From: Philippe Antoine Date: Fri, 30 Jun 2023 13:48:55 +0000 (+0200) Subject: Adds test for enip X-Git-Tag: suricata-7.0.0~17 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=refs%2Fpull%2F1290%2Fhead;p=thirdparty%2Fsuricata-verify.git Adds test for enip Ticket: #3886 --- diff --git a/tests/enip-alert/README.md b/tests/enip-alert/README.md new file mode 100644 index 000000000..d8db0889f --- /dev/null +++ b/tests/enip-alert/README.md @@ -0,0 +1,7 @@ +# Description + +Test ENIP alerts numbers + +# PCAP + +The pcap comes from https://redmine.openinfosecfoundation.org/issues/3886 diff --git a/tests/enip-alert/enip_test1.pcap b/tests/enip-alert/enip_test1.pcap new file mode 100644 index 000000000..3fb12dbff Binary files /dev/null and b/tests/enip-alert/enip_test1.pcap differ diff --git a/tests/enip-alert/test.rules b/tests/enip-alert/test.rules new file mode 100644 index 000000000..35ad845c5 --- /dev/null +++ b/tests/enip-alert/test.rules @@ -0,0 +1 @@ +alert enip any any -> any any (msg:"SURICATA enip test ";enip_command:99 ;sid:6450008; rev:1;) diff --git a/tests/enip-alert/test.yaml b/tests/enip-alert/test.yaml new file mode 100644 index 000000000..cdf4f19d3 --- /dev/null +++ b/tests/enip-alert/test.yaml @@ -0,0 +1,13 @@ +requires: + min-version: 7 + +# disables checksum verification +args: +- -k none --set stream.midstream=true --set app-layer.protocols.enip.enabled=yes + +checks: + - filter: + count: 2 + match: + event_type: alert + alert.signature_id: 6450008