Adds test about ssh new keys

Ticket: 6578

diff --git a/tests/ssh-newkeys/README.md b/tests/ssh-newkeys/README.md
new file mode 100644 (file)
index 0000000..39fb109
--- /dev/null
+++ b/tests/ssh-newkeys/README.md
@@ -0,0 +1,8 @@
+# Description
+
+Test rule on ssh for new keys packet.
+https://redmine.openinfosecfoundation.org/issues/6578
+
+# PCAP
+
+The pcap comes from https://forum.suricata.io/t/can-not-get-ssh-alert/4223/9

diff --git a/tests/ssh-newkeys/input.pcap b/tests/ssh-newkeys/input.pcap
new file mode 100644 (file)
index 0000000..275d728
Binary files /dev/null and b/tests/ssh-newkeys/input.pcap differ

diff --git a/tests/ssh-newkeys/test.rules b/tests/ssh-newkeys/test.rules
new file mode 100644 (file)
index 0000000..3837fe4
--- /dev/null
+++ b/tests/ssh-newkeys/test.rules
@@ -0,0 +1 @@
+alert ssh any any -> any 22 (msg:"This is a test"; content:"|15 00 00 00 00 00 00 00 00 00 00|"; classtype:protocol-command-decode; sid:1300013; rev:1; metadata:created_at 2023_05_23, updated_at 2023_05_24;)

diff --git a/tests/ssh-newkeys/test.yaml b/tests/ssh-newkeys/test.yaml
new file mode 100644 (file)
index 0000000..2c78fd6
--- /dev/null
+++ b/tests/ssh-newkeys/test.yaml
@@ -0,0 +1,12 @@
+requires:
+  min-version: 8
+
+args:
+ - -k none
+
+checks:
+  - filter:
+      count: 1
+      match:
+         event_type: alert
+         alert.signature_id: 1300013