Flowbits tests/v1

README.md

@@ -180,7 +180,12 @@ checks:
         # Check if a string is contained within a JSON list.
         # Eg. "ftp":{"reply":["Opening BINARY mode data connection for temp.txt (1164 bytes).","Transfer complete."], }
         ftp.reply.__contains: 'Transfer complete.'
-
+  - filter:
+      # Check line number of an entry
+      count: 1
+      match:
+        __lineno: 5
+        alert.signature_id: 15
   - shell:
       # A simple shell check. If the command exits with a non-0 exit code the
       # check will fail. The script is run in the output directory of the

run.py

@@ -574,8 +574,11 @@ def run(self):
 
         count = 0
         with open(json_filename, "r", encoding="utf-8") as fileobj:
+            lineno = 1
             for line in fileobj:
                 event = json.loads(line)
+                event["__lineno"] = lineno
+                lineno = lineno + 1
                 if self.match(event):
                     count += 1
         if count == self.config["count"]:

tests/bug-7638-flowbits-sigorder-01/test.rules

@@ -0,0 +1,4 @@
+alert http any any -> any any (http.uri; content:"down"; flowbits:set,uritest; sid:11;)
+alert http any any -> any any (http.user_agent; content:"Mozilla"; flowbits:isset, headtest; flowbits:set,moz; sid:10;)
+alert http any any -> any any (http.method; content:"GET"; flowbits:isset,uritest; flowbits:set,headtest; sid:12;)
+alert http any any -> any any (http.host; content:"ether"; flowbits:isset,moz; sid:14;)

tests/bug-7638-flowbits-sigorder-01/test.yaml

@@ -0,0 +1,33 @@
+requires:
+    min-version: 8.0
+
+pcap: false
+
+args:
+  - --engine-analysis
+
+checks:
+- filter:
+    filename: rules.json
+    count: 1
+    match:
+      __lineno: 1
+      id: 11
+- filter:
+    filename: rules.json
+    count: 1
+    match:
+      __lineno: 2
+      id: 12
+- filter:
+    filename: rules.json
+    count: 1
+    match:
+      __lineno: 3
+      id: 10
+- filter:
+    filename: rules.json
+    count: 1
+    match:
+      __lineno: 4
+      id: 14

tests/flowbits-invalid-01/suricata.yaml

@@ -0,0 +1,12 @@
+%YAML 1.1
+---
+
+engine-analysis:
+  rules: yes
+
+logging:
+  outputs:
+    - file:
+        enabled: yes
+        filename: eve.json
+        type: json

tests/flowbits-invalid-01/test.rules

@@ -0,0 +1 @@
+alert http any any -> any any (msg: "Illegal flowbit set + isset combination"; http.method; content:"GET"; flowbits:set,fb1; flowbits:isset,fb1; sid:111;)

tests/flowbits-invalid-01/test.yaml

@@ -0,0 +1,16 @@
+requires:
+  min-version: 8
+
+pcap: false
+
+exit-code: 1
+
+args:
+  - --engine-analysis
+
+checks:
+  - filter:
+      count: 1
+      match:
+        log_level: Error
+        engine.message: "invalid flowbit command combination in the same signature: set and isset"

tests/flowbits-invalid-02/suricata.yaml

@@ -0,0 +1,12 @@
+%YAML 1.1
+---
+
+engine-analysis:
+  rules: yes
+
+logging:
+  outputs:
+    - file:
+        enabled: yes
+        filename: eve.json
+        type: json

tests/flowbits-invalid-02/test.rules

@@ -0,0 +1 @@
+alert http any any -> any any (msg: "Illegal flowbit unset + isnotset combination"; http.method; content:"GET"; flowbits:unset,fb1; flowbits:isnotset,fb1; sid:111;)

tests/flowbits-invalid-02/test.yaml

@@ -0,0 +1,16 @@
+requires:
+  min-version: 8
+
+pcap: false
+
+exit-code: 1
+
+args:
+  - --engine-analysis
+
+checks:
+  - filter:
+      count: 1
+      match:
+        log_level: Error
+        engine.message: "invalid flowbit command combination in the same signature: unset and isnotset"

tests/flowbits-invalid-03/suricata.yaml

@@ -0,0 +1,12 @@
+%YAML 1.1
+---
+
+engine-analysis:
+  rules: yes
+
+logging:
+  outputs:
+    - file:
+        enabled: yes
+        filename: eve.json
+        type: json

tests/flowbits-invalid-03/test.rules

@@ -0,0 +1 @@
+alert http any any -> any any (msg: "Illegal flowbit set + toggle combination"; http.method; content:"GET"; flowbits:set,fb1; flowbits:toggle,fb1; sid:111;)

tests/flowbits-invalid-03/test.yaml

@@ -0,0 +1,16 @@
+requires:
+  min-version: 8
+
+pcap: false
+
+exit-code: 1
+
+args:
+  - --engine-analysis
+
+checks:
+  - filter:
+      count: 1
+      match:
+        log_level: Error
+        engine.message: "invalid flowbit command combination in the same signature: set and toggle"

tests/flowbits-invalid-04/suricata.yaml

@@ -0,0 +1,12 @@
+%YAML 1.1
+---
+
+engine-analysis:
+  rules: yes
+
+logging:
+  outputs:
+    - file:
+        enabled: yes
+        filename: eve.json
+        type: json

tests/flowbits-invalid-04/test.rules

@@ -0,0 +1 @@
+alert http any any -> any any (msg: "Illegal flowbit isset + isnot combination"; http.method; content:"GET"; flowbits:isset,fb1; flowbits:isnotset,fb1; sid:111;)

tests/flowbits-invalid-04/test.yaml

@@ -0,0 +1,16 @@
+requires:
+  min-version: 8
+
+pcap: false
+
+exit-code: 1
+
+args:
+  - --engine-analysis
+
+checks:
+  - filter:
+      count: 1
+      match:
+        log_level: Error
+        engine.message: "invalid flowbit command combination in the same signature: isset and isnotset"

tests/flowbits-invalid-05/suricata.yaml

@@ -0,0 +1,12 @@
+%YAML 1.1
+---
+
+engine-analysis:
+  rules: yes
+
+logging:
+  outputs:
+    - file:
+        enabled: yes
+        filename: eve.json
+        type: json

tests/flowbits-invalid-05/test.rules

@@ -0,0 +1 @@
+alert http any any -> any any (msg: "Illegal flowbit set + unset combination"; http.method; content:"GET"; flowbits:set,fb1; flowbits:unset,fb1; sid:111;)

tests/flowbits-invalid-05/test.yaml

@@ -0,0 +1,16 @@
+requires:
+  min-version: 8
+
+pcap: false
+
+exit-code: 1
+
+args:
+  - --engine-analysis
+
+checks:
+  - filter:
+      count: 1
+      match:
+        log_level: Error
+        engine.message: "invalid flowbit command combination in the same signature: set and unset"