From f35bab51a83c7d31440de9ac03c236d8ad50f38c Mon Sep 17 00:00:00 2001
From: Victor Julien <victor@inliniac.net>
Date: Tue, 18 Jun 2019 15:51:28 +0200
Subject: [PATCH] tests: add test for tcp.mss keyword

---
 tests/tcp-mss-keyword/input.pcap   | Bin 0 -> 102 bytes
 tests/tcp-mss-keyword/test.rules   |   1 +
 tests/tcp-mss-keyword/test.yaml    |  12 ++++++++++++
 tests/tcp-mss-keyword/writepcap.py |  10 ++++++++++
 4 files changed, 23 insertions(+)
 create mode 100644 tests/tcp-mss-keyword/input.pcap
 create mode 100644 tests/tcp-mss-keyword/test.rules
 create mode 100644 tests/tcp-mss-keyword/test.yaml
 create mode 100755 tests/tcp-mss-keyword/writepcap.py

diff --git a/tests/tcp-mss-keyword/input.pcap b/tests/tcp-mss-keyword/input.pcap
new file mode 100644
index 0000000000000000000000000000000000000000..2745f6f4cc90d2711dd5b712f05918cb4ed26581
GIT binary patch
literal 102
zc-p&ic+)~A1{MYw`2U}Qfe}cTKj(=3wTXqn4#>6xi-Q0IBNH<VYa;^#8wZ0c1A`7o
hsRP?Cr2{J%7{T%)3;{5c5||Vi_8etkU}9n5003h<807!}

literal 0
Hc-jL100001

diff --git a/tests/tcp-mss-keyword/test.rules b/tests/tcp-mss-keyword/test.rules
new file mode 100644
index 000000000..a1aa40a19
--- /dev/null
+++ b/tests/tcp-mss-keyword/test.rules
@@ -0,0 +1 @@
+alert tcp any any -> any any (tcp.mss:<536; sid:1234; rev:5;)
diff --git a/tests/tcp-mss-keyword/test.yaml b/tests/tcp-mss-keyword/test.yaml
new file mode 100644
index 000000000..b658eca6f
--- /dev/null
+++ b/tests/tcp-mss-keyword/test.yaml
@@ -0,0 +1,12 @@
+requires:
+  min-version: 5.0.0
+  features:
+    - HAVE_LIBJANSSON
+
+checks:
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 1234 
+
diff --git a/tests/tcp-mss-keyword/writepcap.py b/tests/tcp-mss-keyword/writepcap.py
new file mode 100755
index 000000000..672bdef8d
--- /dev/null
+++ b/tests/tcp-mss-keyword/writepcap.py
@@ -0,0 +1,10 @@
+#!/usr/bin/env python
+from scapy.all import *
+
+pkts = []
+
+pkts += Ether(dst='ff:ff:ff:ff:ff:ff', src='00:01:02:03:04:05')/ \
+    Dot1Q(vlan=6)/ \
+    IP(dst='255.255.255.255', src='192.168.0.1')/TCP(dport=80,flags="S",options=[("MSS", 8)])
+
+wrpcap('input.pcap', pkts)
-- 
2.47.2