From: Philippe Antoine Date: Mon, 17 Feb 2025 10:17:48 +0000 (+0100) Subject: quic: add tests for fragment reassembly X-Git-Tag: suricata-7.0.9~35 X-Git-Url: http://git.ipfire.org/gitweb/gitweb.cgi?a=commitdiff_plain;h=refs%2Fpull%2F2309%2Fhead;p=thirdparty%2Fsuricata-verify.git quic: add tests for fragment reassembly Ticket: 7556 --- diff --git a/tests/quic-ack3/README.md b/tests/quic-ack3/README.md new file mode 100644 index 000000000..034bf4fd8 --- /dev/null +++ b/tests/quic-ack3/README.md @@ -0,0 +1,11 @@ +# Description + +Test quic parsing with ACK frame number 3 + +# Ticket + +https://redmine.openinfosecfoundation.org/issues/7556 + +# PCAP + +The pcap comes from https://redmine.openinfosecfoundation.org/issues/7556 diff --git a/tests/quic-ack3/input.pcap b/tests/quic-ack3/input.pcap new file mode 100644 index 000000000..8c196ebf1 Binary files /dev/null and b/tests/quic-ack3/input.pcap differ diff --git a/tests/quic-ack3/test.yaml b/tests/quic-ack3/test.yaml new file mode 100644 index 000000000..5ee342c5b --- /dev/null +++ b/tests/quic-ack3/test.yaml @@ -0,0 +1,13 @@ +requires: + min-version: 8 + +checks: + - filter: + count: 1 + match: + event_type: quic + pcap_cnt: 3 + - filter: + count: 0 + match: + event_type: anomaly diff --git a/tests/quic-frag-middle-gap/README.md b/tests/quic-frag-middle-gap/README.md new file mode 100644 index 000000000..2034ef479 --- /dev/null +++ b/tests/quic-frag-middle-gap/README.md @@ -0,0 +1,11 @@ +# Description + +Test quic parsing with crypto fragments over multiple (>2) packets, crypto fragments being out of order, and with the last packet covering a crypto fragment in the middle of the TLS handshake message + +# Ticket + +https://redmine.openinfosecfoundation.org/issues/7556 + +# PCAP + +The pcap comes from https://redmine.openinfosecfoundation.org/issues/7556 diff --git a/tests/quic-frag-middle-gap/input.pcap b/tests/quic-frag-middle-gap/input.pcap new file mode 100644 index 000000000..fc390302b Binary files /dev/null and b/tests/quic-frag-middle-gap/input.pcap differ diff --git a/tests/quic-frag-middle-gap/test.yaml b/tests/quic-frag-middle-gap/test.yaml new file mode 100644 index 000000000..f6ef1caf0 --- /dev/null +++ b/tests/quic-frag-middle-gap/test.yaml @@ -0,0 +1,16 @@ +requires: + min-version: 8 + +checks: + - filter: + count: 1 + match: + event_type: quic + pcap_cnt: 3 + quic.extensions[0].name: "key_share" + quic.extensions[8].name: "server_name" + quic.extensions[8].values[0]: "optimizationguide-pa.googleapis.com" + - filter: + count: 0 + match: + event_type: anomaly diff --git a/tests/quic-frag-unordered/README.md b/tests/quic-frag-unordered/README.md new file mode 100644 index 000000000..436e67f15 --- /dev/null +++ b/tests/quic-frag-unordered/README.md @@ -0,0 +1,11 @@ +# Description + +Test quic parsing with crypto fragments over multiple packets, and crypto fragments being out of order + +# Ticket + +https://redmine.openinfosecfoundation.org/issues/7556 + +# PCAP + +The pcap comes from https://redmine.openinfosecfoundation.org/issues/7556 diff --git a/tests/quic-frag-unordered/input.pcap b/tests/quic-frag-unordered/input.pcap new file mode 100644 index 000000000..795122812 Binary files /dev/null and b/tests/quic-frag-unordered/input.pcap differ diff --git a/tests/quic-frag-unordered/test.yaml b/tests/quic-frag-unordered/test.yaml new file mode 100644 index 000000000..6fe530f7e --- /dev/null +++ b/tests/quic-frag-unordered/test.yaml @@ -0,0 +1,12 @@ +requires: + min-version: 8 + +checks: + - filter: + count: 1 + match: + event_type: quic + pcap_cnt: 2 + quic.extensions[0].name: "supported_groups" + quic.extensions[7].name: "server_name" + quic.extensions[7].values[0]: "mastodon.social" diff --git a/tests/quic-frag-wait/README.md b/tests/quic-frag-wait/README.md new file mode 100644 index 000000000..e8248e381 --- /dev/null +++ b/tests/quic-frag-wait/README.md @@ -0,0 +1,11 @@ +# Description + +Test quic parsing with crypto fragments over multiple packets, crypto fragments being out of order, and with a packet in the middle without new crypto fragment + +# Ticket + +https://redmine.openinfosecfoundation.org/issues/7556 + +# PCAP + +The pcap comes from https://redmine.openinfosecfoundation.org/issues/7556 diff --git a/tests/quic-frag-wait/input.pcap b/tests/quic-frag-wait/input.pcap new file mode 100644 index 000000000..af2ced045 Binary files /dev/null and b/tests/quic-frag-wait/input.pcap differ diff --git a/tests/quic-frag-wait/test.yaml b/tests/quic-frag-wait/test.yaml new file mode 100644 index 000000000..c991f88f9 --- /dev/null +++ b/tests/quic-frag-wait/test.yaml @@ -0,0 +1,14 @@ +requires: + min-version: 8 + +checks: + - filter: + count: 1 + match: + event_type: quic + pcap_cnt: 6 + quic.extensions[0].name: "key_share" + - filter: + count: 0 + match: + event_type: anomaly diff --git a/tests/quic-frag/README.md b/tests/quic-frag/README.md new file mode 100644 index 000000000..7bdfc6de0 --- /dev/null +++ b/tests/quic-frag/README.md @@ -0,0 +1,11 @@ +# Description + +Test quic parsing with crypto fragments over multiple packets + +# Ticket + +https://redmine.openinfosecfoundation.org/issues/7556 + +# PCAP + +The pcap comes from https://redmine.openinfosecfoundation.org/issues/7556 diff --git a/tests/quic-frag/input.pcap b/tests/quic-frag/input.pcap new file mode 100644 index 000000000..0ccad229f Binary files /dev/null and b/tests/quic-frag/input.pcap differ diff --git a/tests/quic-frag/test.yaml b/tests/quic-frag/test.yaml new file mode 100644 index 000000000..e57dadb61 --- /dev/null +++ b/tests/quic-frag/test.yaml @@ -0,0 +1,12 @@ +requires: + min-version: 8 + +checks: + - filter: + count: 1 + match: + event_type: quic + pcap_cnt: 2 + quic.extensions[0].name: "status_request" + quic.extensions[4].name: "alpn" + quic.extensions[4].values[0]: "h3" diff --git a/tests/quic-initial-not-first/README.md b/tests/quic-initial-not-first/README.md new file mode 100644 index 000000000..01f9b4bee --- /dev/null +++ b/tests/quic-initial-not-first/README.md @@ -0,0 +1,11 @@ +# Description + +Test quic parsing initial (as per quic definition) packet not being the first one + +# Ticket + +https://redmine.openinfosecfoundation.org/issues/7556 + +# PCAP + +The pcap comes from https://redmine.openinfosecfoundation.org/issues/7556 diff --git a/tests/quic-initial-not-first/input.pcap b/tests/quic-initial-not-first/input.pcap new file mode 100644 index 000000000..d001cc10b Binary files /dev/null and b/tests/quic-initial-not-first/input.pcap differ diff --git a/tests/quic-initial-not-first/test.yaml b/tests/quic-initial-not-first/test.yaml new file mode 100644 index 000000000..07c55187b --- /dev/null +++ b/tests/quic-initial-not-first/test.yaml @@ -0,0 +1,20 @@ +requires: + min-version: 8 + +checks: + - filter: + count: 1 + match: + event_type: quic + pcap_cnt: 8 + quic.extensions[0].name: "supported_versions" + - filter: + count: 1 + match: + event_type: quic + pcap_cnt: 1 + quic.extensions[1].name: "server_name" + - filter: + count: 0 + match: + event_type: anomaly diff --git a/tests/quic-retry/README.md b/tests/quic-retry/README.md new file mode 100644 index 000000000..04d5ace31 --- /dev/null +++ b/tests/quic-retry/README.md @@ -0,0 +1,11 @@ +# Description + +Test quic parsing with retry packets + +# Ticket + +https://redmine.openinfosecfoundation.org/issues/7556 + +# PCAP + +The pcap comes from https://redmine.openinfosecfoundation.org/issues/7556 diff --git a/tests/quic-retry/input.pcap b/tests/quic-retry/input.pcap new file mode 100644 index 000000000..c3f4d1c23 Binary files /dev/null and b/tests/quic-retry/input.pcap differ diff --git a/tests/quic-retry/test.yaml b/tests/quic-retry/test.yaml new file mode 100644 index 000000000..2cbeed0e6 --- /dev/null +++ b/tests/quic-retry/test.yaml @@ -0,0 +1,26 @@ +requires: + min-version: 8 + +checks: + - filter: + count: 1 + match: + event_type: quic + pcap_cnt: 2 + quic.extensions[0].name: "supported_groups" + - filter: + count: 1 + match: + event_type: quic + pcap_cnt: 6 + quic.extensions[0].name: "supported_groups" + - filter: + count: 1 + match: + event_type: quic + pcap_cnt: 8 + quic.extensions[0].name: "supported_versions" + - filter: + count: 0 + match: + event_type: anomaly