From: Philippe Antoine Date: Mon, 19 Jul 2021 13:47:40 +0000 (+0200) Subject: Adds test about icmpv6 type and code detection X-Git-Tag: suricata-6.0.4~36 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=dc3842d7cbcf5153d7b274e6f05d3d16bb48d466;p=thirdparty%2Fsuricata-verify.git Adds test about icmpv6 type and code detection --- diff --git a/tests/ipv6-evasion/ipv6-dos-with-ext-headers-5/README.md b/tests/ipv6-evasion/ipv6-dos-with-ext-headers-5/README.md new file mode 100644 index 000000000..d250cc357 --- /dev/null +++ b/tests/ipv6-evasion/ipv6-dos-with-ext-headers-5/README.md @@ -0,0 +1,11 @@ +# Description + +Test detection of DoS attack that tries to increase decoding effort. + +# PCAP + +Pcap from https://redmine.cs.uni-potsdam.de/projects/pcap/files + +# Notes + +It might be better to have a dedicated rule that focuses on the DoS aspect. diff --git a/tests/ipv6-evasion/ipv6-dos-with-ext-headers-5/denial6-5.pcap b/tests/ipv6-evasion/ipv6-dos-with-ext-headers-5/denial6-5.pcap new file mode 100644 index 000000000..fefecdb6e Binary files /dev/null and b/tests/ipv6-evasion/ipv6-dos-with-ext-headers-5/denial6-5.pcap differ diff --git a/tests/ipv6-evasion/ipv6-dos-with-ext-headers-5/test.rules b/tests/ipv6-evasion/ipv6-dos-with-ext-headers-5/test.rules new file mode 100644 index 000000000..2fe47894b --- /dev/null +++ b/tests/ipv6-evasion/ipv6-dos-with-ext-headers-5/test.rules @@ -0,0 +1,2 @@ +alert icmpv6 any any -> any any (itype:4; icode:1; sid:1;) + diff --git a/tests/ipv6-evasion/ipv6-dos-with-ext-headers-5/test.yaml b/tests/ipv6-evasion/ipv6-dos-with-ext-headers-5/test.yaml new file mode 100644 index 000000000..25965709f --- /dev/null +++ b/tests/ipv6-evasion/ipv6-dos-with-ext-headers-5/test.yaml @@ -0,0 +1,11 @@ + +requires: + features: + - HAVE_LIBJANSSON + +checks: + - filter: + count: 15 + match: + event_type: alert + alert.signature_id: 1