From 6b17551a1c5a3d4ac132714acd98963986d0b497 Mon Sep 17 00:00:00 2001 From: Juliana Fajardini Date: Wed, 4 Dec 2024 22:32:05 -0300 Subject: [PATCH] test: check flowint isnotset support Related to Task #7426 --- tests/flowint-isnotset/README.md | 15 +++++++++++++++ tests/flowint-isnotset/test.rules | 2 ++ tests/flowint-isnotset/test.yaml | 19 +++++++++++++++++++ 3 files changed, 36 insertions(+) create mode 100644 tests/flowint-isnotset/README.md create mode 100644 tests/flowint-isnotset/test.rules create mode 100644 tests/flowint-isnotset/test.yaml diff --git a/tests/flowint-isnotset/README.md b/tests/flowint-isnotset/README.md new file mode 100644 index 000000000..66c905832 --- /dev/null +++ b/tests/flowint-isnotset/README.md @@ -0,0 +1,15 @@ +Test +---- + +Simple test to check that the keyword ``flowint`` accepts both ``notset`` +and ``isnotset``. + +Pcap +---- + +From test tls-subjectaltname + +Redmine Ticket +-------------- + +https://redmine.openinfosecfoundation.org/issues/7426 diff --git a/tests/flowint-isnotset/test.rules b/tests/flowint-isnotset/test.rules new file mode 100644 index 000000000..2767ee0c4 --- /dev/null +++ b/tests/flowint-isnotset/test.rules @@ -0,0 +1,2 @@ +alert tls any any -> any any (msg:"test flowint isnotset"; flowint:flowtls1,isnotset; flowint:flowtls1,+,1; noalert; sid:1;) +alert tls any any -> any any (msg:"test flowint notset"; flowint:flowtls2,notset; flowint:flowtls2,+,1; sid:2;) diff --git a/tests/flowint-isnotset/test.yaml b/tests/flowint-isnotset/test.yaml new file mode 100644 index 000000000..15f2412b6 --- /dev/null +++ b/tests/flowint-isnotset/test.yaml @@ -0,0 +1,19 @@ +requires: + min-version: 8 + +pcap: ../tls/tls-subjectaltname/input.pcap + +args: +- -k none + +checks: +- filter: + count: 0 + match: + alert.signature_id: 1 + event_type: alert +- filter: + count: 40 + match: + alert.signature_id: 2 + event_type: alert -- 2.47.2