From: Jason Ish Date: Sat, 20 Jun 2026 01:21:27 +0000 (-0600) Subject: tests: add firewall ftp tests for nlst on the data channel X-Git-Tag: suricata-8.0.6~22 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=e04bb14faecb684b58f66e58fc8cc5558fa2fb9d;p=thirdparty%2Fsuricata-verify.git tests: add firewall ftp tests for nlst on the data channel --- diff --git a/tests/firewall/ruletype-firewall-111.2-ftp-download-active/README.md b/tests/firewall/ruletype-firewall-111.2-ftp-download-active/README.md new file mode 100644 index 000000000..f31fde720 --- /dev/null +++ b/tests/firewall/ruletype-firewall-111.2-ftp-download-active/README.md @@ -0,0 +1 @@ +FTP active download tests for firewall. diff --git a/tests/firewall/ruletype-firewall-111.2-ftp-download-active/firewall.rules b/tests/firewall/ruletype-firewall-111.2-ftp-download-active/firewall.rules new file mode 100644 index 000000000..661b7a9bc --- /dev/null +++ b/tests/firewall/ruletype-firewall-111.2-ftp-download-active/firewall.rules @@ -0,0 +1,14 @@ +# Allow all TCP handshakes. +accept:hook tcp:all any any -> any any (flow:not_established; sid:1000;) +accept:hook tcp:all any any <> any any (flow:established; sid:1001;) + +accept:hook ftp:request_started any any -> any any (sid:2000;) +accept:hook ftp:request_complete any any -> any any (sid:2010;) + +accept:hook ftp:response_started any any -> any any (sid:3000;) +accept:hook ftp:response_complete any any -> any any (sid:3010;) + +accept:flow,alert ftp-data:request_started any any -> any any (sid:4000; \ + ftpdata_command: retr;) +accept:flow,alert ftp-data:request_started any any -> any any (sid:4002; \ + ftpdata_command: nlst;) diff --git a/tests/firewall/ruletype-firewall-111.2-ftp-download-active/suricata.yaml b/tests/firewall/ruletype-firewall-111.2-ftp-download-active/suricata.yaml new file mode 100644 index 000000000..7cb351967 --- /dev/null +++ b/tests/firewall/ruletype-firewall-111.2-ftp-download-active/suricata.yaml @@ -0,0 +1,20 @@ +%YAML 1.1 +--- + +stats: + enabled: yes + interval: 8 + +outputs: + - eve-log: + enabled: yes + filetype: regular + filename: eve.json + types: + - flow + - alert + - ftp + - files + - drop: + alerts: yes + flows: all diff --git a/tests/firewall/ruletype-firewall-111.2-ftp-download-active/test.yaml b/tests/firewall/ruletype-firewall-111.2-ftp-download-active/test.yaml new file mode 100644 index 000000000..cf12be43e --- /dev/null +++ b/tests/firewall/ruletype-firewall-111.2-ftp-download-active/test.yaml @@ -0,0 +1,39 @@ +requires: + min-version: 9 + +pcap: ../../ftp/ftp-download-active/input.pcap + +args: + - --simulate-ips + - --runmode=single + - -k none + +checks: + + - filter: + count: 1 + match: + event_type: fileinfo + + - filter: + count: 3 + match: + event_type: ftp_data + + # We expect no drops. + - filter: + count: 0 + match: + event_type: drop + + # There are 2 NLST data channels. + - filter: + count: 2 + match: + alert.signature_id: 4002 + + # We don't expect any drops. + - filter: + count: 0 + match: + event_type: drop diff --git a/tests/firewall/ruletype-firewall-112.2-ftp-download-passive/README.md b/tests/firewall/ruletype-firewall-112.2-ftp-download-passive/README.md new file mode 100644 index 000000000..034b783a8 --- /dev/null +++ b/tests/firewall/ruletype-firewall-112.2-ftp-download-passive/README.md @@ -0,0 +1 @@ +FTP passive download tests for firewall. diff --git a/tests/firewall/ruletype-firewall-112.2-ftp-download-passive/firewall.rules b/tests/firewall/ruletype-firewall-112.2-ftp-download-passive/firewall.rules new file mode 100644 index 000000000..9ba146d6b --- /dev/null +++ b/tests/firewall/ruletype-firewall-112.2-ftp-download-passive/firewall.rules @@ -0,0 +1,18 @@ +# Allow all TCP handshakes. +accept:hook tcp:all any any -> any any (flow:not_established; sid:1000;) +accept:hook tcp:all any any <> any any (flow:established; sid:1001;) + +accept:hook ftp:request_started any any -> any any (sid:2000;) +accept:hook