tests: check exception policy stats counters

Edit the existing exception policy tests to check for the new exception
policy stats counters.

Add two more tests, to showcase behavior for exception policy stats
counters when set up to log counters for each app-proto error and
zero-valued counters are enabled (default behavior).

Ticket #5816

diff --git a/tests/exception-policy-applayer-01/README.md b/tests/exception-policy-applayer-01/README.md
new file mode 100644 (file)
index 0000000..76e7e19
--- /dev/null
+++ b/tests/exception-policy-applayer-01/README.md
@@ -0,0 +1,9 @@
+# Test
+
+Showcase exception policy stats counters for application layer protocol errors,
+showing only the summarized counters.
+
+## Ticket
+
+https://redmine.openinfosecfoundation.org/issues/5816
+

diff --git a/tests/exception-policy-applayer-01/suricata.yaml b/tests/exception-policy-applayer-01/suricata.yaml
index aa46e9763db8e3a36d9fafbc42727277508111a3..f78de69fee31b56442d7c267d6a1237e91c8be1d 100644 (file)
--- a/tests/exception-policy-applayer-01/suricata.yaml
+++ b/tests/exception-policy-applayer-01/suricata.yaml
@@ -1,6 +1,10 @@
 %YAML 1.1
 ---
 
+stats:
+  enabled: yes
+  interval: 8
+
 outputs:
   - eve-log:
       enabled: yes
@@ -14,13 +18,18 @@ outputs:
               stream: yes
               applayer: yes
         - tls:
-            extended: yes     # enable this for extended logging information
+            extended: yes
         - drop:
-            alerts: yes      # log alerts that caused drops
-            flows: all       # start or all: 'start' logs only a single drop
-                             # per flow direction. All logs each dropped pkt.
+            alerts: yes
+            flows: all
+        - stats:
+            totals: yes
+            threads: no
+            deltas: no
         - flow
-        - stats
+  - stats:
+      enabled: yes
+      filename: stats.log
 
 action-order:
   - pass

diff --git a/tests/exception-policy-applayer-01/test.yaml b/tests/exception-policy-applayer-01/test.yaml
index d4d09ebaf442644621f08a0101f600df1886d9ec..1d8e1d88bffaf1868d6befd37cb86c5129efc7ea 100644 (file)
--- a/tests/exception-policy-applayer-01/test.yaml
+++ b/tests/exception-policy-applayer-01/test.yaml
@@ -54,3 +54,10 @@ checks:
       match:
         event_type: stats
         stats.ips.drop_reason.applayer_error: 1
+  - filter:
+      min-version: 8
+      count: 1
+      match:
+        event_type: stats
+        stats.app_layer.error.exception_policy.drop_flow: 1
+        stats.app_layer.error.exception_policy.pass_flow: 0

diff --git a/tests/exception-policy-applayer-02/README.md b/tests/exception-policy-applayer-02/README.md
new file mode 100644 (file)
index 0000000..1582fb8
--- /dev/null
+++ b/tests/exception-policy-applayer-02/README.md
@@ -0,0 +1,9 @@
+# Test
+
+Showcase exception policy stats counters for application layer protocol errors,
+including also indicating how it is possible to configure: exception policy
+stats to log counters per app-proto, instead of only a summary.
+
+## Ticket
+
+https://redmine.openinfosecfoundation.org/issues/5816

diff --git a/tests/exception-policy-applayer-02/suricata.yaml b/tests/exception-policy-applayer-02/suricata.yaml
new file mode 100644 (file)
index 0000000..aedf26e
--- /dev/null
+++ b/tests/exception-policy-applayer-02/suricata.yaml
@@ -0,0 +1,40 @@
+%YAML 1.1
+---
+
+outputs:
+  - eve-log:
+      enabled: yes
+      types:
+        - alert:
+            tagged-packets: yes
+        - anomaly:
+            enabled: yes
+            types:
+              decode: no
+              stream: yes
+              applayer: yes
+        - tls:
+            extended: yes
+        - drop:
+            alerts: yes
+            flows: all
+        - stats:
+            totals: yes
+            threads: no
+            deltas: no
+        - flow
+  - stats:
+      enabled: yes
+      filename: stats.log
+
+action-order:
+  - pass
+  - drop
+  - reject
+  - alert
+
+stats:
+  enabled: yes
+  interval: 8
+  exception-policy:
+    per-app-proto-errors: true

