From: Jeff Lucovsky <jlucovsky@oisf.net>
Date: Fri, 7 Jul 2023 15:30:33 +0000 (-0400)
Subject: test/byte_test: Add nbyte variable name tests
X-Git-Tag: suricata-7.0.0~14
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=004c2ea723c4cfcb125dc060593c0052bab732ff;p=thirdparty%2Fsuricata-verify.git

test/byte_test: Add nbyte variable name tests

Issue: 6144

Add tests for new byte_test functionality that permits a variable name
to be used for nbytes.
---

diff --git a/tests/detect-bytetest-04/README.md b/tests/detect-bytetest-04/README.md
new file mode 100644
index 000000000..e4cfdba49
--- /dev/null
+++ b/tests/detect-bytetest-04/README.md
@@ -0,0 +1 @@
+Simple DNS match with byte extract variable used by byte test.
diff --git a/tests/detect-bytetest-04/input.pcap b/tests/detect-bytetest-04/input.pcap
new file mode 100644
index 000000000..186aebd37
Binary files /dev/null and b/tests/detect-bytetest-04/input.pcap differ
diff --git a/tests/detect-bytetest-04/test.rules b/tests/detect-bytetest-04/test.rules
new file mode 100644
index 000000000..154adad21
--- /dev/null
+++ b/tests/detect-bytetest-04/test.rules
@@ -0,0 +1 @@
+alert dns any any -> any any (msg:"byte_test varname test sig"; byte_extract:1,5,rpkt_len; byte_test:rpkt_len,=,0x01,5, bitmask 0xFF; sid:1;)
diff --git a/tests/detect-bytetest-04/test.yaml b/tests/detect-bytetest-04/test.yaml
new file mode 100644
index 000000000..fa54b92d0
--- /dev/null
+++ b/tests/detect-bytetest-04/test.yaml
@@ -0,0 +1,16 @@
+requires:
+  min-version: 7
+
+args:
+- --set stream.midstream=true
+
+checks:
+- filter:
+    count: 1
+    match:
+      event_type: dns
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 1
diff --git a/tests/detect-bytetest-04/writepcap.py b/tests/detect-bytetest-04/writepcap.py
new file mode 100644
index 000000000..e28cb68c1
--- /dev/null
+++ b/tests/detect-bytetest-04/writepcap.py
@@ -0,0 +1,12 @@
+#!/usr/bin/env python
+from scapy.all import *
+
+pkts = []
+
+data = ('\x38\x35\x01\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x01\x00')
+
+pkts += Ether(dst='ff:ff:ff:ff:ff:ff', src='00:01:02:03:04:05')/ \
+    Dot1Q(vlan=6)/ \
+    IP(dst='1.2.3.4', src='5.6.7.8')/UDP(dport=53)/Raw(load=data)
+
+wrpcap('input.pcap', pkts)
diff --git a/tests/detect-bytetest-05/test.rules b/tests/detect-bytetest-05/test.rules
new file mode 100644
index 000000000..220a17bcc
--- /dev/null
+++ b/tests/detect-bytetest-05/test.rules
@@ -0,0 +1 @@
+alert dns any any -> any any (msg:"byte_test invalid varname test sig"; byte_extract:1,5,rpkt_len; byte_test:no_var,=,0x01,5,bitmask 0xFF; sid:1;)
diff --git a/tests/detect-bytetest-05/test.yaml b/tests/detect-bytetest-05/test.yaml
new file mode 100644
index 000000000..7ae13854d
--- /dev/null
+++ b/tests/detect-bytetest-05/test.yaml
@@ -0,0 +1,14 @@
+requires:
+  min-version: 7
+
+args:
+- --set stream.midstream=true
+
+pcap: ../detect-bytetest-04/input.pcap
+
+checks:
+    - shell:
+        args: grep "Unknown byte_extract var seen in byte_test - no_var" suricata.log | wc -l | xargs
+        expect: 1
+
+exit-code: 1