From: Jeff Lucovsky Date: Thu, 30 Mar 2023 13:41:44 +0000 (-0400) Subject: test/byte-math: Add 0 divisor test. X-Git-Tag: suricata-7.0.0~7 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=refs%2Fpull%2F1309%2Fhead;p=thirdparty%2Fsuricata-verify.git test/byte-math: Add 0 divisor test. Issue: 5945 This commit adds a byte-math test with a zero divisor. Division by 0 is undefined so there's no match. --- diff --git a/tests/detect-bytemath-div-01/README.md b/tests/detect-bytemath-div-01/README.md new file mode 100644 index 000000000..8b06cb44e --- /dev/null +++ b/tests/detect-bytemath-div-01/README.md @@ -0,0 +1,11 @@ +Description +=========== +Test byte_math payload keyword with a 0 division. + +PCAP +==== +PCAP comes from the suricata verify test[detect-bytemath-01] + +Redmine ticket +============== +https://redmine.openinfosecfoundation.org/issues/5945 diff --git a/tests/detect-bytemath-div-01/input.pcap b/tests/detect-bytemath-div-01/input.pcap new file mode 100644 index 000000000..4a18a072c Binary files /dev/null and b/tests/detect-bytemath-div-01/input.pcap differ diff --git a/tests/detect-bytemath-div-01/test.rules b/tests/detect-bytemath-div-01/test.rules new file mode 100644 index 000000000..0d74b524b --- /dev/null +++ b/tests/detect-bytemath-div-01/test.rules @@ -0,0 +1,3 @@ +alert tcp any any -> any any (ipv4.hdr; byte_extract: 1, 2, extracted_val, relative;byte_math: bytes 1, offset 0, oper /, rvalue extracted_val, result var;msg:\ +"Byte extract and byte math with 0 devide\ +";sid:1;) diff --git a/tests/detect-bytemath-div-01/test.yaml b/tests/detect-bytemath-div-01/test.yaml new file mode 100644 index 000000000..230df0c71 --- /dev/null +++ b/tests/detect-bytemath-div-01/test.yaml @@ -0,0 +1,10 @@ +requires: + files: + - src/detect-bytemath.c + +checks: + - filter: + count: 0 + match: + event_type: alert + alert.signature_id: 1