tests: detection_filter unique_on ports and no-dup cases

Add tests coverage to the new detection_filter option of unique_on,
for dst and src ports.

Issue: 7928

diff --git a/tests/detection_filter-distinct-dstport-no-dups/README.md b/tests/detection_filter-distinct-dstport-no-dups/README.md
new file mode 100644 (file)
index 0000000..a1ce62c
--- /dev/null
+++ b/tests/detection_filter-distinct-dstport-no-dups/README.md
@@ -0,0 +1,17 @@
+Purpose
+-------
+Validate that detection_filter with unique_on dst_port does not trigger when
+the number of distinct destination ports stays below the threshold.
+
+Rule requires 3 distinct destination ports for the same destination host (track by_dst).
+The PCAP only has 2 distinct destination ports, so the threshold is not reached
+and no alerts are expected (sid 100011).
+
+Why this matters
+---------------
+Ensures duplicates or insufficient variety of dst ports do not produce alerts
+when distinct counting (unique_on dst_port) is configured with a higher threshold.
+
+Ticket: https://redmine.openinfosecfoundation.org/issues/7928
+
+PCAP: Crafted manually to fit the test.

diff --git a/tests/detection_filter-distinct-dstport-no-dups/input.pcap b/tests/detection_filter-distinct-dstport-no-dups/input.pcap
new file mode 100644 (file)
index 0000000..daf22ab
Binary files /dev/null and b/tests/detection_filter-distinct-dstport-no-dups/input.pcap differ

diff --git a/tests/detection_filter-distinct-dstport-no-dups/test.rules b/tests/detection_filter-distinct-dstport-no-dups/test.rules
new file mode 100644 (file)
index 0000000..142a80c
--- /dev/null
+++ b/tests/detection_filter-distinct-dstport-no-dups/test.rules
@@ -0,0 +1,2 @@
+## Expect 0 alerts: only 2 distinct dst ports present but threshold is 3
+alert tcp any any -> 1.1.1.1 any (msg:"DF distinct dst_port no dup"; flags:S; flow:stateless; detection_filter: track by_dst, count 3, seconds 60, unique_on dst_port; sid:100011; rev:1;)

diff --git a/tests/detection_filter-distinct-dstport-no-dups/test.yaml b/tests/detection_filter-distinct-dstport-no-dups/test.yaml
new file mode 100644 (file)
index 0000000..f3098ec
--- /dev/null
+++ b/tests/detection_filter-distinct-dstport-no-dups/test.yaml
@@ -0,0 +1,9 @@
+requires:
+  min-version: 9
+
+checks:
+  - filter:
+      count: 0
+      match:
+        event_type: alert
+        alert.signature_id: 100011

diff --git a/tests/detection_filter-distinct-dstport/README.md b/tests/detection_filter-distinct-dstport/README.md
new file mode 100644 (file)
index 0000000..8f53976
--- /dev/null
+++ b/tests/detection_filter-distinct-dstport/README.md
@@ -0,0 +1,17 @@
+Purpose
+-------
+Validate detection_filter distinct counting with unique_on dst_port.
+
+Rule requires 1 distinct destination port for the same destination host (track by_dst).
+The PCAP contains traffic that hits 2 different destination ports to 1.1.1.1,
+so the distinct counter reaches the threshold and one alert is expected (sid 100001).
+
+Why this matters
+---------------
+Introduces coverage for detection_filter unique_on dst_port behavior added in Suricata.
+This test ensures that different dst ports contribute separately toward the threshold
+while duplicate ports do not.
+
+Ticket: https://redmine.openinfosecfoundation.org/issues/7928
+
+PCAP: Crafted manually to fit the test.

diff --git a/tests/detection_filter-distinct-dstport/input.pcap b/tests/detection_filter-distinct-dstport/input.pcap
new file mode 100644 (file)
index 0000000..f349233
Binary files /dev/null and b/tests/detection_filter-distinct-dstport/input.pcap differ

diff --git a/tests/detection_filter-distinct-dstport/test.rules b/tests/detection_filter-distinct-dstport/test.rules
new file mode 100644 (file)
index 0000000..5cb1724
--- /dev/null
+++ b/tests/detection_filter-distinct-dstport/test.rules
@@ -0,0 +1,2 @@
+## Expect 1 alert after 1 distinct destination port (unique_on dst_port, count 1)
+alert tcp any any -> 1.1.1.1 any (msg:"DF distinct dst_port"; flags:S; flow:stateless; detection_filter: track by_dst, count 1, seconds 60, unique_on dst_port; sid:100001; rev:1;)

diff --git a/tests/detection_filter-distinct-dstport/test.yaml b/tests/detection_filter-distinct-dstport/test.yaml
new file mode 100644 (file)
index 0000000..f5c7d99
--- /dev/null
+++ b/tests/detection_filter-distinct-dstport/test.yaml
@@ -0,0 +1,16 @@
+requires:
+  min-version: 9
+
+checks:
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 100001
+
+  - filter:
+      count: 1
+      match:
+        event_type: stats
+        stats.detect.thresholds.bitmap_alloc_fail: 0
+        stats.detect.thresholds.bitmap_memuse: 8192

