
tests/detect-pcre/detect-pcre-02/test.yaml [new file with mode: 0644] patch | blob
tests/detect-pcre/detect-pcre-02/writepcap.t [new file with mode: 0644] patch | blob
tests/detect-pcre/detect-pcre-03/README.md [new file with mode: 0644] patch | blob
tests/detect-pcre/detect-pcre-03/input.pcap [new file with mode: 0644] patch | blob
tests/detect-pcre/detect-pcre-03/test.rules [new file with mode: 0644] patch | blob
tests/detect-pcre/detect-pcre-03/test.yaml [new file with mode: 0644] patch | blob
tests/detect-pcre/detect-pcre-03/writepcap.py [new file with mode: 0644] patch | blob
tests/detect-pcre/detect-pcre-04/README.md [new file with mode: 0644] patch | blob
tests/detect-pcre/detect-pcre-04/input.pcap [new file with mode: 0644] patch | blob
tests/detect-pcre/detect-pcre-04/test.rules [new file with mode: 0644] patch | blob
tests/detect-pcre/detect-pcre-04/test.yaml [new file with mode: 0644] patch | blob
tests/detect-pcre/detect-pcre-04/writepcap.py [new file with mode: 0644] patch | blob
tests/detect-pcre/detect-pcre-05/README.md [new file with mode: 0644] patch | blob
tests/detect-pcre/detect-pcre-05/input.pcap [new file with mode: 0644] patch | blob
tests/detect-pcre/detect-pcre-05/test.rules [new file with mode: 0644] patch | blob
tests/detect-pcre/detect-pcre-05/test.yaml [new file with mode: 0644] patch | blob
tests/detect-pcre/detect-pcre-05/writepcap.py [new file with mode: 0644] patch | blob

diff --git a/tests/detect-pcre/detect-pcre-01/README.md b/tests/detect-pcre/detect-pcre-01/README.md
new file mode 100644 (file)
index 0000000..63b23bb
--- /dev/null
+++ b/tests/detect-pcre/detect-pcre-01/README.md
@@ -0,0 +1,12 @@
+# Test
+
+Test the pcre modifier P (match with L7 to http body data).
+
+## Ticket
+
+Redmine ticket https://redmine.openinfosecfoundation.org/issues/6147
+
+## Pcap
+
+Crafted using Scapy based on buffers from the original unit tests.
+
diff --git a/tests/detect-pcre/detect-pcre-01/input.pcap b/tests/detect-pcre/detect-pcre-01/input.pcap
new file mode 100644 (file)
index 0000000..14dda2e
Binary files /dev/null and b/tests/detect-pcre/detect-pcre-01/input.pcap differ
diff --git a/tests/detect-pcre/detect-pcre-01/test.rules b/tests/detect-pcre/detect-pcre-01/test.rules
new file mode 100644 (file)
index 0000000..706c49e
--- /dev/null
+++ b/tests/detect-pcre/detect-pcre-01/test.rules
@@ -0,0 +1,2 @@
+alert http any any -> any any (msg:"Pcre modifier P"; pcre:"/DOCTYPE/P"; sid:1;)
+alert http any any -> any any (msg:"Pcre modifier P - no match"; pcre:"/blah/P"; sid:2;)
diff --git a/tests/detect-pcre/detect-pcre-01/test.yaml b/tests/detect-pcre/detect-pcre-01/test.yaml
new file mode 100644 (file)
index 0000000..83cf4a2
--- /dev/null
+++ b/tests/detect-pcre/detect-pcre-01/test.yaml
@@ -0,0 +1,22 @@
+args:
+- --set stream.midstream=true
+
+checks:
+- filter:
+    count: 1
+    match:
+      event_type: flow
+- filter:
+    count: 1
+    match:
+      event_type: stats
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 1
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 2
diff --git a/tests/detect-pcre/detect-pcre-01/writepcap.py b/tests/detect-pcre/detect-pcre-01/writepcap.py
new file mode 100644 (file)
index 0000000..360185a
--- /dev/null
+++ b/tests/detect-pcre/detect-pcre-01/writepcap.py
@@ -0,0 +1,11 @@
+#!/usr/bin/env python
+from scapy.all import *
+
+pkts = []
+
+load_layer("http")
+pkts += Ether(dst='ff:ff:ff:ff:ff:ff', src='00:01:02:03:04:05')/ \
+    Dot1Q(vlan=6)/ \
+    IPv6(dst='1.2.3.4', src='5.6.7.8')/TCP(sport=6666, dport=63, flags='P''A')/HTTP()/HTTPRequest(Method='GET', Path=' / ', Http_Version='HTTP/1.1', Host='www.emergingthreats.net', User_Agent='Mozilla/1.0', Content_Type='text/html; charset=utf-8\r\n\r\n15\r\n<!DOCTYPE html PUBLIC')
+
+wrpcap('input.pcap', pkts)
diff --git a/tests/detect-pcre/detect-pcre-02/README.md b/tests/detect-pcre/detect-pcre-02/README.md
new file mode 100644 (file)
index 0000000..527b139
--- /dev/null
+++ b/tests/detect-pcre/detect-pcre-02/README.md
@@ -0,0 +1,14 @@
+# Test
+
+Test the pcre modifier P (match with L7 to http body data) over fragmented
+chunks (DOCTYPE fragmented).