diff --git a/tests/exception-policy-applayer-02/test.rules b/tests/exception-policy-applayer-02/test.rules
new file mode 100644 (file)
index 0000000..3d147af
--- /dev/null
+++ b/tests/exception-policy-applayer-02/test.rules
@@ -0,0 +1,5 @@
+#pass tls any any -> any any (tls.sni; content:"example.com"; startswith; nocase; endswith; msg:"matching TLS allowlisted"; flow:to_server,established; sid:1;)
+#drop tls any any -> any any (msg:"not matching any TLS allowlisted Domain"; flow:to_server,established; sid:2; rev:1;)
+
+# matches packet 4, but should not alert due to memcap drop
+alert tcp any any -> any any (seq:3964863680; ack:2403674603; dsize:214; sid:3;)

diff --git a/tests/exception-policy-applayer-02/test.yaml b/tests/exception-policy-applayer-02/test.yaml
new file mode 100644 (file)
index 0000000..c0e33bb
--- /dev/null
+++ b/tests/exception-policy-applayer-02/test.yaml
@@ -0,0 +1,50 @@
+requires:
+  features:
+    - DEBUG
+pcap: ../tls/tls-certs-alert/input.pcap
+args:
+- --simulate-ips
+- -k none
+# pretend pretend error in the first data
+- --simulate-applayer-error-at-offset-ts=0
+- --set app-layer.error-policy=pass-packet
+checks:
+  - filter:
+      count: 0
+      match:
+        event_type: alert
+  - filter:
+      count: 0
+      match:
+        event_type: drop
+  - filter:
+      count: 0
+      match:
+        event_type: drop
+        drop.reason: "flow drop"
+  - filter:
+      count: 0
+      match:
+        event_type: tls
+        tls.sni: example.com
+  - filter:
+      count: 0
+      match:
+        event_type: tls
+  - filter:
+      count: 1
+      match:
+        event_type: flow
+        app_proto: tls
+  - filter:
+      count: 0
+      match:
+        event_type: flow
+        flow.action: drop
+  - filter:
+      min-version: 8
+      count: 1
+      match:
+        event_type: stats
+        stats.app_layer.error.tls.exception_policy.pass_packet: 1
+        stats.app_layer.error.tls.exception_policy.drop_packet: 0

diff --git a/tests/exception-policy-applayer-03/README.md b/tests/exception-policy-applayer-03/README.md
new file mode 100644 (file)
index 0000000..9bcd057
--- /dev/null
+++ b/tests/exception-policy-applayer-03/README.md
@@ -0,0 +1,15 @@
+# Test
+
+Showcase exception policy stats counters for application layer protocol errors
+with a longer per-app-proto stats counter - in case, ``bittorrent-dht.pass-packet``.
+
+The result can be seen in the stats.log file in the output directory.
+
+## PCAP
+
+Reused from existing bittorrent-dht test.
+
+## Ticket
+
+Related to work for exception policy stats counters:
+https://redmine.openinfosecfoundation.org/issues/5816

diff --git a/tests/exception-policy-applayer-03/suricata.yaml b/tests/exception-policy-applayer-03/suricata.yaml
new file mode 100644 (file)
index 0000000..2f6b636
--- /dev/null
+++ b/tests/exception-policy-applayer-03/suricata.yaml
@@ -0,0 +1,44 @@
+%YAML 1.1
+---
+
+app-layer:
+  protocols:
+    bittorrent-dht:
+      enabled: yes
+
+outputs:
+  - eve-log:
+      enabled: yes
+      types:
+        - alert:
+            tagged-packets: yes
+        - anomaly:
+            enabled: yes
+            types:
+              decode: no
+              stream: yes
+              applayer: yes
+        - bittorrent-dht
+        - drop:
+            alerts: yes
+            flows: all
+        - stats:
+            totals: yes
+            threads: no
+            deltas: no
+        - flow
+  - stats:
+      enabled: yes
+      filename: stats.log
+
+action-order:
+  - pass
+  - drop
+  - reject
+  - alert
+
+stats:
+  enabled: yes
+  interval: 8
+  exception-policy:
+    per-app-proto-errors: true

