From: Jason Ish Date: Tue, 6 Jun 2023 22:17:24 +0000 (-0600) Subject: tests/datasets: test for dataset write disabled X-Git-Tag: suricata-6.0.13~12 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=bb05244c7226b35047d91ce2596d3bc2e13437e8;p=thirdparty%2Fsuricata-verify.git tests/datasets: test for dataset write disabled Test the configuration flag to disable dataset writes from rules. Ticket: #6123 --- diff --git a/tests/datasets/datasets-deny-save/README.md b/tests/datasets/datasets-deny-save/README.md new file mode 100644 index 000000000..154f6e3c4 --- /dev/null +++ b/tests/datasets/datasets-deny-save/README.md @@ -0,0 +1,2 @@ +Test that a dataset rule trying to use an absolute path results in an +initialization error. diff --git a/tests/datasets/datasets-deny-save/one-packet.pcap b/tests/datasets/datasets-deny-save/one-packet.pcap new file mode 100644 index 000000000..00c2b34d0 Binary files /dev/null and b/tests/datasets/datasets-deny-save/one-packet.pcap differ diff --git a/tests/datasets/datasets-deny-save/suricata.yaml b/tests/datasets/datasets-deny-save/suricata.yaml new file mode 100644 index 000000000..e3360a128 --- /dev/null +++ b/tests/datasets/datasets-deny-save/suricata.yaml @@ -0,0 +1,13 @@ +%YAML 1.1 +--- + +logging: + outputs: + - file: + enabled: yes + filename: eve.json + type: json + +datasets: + rules: + allow-write: false diff --git a/tests/datasets/datasets-deny-save/test.rules b/tests/datasets/datasets-deny-save/test.rules new file mode 100644 index 000000000..14d1a3bf0 --- /dev/null +++ b/tests/datasets/datasets-deny-save/test.rules @@ -0,0 +1 @@ +alert dns any any -> any any (dns.query; dataset: isnotset, dns-seen, type string, state dns-seen.txt; sid:1; rev:1;) diff --git a/tests/datasets/datasets-deny-save/test.yaml b/tests/datasets/datasets-deny-save/test.yaml new file mode 100644 index 000000000..0bb9b1c1f --- /dev/null +++ b/tests/datasets/datasets-deny-save/test.yaml @@ -0,0 +1,7 @@ +exit-code: 1 + +checks: + - filter: + count: 1 + match: + engine.message: "Rules containing save/state datasets have been disabled"