tests: test accept:flow with threat detection

diff --git a/tests/firewall/ruletype-firewall-85-packet-filter-accept-flow-with-td/README.md b/tests/firewall/ruletype-firewall-85-packet-filter-accept-flow-with-td/README.md
new file mode 100644 (file)
index 0000000..ae80823
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-85-packet-filter-accept-flow-with-td/README.md
@@ -0,0 +1 @@
+Test packet filter accept:flow still allowing TD matching.

diff --git a/tests/firewall/ruletype-firewall-85-packet-filter-accept-flow-with-td/firewall.rules b/tests/firewall/ruletype-firewall-85-packet-filter-accept-flow-with-td/firewall.rules
new file mode 100644 (file)
index 0000000..3c1e660
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-85-packet-filter-accept-flow-with-td/firewall.rules
@@ -0,0 +1,4 @@
+accept:packet arp:all any any -> any any (sid:200;)
+
+accept:hook tcp:all any any <> any 80 (flow:not_established; sid:1021;)
+accept:flow tcp:all any any <> any 80 (flow:established; sid:1023;)

diff --git a/tests/firewall/ruletype-firewall-85-packet-filter-accept-flow-with-td/suricata.yaml b/tests/firewall/ruletype-firewall-85-packet-filter-accept-flow-with-td/suricata.yaml
new file mode 100644 (file)
index 0000000..0987df7
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-85-packet-filter-accept-flow-with-td/suricata.yaml
@@ -0,0 +1,16 @@
+%YAML 1.1
+---
+
+# Global stats configuration
+stats:
+  enabled: yes
+  interval: 8
+
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular
+      filename: eve.json
+      types:
+        - stats
+        - alert

diff --git a/tests/firewall/ruletype-firewall-85-packet-filter-accept-flow-with-td/td.rules b/tests/firewall/ruletype-firewall-85-packet-filter-accept-flow-with-td/td.rules
new file mode 100644 (file)
index 0000000..78ea939
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-85-packet-filter-accept-flow-with-td/td.rules
@@ -0,0 +1 @@
+alert tcp-pkt any any -> any 80 (flow:to_server,established; content:"GET"; startswith; sid:100001;)

diff --git a/tests/firewall/ruletype-firewall-85-packet-filter-accept-flow-with-td/test.yaml b/tests/firewall/ruletype-firewall-85-packet-filter-accept-flow-with-td/test.yaml
new file mode 100644 (file)
index 0000000..2df2935
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-85-packet-filter-accept-flow-with-td/test.yaml
@@ -0,0 +1,22 @@
+requires:
+  min-version: 9
+
+pcap: ../../flowbit-oring/input.pcap
+
+args:
+  - --simulate-ips
+  - -k none
+
+checks:
+- filter:
+    # Should see this rule fire once, but it currenty being bypassed.
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 100001
+- filter:
+    count: 1
+    match:
+      event_type: stats
+      stats.ips.accepted: 10
+      stats.ips.blocked: 0

diff --git a/tests/firewall/ruletype-firewall-86-packet-filter-accept-flow-pass-with-td/README.md b/tests/firewall/ruletype-firewall-86-packet-filter-accept-flow-pass-with-td/README.md
new file mode 100644 (file)
index 0000000..ae80823
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-86-packet-filter-accept-flow-pass-with-td/README.md
@@ -0,0 +1 @@
+Test packet filter accept:flow still allowing TD matching.

diff --git a/tests/firewall/ruletype-firewall-86-packet-filter-accept-flow-pass-with-td/firewall.rules b/tests/firewall/ruletype-firewall-86-packet-filter-accept-flow-pass-with-td/firewall.rules
new file mode 100644 (file)
index 0000000..6ac30ea
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-86-packet-filter-accept-flow-pass-with-td/firewall.rules
@@ -0,0 +1,4 @@
+accept:packet arp:all any any -> any any (sid:200;)
+
+accept:hook tcp:all any any <> any 80 (flow:not_established; sid:1021;)
+accept:hook tcp:all any any <> any 80 (flow:established; sid:1023;)

diff --git a/tests/firewall/ruletype-firewall-86-packet-filter-accept-flow-pass-with-td/suricata.yaml b/tests/firewall/ruletype-firewall-86-packet-filter-accept-flow-pass-with-td/suricata.yaml
new file mode 100644 (file)
index 0000000..107ae9d
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-86-packet-filter-accept-flow-pass-with-td/suricata.yaml
@@ -0,0 +1,24 @@
+%YAML 1.1
+---
+
+# Global stats configuration
+stats:
+  enabled: yes
+  interval: 8
+
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular
+      filename: eve.json
+      types:
+        - stats
+        - alert
+        - drop
+        - flow
+
+firewall:
+  policies:
+    http:
+      request-started: [ "accept:flow" ]
+      #request-started: [ "accept:flow", "pass:flow" ]

