From: Jason Ish <jason.ish@oisf.net>
Date: Fri, 24 May 2024 22:02:43 +0000 (-0600)
Subject: test: lua scripts exceeding the instruction limit
X-Git-Tag: suricata-6.0.20~33
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=ece28c1bcedc1567920d9ac94da4c76d6f4517e0;p=thirdparty%2Fsuricata-verify.git

test: lua scripts exceeding the instruction limit
---

diff --git a/tests/lua/lua-instruction-limit/README.md b/tests/lua/lua-instruction-limit/README.md
new file mode 100644
index 000000000..b620d55bd
--- /dev/null
+++ b/tests/lua/lua-instruction-limit/README.md
@@ -0,0 +1 @@
+Test for Lua rules that exceed the instruction limit.
diff --git a/tests/lua/lua-instruction-limit/test.lua b/tests/lua/lua-instruction-limit/test.lua
new file mode 100644
index 000000000..a51640f15
--- /dev/null
+++ b/tests/lua/lua-instruction-limit/test.lua
@@ -0,0 +1,13 @@
+function init(args)
+   local requires = {}
+   return requires
+end
+
+function match(args)
+   local total = 0
+   for count = 1, 300000 do
+      total = total + 1
+   end
+
+   return 1
+end
diff --git a/tests/lua/lua-instruction-limit/test.rules b/tests/lua/lua-instruction-limit/test.rules
new file mode 100644
index 000000000..c13a82aa2
--- /dev/null
+++ b/tests/lua/lua-instruction-limit/test.rules
@@ -0,0 +1 @@
+alert http any any -> any any (msg:"TEST"; content:"uid=0"; lua:test.lua; sid:1; rev:1;)
diff --git a/tests/lua/lua-instruction-limit/test.yaml b/tests/lua/lua-instruction-limit/test.yaml
new file mode 100644
index 000000000..744e0dfd4
--- /dev/null
+++ b/tests/lua/lua-instruction-limit/test.yaml
@@ -0,0 +1,26 @@
+requires:
+  min-version: 8
+
+args:
+  - --set default-rule-path=${TEST_DIR}
+  - --set security.lua.allow-rules=true
+  - --set logging.outputs.1.file.type=json
+
+pcap: ../lua-blocked-function-1/testmyids.pcap
+
+checks:
+  - filter:
+      filename: suricata.log
+      count: 1
+      match:
+        engine.message.__startswith: "Lua script failed to run successfully: instruction limit exceeded"
+  - filter:
+      count: 1
+      match:
+        event_type: stats
+        stats.detect.lua.errors: 1
+        stats.detect.lua.instruction_limit_errors: 1
+  - filter:
+      count: 0
+      match:
+        event_type: alert