+
+## Ticket
+
+Redmine ticket https://redmine.openinfosecfoundation.org/issues/6147
+
+## Pcap
+
+Crafted based on the original unittest being converted to SV test, using
+the [htptopcap.py](https://github.com/OISF/suricata-verify/blob/master/tests/engine-state/htptopcap.py)
+libhtp script to convert the writepcap.t script into a pcap.
diff --git a/tests/detect-pcre/detect-pcre-02/input.pcap b/tests/detect-pcre/detect-pcre-02/input.pcap
new file mode 100644 (file)
index 0000000..8e2182e
Binary files /dev/null and b/tests/detect-pcre/detect-pcre-02/input.pcap differ
diff --git a/tests/detect-pcre/detect-pcre-02/test.rules b/tests/detect-pcre/detect-pcre-02/test.rules
new file mode 100644 (file)
index 0000000..d5d3d53
--- /dev/null
+++ b/tests/detect-pcre/detect-pcre-02/test.rules
@@ -0,0 +1,2 @@
+alert http any any -> any any (msg:"Pcre modifier P"; pcre:"/DOC/P"; sid:1;)
+alert http any any -> any any (msg:"Pcre modifier P"; pcre:"/DOCTYPE/P"; sid:2;)
diff --git a/tests/detect-pcre/detect-pcre-02/test.yaml b/tests/detect-pcre/detect-pcre-02/test.yaml
new file mode 100644 (file)
index 0000000..1a489d8
--- /dev/null
+++ b/tests/detect-pcre/detect-pcre-02/test.yaml
@@ -0,0 +1,23 @@
+args:
+- --set stream.midstream=true
+- -k none
+
+checks:
+- filter:
+    count: 1
+    match:
+      event_type: flow
+- filter:
+    count: 1
+    match:
+      event_type: stats
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 1
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 2
diff --git a/tests/detect-pcre/detect-pcre-02/writepcap.t b/tests/detect-pcre/detect-pcre-02/writepcap.t
new file mode 100644 (file)
index 0000000..4ff83c7
--- /dev/null
+++ b/tests/detect-pcre/detect-pcre-02/writepcap.t
@@ -0,0 +1,13 @@
+>>>
+GET / HTTP/1.1
+Host: www.emergingthreats.net
+User-Agent: Mozilla/5.0 (X11; U; Linux i686; es-ES; rv:1.9.0.13) Gecko/2009080315 Ubuntu/8.10 (intrepid) Firefox/3.0.13
+Content-Type: text/html; charset=utf-8
+Content-Length: 21
+
+<!DOC
+
+>>>
+<!DOCTYPE html PUBLIC
+
+<<<
diff --git a/tests/detect-pcre/detect-pcre-03/README.md b/tests/detect-pcre/detect-pcre-03/README.md
new file mode 100644 (file)
index 0000000..a226bec
--- /dev/null
+++ b/tests/detect-pcre/detect-pcre-03/README.md
@@ -0,0 +1,13 @@
+# Tests
+
+Tests pcre modifiers, originally from Suricata unit tests, converted to SV.
