From 0a8596b024b14ab5c32fba76234fe75eea581f15 Mon Sep 17 00:00:00 2001
From: Philippe Antoine <pantoine@oisf.net>
Date: Fri, 30 Jun 2023 15:48:55 +0200
Subject: [PATCH] Adds test for enip

Ticket: #3886
---
 tests/enip-alert/README.md       |   7 +++++++
 tests/enip-alert/enip_test1.pcap | Bin 0 -> 987 bytes
 tests/enip-alert/test.rules      |   1 +
 tests/enip-alert/test.yaml       |  13 +++++++++++++
 4 files changed, 21 insertions(+)
 create mode 100644 tests/enip-alert/README.md
 create mode 100644 tests/enip-alert/enip_test1.pcap
 create mode 100644 tests/enip-alert/test.rules
 create mode 100644 tests/enip-alert/test.yaml

diff --git a/tests/enip-alert/README.md b/tests/enip-alert/README.md
new file mode 100644
index 000000000..d8db0889f
--- /dev/null
+++ b/tests/enip-alert/README.md
@@ -0,0 +1,7 @@
+# Description
+
+Test ENIP alerts numbers
+
+# PCAP
+
+The pcap comes from https://redmine.openinfosecfoundation.org/issues/3886
diff --git a/tests/enip-alert/enip_test1.pcap b/tests/enip-alert/enip_test1.pcap
new file mode 100644
index 0000000000000000000000000000000000000000..3fb12dbff6763e6d447bcddf8103c51f7c648cdb
GIT binary patch
literal 987
zc-p&ic+)~A1{MYcU}0bclA$+k;`1l)F*pI)ApB(2tCgzy8?MfcoA!=_!Igo*MEj=$
zLj#+~)HRagj6lp(<*{DKB_!1jWJUwiuMbjx7#NsXShp}TGjlL9vM_}KO<ZBf2saU8
z7Q|eLi3|)53=V8t`aq_EOkFQj<xzD^bT!aa`v#$3AG)fbCIU?Zn#v9`(angF!3=1c
z88$a+X#WDcaRHhe?SZDQ2@qgnJYvJZ05at&&=fzQ34Yj2anSw^Hl-b_DH2SK53(5;
zk{M9J!F&5If@qNGXFL&Z#PGF7&Q*}F-H)RAdJWKq@BjhEZ%6bYrkn+u(g-x65t}K+
zIoH6ZRAMzng7KT?N{}0kvAU6wfrmjC6zfdug}4|Qm%!vf;#LeS%mxg7zCjG!hUTVb
zx~_gsA^MKYAO}r&g*WK`fCFtFTA+mk9rYa;^bCh@F)%~`O?mIajVEwid_dlE0-I26
zU8eIaPi^%H<%fAs!k@7N1Ltc+0K}9&e{MW($yRk>Fkw^I0GR+XNp1Brun9nu@&g1I
z?5kKA7$SkD2>#>4=c9jMAI-t)BSD~#ZZa@L0ZqA3%!DtxuY)7%Fj_=?2bvTSAjtUb
e@FR#RG9^s--0~mnmf2`-i2$1P101?H7#ILPJ|m+5

literal 0
Hc-jL100001

diff --git a/tests/enip-alert/test.rules b/tests/enip-alert/test.rules
new file mode 100644
index 000000000..35ad845c5
--- /dev/null
+++ b/tests/enip-alert/test.rules
@@ -0,0 +1 @@
+alert enip any any -> any any (msg:"SURICATA enip test ";enip_command:99 ;sid:6450008; rev:1;)
diff --git a/tests/enip-alert/test.yaml b/tests/enip-alert/test.yaml
new file mode 100644
index 000000000..cdf4f19d3
--- /dev/null
+++ b/tests/enip-alert/test.yaml
@@ -0,0 +1,13 @@
+requires:
+  min-version: 7
+
+# disables checksum verification
+args:
+- -k none --set stream.midstream=true --set app-layer.protocols.enip.enabled=yes
+
+checks:
+  - filter:
+      count: 2
+      match:
+        event_type: alert
+        alert.signature_id: 6450008
-- 
2.47.2