]> git.ipfire.org Git - thirdparty/suricata-verify.git/commitdiff
tcp: add a SYN packet test to verify correct flow output 1659/head 1660/head
authorLukas Sismis <lsismis@oisf.net>
Tue, 6 Feb 2024 10:54:03 +0000 (11:54 +0100)
committerLukas Sismis <lukas.sismis@gmail.com>
Tue, 20 Feb 2024 20:26:14 +0000 (21:26 +0100)
Ticket: #6733

tests/bug-6733-syn-packet-flow-output/README.md [new file with mode: 0644]
tests/bug-6733-syn-packet-flow-output/input.pcap [new file with mode: 0644]
tests/bug-6733-syn-packet-flow-output/test.rules [new file with mode: 0644]
tests/bug-6733-syn-packet-flow-output/test.yaml [new file with mode: 0644]

diff --git a/tests/bug-6733-syn-packet-flow-output/README.md b/tests/bug-6733-syn-packet-flow-output/README.md
new file mode 100644 (file)
index 0000000..3fe7634
--- /dev/null
@@ -0,0 +1,11 @@
+# Description
+
+Created when a bug was found - pseudopackets were assigned with ACK flag 
+and that falsely turned SYN flows to SYN/ACK flows. 
+This only happened when content-matching rules were in the ruleset.
+
+https://redmine.openinfosecfoundation.org/issues/6733
+
+# PCAP
+
+The PCAP files comes from a private capture, free to share.
diff --git a/tests/bug-6733-syn-packet-flow-output/input.pcap b/tests/bug-6733-syn-packet-flow-output/input.pcap
new file mode 100644 (file)
index 0000000..544fb7d
Binary files /dev/null and b/tests/bug-6733-syn-packet-flow-output/input.pcap differ
diff --git a/tests/bug-6733-syn-packet-flow-output/test.rules b/tests/bug-6733-syn-packet-flow-output/test.rules
new file mode 100644 (file)
index 0000000..80eeb36
--- /dev/null
@@ -0,0 +1 @@
+alert tcp $HOME_NET any -> any any (msg: "example"; flow:established,to_server; content:"GET|20|"; sid:11111; rev:1;)
diff --git a/tests/bug-6733-syn-packet-flow-output/test.yaml b/tests/bug-6733-syn-packet-flow-output/test.yaml
new file mode 100644 (file)
index 0000000..bdf46c7
--- /dev/null
@@ -0,0 +1,23 @@
+checks:
+- filter:
+    count: 1
+    match:
+      event_type: flow
+      dest_ip: "155.166.235.43"
+      dest_port: 25
+      flow.age: 0
+      flow.alerted: false
+      flow.bytes_toclient: 0
+      flow.bytes_toserver: 66
+      flow.pkts_toclient: 0
+      flow.pkts_toserver: 1
+      flow.reason: shutdown
+      flow.state: new
+      proto: TCP
+      src_ip: "147.183.77.73"
+      src_port: 38212
+      tcp.state: syn_sent
+      tcp.syn: true
+      tcp.tcp_flags: "02"
+      tcp.tcp_flags_tc: '00'
+      tcp.tcp_flags_ts: '02'