From: Victor Julien Date: Sat, 2 Mar 2024 07:40:42 +0000 (+0100) Subject: tests: add global by_flow thresholding tests X-Git-Tag: suricata-7.0.7~90 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=ce00974515190e5e082df1bcbccdc9b210f51467;p=thirdparty%2Fsuricata-verify.git tests: add global by_flow thresholding tests --- diff --git a/tests/threshold/threshold-config-rate-filter-alert-flow/README.md b/tests/threshold/threshold-config-rate-filter-alert-flow/README.md new file mode 100644 index 000000000..ff3dec0de --- /dev/null +++ b/tests/threshold/threshold-config-rate-filter-alert-flow/README.md @@ -0,0 +1,5 @@ +# Threshold.config with by_flow + +This test checks threshold.config file using by_flow tracking + +The pcap file is from http-all-headers test diff --git a/tests/threshold/threshold-config-rate-filter-alert-flow/input.rules b/tests/threshold/threshold-config-rate-filter-alert-flow/input.rules new file mode 100644 index 000000000..7cb862d41 --- /dev/null +++ b/tests/threshold/threshold-config-rate-filter-alert-flow/input.rules @@ -0,0 +1 @@ +drop tcp any any -> any any (dsize:0; sid: 1000001;) diff --git a/tests/threshold/threshold-config-rate-filter-alert-flow/suricata.yaml b/tests/threshold/threshold-config-rate-filter-alert-flow/suricata.yaml new file mode 100644 index 000000000..ee5c3f004 --- /dev/null +++ b/tests/threshold/threshold-config-rate-filter-alert-flow/suricata.yaml @@ -0,0 +1,15 @@ +%YAML 1.1 +--- + +outputs: + - eve-log: + enabled: yes + filetype: regular + filename: eve.json + types: + - alert + - drop: + flows: all + alerts: true + - http + - anomaly diff --git a/tests/threshold/threshold-config-rate-filter-alert-flow/test.yaml b/tests/threshold/threshold-config-rate-filter-alert-flow/test.yaml new file mode 100644 index 000000000..7f23097b0 --- /dev/null +++ b/tests/threshold/threshold-config-rate-filter-alert-flow/test.yaml @@ -0,0 +1,30 @@ +pcap: ../../http-all-headers/input.pcap + +requires: + min-version: 8 + +args: +- --set threshold-file=${TEST_DIR}/threshold.config +- --simulate-ips + +checks: + - filter: + count: 3 + match: + event_type: alert + alert.signature_id: 1000001 + alert.action: blocked + - filter: + count: 16 + match: + event_type: alert + alert.signature_id: 1000001 + alert.action: allowed + - filter: + count: 3 + match: + event_type: drop + - filter: + count: 1 + match: + event_type: http diff --git a/tests/threshold/threshold-config-rate-filter-alert-flow/threshold.config b/tests/threshold/threshold-config-rate-filter-alert-flow/threshold.config new file mode 100644 index 000000000..ae0ebefdb --- /dev/null +++ b/tests/threshold/threshold-config-rate-filter-alert-flow/threshold.config @@ -0,0 +1 @@ +rate_filter gen_id 1, sig_id 1000001, track by_flow, count 3, seconds 60, new_action alert, timeout 1000 diff --git a/tests/threshold/threshold-config-threshold-both-flow/README.md b/tests/threshold/threshold-config-threshold-both-flow/README.md new file mode 100644 index 000000000..432a2ebb7 --- /dev/null +++ b/tests/threshold/threshold-config-threshold-both-flow/README.md @@ -0,0 +1,5 @@ +# Threshold.config with by_flow + +This test checks threshold.config file using by_flow keyword + +The pcap file is from http-all-headers test diff --git a/tests/threshold/threshold-config-threshold-both-flow/input.rules b/tests/threshold/threshold-config-threshold-both-flow/input.rules new file mode 100644 index 000000000..9ace89c29 --- /dev/null +++ b/tests/threshold/threshold-config-threshold-both-flow/input.rules @@ -0,0 +1 @@ +alert tcp any any -> any any (dsize:0; sid: 1000001;) diff --git a/tests/threshold/threshold-config-threshold-both-flow/suricata.yaml b/tests/threshold/threshold-config-threshold-both-flow/suricata.yaml new file mode 100644 index 000000000..ee5c3f004 --- /dev/null +++ b/tests/threshold/threshold-config-threshold-both-flow/suricata.yaml @@ -0,0 +1,15 @@ +%YAML 1.1 +--- + +outputs: + - eve-log: + enabled: yes + filetype: regular + filename: eve.json + types: + - alert + - drop: + flows: all + alerts: true + - http + - anomaly diff --git a/tests/threshold/threshold-config-threshold-both-flow/test.yaml b/tests/threshold/threshold-config-threshold-both-flow/test.yaml new file mode 100644 index 000000000..a9413effc --- /dev/null +++ b/tests/threshold/threshold-config-threshold-both-flow/test.yaml @@ -0,0 +1,19 @@ +pcap: ../../http-all-headers/input.pcap + +requires: + min-version: 8 + +args: +- --set threshold-file=${TEST_DIR}/threshold.config +- --simulate-ips + +checks: + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 1000001 + - filter: + count: 1 + match: + event_type: http diff --git a/tests/threshold/threshold-config-threshold-both-flow/threshold.config b/tests/threshold/threshold-config-threshold-both-flow/threshold.config