From: Victor Julien <victor@inliniac.net>
Date: Mon, 1 Jul 2019 12:47:00 +0000 (+0200)
Subject: tests: add ipv4.hdr and ipv6.hdr tests
X-Git-Tag: suricata-6.0.4~417
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=refs%2Fpull%2F85%2Fhead;p=thirdparty%2Fsuricata-verify.git

tests: add ipv4.hdr and ipv6.hdr tests
---

diff --git a/tests/ipv4-hdr-keyword/input.pcap b/tests/ipv4-hdr-keyword/input.pcap
new file mode 100644
index 000000000..b42bb8b28
Binary files /dev/null and b/tests/ipv4-hdr-keyword/input.pcap differ
diff --git a/tests/ipv4-hdr-keyword/test.rules b/tests/ipv4-hdr-keyword/test.rules
new file mode 100644
index 000000000..10d00fc6c
--- /dev/null
+++ b/tests/ipv4-hdr-keyword/test.rules
@@ -0,0 +1 @@
+alert ip any any -> any any (ipv4.hdr; content:"|00 00|"; offset:4; depth:2; sid:1234;)
diff --git a/tests/ipv4-hdr-keyword/test.yaml b/tests/ipv4-hdr-keyword/test.yaml
new file mode 100644
index 000000000..b658eca6f
--- /dev/null
+++ b/tests/ipv4-hdr-keyword/test.yaml
@@ -0,0 +1,12 @@
+requires:
+  min-version: 5.0.0
+  features:
+    - HAVE_LIBJANSSON
+
+checks:
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 1234 
+
diff --git a/tests/ipv4-hdr-keyword/writepcap.py b/tests/ipv4-hdr-keyword/writepcap.py
new file mode 100755
index 000000000..96b3fc698
--- /dev/null
+++ b/tests/ipv4-hdr-keyword/writepcap.py
@@ -0,0 +1,10 @@
+#!/usr/bin/env python
+from scapy.all import *
+
+pkts = []
+
+pkts += Ether(dst='ff:ff:ff:ff:ff:ff', src='00:01:02:03:04:05')/ \
+    Dot1Q(vlan=6)/ \
+    IP(dst='255.255.255.255', src='192.168.0.1', id=0)/UDP(dport=80)
+
+wrpcap('input.pcap', pkts)
diff --git a/tests/ipv6-hdr-keyword-01/input.pcap b/tests/ipv6-hdr-keyword-01/input.pcap
new file mode 100644
index 000000000..f836869f7
Binary files /dev/null and b/tests/ipv6-hdr-keyword-01/input.pcap differ
diff --git a/tests/ipv6-hdr-keyword-01/test.rules b/tests/ipv6-hdr-keyword-01/test.rules
new file mode 100644
index 000000000..17d7bcccb
--- /dev/null
+++ b/tests/ipv6-hdr-keyword-01/test.rules
@@ -0,0 +1 @@
+alert ip any any -> any any (ipv6.hdr; content:"|40|"; offset:7; depth:1; sid:1234;)
diff --git a/tests/ipv6-hdr-keyword-01/test.yaml b/tests/ipv6-hdr-keyword-01/test.yaml
new file mode 100644
index 000000000..b658eca6f
--- /dev/null
+++ b/tests/ipv6-hdr-keyword-01/test.yaml
@@ -0,0 +1,12 @@
+requires:
+  min-version: 5.0.0
+  features:
+    - HAVE_LIBJANSSON
+
+checks:
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 1234 
+
diff --git a/tests/ipv6-hdr-keyword-01/writepcap.py b/tests/ipv6-hdr-keyword-01/writepcap.py
new file mode 100755
index 000000000..a871541dc
--- /dev/null
+++ b/tests/ipv6-hdr-keyword-01/writepcap.py
@@ -0,0 +1,10 @@
+#!/usr/bin/env python
+from scapy.all import *
+
+pkts = []
+
+pkts += Ether(dst='ff:ff:ff:ff:ff:ff', src='00:01:02:03:04:05')/ \
+    Dot1Q(vlan=6)/ \
+    IPv6()/UDP(dport=80)
+
+wrpcap('input.pcap', pkts)
diff --git a/tests/ipv6-hdr-keyword-02/input.pcap b/tests/ipv6-hdr-keyword-02/input.pcap
new file mode 100644
index 000000000..e872c8e95
Binary files /dev/null and b/tests/ipv6-hdr-keyword-02/input.pcap differ
diff --git a/tests/ipv6-hdr-keyword-02/test.rules b/tests/ipv6-hdr-keyword-02/test.rules
new file mode 100644
index 000000000..4186008fe
--- /dev/null
+++ b/tests/ipv6-hdr-keyword-02/test.rules
@@ -0,0 +1 @@
+alert ip any any -> any any (ipv6.hdr; content:"|11 00 00 00 00 00 00 00|"; offset:40; endswith; sid:1234;)
diff --git a/tests/ipv6-hdr-keyword-02/test.yaml b/tests/ipv6-hdr-keyword-02/test.yaml
new file mode 100644
index 000000000..b658eca6f
--- /dev/null
+++ b/tests/ipv6-hdr-keyword-02/test.yaml
@@ -0,0 +1,12 @@
+requires:
+  min-version: 5.0.0
+  features:
+    - HAVE_LIBJANSSON
+
+checks:
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 1234 
+
diff --git a/tests/ipv6-hdr-keyword-02/writepcap.py b/tests/ipv6-hdr-keyword-02/writepcap.py
new file mode 100755
index 000000000..dc40cb1da
--- /dev/null
+++ b/tests/ipv6-hdr-keyword-02/writepcap.py
@@ -0,0 +1,10 @@
+#!/usr/bin/env python
+from scapy.all import *
+
+pkts = []
+
+pkts += Ether(dst='ff:ff:ff:ff:ff:ff', src='00:01:02:03:04:05')/ \
+    Dot1Q(vlan=6)/ \
+    IPv6()/IPv6ExtHdrHopByHop()/IPv6ExtHdrDestOpt()/IPv6ExtHdrRouting()/UDP(dport=80)
+
+wrpcap('input.pcap', pkts)