+
+Signature 3 - Real negation test ! outside of "" this sig should not match.
+
+## Ticket
+
+Redmine ticket https://redmine.openinfosecfoundation.org/issues/6147
+
+## Pcap
+
+Crafted with scapy, based on buffers from the unit test.
diff --git a/tests/detect-pcre/detect-pcre-03/input.pcap b/tests/detect-pcre/detect-pcre-03/input.pcap
new file mode 100644 (file)
index 0000000..d64c67a
Binary files /dev/null and b/tests/detect-pcre/detect-pcre-03/input.pcap differ
diff --git a/tests/detect-pcre/detect-pcre-03/test.rules b/tests/detect-pcre/detect-pcre-03/test.rules
new file mode 100644 (file)
index 0000000..c6d5c63
--- /dev/null
+++ b/tests/detect-pcre/detect-pcre-03/test.rules
@@ -0,0 +1,3 @@
+alert tcp any any -> any any (msg:"HTTP TEST"; pcre:"/^gEt/i"; pcre:"/\/two\//U"; pcre:"/GET \/two\//"; pcre:"/\s+HTTP/R"; sid:1;)
+alert tcp any any -> any any (msg:"HTTP TEST"; pcre:"/two/O"; sid:2;)
+alert tcp any any -> any any (msg:"HTTP TEST. Negated pcre - no match"; content:"GET"; pcre:!"/two/"; sid:3;)
diff --git a/tests/detect-pcre/detect-pcre-03/test.yaml b/tests/detect-pcre/detect-pcre-03/test.yaml
new file mode 100644 (file)
index 0000000..a8e90b0
--- /dev/null
+++ b/tests/detect-pcre/detect-pcre-03/test.yaml
@@ -0,0 +1,27 @@
+args:
+- --set stream.midstream=true
+
+checks:
+- filter:
+    count: 1
+    match:
+      event_type: flow
+- filter:
+    count: 1
+    match:
+      event_type: stats
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 1
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 2
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 3
diff --git a/tests/detect-pcre/detect-pcre-03/writepcap.py b/tests/detect-pcre/detect-pcre-03/writepcap.py
new file mode 100644 (file)
index 0000000..8d5b5c0
--- /dev/null
+++ b/tests/detect-pcre/detect-pcre-03/writepcap.py
@@ -0,0 +1,10 @@
+#!/usr/bin/env python
+from scapy.all import *
+
+pkts = []
+
+pkts += Ether(dst='ff:ff:ff:ff:ff:ff', src='00:01:02:03:04:05')/ \
+    Dot1Q(vlan=6)/ \
+    IP(dst='1.2.3.4', src='5.6.7.8')/TCP(sport=6666, dport=80, flags='P''A')/"GET /one/ HTTP/1.1\r\nHost: one.example.org\r\n\r\n\r\nGET /two/ HTTP/1.1\r\nHost: two.example.org\r\n\r\n\r\n"
+
+wrpcap('input.pcap', pkts)
diff --git a/tests/detect-pcre/detect-pcre-04/README.md b/tests/detect-pcre/detect-pcre-04/README.md
new file mode 100644 (file)
index 0000000..da20f21
--- /dev/null
+++ b/tests/detect-pcre/detect-pcre-04/README.md
@@ -0,0 +1,15 @@
+# Test
+
+Check that Suricata properly matches on signatures with method or cookie
+modifiers passed to pcre, including cases with negated pcre and relative
+modifiers.
+
+This test is based on Suricata unit tests adapted to SV.
+
+## Ticket
+
+Redmine ticket https://redmine.openinfosecfoundation.org/issues/6147
+
+## Pcap
+
+Crafted with Scapy based on buffers present in the original unit tests.