new file mode 100644 index 000000000..2c50d6479 --- /dev/null +++ b/tests/threshold/threshold-config-threshold-both-flow/threshold.config @@ -0,0 +1 @@ +threshold gen_id 1, sig_id 1000001, type both, track by_flow, count 5, seconds 60 diff --git a/tests/threshold/threshold-config-threshold-limit-flow/README.md b/tests/threshold/threshold-config-threshold-limit-flow/README.md new file mode 100644 index 000000000..432a2ebb7 --- /dev/null +++ b/tests/threshold/threshold-config-threshold-limit-flow/README.md @@ -0,0 +1,5 @@ +# Threshold.config with by_flow + +This test checks threshold.config file using by_flow keyword + +The pcap file is from http-all-headers test diff --git a/tests/threshold/threshold-config-threshold-limit-flow/input.rules b/tests/threshold/threshold-config-threshold-limit-flow/input.rules new file mode 100644 index 000000000..9ace89c29 --- /dev/null +++ b/tests/threshold/threshold-config-threshold-limit-flow/input.rules @@ -0,0 +1 @@ +alert tcp any any -> any any (dsize:0; sid: 1000001;) diff --git a/tests/threshold/threshold-config-threshold-limit-flow/suricata.yaml b/tests/threshold/threshold-config-threshold-limit-flow/suricata.yaml new file mode 100644 index 000000000..ee5c3f004 --- /dev/null +++ b/tests/threshold/threshold-config-threshold-limit-flow/suricata.yaml @@ -0,0 +1,15 @@ +%YAML 1.1 +--- + +outputs: + - eve-log: + enabled: yes + filetype: regular + filename: eve.json + types: + - alert + - drop: + flows: all + alerts: true + - http + - anomaly diff --git a/tests/threshold/threshold-config-threshold-limit-flow/test.yaml b/tests/threshold/threshold-config-threshold-limit-flow/test.yaml new file mode 100644 index 000000000..a9413effc --- /dev/null +++ b/tests/threshold/threshold-config-threshold-limit-flow/test.yaml @@ -0,0 +1,19 @@ +pcap: ../../http-all-headers/input.pcap + +requires: + min-version: 8 + +args: +- --set threshold-file=${TEST_DIR}/threshold.config +- --simulate-ips + +checks: + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 1000001 + - filter: + count: 1 + match: + event_type: http diff --git a/tests/threshold/threshold-config-threshold-limit-flow/threshold.config b/tests/threshold/threshold-config-threshold-limit-flow/threshold.config new file mode 100644 index 000000000..8ef60ce92 --- /dev/null +++ b/tests/threshold/threshold-config-threshold-limit-flow/threshold.config @@ -0,0 +1 @@ +threshold gen_id 1, sig_id 1000001, type limit, track by_flow, count 1, seconds 60 diff --git a/tests/threshold/threshold-config-threshold-threshold-flow/README.md b/tests/threshold/threshold-config-threshold-threshold-flow/README.md new file mode 100644 index 000000000..432a2ebb7 --- /dev/null +++ b/tests/threshold/threshold-config-threshold-threshold-flow/README.md @@ -0,0 +1,5 @@ +# Threshold.config with by_flow + +This test checks threshold.config file using by_flow keyword + +The pcap file is from http-all-headers test diff --git a/tests/threshold/threshold-config-threshold-threshold-flow/input.rules b/tests/threshold/threshold-config-threshold-threshold-flow/input.rules new file mode 100644 index 000000000..9ace89c29 --- /dev/null +++ b/tests/threshold/threshold-config-threshold-threshold-flow/input.rules @@ -0,0 +1 @@ +alert tcp any any -> any any (dsize:0; sid: 1000001;) diff --git a/tests/threshold/threshold-config-threshold-threshold-flow/suricata.yaml b/tests/threshold/threshold-config-threshold-threshold-flow/suricata.yaml new file mode 100644 index 000000000..ee5c3f004 --- /dev/null +++ b/tests/threshold/threshold-config-threshold-threshold-flow/suricata.yaml @@ -0,0 +1,15 @@ +%YAML 1.1 +--- + +outputs: + - eve-log: + enabled: yes + filetype: regular + filename: eve.json + types: + - alert + - drop: + flows: all + alerts: true + - http + - anomaly diff --git a/tests/threshold/threshold-config-threshold-threshold-flow/test.yaml b/tests/threshold/threshold-config-threshold-threshold-flow/test.yaml new file mode 100644 index 000000000..4e7b4d840 --- /dev/null +++ b/tests/threshold/threshold-config-threshold-threshold-flow/test.yaml @@ -0,0 +1,19 @@ +pcap: ../../http-all-headers/input.pcap + +requires: + min-version: 8 + +args: +- --set threshold-file=${TEST_DIR}/threshold.config +- --simulate-ips + +checks: + - filter: + count: 3 + match: + event_type: alert + alert.signature_id: 1000001 + - filter: + count: 1 + match: + event_type: http diff --git a/tests/threshold/threshold-config-threshold-threshold-flow/threshold.config b/tests/threshold/threshold-config-threshold-threshold-flow/threshold.config new file mode 100644 index 000000000..0b08a5724 --- /dev/null +++ b/tests/threshold/threshold-config-threshold-threshold-flow/threshold.config @@ -0,0 +1 @@ +threshold gen_id 1, sig_id 1000001, type threshold, track by_flow, count 5, seconds 60