xff: checks dependig on suricata version

diff --git a/run.py b/run.py
index 6a5636d1c6a4126475d0f3e8d463dc64f739f876..1c1763d171af62051633288273b9976f7084066e 100755 (executable)
--- a/run.py
+++ b/run.py
@@ -441,10 +441,13 @@ class FilterCheck:
         requires = self.config.get("requires", {})
         req_version = self.config.get("version")
         min_version = self.config.get("min-version")
+        lt_version = self.config.get("lt-version")
         if req_version is not None:
             requires["version"] = req_version
         if min_version is not None:
             requires["min-version"] = min_version
+        if lt_version is not None:
+            requires["lt-version"] = lt_version
         feature = self.config.get("feature")
         if feature is not None:
             requires["features"] = [feature]

diff --git a/tests/http-xff-eve-forward-extra-data/test.yaml b/tests/http-xff-eve-forward-extra-data/test.yaml
index 50251986941cce16b0774d8429756a600fcb5e46..30d9f5f6a570f11ac69afc05a09313e3470a79ce 100644 (file)
--- a/tests/http-xff-eve-forward-extra-data/test.yaml
+++ b/tests/http-xff-eve-forward-extra-data/test.yaml
@@ -3,6 +3,13 @@ args:
 
 checks:
   - filter:
+      min-version: 7
+      count: 1
+      match:
+        alert.xff: 10.2.2.2
+
+  - filter:
+      lt-version: 7
       count: 1
       match:
         xff: 10.2.2.2

diff --git a/tests/http-xff-eve-reverse-extra-data/test.yaml b/tests/http-xff-eve-reverse-extra-data/test.yaml
index b686c73bf1f92d40ef22558c6b756e20c34f2af8..c91ccd21927067651ce2580c5299662ed69c6b48 100644 (file)
--- a/tests/http-xff-eve-reverse-extra-data/test.yaml
+++ b/tests/http-xff-eve-reverse-extra-data/test.yaml
@@ -3,6 +3,13 @@ args:
 
 checks:
   - filter:
+      min-version: 7
+      count: 1
+      match:
+        alert.xff: 10.3.3.3
+
+  - filter:
+      lt-version: 7
       count: 1
       match:
         xff: 10.3.3.3