From: Victor Julien <victor@inliniac.net>
Date: Fri, 1 Mar 2024 13:15:27 +0000 (+0100)
Subject: tests: add threshold by_flow test
X-Git-Tag: suricata-7.0.7~91
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=522966d11bd2fb72b2d3df3c03cc761c00cd15b3;p=thirdparty%2Fsuricata-verify.git

tests: add threshold by_flow test

Ticket: #6822.
---

diff --git a/tests/threshold/threshold-rule-flow/README.md b/tests/threshold/threshold-rule-flow/README.md
new file mode 100644
index 000000000..3a000ae60
--- /dev/null
+++ b/tests/threshold/threshold-rule-flow/README.md
@@ -0,0 +1,3 @@
+PCAP
+====
+PCAP from https://wiki.wireshark.org/Internet_Control_Message_Protocol
diff --git a/tests/threshold/threshold-rule-flow/icmp.pcap b/tests/threshold/threshold-rule-flow/icmp.pcap
new file mode 100644
index 000000000..037606d1b
Binary files /dev/null and b/tests/threshold/threshold-rule-flow/icmp.pcap differ
diff --git a/tests/threshold/threshold-rule-flow/test.rules b/tests/threshold/threshold-rule-flow/test.rules
new file mode 100644
index 000000000..602c24969
--- /dev/null
+++ b/tests/threshold/threshold-rule-flow/test.rules
@@ -0,0 +1,4 @@
+alert icmp any any -> any any (itype:8; sid:1;)
+alert icmp any any -> any any (itype:8; threshold:type limit, track by_flow, count 1, seconds 3600; sid:2;)
+alert icmp any any -> any any (itype:8; threshold:type limit, track by_flow, count 2, seconds 3600; sid:3;)
+alert icmp any any -> any any (itype:8; threshold:type both, track by_flow, count 3, seconds 3600; sid:4;)
diff --git a/tests/threshold/threshold-rule-flow/test.yaml b/tests/threshold/threshold-rule-flow/test.yaml
new file mode 100644
index 000000000..cfa502879
--- /dev/null
+++ b/tests/threshold/threshold-rule-flow/test.yaml
@@ -0,0 +1,24 @@
+requires:
+  min-version: 8
+
+checks:
+  - filter:
+      count: 8
+      match:
+        event_type: alert
+        alert.signature_id: 1
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 2
+  - filter:
+      count: 2
+      match:
+        event_type: alert
+        alert.signature_id: 3
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 4