Skip to content

Commit

Permalink
test/linktype: Expand linktype_name coverage
Browse files Browse the repository at this point in the history
Issue: 4974

This commit extends the linktype_name validation across the existing
tests so that more linktype name values are checked:
    - C_HDLC
    - PPP
    - IPV4
    - IPV6
    - RAW
    - EN10B
    - LINUX_SLL

Some existing tests required suricata.yaml configuration to enable the
packet values to be in the alerts.
  • Loading branch information
jlucovsky committed Aug 28, 2024
1 parent 4fe8d00 commit 4ab1813
Show file tree
Hide file tree
Showing 17 changed files with 262 additions and 0 deletions.
3 changes: 3 additions & 0 deletions tests/decode-chdlc-02/README.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
Ensure Cisco HDLC packets are decoded and the linktype name is correct


24 changes: 24 additions & 0 deletions tests/decode-chdlc-02/suricata.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
%YAML 1.1
---

outputs:
- eve-log:
enabled: yes
filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
filename: eve.json
types:
- alert:
packet: yes # enable dumping of packet (without stream segments)
- http:
extended: true
- files:
force-magic: no
- flow
- stats
app-layer:
protocols:
http:
enabled: yes
libhtp:
default-config:
response-body-limit: 100kb
1 change: 1 addition & 0 deletions tests/decode-chdlc-02/test.rules
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
alert http any any -> any any (http.method; content:"GET"; sid:666;)
38 changes: 38 additions & 0 deletions tests/decode-chdlc-02/test.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,38 @@
requires:

min-version: 8

pcap: ../decode-chdlc-01/hdlc-http_1tx.pcap

checks:

- filter:
count: 1
match:
event_type: http
http.hostname: "view.atdmt.com"
http.status: 200
http.length: 8079

- filter:
count: 1
match:
event_type: fileinfo
fileinfo.state: CLOSED

- filter:
count: 1
match:
event_type: alert
alert.signature_id: 666
packet_info.linktype_name: C_HDLC

- filter:
count: 1
match:
event_type: flow
proto: TCP

- stats:
decoder.ipv4: 17
decoder.chdlc: 17
10 changes: 10 additions & 0 deletions tests/defrag/bug-6887-defrag-ipv6-tcp/test.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -9,3 +9,13 @@ checks:
alert.signature_id: 1
packet: "YAAAAAP8BkAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAATA5H5AAAAABAAAAAFAQIADIrQAAQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQQ=="
packet_info.linktype: 229

- filter:
count: 1
min-version: 8
match:
event_type: alert
alert.signature_id: 1
packet: "YAAAAAP8BkAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAATA5H5AAAAABAAAAAFAQIADIrQAAQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQQ=="
packet_info.linktype: 229
packet_info.linktype_name: IPV6
13 changes: 13 additions & 0 deletions tests/detect-ipopts-02/README
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
Test the IP options and verify the linktype name value.

There's already a test for the extended security option; the following IP options are tested:
- Record Route "rr"
- Loose source route "lsrr"
- EOL "eol"
- NOP "nop"
- Timestamp "ts"
- Security "sec"
- Strict source route "ssrr"
- Stream id "satid"

The pcap was generated using detect-ipopts/ipopt.py
11 changes: 11 additions & 0 deletions tests/detect-ipopts-02/suricata.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
%YAML 1.1
---

outputs:
- eve-log:
enabled: yes
filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
filename: eve.json
types:
- alert:
packet: yes # enable dumping of packet (without stream segments)
10 changes: 10 additions & 0 deletions tests/detect-ipopts-02/test.rules
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
alert ip any any -> any any (msg:"RR option set"; ipopts:rr; sid: 1;)
alert ip any any -> any any (msg:"LSRR option set"; ipopts:lsrr; sid: 2;)
alert ip any any -> any any (msg:"EOL option set"; ipopts:eol; sid: 3;)
alert ip any any -> any any (msg:"NOP option set"; ipopts:nop; sid: 4;)
alert ip any any -> any any (msg:"TS option set"; ipopts:ts; sid: 5;)
alert ip any any -> any any (msg:"SEC option set"; ipopts:sec; sid: 6;)
alert ip any any -> any any (msg:"SSRR option set"; ipopts:ssrr; sid: 7;)
alert ip any any -> any any (msg:"SID option set"; ipopts:satid; sid: 8;)
# covered in ipopts-sec
#alert ip any any <> any any (msg:"ESEC option set"; ipopts:esec; sid: 42;)
64 changes: 64 additions & 0 deletions tests/detect-ipopts-02/test.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,64 @@
requires:
min-version: 8

