tests: add tests for smb.version keyword

Signed-off-by: jason taylor <[email protected]>
OISF · Aug 29, 2023 · 500c99e · 500c99e
1 parent e338b7b
commit 500c99e
Show file tree

Hide file tree

Showing 7 changed files with 42 additions and 0 deletions.
diff --git a/tests/smb-version-keyword-invalid/README.md b/tests/smb-version-keyword-invalid/README.md
@@ -0,0 +1,4 @@
+TEST
+====
+
+Test invalid smb.version keyword syntax in signature
diff --git a/tests/smb-version-keyword-invalid/test.rules b/tests/smb-version-keyword-invalid/test.rules
@@ -0,0 +1 @@
+alert smb any any -> any any (msg:"Two smb version declarations"; flow:established; smb.version:2; smb.version:1; sid:1;)
diff --git a/tests/smb-version-keyword-invalid/test.yaml b/tests/smb-version-keyword-invalid/test.yaml
@@ -0,0 +1,14 @@
+requires:
+  min-version: 7
+
+args:
+- -k none
+
+pcap: ../smb-version-keyword/input.pcap
+
+checks:
+- shell:
+    args: grep "Can't use 2 or more smb.version declarations" suricata.log | wc -l | xargs
+    expect: 1
+
+exit-code: 1
diff --git a/tests/smb-version-keyword/README.md b/tests/smb-version-keyword/README.md
@@ -0,0 +1,4 @@
+TEST
+====
+
+Test smb.version keyword
diff --git a/tests/smb-version-keyword/input.pcap b/tests/smb-version-keyword/input.pcap
diff --git a/tests/smb-version-keyword/test.rules b/tests/smb-version-keyword/test.rules
@@ -0,0 +1,2 @@
+alert smb any any -> any any (msg:"SMBv1 Request"; flow:established; smb.version:1; sid:1;)
+alert smb any any -> any any (msg:"SMBv2 Request"; flow:established; smb.version:2; sid:2;)
diff --git a/tests/smb-version-keyword/test.yaml b/tests/smb-version-keyword/test.yaml
@@ -0,0 +1,17 @@
+requires:
+  min-version: 7
+
+args:
+- -k none
+
+checks:
+- filter:
+    count: 2
+    match:
+      event_type: alert
+      alert.signature_id: 1
+- filter:
+    count: 14
+    match:
+      event_type: alert
+      alert.signature_id: 2
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		alert smb any any -> any any (msg:"Two smb version declarations"; flow:established; smb.version:2; smb.version:1; sid:1;)
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,2 @@
		alert smb any any -> any any (msg:"SMBv1 Request"; flow:established; smb.version:1; sid:1;)
		alert smb any any -> any any (msg:"SMBv2 Request"; flow:established; smb.version:2; sid:2;)