diff --git a/tests/exception-policy-applayer-03/test.yaml b/tests/exception-policy-applayer-03/test.yaml
new file mode 100644 (file)
index 0000000..3884db3
--- /dev/null
+++ b/tests/exception-policy-applayer-03/test.yaml
@@ -0,0 +1,67 @@
+requires:
+  min-version: 8
+  features:
+    - DEBUG
+pcap: ../bittorrent-dht/input.pcap
+args:
+- --simulate-ips
+- -k none
+- --simulate-applayer-error-at-offset-tc=3
+- --set app-layer.error-policy=pass-packet
+
+checks:
+- filter:
+    count: 1
+    match:
+      bittorrent_dht.request.id: 6162636465666768696a30313233343536373839
+      bittorrent_dht.request_type: ping
+      bittorrent_dht.transaction_id: '6161'
+      dest_ip: 190.0.0.3
+      dest_port: 30000
+      event_type: bittorrent_dht
+      pcap_cnt: 3
+      pkt_src: wire/pcap
+      proto: UDP
+      src_ip: 190.0.0.1
+      src_port: 20000
+- filter:
+    count: 1
+    match:
+      bittorrent_dht.request.id: 6162636465666768696a30313233343536373839
+      bittorrent_dht.request_type: ping
+      bittorrent_dht.transaction_id: '6161'
+      dest_ip: 190.0.0.2
+      dest_port: 50000
+      event_type: bittorrent_dht
+      pcap_cnt: 1
+      pkt_src: wire/pcap
+      proto: UDP
+      src_ip: 190.0.0.1
+      src_port: 40000
+- filter:
+    count: 1
+    match:
+      bittorrent_dht.error.msg: A Generic Error Ocurred
+      bittorrent_dht.error.num: 201
+      bittorrent_dht.transaction_id: '6161'
+      dest_ip: 190.0.0.1
+      dest_port: 20000
+      event_type: bittorrent_dht
+      pcap_cnt: 4
+      pkt_src: wire/pcap
+      proto: UDP
+      src_ip: 190.0.0.3
+      src_port: 30000
+- filter:
+    count: 1
+    match:
+      bittorrent_dht.response.id: 6d6e6f707172737475767778797a313233343536
+      bittorrent_dht.transaction_id: '6161'
+      dest_ip: 190.0.0.1
+      dest_port: 40000
+      event_type: bittorrent_dht
+      pcap_cnt: 2
+      pkt_src: wire/pcap
+      proto: UDP
+      src_ip: 190.0.0.2
+      src_port: 50000

diff --git a/tests/exception-policy-default-01/suricata.yaml b/tests/exception-policy-default-01/suricata.yaml
index 8e0bca08093e13507bdf70221aa30878aa498ef1..09637bdec0577db17716f1792d3fcbbf264fc25a 100644 (file)
--- a/tests/exception-policy-default-01/suricata.yaml
+++ b/tests/exception-policy-default-01/suricata.yaml
@@ -12,11 +12,16 @@ outputs:
         - drop:
             alerts: yes      # log alerts that caused drops
             flows: all       # start or all: 'start' logs only a single drop
-                             # per flow direction. All logs each dropped pkt.
+        - stats
+  - stats:
+       enabled: yes
+       filename: stats.log
+       append: yes
+
 action-order:
   - pass
   - drop
   - reject
   - alert
 
-    #exception-policy: ignore
+exception-policy: ignore

diff --git a/tests/exception-policy-default-01/test.yaml b/tests/exception-policy-default-01/test.yaml
index c3821598c9175e116586fc9d5bbfd8dfa0fd6fb2..676b6c260be46676cb5ffddeab8e66f01269d512 100644 (file)
--- a/tests/exception-policy-default-01/test.yaml
+++ b/tests/exception-policy-default-01/test.yaml
@@ -1,9 +1,9 @@
 requires:
   features:
     - DEBUG
-  files:
-    - src/util-exception-policy.c
+
 pcap: ../tls/tls-certs-alert/input.pcap
+
 args:
 - --simulate-ips
 - -k none

