From: Jason Ish <ish@unx.ca>
Date: Wed, 4 Jan 2017 17:59:38 +0000 (-0600)
Subject: proto-mismatch-http-ssh: test app-layer mismatch
X-Git-Tag: suricata-3.2.1~7
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=78a0e67f0638ecebf2c6b05ff52dcf1826c5a87c;p=thirdparty%2Fsuricata-verify.git

proto-mismatch-http-ssh: test app-layer mismatch

Tests that an app-layer mismatch is detected.
---

diff --git a/proto-mismatch-http-ssh/app-layer-events.rules b/proto-mismatch-http-ssh/app-layer-events.rules
new file mode 100644
index 000000000..4d2ac28bb
--- /dev/null
+++ b/proto-mismatch-http-ssh/app-layer-events.rules
@@ -0,0 +1,14 @@
+# App layer event  rules
+#
+# SID's fall in the 2260000+ range. See http://doc.emergingthreats.net/bin/view/Main/SidAllocation
+#
+# These sigs fire at most once per connection.
+#
+# A flowint applayer.anomaly.count is incremented for each match. By default it will be 0.
+#
+alert ip any any -> any any (msg:"SURICATA Applayer Mismatch protocol both directions"; flow:established; app-layer-event:applayer_mismatch_protocol_both_directions; flowint:applayer.anomaly.count,+,1; classtype:protocol-command-decode; sid:2260000; rev:1;)
+alert ip any any -> any any (msg:"SURICATA Applayer Wrong direction first Data"; flow:established; app-layer-event:applayer_wrong_direction_first_data; flowint:applayer.anomaly.count,+,1; classtype:protocol-command-decode; sid:2260001; rev:1;)
+alert ip any any -> any any (msg:"SURICATA Applayer Detect protocol only one direction"; flow:established; app-layer-event:applayer_detect_protocol_only_one_direction; flowint:applayer.anomaly.count,+,1; classtype:protocol-command-decode; sid:2260002; rev:1;)
+alert ip any any -> any any (msg:"SURICATA Applayer Protocol detection skipped"; flow:established; app-layer-event:applayer_proto_detection_skipped; flowint:applayer.anomaly.count,+,1; classtype:protocol-command-decode; sid:2260003; rev:1;)
+
+#next sid is 2260004
diff --git a/proto-mismatch-http-ssh/check.sh b/proto-mismatch-http-ssh/check.sh
new file mode 100755
index 000000000..252d1bf29
--- /dev/null
+++ b/proto-mismatch-http-ssh/check.sh
@@ -0,0 +1,25 @@
+#! /bin/sh
+
+failed=no
+
+# We should get a "SURICATA Applayer Mismatch protocol both
+# directions" alert.
+n=$(cat output/eve.json | jq -c 'select(.alert.signature_id == 2260000)' | wc -l)
+if [ "$n" != 1 ]; then
+    echo "expected 1 event with SID 2260000"
+    failed=yes
+fi
+
+# We should have a flow event with app_proto = http and app_proto_tc = ssh.
+n=$(cat output/eve.json | jq -c 'select(.event_type == "flow") | select(.app_proto == "http") | select(.app_proto_tc == "ssh")' | wc -l)
+if [ "$n" != 1 ]; then
+    echo "expected 1 event with app_proto http and app_proto_tc ssh"
+    failed=yes
+fi
+
+if [ "${failed}" = "yes" ]; then
+    exit 1
+fi
+
+exit 0
+
diff --git a/proto-mismatch-http-ssh/input.pcap b/proto-mismatch-http-ssh/input.pcap
new file mode 100644
index 000000000..d50be3325
Binary files /dev/null and b/proto-mismatch-http-ssh/input.pcap differ