diff --git a/tests/detect-pcre/detect-pcre-04/input.pcap b/tests/detect-pcre/detect-pcre-04/input.pcap
new file mode 100644 (file)
index 0000000..31abc5d
Binary files /dev/null and b/tests/detect-pcre/detect-pcre-04/input.pcap differ
diff --git a/tests/detect-pcre/detect-pcre-04/test.rules b/tests/detect-pcre/detect-pcre-04/test.rules
new file mode 100644 (file)
index 0000000..b3c6b96
--- /dev/null
+++ b/tests/detect-pcre/detect-pcre-04/test.rules
@@ -0,0 +1,10 @@
+alert http any any -> any any (msg:"HTTP cookie"; pcre:"/dummy/C"; sid:1;)
+alert http any any -> any any (msg:"HTTP cookie"; pcre:!"/dummy/C"; sid:2;)
+alert http any any -> any any (msg:"HTTP method"; pcre:"/POST/M"; sid:3;)
+alert http any any -> any any (msg:"HTTP method"; pcre:!"/POST/M"; sid:4;)
+alert http any any -> any any (msg:"pcre relative HTTP cookie"; content:"dummy"; http_cookie; pcre:"/1234/RC"; sid:5;)
+alert http any any -> any any (msg:"pcre relative HTTP method"; content:"PO"; http_method; pcre:"/ST/RM"; sid:6;)
+alert http any any -> any any (msg:"HTTP header"; pcre:"/User[-_]Agent[:]?\sMozilla/H"; sid:7;)
+alert http any any -> any any (msg:"HTTP header"; pcre:"/User-Agent[:]?\s+Mozilla/H"; sid:8;)
+alert http any any -> any any (msg:"HTTP header"; pcre:!"/User[-_]Agent[:]?\sIEXPLORER/H"; sid:9;)
+alert http any any -> any any (msg:"HTTP header - no match"; pcre:!"/User[-_]Agent[:]?\sMozil/H"; sid:10;)
diff --git a/tests/detect-pcre/detect-pcre-04/test.yaml b/tests/detect-pcre/detect-pcre-04/test.yaml
new file mode 100644 (file)
index 0000000..b6a876d
--- /dev/null
+++ b/tests/detect-pcre/detect-pcre-04/test.yaml
@@ -0,0 +1,63 @@
+args:
+- --set stream.midstream=true
+
+checks:
+- filter:
+    count: 2
+    match:
+      event_type: flow
+- filter:
+    count: 1
+    match:
+      event_type: stats
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 1
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 2
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 3
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 4
+      http.http_method: "GET"
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 5
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 6
+- filter:
+    count: 2
+    match:
+      event_type: alert
+      alert.signature_id: 7
+- filter:
+    count: 2
+    match:
+      event_type: alert
+      alert.signature_id: 8
+- filter:
+    count: 2
+    match:
+      event_type: alert
+      alert.signature_id: 9
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 10
diff --git a/tests/detect-pcre/detect-pcre-04/writepcap.py b/tests/detect-pcre/detect-pcre-04/writepcap.py
new file mode 100644 (file)
index 0000000..a468628
--- /dev/null
+++ b/tests/detect-pcre/detect-pcre-04/writepcap.py
@@ -0,0 +1,14 @@
+#!/usr/bin/env python
+from scapy.all import *
+
+pkts = []
+
+load_layer("http")
+pkts += Ether(dst='ff:ff:ff:ff:ff:ff', src='00:01:02:03:04:05')/ \
+    Dot1Q(vlan=6)/ \
+    IPv6(dst='1.2.3.4', src='5.6.7.8')/TCP(sport=6666, dport=63, flags='P''A')/HTTP()/HTTPRequest(Method='POST', Path=' / ', Http_Version='HTTP/1.0', User_Agent='Mozilla', Cookie='dummy 1234')
+pkts += Ether(dst='ff:ff:ff:ff:ff:ff', src='00:01:02:03:04:05')/ \
+    Dot1Q(vlan=6)/ \
+    IPv6(dst='1.2.3.4', src='5.6.7.8')/TCP(sport=6666, dport=93, flags='P''A')/HTTP()/HTTPRequest(Method='GET', Path=' / ', Http_Version='HTTP/1.0', User_Agent='Mozilla', Cookie='dummoOOooooO')
+
+wrpcap('input.pcap', pkts)
diff --git a/tests/detect-pcre/detect-pcre-05/README.md b/tests/detect-pcre/detect-pcre-05/README.md
new file mode 100644 (file)
index 0000000..3a33078
--- /dev/null
+++ b/tests/detect-pcre/detect-pcre-05/README.md
@@ -0,0 +1,12 @@
+# Test
+
+Test flowvar capture on http buffer, based on a Suricata unit test and adapted
+to SV.