diff --git a/tests/exception-policy-defrag-01/test.yaml b/tests/exception-policy-defrag-01/test.yaml
index 9daab62979598e5e4b6442cd0e30f3ca766d27b1..3f00f7808343d59b818158a7664596f7d076662c 100644 (file)
--- a/tests/exception-policy-defrag-01/test.yaml
+++ b/tests/exception-policy-defrag-01/test.yaml
@@ -1,8 +1,6 @@
 requires:
   features:
     - DEBUG
-  files:
-    - src/util-exception-policy.c
 args:
 - --simulate-ips
 - -k none
@@ -40,3 +38,11 @@ checks:
       match:
         event_type: stats
         stats.ips.drop_reason.defrag_memcap: 1
+  - filter:
+      min-version: 8
+      count: 1
+      match:
+        event_type: stats
+        stats.defrag.memcap_exception_policy.drop_packet: 1
+        stats.defrag.memcap_exception_policy.pass_packet: 0
+

diff --git a/tests/exception-policy-midstream-01/suricata.yaml b/tests/exception-policy-midstream-01/suricata.yaml
index b22aeadcd864eb9ac21c203b2023f6793dcaa5c8..6ffa252bb5f28230f64d8dd085b81b62fb2c295b 100644 (file)
--- a/tests/exception-policy-midstream-01/suricata.yaml
+++ b/tests/exception-policy-midstream-01/suricata.yaml
@@ -1,6 +1,9 @@
 %YAML 1.1
 ---
 
+stats:
+  enabled: yes
+
 outputs:
   - eve-log:
       enabled: yes
@@ -26,3 +29,10 @@ outputs:
         - drop:
             alerts: yes
             flows: all
+        - stats
+  - stats:
+       enabled: yes
+       filename: stats.log
+       append: yes
+
+exception-policy: ignore

diff --git a/tests/exception-policy-midstream-01/test.yaml b/tests/exception-policy-midstream-01/test.yaml
index 8cf3deb07b63245b0e1d94e97e449c265a7bdbda..29fb09d8a821baf86adb3070463cc2b3ba4fd896 100644 (file)
--- a/tests/exception-policy-midstream-01/test.yaml
+++ b/tests/exception-policy-midstream-01/test.yaml
@@ -18,3 +18,9 @@ checks:
       count: 0
       match:
         event_type: http
+  - filter:
+      min-version: 8
+      count: 1
+      match:
+        event_type: stats
+        stats.tcp.midstream_exception_policy.pass_flow: 9

diff --git a/tests/exception-policy-midstream-02/test.yaml b/tests/exception-policy-midstream-02/test.yaml
index 83a2f4671a005733b2412d0ed408f43f6cd85717..0db32854371f2536e7bc82ee851a1f99775564e1 100644 (file)
--- a/tests/exception-policy-midstream-02/test.yaml
+++ b/tests/exception-policy-midstream-02/test.yaml
@@ -30,3 +30,9 @@ checks:
       match:
         event_type: stats
         stats.ips.drop_reason.stream_midstream: 1
+  - filter:
+      min-version: 8
+      count: 1
+      match:
+        event_type: stats
+        stats.tcp.midstream_exception_policy.drop_flow: 1

diff --git a/tests/exception-policy-midstream-03/suricata.yaml b/tests/exception-policy-midstream-03/suricata.yaml
index 1d909b80a1d3065fa69194eb9e7cf39a016f80a5..32f0f4aa2bbcf7e746a6b7eee02a7c6b0ce806db 100644 (file)
--- a/tests/exception-policy-midstream-03/suricata.yaml
+++ b/tests/exception-policy-midstream-03/suricata.yaml
@@ -15,6 +15,11 @@ outputs:
             http: yes
         - flow
         - http
+        - stats
+  - stats:
+       enabled: yes
+       filename: stats.log
+       append: yes
 
 logging:
   default-log-level: notice

diff --git a/tests/exception-policy-midstream-04/suricata.yaml b/tests/exception-policy-midstream-04/suricata.yaml
index e142e70862a827c6d0cec71a6cf7bb4c391c3dc2..e318821f82fdaaaced440abec0a39effe7fd9da4 100644 (file)
--- a/tests/exception-policy-midstream-04/suricata.yaml
+++ b/tests/exception-policy-midstream-04/suricata.yaml
@@ -8,3 +8,8 @@ outputs:
         - alert
         - flow
         - http
+        - stats
+  - stats:
+       enabled: yes
+       filename: stats.log
+       append: yes

