From: Philippe Antoine <pantoine@oisf.net>
Date: Fri, 21 Jun 2024 06:53:30 +0000 (+0200)
Subject: ssh: adds test for frames
X-Git-Tag: suricata-7.0.7~34
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=refs%2Fpull%2F1998%2Fhead;p=thirdparty%2Fsuricata-verify.git

ssh: adds test for frames

Ticket: 5734
---

diff --git a/tests/ssh-frames/README.md b/tests/ssh-frames/README.md
new file mode 100644
index 000000000..1721f2bf8
--- /dev/null
+++ b/tests/ssh-frames/README.md
@@ -0,0 +1,8 @@
+# Description
+
+Test ssh frames.
+https://redmine.openinfosecfoundation.org/issues/5734
+
+# PCAP
+
+reused from another test
diff --git a/tests/ssh-frames/test.rules b/tests/ssh-frames/test.rules
new file mode 100644
index 000000000..e5c7f6e86
--- /dev/null
+++ b/tests/ssh-frames/test.rules
@@ -0,0 +1,3 @@
+alert ssh any any -> any 22 (msg:"pdu frame"; frame:ssh.record.pdu; content: "|06 1e 00 00 00 20|"; offset: 4; depth:6; sid:1;)
+alert ssh any any -> any 22 (msg:"hdr frame new keys"; frame:ssh.record.hdr; content: "|15|"; endswith; bsize: 6; sid:2;)
+alert ssh any any -> any 22 (msg:"data frame"; frame:ssh.record.data; content: "curve"; sid:3;)
diff --git a/tests/ssh-frames/test.yaml b/tests/ssh-frames/test.yaml
new file mode 100644
index 000000000..5d7f18165
--- /dev/null
+++ b/tests/ssh-frames/test.yaml
@@ -0,0 +1,25 @@
+requires:
+  min-version: 8
+
+pcap:  ../ssh-newkeys/input.pcap
+
+args:
+ - -k none
+
+checks:
+  - filter:
+      count: 1
+      match:
+         event_type: alert
+         alert.signature_id: 1
+         ssh.client.software_version: "libssh-0.7.2"
+  - filter:
+      count: 1
+      match:
+         event_type: alert
+         alert.signature_id: 2
+  - filter:
+      count: 1
+      match:
+         event_type: alert
+         alert.signature_id: 3