+
+## Ticket
+
+Redmine ticket https://redmine.openinfosecfoundation.org/issues/6147
+
+## Pcap
+
+Crafted with Scapy with buffers based on the ones from the unit tests.
diff --git a/tests/detect-pcre/detect-pcre-05/input.pcap b/tests/detect-pcre/detect-pcre-05/input.pcap
new file mode 100644 (file)
index 0000000..0e2f0e0
Binary files /dev/null and b/tests/detect-pcre/detect-pcre-05/input.pcap differ
diff --git a/tests/detect-pcre/detect-pcre-05/test.rules b/tests/detect-pcre/detect-pcre-05/test.rules
new file mode 100644 (file)
index 0000000..0f2cc59
--- /dev/null
+++ b/tests/detect-pcre/detect-pcre-05/test.rules
@@ -0,0 +1,6 @@
+alert http any any -> any any (content:"User-Agent: "; http_header; pcre:"/(?P<flow_ua>.*)\r\n/HR"; priority:1; sid:1;)
+alert http any any -> any any (content:"User-Agent: "; http_header; pcre:"/(?P<flow_ua>.*)\r\n/HR"; sid:2;)
+alert http any any -> any any (content:"Server: "; http_header; pcre:"/(?P<flow_ua>.*)\r\n/HR"; priority:3; sid:3;)
+# Shouldn't match
+alert http any any -> any any (msg:"pcre flowvar http header, user-agent, no match"; content:"User-Agent: "; http_header; pcre:"/(?P<flow_ua>.*)\r\n/HR"; content:"xyz"; http_header; priority:1; sid:4;)
+alert http any any -> any any (msg:"pcre flowvar http header, server, no match"; content:"Server: "; http_header; pcre:"/(?P<flow_ua>.*)\r\n/HR"; content:"xyz"; http_header; priority:3; sid:5;)
diff --git a/tests/detect-pcre/detect-pcre-05/test.yaml b/tests/detect-pcre/detect-pcre-05/test.yaml
new file mode 100644 (file)
index 0000000..7dbfe2e
--- /dev/null
+++ b/tests/detect-pcre/detect-pcre-05/test.yaml
@@ -0,0 +1,37 @@
+args:
+- --set stream.midstream=true
+
+checks:
+- filter:
+    count: 2
+    match:
+      event_type: flow
+- filter:
+    count: 1
+    match:
+      event_type: stats
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 1
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 2
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 3
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 4
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 5
diff --git a/tests/detect-pcre/detect-pcre-05/writepcap.py b/tests/detect-pcre/detect-pcre-05/writepcap.py
new file mode 100644 (file)
index 0000000..f4104e7
--- /dev/null
+++ b/tests/detect-pcre/detect-pcre-05/writepcap.py
@@ -0,0 +1,11 @@
+#!/usr/bin/env python
+from scapy.all import *
+
+pkts = []
+
+load_layer("http")
+pkts += Ether(dst='ff:ff:ff:ff:ff:ff', src='00:01:02:03:04:05')/ \
+    Dot1Q(vlan=6)/ \
+    IPv6(dst='1.2.3.4', src='5.6.7.8')/TCP(sport=6666, dport=63, flags='P''A')/HTTP()/HTTPRequest(Method='GET', Path=' / ', Http_Version='HTTP/1.1', Host='www.emergingthreats.net', User_Agent='Mozilla/5.0 (X11; U; Linux i686; es-ES; rv:1.9.0.13) Gecko/2009080315 Ubuntu/8.10 (intrepid) Firefox/3.0.13', Accept='text/html,application/xhtml+xml,application/xml;q=0.9;q=0.8', Accept_Language='es-es,es;q=0.8,en-us;q=0.5,en;q=0.3', Accept_Encoding='gzip,deflate', Accept_Charset='ISO-8859-1,utf-8;q=0.7,*;q=0.7', Content_Type='Apache<!DOCTYPE html PUBLIC')
+
+wrpcap('input.pcap', pkts)
Mirror of https://github.com/OISF/suricata-verify.git