diff --git a/tests/exception-policy-midstream-04/test.yaml b/tests/exception-policy-midstream-04/test.yaml
index b57a4146521a596b859dac528b33e5d1a46a2d6e..10fb97e7e510a7b69f92a0d7a0dab31a4265b4e2 100644 (file)
--- a/tests/exception-policy-midstream-04/test.yaml
+++ b/tests/exception-policy-midstream-04/test.yaml
@@ -19,3 +19,9 @@ checks:
     count: 0
     match:
       event_type: http
+- filter:
+    min-version: 8
+    count: 1
+    match:
+      event_type: stats
+      stats.tcp.midstream_exception_policy.pass_flow: 2

diff --git a/tests/exception-policy-midstream-05/suricata.yaml b/tests/exception-policy-midstream-05/suricata.yaml
index b22aeadcd864eb9ac21c203b2023f6793dcaa5c8..64b32f334c5cd99363fcdfb270935ebc6a3a611c 100644 (file)
--- a/tests/exception-policy-midstream-05/suricata.yaml
+++ b/tests/exception-policy-midstream-05/suricata.yaml
@@ -22,7 +22,12 @@ outputs:
               deployment: reverse
               header: X-Forwarded-For
         - flow
+        - stats
         - http
         - drop:
             alerts: yes
             flows: all
+  - stats:
+       enabled: yes
+       filename: stats.log
+       append: yes

diff --git a/tests/exception-policy-midstream-05/test.yaml b/tests/exception-policy-midstream-05/test.yaml
index bd54da62cbdff45bfb1b0c0b5c7b50f8a12eec04..7c6db568a2b14ac688b7119bdc8a9f1a233f4837 100644 (file)
--- a/tests/exception-policy-midstream-05/test.yaml
+++ b/tests/exception-policy-midstream-05/test.yaml
@@ -18,3 +18,9 @@ checks:
       count: 0
       match:
         event_type: http
+  - filter:
+      min-version: 8
+      count: 1
+      match:
+        event_type: stats
+        stats.tcp.midstream_exception_policy.bypass: 1

diff --git a/tests/exception-policy-midstream-06/suricata.yaml b/tests/exception-policy-midstream-06/suricata.yaml
index d672946e9cfae960a76253998b7cc4fcc62a99e8..ca0134c6bab758062405ab5792c1ba7b1642b5ca 100644 (file)
--- a/tests/exception-policy-midstream-06/suricata.yaml
+++ b/tests/exception-policy-midstream-06/suricata.yaml
@@ -8,6 +8,11 @@ outputs:
         - alert:
         - flow
         - http
+        - stats
         - drop:
             alerts: yes
             flows: all
+  - stats:
+       enabled: yes
+       filename: stats.log
+       append: yes

diff --git a/tests/exception-policy-midstream-06/test.yaml b/tests/exception-policy-midstream-06/test.yaml
index 67c8de631471a6828128a9a9021ff354e34f87cf..f4e4c44f335144b46b86ff75432907b6c9926fc1 100644 (file)
--- a/tests/exception-policy-midstream-06/test.yaml
+++ b/tests/exception-policy-midstream-06/test.yaml
@@ -16,4 +16,9 @@ checks:
       match:
         event_type: flow
         flow.action: drop
-
+  - filter:
+      min-version: 8
+      count: 1
+      match:
+        event_type: stats
+        stats.tcp.midstream_exception_policy.drop_flow: 1

diff --git a/tests/exception-policy-simulated-flow-memcap/suricata.yaml b/tests/exception-policy-simulated-flow-memcap/suricata.yaml
index 20dcc8e0c798fc9a5f1f79965404d491d89a6e63..6baf208c7d18ed873b6ebe4b4b52dabf53767836 100644 (file)
--- a/tests/exception-policy-simulated-flow-memcap/suricata.yaml
+++ b/tests/exception-policy-simulated-flow-memcap/suricata.yaml
@@ -1,6 +1,9 @@
 %YAML 1.1
 ---
 
