From 9f11a1deba199374e87948aff754676529e104ce Mon Sep 17 00:00:00 2001 From: Jeff Lucovsky Date: Sun, 15 Jun 2025 10:27:00 -0400 Subject: [PATCH] analyzer/tests: ICMP icode engine analysis test Test the ICMP icode engine analysis additions. Issue: 6359 --- tests/rules/icmp_code/test.rules | 1 + tests/rules/icmp_code/test.yaml | 15 +++++++++++++++ 2 files changed, 16 insertions(+) create mode 100644 tests/rules/icmp_code/test.rules create mode 100644 tests/rules/icmp_code/test.yaml diff --git a/tests/rules/icmp_code/test.rules b/tests/rules/icmp_code/test.rules new file mode 100644 index 000000000..e275479e7 --- /dev/null +++ b/tests/rules/icmp_code/test.rules @@ -0,0 +1 @@ +alert icmp any any -> any any (msg:"Testing icode"; icode:2; sid:1;) diff --git a/tests/rules/icmp_code/test.yaml b/tests/rules/icmp_code/test.yaml new file mode 100644 index 000000000..66e0b15e7 --- /dev/null +++ b/tests/rules/icmp_code/test.yaml @@ -0,0 +1,15 @@ +requires: + min-version: 8.0 + pcap: false + +args: + - --engine-analysis + +checks: +- filter: + filename: rules.json + count: 1 + match: + id: 1 + lists.packet.matches[0].name: "icode" + lists.packet.matches[0].code.equal: 2 -- 2.47.2