From: Eric Leblond Date: Sun, 19 Jun 2022 11:19:47 +0000 (+0200) Subject: tests: add ip dataset loading test X-Git-Tag: suricata-6.0.9~29 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=2ea27887a8e40338470189808c4691d232273b6c;p=thirdparty%2Fsuricata-verify.git tests: add ip dataset loading test --- diff --git a/tests/datasets-09-load/datasets-ip.csv b/tests/datasets-09-load/datasets-ip.csv new file mode 100644 index 000000000..625e0ac21 --- /dev/null +++ b/tests/datasets-09-load/datasets-ip.csv @@ -0,0 +1 @@ +::ffff:82.165.177.154 diff --git a/tests/datasets-09-load/datasets-ipv4.csv b/tests/datasets-09-load/datasets-ipv4.csv new file mode 100644 index 000000000..99e3430bf --- /dev/null +++ b/tests/datasets-09-load/datasets-ipv4.csv @@ -0,0 +1 @@ +82.165.177.154 diff --git a/tests/datasets-09-load/input.pcap b/tests/datasets-09-load/input.pcap new file mode 100644 index 000000000..8fb6832de Binary files /dev/null and b/tests/datasets-09-load/input.pcap differ diff --git a/tests/datasets-09-load/test.rules b/tests/datasets-09-load/test.rules new file mode 100644 index 000000000..dd381b697 --- /dev/null +++ b/tests/datasets-09-load/test.rules @@ -0,0 +1,3 @@ +alert http any any -> any any (ip.dst; dataset:isset,ipv4-list,type ipv4,load datasets-ipv4.csv; flow:established,to_server; sid:1;) +alert http any any -> any any (ip.src; dataset:isset,ipv4-list,type ipv4,load datasets-ipv4.csv; flow:established,to_server; sid:2;) +alert http any any -> any any (ip.dst; dataset:isset,ip-list,type ip,load datasets-ip.csv; flow:established,to_server; sid:3;) diff --git a/tests/datasets-09-load/test.yaml b/tests/datasets-09-load/test.yaml new file mode 100644 index 000000000..d7084fe39 --- /dev/null +++ b/tests/datasets-09-load/test.yaml @@ -0,0 +1,29 @@ +requires: + features: + - HAVE_LIBJANSSON + files: + - src/detect-ipaddr.c + +args: + - -k none + +checks: + - filter: + count: 6 + match: + event_type: alert + - filter: + count: 3 + match: + event_type: alert + alert.signature_id: 1 + - filter: + count: 0 + match: + event_type: alert + alert.signature_id: 2 + - filter: + count: 3 + match: + event_type: alert + alert.signature_id: 3