From: jason taylor <jtfas90@gmail.com>
Date: Thu, 12 Oct 2023 13:31:12 +0000 (+0000)
Subject: tests: add tests for tls.cert_chain_len
X-Git-Tag: suricata-6.0.16~44
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=8580a056acfb8db458515c2a36c5d95efce1ad77;p=thirdparty%2Fsuricata-verify.git

tests: add tests for tls.cert_chain_len

Ticket: #6386

Signed-off-by: jason taylor <jtfas90@gmail.com>
---

diff --git a/tests/tls/tls-cert-chain-len/README.md b/tests/tls/tls-cert-chain-len/README.md
new file mode 100644
index 000000000..d79f24a3c
--- /dev/null
+++ b/tests/tls/tls-cert-chain-len/README.md
@@ -0,0 +1,14 @@
+Test
+====
+
+Test alerts with the tls.cert_chain_len keyword
+
+PCAP
+----
+
+We are reusing/referencing the pcap file from other tls tests
+
+Related Issues
+--------------
+
+https://redmine.openinfosecfoundation.org/issues/6386
diff --git a/tests/tls/tls-cert-chain-len/suricata.yaml b/tests/tls/tls-cert-chain-len/suricata.yaml
new file mode 100644
index 000000000..0211a9fc1
--- /dev/null
+++ b/tests/tls/tls-cert-chain-len/suricata.yaml
@@ -0,0 +1,16 @@
+%YAML 1.1
+---
+
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
+      filename: eve.json
+      types:
+        - alert:
+            payload: no
+            payload-buffer-size: 4kb
+            payload-printable: no
+            packet: no
+            metadata: no
+        - tls
diff --git a/tests/tls/tls-cert-chain-len/test.rules b/tests/tls/tls-cert-chain-len/test.rules
new file mode 100644
index 000000000..8956d25e4
--- /dev/null
+++ b/tests/tls/tls-cert-chain-len/test.rules
@@ -0,0 +1,9 @@
+alert tls any any -> any any (msg:"cert chain exact value"; tls.cert_chain_len:3; classtype:misc-activity; sid:1; rev:1;)
+
+alert tls any any -> any any (msg:"cert chain less than value"; tls.cert_chain_len:<4; classtype:misc-activity; sid:2; rev:1;)
+
+alert tls any any -> any any (msg:"cert chain greater than value"; tls.cert_chain_len:>0; classtype:misc-activity; sid:3; rev:1;)
+
+alert tls any any -> any any (msg:"cert chain greater than less than value"; tls.cert_chain_len:0<>4; classtype:misc-activity; sid:4; rev:1;)
+
+alert tls any any -> any any (msg:"cert chain not value"; tls.cert_chain_len:!2; classtype:misc-activity; sid:5; rev:1;)
diff --git a/tests/tls/tls-cert-chain-len/test.yaml b/tests/tls/tls-cert-chain-len/test.yaml
new file mode 100644
index 000000000..393f82472
--- /dev/null
+++ b/tests/tls/tls-cert-chain-len/test.yaml
@@ -0,0 +1,42 @@
+requires:
+  min-version: 7.0.0
+  features:
+    - HAVE_LIBJANSSON
+
+args:
+ - -k none
+
+pcap: ../tls-certs-alert/input.pcap
+
+checks:
+  # Check that we can alert on all three certs in the certificate chain
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        app_proto: tls
+        alert.signature_id: 1
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        app_proto: tls
+        alert.signature_id: 2
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        app_proto: tls
+        alert.signature_id: 3
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        app_proto: tls
+        alert.signature_id: 4
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        app_proto: tls
+        alert.signature_id: 5