ftp:request_complete any any -> any any (sid:2010;) + +accept:hook ftp:response_started any any -> any any (sid:3000;) +accept:hook ftp:response_complete any any -> any any (sid:3010;) + +# For passive FTP, the request is never started. +accept:hook,alert ftp-data:request_started any any -> any any (sid:4000;) +accept:hook,alert ftp-data:request_complete any any -> any any (sid:4010;) + +accept:flow,alert ftp-data:response_started any any -> any any (sid:5000; \ + ftpdata_command: retr;) +accept:flow,alert ftp-data:response_started any any -> any any (sid:5001; \ + ftpdata_command: nlst;) diff --git a/tests/firewall/ruletype-firewall-112.2-ftp-download-passive/suricata.yaml b/tests/firewall/ruletype-firewall-112.2-ftp-download-passive/suricata.yaml new file mode 100644 index 000000000..46df91474 --- /dev/null +++ b/tests/firewall/ruletype-firewall-112.2-ftp-download-passive/suricata.yaml @@ -0,0 +1,21 @@ +%YAML 1.1 +--- + +stats: + enabled: yes + interval: 8 + +outputs: + - eve-log: + enabled: yes + filetype: regular + filename: eve.json + types: + - stats + - flow + - alert + - ftp + - files + - drop: + alerts: yes + flows: all diff --git a/tests/firewall/ruletype-firewall-112.2-ftp-download-passive/test.yaml b/tests/firewall/ruletype-firewall-112.2-ftp-download-passive/test.yaml new file mode 100644 index 000000000..a26aee380 --- /dev/null +++ b/tests/firewall/ruletype-firewall-112.2-ftp-download-passive/test.yaml @@ -0,0 +1,47 @@ +requires: + min-version: 9 + +pcap: ../../ftp/ftp-download-passive/input.pcap + +args: + - --simulate-ips + - --runmode=single + - -k none + +checks: + + # ftp-data:request_started never reach in passive mode + - filter: + count: 0 + match: + alert.signature_id: 4000 + + # ftp-data:request_complete never reach in passive mode + - filter: + count: 0 + match: + alert.signature_id: 4010 + + - filter: + count: 1 + match: + event_type: ftp_data + ftp_data.command: RETR + + - filter: + count: 2 + match: + event_type: ftp_data + ftp_data.command: NLST + + # ftpdata_command: retr matches in ftp-data:response_started + - filter: + count: 1 + match: + alert.signature_id: 5000 + + # Should see no drops. + - filter: + count: 0 + match: + event_type: drop diff --git a/tests/firewall/ruletype-firewall-113.2-ftp-upload-active/README.md b/tests/firewall/ruletype-firewall-113.2-ftp-upload-active/README.md new file mode 100644 index 000000000..2376b8920 --- /dev/null +++ b/tests/firewall/ruletype-firewall-113.2-ftp-upload-active/README.md @@ -0,0 +1 @@ +FTP active upload tests for firewall. diff --git a/tests/firewall/ruletype-firewall-113.2-ftp-upload-active/firewall.rules b/tests/firewall/ruletype-firewall-113.2-ftp-upload-active/firewall.rules new file mode 100644 index 000000000..1dc0fefb0 --- /dev/null +++ b/tests/firewall/ruletype-firewall-113.2-ftp-upload-active/firewall.rules @@ -0,0 +1,16 @@ +# Allow all TCP handshakes. +accept:hook tcp:all any any -> any any (flow:not_established; sid:1000;) +accept:hook tcp:all any any <> any any (flow:established; sid:1001;) + +accept:hook ftp:request_started any any -> any any (sid:2000;) +accept:hook ftp:request_complete any any -> any any (sid:2010;) + +accept:hook ftp:response_started any any -> any any (sid:3000;) +accept:hook ftp:response_complete any any -> any any (sid:3010;) + +# Only allow NLST as a data request. +accept:flow,alert ftp-data:request_started any any -> any any (sid:4002; \ + ftpdata_command: nlst;) + +accept:flow,alert ftp-data:response_started any any -> any any (sid:5000; \ + ftpdata_command: stor;) diff --git a/tests/firewall/ruletype-firewall-113.2-ftp-upload-active/suricata.yaml b/tests/firewall/ruletype-firewall-113.2-ftp-upload-active/suricata.yaml new file mode 100644 index 000000000..7cb351967 --- /dev/null +++ b/tests/firewall/ruletype-firewall-113.2-ftp-upload-active/suricata.yaml @@ -0,0 +1,20 @@ +%YAML 1.1 +--- + +stats: + enabled: yes + interval: 8 + +outputs: + - eve-log: + enabled: yes + filetype: regular + filename: eve.json + types: + - flow + - alert + - ftp + - files + - drop: + alerts: yes + flows: all diff --git a/tests/firewall/ruletype-firewall-113.2-ftp-upload-active/test.yaml b/tests/firewall/ruletype-firewall-113.2-ftp-upload-active/test.yaml new file mode 100644 index 000000000..18e568b05 --- /dev/null +++ b/tests/firewall/ruletype-firewall-113.2-ftp-upload-active/test.yaml @@ -0,0 +1,45 @@ +requires: + min-version: 9 + +pcap: ../../ftp/ftp-upload-active/input.pcap + +args: + - --simulate-ips + - --runmode=single + +checks: + + - filter: + count: 1 + match: + event_type: ftp_data + ftp_data.command: STOR + + # This pcap has 2 NLST commands. + - filter: + count: 2 + match: + event_type: ftp_data + ftp_data.command: NLST + + # ftpdata_command: stor matches in ftp-data:response_started + - filter: + count: 1 + match: + alert.signature_id: 5000 + + - filter: + count: 1 + match: + event_type: fileinfo + + - filter: + count: 2 + match: + alert.signature_id: 4002 + + # There should be no drops. + - filter: + count: 0 + match: + event_type: drop diff --git a/tests/firewall/ruletype-firewall-114.2-ftp-upload-passive/README.md b/tests/firewall/ruletype-firewall-114.2-ftp-upload-passive/README.md new file mode 100644 index 000000000..4eb76758c --- /dev/null +++ b/tests/firewall/ruletype-firewall-114.2-ftp-upload-passive/README.md @@ -0,0 +1 @@ +FTP passive upload tests for firewall. diff --git a/tests/firewall/ruletype-firewall-114.2-ftp-upload-passive/firewall.rules b/tests/firewall/ruletype-firewall-114.2-ftp-upload-passive/firewall.rules new file mode 100644 index 000000000..b2d804bd2 --- /dev/null +++ b/tests/firewall/ruletype-firewall-114.2-ftp-upload-passive/firewall.rules @@ -0,0 +1,17 @@ +# Allow all TCP handshakes. +accept:hook tcp:all any any -> any any (flow:not_established; sid:1000;) +accept:hook tcp:all any any <> any any (flow:established; sid:1001;) + +accept:hook ftp:request_started any any -> any any (sid:2000;) +accept:hook ftp:request_complete any any -> any any (sid:2010;) + +accept:hook ftp:response_started any any -> any any (sid:3000;) +accept:hook ftp:response_complete any any -> any any (sid:3010;) + +# Accept STOR on the request data channel. +accept:flow,alert ftp-data:request_started any any -> any any (sid:4000; \ + ftpdata_command: stor;) + +# Accept NLST on the response data channel. +accept:flow,alert ftp-data:response_started any any -> any any (sid: 4010; \ + ftpdata_command: nlst;) diff --git a/tests/firewall/ruletype-firewall-114.2-ftp-upload-passive/suricata.yaml b/tests/firewall/ruletype-firewall-114.2-ftp-upload-passive/suricata.yaml new file mode 100644 index 000000000..7cb351967 --- /dev/null +++ b/tests/firewall/ruletype-firewall-114.2-ftp-upload-passive/suricata.yaml @@ -0,0 +1,20 @@ +%YAML 1.1 +--- + +stats: + enabled: yes + interval: 8 + +outputs: + - eve-log: + enabled: yes + filetype: regular + filename: eve.json + types: + - flow + - alert + - ftp + - files + - drop: + alerts: yes + flows: all diff --git a/tests/firewall/ruletype-firewall-114.2-ftp-upload-passive/test.yaml b/tests/firewall/ruletype-firewall-114.2-ftp-upload-passive/test.yaml new file mode 100644 index 000000000..1c956ccba --- /dev/null +++ b/tests/firewall/ruletype-firewall-114.2-ftp-upload-passive/test.yaml @@ -0,0 +1,39 @@ +requires: + min-version: 9 + +pcap: ../../ftp/ftp-upload-passive/input.pcap + +args: + - --simulate-ips + - --runmode=single + +checks: + + - filter: + count: 1 + match: + event_type: ftp_data + ftp_data.command: STOR + + # ftpdata_command: stor matches in ftp-data:request_started + - filter: + count: 1 + match: + alert.signature_id: 4000 + + # ftpdata_command: nlst matches in ftp-data:response_started + - filter: + count: 2 + match: + alert.signature_id: 4010 + + - filter: + count: 1 + match: + event_type: fileinfo + + # There should be no drops. + - filter: + count: 0 + match: + event_type: drop