From 47c1bc47ea5faa5516e30edb27fce3cbd4dfe76a Mon Sep 17 00:00:00 2001
From: Philippe Antoine <pantoine@oisf.net>
Date: Fri, 21 Jun 2024 08:53:30 +0200
Subject: [PATCH] ssh: adds test for frames

Ticket: 5734
---
 tests/ssh-frames/README.md  |  8 ++++++++
 tests/ssh-frames/test.rules |  3 +++
 tests/ssh-frames/test.yaml  | 25 +++++++++++++++++++++++++
 3 files changed, 36 insertions(+)
 create mode 100644 tests/ssh-frames/README.md
 create mode 100644 tests/ssh-frames/test.rules
 create mode 100644 tests/ssh-frames/test.yaml

diff --git a/tests/ssh-frames/README.md b/tests/ssh-frames/README.md
new file mode 100644
index 000000000..1721f2bf8
--- /dev/null
+++ b/tests/ssh-frames/README.md
@@ -0,0 +1,8 @@
+# Description
+
+Test ssh frames.
+https://redmine.openinfosecfoundation.org/issues/5734
+
+# PCAP
+
+reused from another test
diff --git a/tests/ssh-frames/test.rules b/tests/ssh-frames/test.rules
new file mode 100644
index 000000000..e5c7f6e86
--- /dev/null
+++ b/tests/ssh-frames/test.rules
@@ -0,0 +1,3 @@
+alert ssh any any -> any 22 (msg:"pdu frame"; frame:ssh.record.pdu; content: "|06 1e 00 00 00 20|"; offset: 4; depth:6; sid:1;)
+alert ssh any any -> any 22 (msg:"hdr frame new keys"; frame:ssh.record.hdr; content: "|15|"; endswith; bsize: 6; sid:2;)
+alert ssh any any -> any 22 (msg:"data frame"; frame:ssh.record.data; content: "curve"; sid:3;)
diff --git a/tests/ssh-frames/test.yaml b/tests/ssh-frames/test.yaml
new file mode 100644
index 000000000..5d7f18165
--- /dev/null
+++ b/tests/ssh-frames/test.yaml
@@ -0,0 +1,25 @@
+requires:
+  min-version: 8
+
+pcap:  ../ssh-newkeys/input.pcap
+
+args:
+ - -k none
+
+checks:
+  - filter:
+      count: 1
+      match:
+         event_type: alert
+         alert.signature_id: 1
+         ssh.client.software_version: "libssh-0.7.2"
+  - filter:
+      count: 1
+      match:
+         event_type: alert
+         alert.signature_id: 2
+  - filter:
+      count: 1
+      match:
+         event_type: alert
+         alert.signature_id: 3
-- 
2.47.2