args:
- --set stream.midstream=true -k none

pcap: ../detect-ipopts/input.pcap

checks:
- filter:
count: 1
match:
event_type: alert
pcap_cnt: 1
alert.signature_id: 1
packet_info.linktype_name: IPV4
- filter:
count: 1
match:
event_type: alert
pcap_cnt: 2
alert.signature_id: 2
packet_info.linktype_name: IPV4
- filter:
count: 6
match:
event_type: alert
alert.signature_id: 3
packet_info.linktype_name: IPV4
- filter:
count: 1
match:
event_type: alert
pcap_cnt: 4
alert.signature_id: 4
packet_info.linktype_name: IPV4
- filter:
count: 1
match:
event_type: alert
pcap_cnt: 5
alert.signature_id: 5
packet_info.linktype_name: IPV4
- filter:
count: 1
match:
event_type: alert
pcap_cnt: 6
alert.signature_id: 6
packet_info.linktype_name: IPV4
- filter:
count: 1
match:
event_type: alert
pcap_cnt: 7
alert.signature_id: 7
packet_info.linktype_name: IPV4
- filter:
count: 1
match:
event_type: alert
pcap_cnt: 8
alert.signature_id: 8
packet_info.linktype_name: IPV4
8 changes: 8 additions & 0 deletions tests/dnp3-dnp3_obj-alert/test.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -15,3 +15,11 @@ checks:
match:
event_type: alert
alert.signature_id: 2

- filter:
count: 4
min-version: 8
match:
event_type: alert
alert.signature_id: 1
packet_info.linktype_name: EN10MB
12 changes: 12 additions & 0 deletions tests/tcp-fastopen-12/suricata.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
%YAML 1.1
---

outputs:
- eve-log:
enabled: yes
filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
filename: eve.json
types:
- alert:
packet: yes # enable dumping of packet (without stream segments)
- flow
1 change: 1 addition & 0 deletions tests/tcp-fastopen-12/test.rules
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
alert tcp any any -> any any (content:"Hello!"; sid:1;)
20 changes: 20 additions & 0 deletions tests/tcp-fastopen-12/test.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,20 @@
pcap: ../tcp-fastopen-05/tfo.pcap

requires:
min-version: 8

args:
- -k none

checks:
- filter:
count: 2
match:
event_type: alert
alert.signature_id: 1
packet_info.linktype_name: LINUX_SLL
- filter:
count: 2
match:
event_type: flow
proto: TCP
7 changes: 7 additions & 0 deletions tests/vxlan-decoder-04/README.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
# Description

Test basic VXLAN decoding

# PCAP

https://github.com/the-tcpdump-group/tcpdump/blob/master/tests/vxlan.pcap
12 changes: 12 additions & 0 deletions tests/vxlan-decoder-04/suricata.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
%YAML 1.1
---

outputs:
- eve-log:
enabled: yes
filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
filename: eve.json
types:
- alert:
packet: yes # enable dumping of packet (without stream segments)
- flow
1 change: 1 addition & 0 deletions tests/vxlan-decoder-04/test.rules
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
alert icmp any any -> any any (itype:8; sid:1;)
27 changes: 27 additions & 0 deletions tests/vxlan-decoder-04/test.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,27 @@
requires:
min-version: 8

args:
- --set decoder.vxlan.enabled=true

pcap: ../vxlan-decoder-02/vxlan.pcap

checks:
- filter:
count: 1
match:
event_type: flow
proto: "ICMP"
flow.pkts_toserver: 4
flow.pkts_toclient: 4
- filter:
count: 4
match:
event_type: flow
dest_port: 4789
- filter:
count: 4
match:
event_type: alert
tunnel.dest_port: 4789
packet_info.linktype_name: RAW

0 comments on commit 4ab1813

Please sign in to comment.