From: jason taylor <jtfas90@gmail.com>
Date: Wed, 15 May 2019 16:09:38 +0000 (-0400)
Subject: tests: add invalid dsize range and offset usage
X-Git-Tag: suricata-6.0.4~441
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=edee5f8c856b61492d327711c01e22f8e5965bb0;p=thirdparty%2Fsuricata-verify.git

tests: add invalid dsize range and offset usage

Signed-off-by: jason taylor <jtfas90@gmail.com>
---

diff --git a/tests/test-bad-dsize-range-offset-rule-1/suricata.yaml b/tests/test-bad-dsize-range-offset-rule-1/suricata.yaml
new file mode 100644
index 000000000..dcaae57fe
--- /dev/null
+++ b/tests/test-bad-dsize-range-offset-rule-1/suricata.yaml
@@ -0,0 +1,10 @@
+%YAML 1.1
+---
+
+logging:
+  default-log-level: info
+  outputs:
+  - file:
+      enabled: yes
+      filename: eve.json
+      type: json
diff --git a/tests/test-bad-dsize-range-offset-rule-1/test.rules b/tests/test-bad-dsize-range-offset-rule-1/test.rules
new file mode 100644
index 000000000..6a2b3d111
--- /dev/null
+++ b/tests/test-bad-dsize-range-offset-rule-1/test.rules
@@ -0,0 +1 @@
+alert udp any any -> any any (msg:"TEST SUCCESFULL - dsize/offset INVALID combination "; dsize:5<>10; content:"AAAA"; offset:8; sid:6666665; rev:1;)
diff --git a/tests/test-bad-dsize-range-offset-rule-1/test.yaml b/tests/test-bad-dsize-range-offset-rule-1/test.yaml
new file mode 100644
index 000000000..ddb3e159c
--- /dev/null
+++ b/tests/test-bad-dsize-range-offset-rule-1/test.yaml
@@ -0,0 +1,21 @@
+requires:
+  features:
+    - HAVE_LIBJANSSON
+
+command: |
+  ${SRCDIR}/src/suricata --set classification-file="${SRCDIR}/classification.config" --set reference-config-file="${SRCDIR}/reference.config" -l ${OUTPUT_DIR} -c ${TEST_DIR}/suricata.yaml -r ${TEST_DIR}/ -S ${TEST_DIR}/test.rules
+
+checks:
+  # check that we have the following entres in eve.json
+  # match 1 specific rule load failure reason
+  - filter:
+      count: 1
+      match:
+        event_type: engine
+        engine.message: "signature can't match as content length 4 with offset 8 (=12) is bigger than dsize 10"
+
+  - filter:
+      count: 1
+      match:
+        event_type: engine
+        engine.error: "SC_ERR_NO_RULES_LOADED"