diff --git a/tests/firewall/ruletype-firewall-86-packet-filter-accept-flow-pass-with-td/td.rules b/tests/firewall/ruletype-firewall-86-packet-filter-accept-flow-pass-with-td/td.rules
new file mode 100644 (file)
index 0000000..7e21d28
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-86-packet-filter-accept-flow-pass-with-td/td.rules
@@ -0,0 +1,2 @@
+alert http any any -> any 80 (flow:to_server,established; http.method; content:"GET"; startswith; sid:100001;)
+##alert http any any -> any 80 (flow:to_server,established; http.uri; content:"GET"; startswith; sid:100001;)

diff --git a/tests/firewall/ruletype-firewall-86-packet-filter-accept-flow-pass-with-td/test.yaml b/tests/firewall/ruletype-firewall-86-packet-filter-accept-flow-pass-with-td/test.yaml
new file mode 100644 (file)
index 0000000..e2cee52
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-86-packet-filter-accept-flow-pass-with-td/test.yaml
@@ -0,0 +1,27 @@
+requires:
+  min-version: 9
+
+pcap: ../../flowbit-oring/input.pcap
+
+args:
+  - --simulate-ips
+  - -k none
+
+checks:
+- filter:
+    # no match expected due to `accept:flow,pass:flow`
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 100001
+- filter:
+    # no match expected due to `accept:flow,pass:flow`
+    count: 0
+    match:
+      event_type: drop
+- filter:
+    count: 1
+    match:
+      event_type: stats
+      stats.ips.accepted: 10
+      stats.ips.blocked: 0

diff --git a/tests/firewall/ruletype-firewall-87-broken-default-policy/README.md b/tests/firewall/ruletype-firewall-87-broken-default-policy/README.md
new file mode 100644 (file)
index 0000000..ae80823
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-87-broken-default-policy/README.md
@@ -0,0 +1 @@
+Test packet filter accept:flow still allowing TD matching.

diff --git a/tests/firewall/ruletype-firewall-87-broken-default-policy/firewall.rules b/tests/firewall/ruletype-firewall-87-broken-default-policy/firewall.rules
new file mode 100644 (file)
index 0000000..6ac30ea
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-87-broken-default-policy/firewall.rules
@@ -0,0 +1,4 @@
+accept:packet arp:all any any -> any any (sid:200;)
+
+accept:hook tcp:all any any <> any 80 (flow:not_established; sid:1021;)
+accept:hook tcp:all any any <> any 80 (flow:established; sid:1023;)

diff --git a/tests/firewall/ruletype-firewall-87-broken-default-policy/suricata.yaml b/tests/firewall/ruletype-firewall-87-broken-default-policy/suricata.yaml
new file mode 100644 (file)
index 0000000..6426547
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-87-broken-default-policy/suricata.yaml
@@ -0,0 +1,23 @@
+%YAML 1.1
+---
+
+# Global stats configuration
+stats:
+  enabled: yes
+  interval: 8
+
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular
+      filename: eve.json
+      types:
+        - stats
+        - alert
+        - drop
+        - flow
+
+firewall:
+  policies:
+    http:
+      request-started: [ "accept:foo" ]

diff --git a/tests/firewall/ruletype-firewall-87-broken-default-policy/td.rules b/tests/firewall/ruletype-firewall-87-broken-default-policy/td.rules
new file mode 100644 (file)
index 0000000..7e21d28
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-87-broken-default-policy/td.rules
@@ -0,0 +1,2 @@
+alert http any any -> any 80 (flow:to_server,established; http.method; content:"GET"; startswith; sid:100001;)
+##alert http any any -> any 80 (flow:to_server,established; http.uri; content:"GET"; startswith; sid:100001;)

diff --git a/tests/firewall/ruletype-firewall-87-broken-default-policy/test.yaml b/tests/firewall/ruletype-firewall-87-broken-default-policy/test.yaml
new file mode 100644 (file)
index 0000000..adf4b33
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-87-broken-default-policy/test.yaml
@@ -0,0 +1,11 @@
+requires:
+  min-version: 9
+
+pcap: ../../flowbit-oring/input.pcap
+
+args:
+  - --simulate-ips
+  - -k none
+  - -T
+
+exit-code: 1