From 15a540538f7294f3de07856e1608e884a3000e47 Mon Sep 17 00:00:00 2001 From: Jason Ish Date: Tue, 22 Mar 2022 09:53:59 -0600 Subject: [PATCH] test-bad-hex-rule-1: add rule with incomplete hex Add a rule with incomplete hex, for example "|22 2 22|" which should result in a parse error. Ticket #5201. --- tests/test-bad-hex-rule-1/test.rules | 1 + tests/test-bad-hex-rule-1/test.yaml | 6 ++++++ 2 files changed, 7 insertions(+) diff --git a/tests/test-bad-hex-rule-1/test.rules b/tests/test-bad-hex-rule-1/test.rules index 1c7917660..4d4f3df97 100644 --- a/tests/test-bad-hex-rule-1/test.rules +++ b/tests/test-bad-hex-rule-1/test.rules @@ -1 +1,2 @@ alert tcp any any -> any any (msg:"invalid hex test rule"; content:"|l0 01 01|"; sid:12345; rev:1;) +alert tcp any any -> any any (msg:"invalid hex test rule"; content:"|22 2 22|"; sid:12346; rev:1;) diff --git a/tests/test-bad-hex-rule-1/test.yaml b/tests/test-bad-hex-rule-1/test.yaml index 897827840..3e9c8306d 100644 --- a/tests/test-bad-hex-rule-1/test.yaml +++ b/tests/test-bad-hex-rule-1/test.yaml @@ -21,3 +21,9 @@ checks: match: event_type: engine engine.error: "SC_ERR_NO_RULES_LOADED" + + - filter: + count: 1 + match: + event_type: engine + engine.message: "Incomplete hex code in content - |22 2 22|. Invalidating signature." -- 2.47.2