From: Jason Ish <jason.ish@oisf.net>
Date: Thu, 27 Mar 2025 17:20:05 +0000 (-0600)
Subject: tests: add dnp3 lua state
X-Git-Tag: suricata-7.0.11~139
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=1acc44e71ce872d9565ddf790d21aa5e7e9cb76f;p=thirdparty%2Fsuricata-verify.git

tests: add dnp3 lua state

This is very minimal, should be expanded on.

Ticket: #7601
---

diff --git a/tests/dnp3/dnp3-lua/README.md b/tests/dnp3/dnp3-lua/README.md
new file mode 100644
index 000000000..4d3199a04
--- /dev/null
+++ b/tests/dnp3/dnp3-lua/README.md
@@ -0,0 +1,8 @@
+# Description
+
+Test dnp3_func rule keyword.
+
+# PCAP
+
+The pcap comes from running the master-demo and outstation-demo from
+the OpenDNP3 project.
diff --git a/tests/dnp3/dnp3-lua/rule.lua b/tests/dnp3/dnp3-lua/rule.lua
new file mode 100644
index 000000000..7569cfe7c
--- /dev/null
+++ b/tests/dnp3/dnp3-lua/rule.lua
@@ -0,0 +1,31 @@
+local dnp3 = require("suricata.dnp3")
+
+function init (args)
+   return {dnp3 = true}
+end
+
+function match(args)
+   -- No args for DNP3.
+   
+   -- Get transaction.
+   local tx = dnp3.get_tx()
+
+   if not tx["is_request"] then
+      return 0
+   end
+
+   local request = tx["request"]
+   if request == nil then
+      return 0
+   end
+
+   if not request["done"] then
+      return 0
+   end
+
+   if not request["complete"] then
+      return 0
+   end
+
+   return 1
+end
diff --git a/tests/dnp3/dnp3-lua/suricata.yaml b/tests/dnp3/dnp3-lua/suricata.yaml
new file mode 100644
index 000000000..83b7626c1
--- /dev/null
+++ b/tests/dnp3/dnp3-lua/suricata.yaml
@@ -0,0 +1,18 @@
+%YAML 1.1
+---
+
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular
+      filename: eve.json
+      types:
+        - alert:
+        - dnp3:
+
+app-layer:
+  protocols:
+    dnp3:
+      enabled: yes
+      detection-ports:
+        dp: 20000
diff --git a/tests/dnp3/dnp3-lua/test.rules b/tests/dnp3/dnp3-lua/test.rules
new file mode 100644
index 000000000..77b2c45df
--- /dev/null
+++ b/tests/dnp3/dnp3-lua/test.rules
@@ -0,0 +1 @@
+alert dnp3 any any -> any any (msg:"LUA"; dnp3_func:21; lua:rule.lua; sid:4; rev:1;)
diff --git a/tests/dnp3/dnp3-lua/test.yaml b/tests/dnp3/dnp3-lua/test.yaml
new file mode 100644
index 000000000..024dd7de3
--- /dev/null
+++ b/tests/dnp3/dnp3-lua/test.yaml
@@ -0,0 +1,13 @@
+requires:
+  min-version: 8
+
+args:
+  - --set security.lua.allow-rules=true
+
+pcap: ../dnp3-eve/input.pcap
+
+checks:
+  - filter:
+      count: 1
+      match:
+        alert.signature_id: 4