From: Jason Ish <jason.ish@oisf.net>
Date: Tue, 22 Mar 2022 15:53:59 +0000 (-0600)
Subject: test-bad-hex-rule-1: add rule with incomplete hex
X-Git-Tag: suricata-5.0.10~62
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=15a540538f7294f3de07856e1608e884a3000e47;p=thirdparty%2Fsuricata-verify.git

test-bad-hex-rule-1: add rule with incomplete hex

Add a rule with incomplete hex, for example "|22 2 22|" which
should result in a parse error.

Ticket #5201.
---

diff --git a/tests/test-bad-hex-rule-1/test.rules b/tests/test-bad-hex-rule-1/test.rules
index 1c7917660..4d4f3df97 100644
--- a/tests/test-bad-hex-rule-1/test.rules
+++ b/tests/test-bad-hex-rule-1/test.rules
@@ -1 +1,2 @@
 alert tcp any any -> any any (msg:"invalid hex test rule"; content:"|l0 01 01|"; sid:12345; rev:1;)
+alert tcp any any -> any any (msg:"invalid hex test rule"; content:"|22 2 22|"; sid:12346; rev:1;)
diff --git a/tests/test-bad-hex-rule-1/test.yaml b/tests/test-bad-hex-rule-1/test.yaml
index 897827840..3e9c8306d 100644
--- a/tests/test-bad-hex-rule-1/test.yaml
+++ b/tests/test-bad-hex-rule-1/test.yaml
@@ -21,3 +21,9 @@ checks:
       match:
         event_type: engine
         engine.error: "SC_ERR_NO_RULES_LOADED"
+
+  - filter:
+      count: 1
+      match:
+        event_type: engine
+        engine.message: "Incomplete hex code in content - |22 2 22|. Invalidating signature."