+stats:
+  enabled: yes
+
 outputs:
   - eve-log:
       enabled: yes

diff --git a/tests/exception-policy-simulated-flow-memcap/test.yaml b/tests/exception-policy-simulated-flow-memcap/test.yaml
index afa5f294f2c4f1e90765bda4a97c1d6fae58eecb..c378a8e856c2de9210c00e023cd1656f83cba889 100644 (file)
--- a/tests/exception-policy-simulated-flow-memcap/test.yaml
+++ b/tests/exception-policy-simulated-flow-memcap/test.yaml
@@ -32,3 +32,10 @@ checks:
       match:
         event_type: stats
         stats.ips.drop_reason.flow_memcap: 1
+  - filter:
+      min-version: 8
+      count: 1
+      match:
+        event_type: stats
+        stats.flow.memcap_exception_policy.drop_packet: 1
+        stats.flow.memcap_exception_policy.pass_packet: 0

diff --git a/tests/exception-policy-stream-reassembly-memcap-01/suricata.yaml b/tests/exception-policy-stream-reassembly-memcap-01/suricata.yaml
index 3c973a2beb9dc6c5aff8cc4417cbdd7fe96f9bdb..1c09123ac50d140bece77c34e4cdfa59e6a69f35 100644 (file)
--- a/tests/exception-policy-stream-reassembly-memcap-01/suricata.yaml
+++ b/tests/exception-policy-stream-reassembly-memcap-01/suricata.yaml
@@ -26,7 +26,12 @@ outputs:
         - stats:
             totals: yes       # stats for all threads merged together
             threads: no       # per thread stats
-            deltas: no        # include delta values
+            deltas: no
+  - stats:
+       enabled: yes
+       filename: stats.log
+       append: yes
+
 action-order:
   - pass
   - drop

diff --git a/tests/exception-policy-stream-reassembly-memcap-06/suricata.yaml b/tests/exception-policy-stream-reassembly-memcap-06/suricata.yaml
index 758f7208528ae36ae1c3af2fa89b6b131673a305..8894da2d280ccb81d2120c78be72293ddd1f85ea 100644 (file)
--- a/tests/exception-policy-stream-reassembly-memcap-06/suricata.yaml
+++ b/tests/exception-policy-stream-reassembly-memcap-06/suricata.yaml
@@ -14,3 +14,9 @@ outputs:
             flows: all       # start or all: 'start' logs only a single drop
                              # per flow direction. All logs each dropped pkt.
         - flow
+        - stats
+
+  - stats:
+       enabled: yes
+       filename: stats.log
+       append: yes

diff --git a/tests/exception-policy-stream-reassembly-memcap-06/test.yaml b/tests/exception-policy-stream-reassembly-memcap-06/test.yaml
index d5c95b8b43a61899a6d7b07551dd6ef5589dc48a..c434242411c0a1cb0d161285d503146bf3393e93 100644 (file)
--- a/tests/exception-policy-stream-reassembly-memcap-06/test.yaml
+++ b/tests/exception-policy-stream-reassembly-memcap-06/test.yaml
@@ -49,3 +49,9 @@ checks:
       match:
         event_type: flow
         flow.action: drop
+  - filter:
+      min-version: 8
+      count: 1
+      match:
+        event_type: stats
+        stats.tcp.reassembly_exception_policy.pass_packet: 1

diff --git a/tests/exception-policy-stream-ssn-memcap-01/test.yaml b/tests/exception-policy-stream-ssn-memcap-01/test.yaml
index 88576cade7a7dbc031efc0fd372035c31a847495..c5f85bd3f7af255bf0ddc977311ccb38db62ec23 100644 (file)
--- a/tests/exception-policy-stream-ssn-memcap-01/test.yaml
+++ b/tests/exception-policy-stream-ssn-memcap-01/test.yaml
@@ -53,3 +53,9 @@ checks:
       match:
         event_type: stats
         stats.ips.drop_reason.stream_memcap: 1
+  - filter:
+      min-version: 8
+      count: 1
+      match:
+        event_type: stats
+        stats.tcp.ssn_memcap_exception_policy.drop_flow: 1