From 282a7e389554cef7f52c821ce48cdcbeae106697 Mon Sep 17 00:00:00 2001 From: Jeff Lucovsky Date: Thu, 30 Mar 2023 09:41:44 -0400 Subject: [PATCH] test/byte-math: Add 0 divisor test. Issue: 5945 This commit adds a byte-math test with a zero divisor. Division by 0 is undefined so there's no match. --- tests/detect-bytemath-div-01/README.md | 11 +++++++++++ tests/detect-bytemath-div-01/input.pcap | Bin 0 -> 80 bytes tests/detect-bytemath-div-01/test.rules | 3 +++ tests/detect-bytemath-div-01/test.yaml | 10 ++++++++++ 4 files changed, 24 insertions(+) create mode 100644 tests/detect-bytemath-div-01/README.md create mode 100644 tests/detect-bytemath-div-01/input.pcap create mode 100644 tests/detect-bytemath-div-01/test.rules create mode 100644 tests/detect-bytemath-div-01/test.yaml diff --git a/tests/detect-bytemath-div-01/README.md b/tests/detect-bytemath-div-01/README.md new file mode 100644 index 000000000..8b06cb44e --- /dev/null +++ b/tests/detect-bytemath-div-01/README.md @@ -0,0 +1,11 @@ +Description +=========== +Test byte_math payload keyword with a 0 division. + +PCAP +==== +PCAP comes from the suricata verify test[detect-bytemath-01] + +Redmine ticket +============== +https://redmine.openinfosecfoundation.org/issues/5945 diff --git a/tests/detect-bytemath-div-01/input.pcap b/tests/detect-bytemath-div-01/input.pcap new file mode 100644 index 0000000000000000000000000000000000000000..4a18a072c33c34de444586574c1bd667eaf6f28d GIT binary patch literal 80 zc-p&ic+)~A1{MYw`2U}QAr(j)&)*a`_belW29OQHu1Y|Pk%7U1jiKWJgWo any any (ipv4.hdr; byte_extract: 1, 2, extracted_val, relative;byte_math: bytes 1, offset 0, oper /, rvalue extracted_val, result var;msg:\ +"Byte extract and byte math with 0 devide\ +";sid:1;) diff --git a/tests/detect-bytemath-div-01/test.yaml b/tests/detect-bytemath-div-01/test.yaml new file mode 100644 index 000000000..230df0c71 --- /dev/null +++ b/tests/detect-bytemath-div-01/test.yaml @@ -0,0 +1,10 @@ +requires: + files: + - src/detect-bytemath.c + +checks: + - filter: + count: 0 + match: + event_type: alert + alert.signature_id: 1 -- 2.47.2