diff --git a/tests/detection_filter-distinct-srcport-no-dups/README.md b/tests/detection_filter-distinct-srcport-no-dups/README.md
new file mode 100644 (file)
index 0000000..4dafe87
--- /dev/null
+++ b/tests/detection_filter-distinct-srcport-no-dups/README.md
@@ -0,0 +1,17 @@
+Purpose
+-------
+Validate that detection_filter with unique_on src_port does not trigger when
+the number of distinct source ports stays below the threshold.
+
+Rule requires 3 distinct source ports for the same source host (track by_src).
+The PCAP only has 2 distinct source ports, so the threshold is not reached
+and no alerts are expected (sid 100012).
+
+Why this matters
+---------------
+Ensures duplicates or insufficient variety of src ports do not produce alerts
+when distinct counting (unique_on src_port) is configured with a higher threshold.
+
+Ticket: https://redmine.openinfosecfoundation.org/issues/7928
+
+PCAP: Crafted manually to fit the test.

diff --git a/tests/detection_filter-distinct-srcport-no-dups/input.pcap b/tests/detection_filter-distinct-srcport-no-dups/input.pcap
new file mode 100644 (file)
index 0000000..195a989
Binary files /dev/null and b/tests/detection_filter-distinct-srcport-no-dups/input.pcap differ

diff --git a/tests/detection_filter-distinct-srcport-no-dups/test.rules b/tests/detection_filter-distinct-srcport-no-dups/test.rules
new file mode 100644 (file)
index 0000000..d471ec0
--- /dev/null
+++ b/tests/detection_filter-distinct-srcport-no-dups/test.rules
@@ -0,0 +1,2 @@
+## Expect 0 alerts: only 2 distinct src ports present but threshold is 3
+alert tcp any any -> 2.2.2.2 80 (msg:"DF distinct src_port no dup"; flags:S; flow:stateless; detection_filter: track by_src, count 3, seconds 60, unique_on src_port; sid:100012; rev:1;)

diff --git a/tests/detection_filter-distinct-srcport-no-dups/test.yaml b/tests/detection_filter-distinct-srcport-no-dups/test.yaml
new file mode 100644 (file)
index 0000000..d0956ed
--- /dev/null
+++ b/tests/detection_filter-distinct-srcport-no-dups/test.yaml
@@ -0,0 +1,9 @@
+requires:
+  min-version: 9
+
+checks:
+  - filter:
+      count: 0
+      match:
+        event_type: alert
+        alert.signature_id: 100012

diff --git a/tests/detection_filter-distinct-srcport/README.md b/tests/detection_filter-distinct-srcport/README.md
new file mode 100644 (file)
index 0000000..068d17e
--- /dev/null
+++ b/tests/detection_filter-distinct-srcport/README.md
@@ -0,0 +1,18 @@
+Purpose
+-------
+Validate detection_filter distinct counting with unique_on src_port.
+
+Rule uses count 1, meaning it alerts after seeing more than 1 distinct source port
+for the same source host (track by_src). The PCAP contains traffic with 2 different
+source ports toward 2.2.2.2:80, so the distinct counter exceeds the threshold (2 > 1)
+and one alert is expected (sid 100002).
+
+Why this matters
+---------------
+Introduces coverage for detection_filter unique_on src_port behavior added in Suricata.
+This test ensures that different src ports contribute separately toward the threshold
+while duplicate ports do not.
+
+Ticket: https://redmine.openinfosecfoundation.org/issues/7928
+
+PCAP: Crafted manually to fit the test.

diff --git a/tests/detection_filter-distinct-srcport/input.pcap b/tests/detection_filter-distinct-srcport/input.pcap
new file mode 100644 (file)
index 0000000..a4b9591
Binary files /dev/null and b/tests/detection_filter-distinct-srcport/input.pcap differ

diff --git a/tests/detection_filter-distinct-srcport/test.rules b/tests/detection_filter-distinct-srcport/test.rules
new file mode 100644 (file)
index 0000000..e7b5711
--- /dev/null
+++ b/tests/detection_filter-distinct-srcport/test.rules
@@ -0,0 +1,2 @@
+## Expect 1 alert after seeing >1 distinct source ports (unique_on src_port, count 1)
+alert tcp any any -> 2.2.2.2 80 (msg:"DF distinct src_port"; flags:S; flow:stateless; detection_filter: track by_src, count 1, seconds 60, unique_on src_port; sid:100002; rev:1;)

diff --git a/tests/detection_filter-distinct-srcport/test.yaml b/tests/detection_filter-distinct-srcport/test.yaml
new file mode 100644 (file)
index 0000000..975ab34
--- /dev/null
+++ b/tests/detection_filter-distinct-srcport/test.yaml
@@ -0,0 +1,9 @@
+requires:
+  min-version: 9
+
+checks:
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 100002