From 3b1e473843909aa828792692fe4ebaa6f8755c42 Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Mon, 18 Jan 2021 08:47:19 +0100 Subject: [PATCH] tests: add simple sctp decoder test --- tests/decode-sctp-01/README.md | 4 ++++ tests/decode-sctp-01/input.pcap | Bin 0 -> 720 bytes tests/decode-sctp-01/test.rules | 1 + tests/decode-sctp-01/test.yaml | 26 ++++++++++++++++++++++++++ 4 files changed, 31 insertions(+) create mode 100644 tests/decode-sctp-01/README.md create mode 100644 tests/decode-sctp-01/input.pcap create mode 100644 tests/decode-sctp-01/test.rules create mode 100644 tests/decode-sctp-01/test.yaml diff --git a/tests/decode-sctp-01/README.md b/tests/decode-sctp-01/README.md new file mode 100644 index 000000000..651f69601 --- /dev/null +++ b/tests/decode-sctp-01/README.md @@ -0,0 +1,4 @@ +PCAP +==== + +https://redmine.openinfosecfoundation.org/issues/1370 diff --git a/tests/decode-sctp-01/input.pcap b/tests/decode-sctp-01/input.pcap new file mode 100644 index 0000000000000000000000000000000000000000..c6623cf168175110e97dde43eb85d19f7d76703b GIT binary patch literal 720 zc-rIQ<>d-sU|{gI(UxKa(*L1=g+YfQBse3nC|ki$&(KKESV6-*vqT{%wM-#2FFP;4 zJWnC5C_h)B6vEL2YGnYK12RJaO8@`Qz`zM)u`xgZNF2mYV1n@DKQJ?tPhd5+1M)$b z;eo_Pp0x}K9Ij77IT&0Sm<%?2VPI%z*?9QCid7as%)!9U!0xQ9>SA^8HxmOplK=yQ PnG6F5!zdU9&~ya=s17e9 literal 0 Hc-jL100001 diff --git a/tests/decode-sctp-01/test.rules b/tests/decode-sctp-01/test.rules new file mode 100644 index 000000000..48e5e12ce --- /dev/null +++ b/tests/decode-sctp-01/test.rules @@ -0,0 +1 @@ +alert sctp any 7 -> any 7 (sid:1;) diff --git a/tests/decode-sctp-01/test.yaml b/tests/decode-sctp-01/test.yaml new file mode 100644 index 000000000..5306529f5 --- /dev/null +++ b/tests/decode-sctp-01/test.yaml @@ -0,0 +1,26 @@ +# *** Add configuration here *** + +args: +- -k none + +checks: +- filter: + count: 1 + match: + dest_ip: 192.168.170.8 + dest_port: 7 + event_type: alert + proto: SCTP + src_ip: 192.168.170.56 + src_port: 7 + alert.signature_id: 1 + +- filter: + count: 1 + match: + dest_ip: 192.168.170.8 + dest_port: 7 + event_type: flow + proto: SCTP + src_ip: 192.168.170.56 + src_port: 7 -- 2.47.2