From: Victor Julien Date: Tue, 21 Dec 2021 09:07:01 +0000 (+0100) Subject: tests: add tests for negated protocol matching X-Git-Tag: suricata-6.0.20~51 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a10cff7cc23bdbb94fbee1d7a3bba9f9e1d06793;p=thirdparty%2Fsuricata-verify.git tests: add tests for negated protocol matching Ticket: #4921 --- diff --git a/tests/detect-app-layer-protocol-03/README.md b/tests/detect-app-layer-protocol-03/README.md new file mode 100644 index 000000000..90374c8c0 --- /dev/null +++ b/tests/detect-app-layer-protocol-03/README.md @@ -0,0 +1,5 @@ +Test `app-layer-protocol:!http` when toserver detection failed. + +PCAP extracted from output-eve-ftp-data pcap. + +https://redmine.openinfosecfoundation.org/issues/4921 diff --git a/tests/detect-app-layer-protocol-03/input.pcap b/tests/detect-app-layer-protocol-03/input.pcap new file mode 100644 index 000000000..b839d2540 Binary files /dev/null and b/tests/detect-app-layer-protocol-03/input.pcap differ diff --git a/tests/detect-app-layer-protocol-03/test.rules b/tests/detect-app-layer-protocol-03/test.rules new file mode 100644 index 000000000..2533090d5 --- /dev/null +++ b/tests/detect-app-layer-protocol-03/test.rules @@ -0,0 +1,2 @@ +alert tcp any any -> any [80,443] (msg:"non-HTTP traffic over HTTP/S standard port"; flow:to_server; app-layer-protocol:!http,final; app-layer-protocol:!tls,final; sid:1; ) +alert tcp any [80,443] -> any any (msg:"non-HTTP traffic over HTTP/S standard port"; flow:to_client; app-layer-protocol:!http,final; app-layer-protocol:!tls,final; sid:2; ) diff --git a/tests/detect-app-layer-protocol-03/test.yaml b/tests/detect-app-layer-protocol-03/test.yaml new file mode 100644 index 000000000..1474c7305 --- /dev/null +++ b/tests/detect-app-layer-protocol-03/test.yaml @@ -0,0 +1,14 @@ +requires: + min-version: 8 + +checks: +- filter: + count: 0 + match: + event_type: alert + alert.signature_id: 1 +- filter: + count: 0 + match: + event_type: alert + alert.signature_id: 2