From: Philippe Antoine Date: Wed, 21 Jul 2021 12:01:31 +0000 (+0200) Subject: Adds test with http over IPv6 X-Git-Tag: suricata-6.0.4~1 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=cc2ccd12bc7bc8d61d88ede6e778b99cd9e93169;p=thirdparty%2Fsuricata-verify.git Adds test with http over IPv6 and absence of anomalies --- diff --git a/tests/http-ipv6/README.md b/tests/http-ipv6/README.md new file mode 100644 index 000000000..d27f59ea8 --- /dev/null +++ b/tests/http-ipv6/README.md @@ -0,0 +1,9 @@ +# Description + +Test http over IPv6 + +# PCAP + +The pcap comes from running +`python -m SimpleHTTPServer 8000` or `python3 -m http.server` as a server and the following command +`curl "[::1]:8000/"` as a client diff --git a/tests/http-ipv6/input.pcap b/tests/http-ipv6/input.pcap new file mode 100644 index 000000000..dc12da2bd Binary files /dev/null and b/tests/http-ipv6/input.pcap differ diff --git a/tests/http-ipv6/test.rules b/tests/http-ipv6/test.rules new file mode 100644 index 000000000..f7a6f2384 --- /dev/null +++ b/tests/http-ipv6/test.rules @@ -0,0 +1,2 @@ +alert http any any -> any any (msg:"SURICATA HTTP Host header invalid"; flow:established,to_server; app-layer-event:http.request_header_host_invalid; flowint:http.anomaly.count,+,1; classtype:protocol-command-decode; sid:2221028; rev:1;) + diff --git a/tests/http-ipv6/test.yaml b/tests/http-ipv6/test.yaml new file mode 100644 index 000000000..6e9317596 --- /dev/null +++ b/tests/http-ipv6/test.yaml @@ -0,0 +1,18 @@ +requires: + features: + - HAVE_LIBJANSSON + +# disables checksum verification +args: + - -k none + +checks: + - filter: + count: 0 + match: + event_type: anomaly + # no false positive + - filter: + count: 0 + match: + event_type: alert