From: Jeff Lucovsky Date: Fri, 8 Sep 2023 14:25:15 +0000 (-0400) Subject: detect/bytejump: Handle post_offset changes X-Git-Tag: suricata-6.0.15~5 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a57fb5f46db4940c683bed3aad58f1c473279d5d;p=thirdparty%2Fsuricata-verify.git detect/bytejump: Handle post_offset changes Issue: 4624 Update test case and add one to reflect post_offset handling differences. post_offset values that move before the buffer are treated as though they move to the buffer start. --- diff --git a/tests/detect-bytejump-05/README.md b/tests/detect-bytejump-05/README.md new file mode 100644 index 000000000..76f3c8044 --- /dev/null +++ b/tests/detect-bytejump-05/README.md @@ -0,0 +1 @@ +Tests using rules and pcap file from https://redmine.openinfosecfoundation.org/issues/4624 diff --git a/tests/detect-bytejump-05/input.pcap b/tests/detect-bytejump-05/input.pcap new file mode 100644 index 000000000..c4b257728 Binary files /dev/null and b/tests/detect-bytejump-05/input.pcap differ diff --git a/tests/detect-bytejump-05/test.rules b/tests/detect-bytejump-05/test.rules new file mode 100644 index 000000000..e84a0de4b --- /dev/null +++ b/tests/detect-bytejump-05/test.rules @@ -0,0 +1,3 @@ +drop tcp any any -> any any ( msg:"neg post_offset: buffer start"; rev:1; content:"|0A 95 00 20|"; byte_jump:0,0,relative,post_offset -8; pcre:"/\x4e\x53\x4c\x4f/R"; sid:1; ) +drop tcp any any -> any any ( msg:"neg post_offset: before buffer start #1"; rev:1; content:"|0A 95 00 20|"; byte_jump:0,0,relative,post_offset -10; pcre:"/\x4e\x53\x4c\x4f/R"; sid:2; ) +drop tcp any any -> any any ( msg:"neg post_offset: before buffer start #2"; rev:1; content:"|0A 95 00 20|"; byte_jump:0,0,relative,post_offset -10; sid:3; ) diff --git a/tests/detect-bytejump-05/test.yaml b/tests/detect-bytejump-05/test.yaml new file mode 100644 index 000000000..4678506c3 --- /dev/null +++ b/tests/detect-bytejump-05/test.yaml @@ -0,0 +1,23 @@ +requires: + gt-version: 7.0.0 + +args: + - -k none + +checks: + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 1 + + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 2 + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 3