Skip to content

Commit 71cd6f8

Browse files
committed
multi-tenant: Basic multi-tenant selector tests
This commit adds basic tests for vlan-selector configurations (including vlan-tuple, added in 6237) Issue: 6237
1 parent 4de2a8c commit 71cd6f8

21 files changed

+363
-0
lines changed
Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
../vlan-selector-01/classification.config
Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
../vlan-selector-01/reference.config
Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
%YAML 1.1
2+
---
3+
4+
classification-file: classification.config
5+
reference-config-file: reference.config
6+
7+
include: tenant.yaml
Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
%YAML 1.1
2+
---
3+
4+
# Suricata configuration file. In addition to the comments describing all
5+
# options in this file, full documentation can be found at:
6+
# https://suricata.readthedocs.io/en/latest/configuration/suricata-yaml.html
7+
8+
##
9+
## Step 1: Inform Suricata about your network
10+
##
11+
12+
vars:
13+
# more specific is better for alert accuracy and performance
14+
address-groups:
15+
HOME_NET: "[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]"
16+
#HOME_NET: "[192.168.0.0/16]"
17+
#HOME_NET: "[10.0.0.0/8]"
18+
#HOME_NET: "[172.16.0.0/12]"
19+
#HOME_NET: "any"
20+
21+
EXTERNAL_NET: "!$HOME_NET"
22+
#EXTERNAL_NET: "any"
23+
24+
HTTP_SERVERS: "$HOME_NET"
25+
SMTP_SERVERS: "$HOME_NET"
26+
SQL_SERVERS: "$HOME_NET"
27+
DNS_SERVERS: "$HOME_NET"
28+
TELNET_SERVERS: "$HOME_NET"
29+
AIM_SERVERS: "$EXTERNAL_NET"
30+
DC_SERVERS: "$HOME_NET"
31+
DNP3_SERVER: "$HOME_NET"
32+
DNP3_CLIENT: "$HOME_NET"
33+
MODBUS_CLIENT: "$HOME_NET"
34+
MODBUS_SERVER: "$HOME_NET"
35+
ENIP_CLIENT: "$HOME_NET"
36+
ENIP_SERVER: "$HOME_NET"
37+
38+
port-groups:
39+
HTTP_PORTS: "80"
40+
SHELLCODE_PORTS: "!80"
41+
ORACLE_PORTS: 1521
42+
SSH_PORTS: 22
43+
DNP3_PORTS: 20000
44+
MODBUS_PORTS: 502
45+
FILE_DATA_PORTS: "[$HTTP_PORTS,110,143]"
46+
FTP_PORTS: 21
47+
GENEVE_PORTS: 6081
48+
VXLAN_PORTS: 4789
49+
TEREDO_PORTS: 3544
50+
51+
rule-files:
52+
- tenant.rules
53+
54+
classification-file: classification.config
55+
reference-config-file: reference.config
Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
alert tcp-pkt any any -> any any (msg:"byte extract test 1"; byte_extract:2,0,two1,string,dec; content:"|33 34|"; offset:0; depth:two1; sid:1; rev:1;)
2+
alert tcp-pkt any any -> any any (msg:"byte extract test 2"; byte_extract:1,2,two2,string,dec; content:"|33 34|"; offset:8; depth:two2; sid:2; rev:1;)
3+
alert tcp-pkt any any -> any any (msg:"byte extract test 3"; byte_extract:1,2,two3,string,dec; byte_extract:1,5,eight,string,dec; content:"|33 34|"; offset:eight; depth:two3; sid:3; rev:1;)
4+
alert tcp-pkt any any -> any any (msg:"byte extract test 4"; byte_extract:1,3,sixd1,string,dec; content:"|31 30|"; content:"|33 34|"; distance:sixd1; sid:4; rev:1;)
5+
alert tcp-pkt any any -> any any (msg:"byte extract test 5"; byte_extract:1,2,twow,string,dec; byte_extract:1,3,sixd2,string,dec; content:"|31 30|"; content:"|33 34|"; distance:sixd2; within:twow; sid: 5; rev:1;)
6+
alert tcp-pkt any any -> any any (msg:"byte extract test 6"; content:"|31 30|"; byte_extract:1,6,three1,relative,string,dec; content:"|36 10|"; offset:three1; depth:2; sid:6; rev:1;)
7+
alert tcp-pkt any any -> any any (msg:"byte extract test 7"; byte_extract:1,2,dectwo1,string,dec; content:"|32|"; offset:dectwo1; depth:1; sid:7; rev:1;)
8+
alert tcp-pkt any any -> any any (msg:"byte extract test 8"; byte_extract:1,2,dectwo2,string,dec; content:"|32|"; offset:dectwo2; sid:8; rev:1;)
9+
alert tcp-pkt any any -> any any (msg:"byte extract test 9"; byte_extract:1,4,hexten; byte_extract:1,0,decone,string,dec; content:"|66|"; offset:hexten; depth:decone; sid:9; rev:1;)
10+
alert tcp-pkt any any -> any any (msg:"byte extract test 10"; byte_extract:1,4,two4; content:"|31|"; depth:1; content:"|2e|"; distance:two4; within:1; sid:10; rev:1;)
Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
%YAML 1.1
2+
---
3+
4+
multi-detect:
5+
enabled: on
6+
default: on
7+
selector: vlan-tupleee
8+
9+
tenants:
10+
- id: 1
11+
yaml: tenant-1.yaml
12+
13+
mappings:
14+
- vlan-id: 1011
15+
tenant-id: 1
Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
requires:
2+
min-version: 7
3+
4+
command: |
5+
${SRCDIR}/src/suricata -l ${OUTPUT_DIR} -c ${TEST_DIR}/suricata.yaml -T
6+
7+
exit-code: 1
Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
#
2+
# config classification:shortname,short description,priority
3+
#
4+
5+
config classification: not-suspicious,Not Suspicious Traffic,3
6+
config classification: unknown,Unknown Traffic,3
7+
config classification: bad-unknown,Potentially Bad Traffic, 2
8+
config classification: attempted-recon,Attempted Information Leak,2
9+
config classification: successful-recon-limited,Information Leak,2
10+
config classification: successful-recon-largescale,Large Scale Information Leak,2
11+
config classification: attempted-dos,Attempted Denial of Service,2
12+
config classification: successful-dos,Denial of Service,2
13+
config classification: attempted-user,Attempted User Privilege Gain,1
14+
config classification: unsuccessful-user,Unsuccessful User Privilege Gain,1
15+
config classification: successful-user,Successful User Privilege Gain,1
16+
config classification: attempted-admin,Attempted Administrator Privilege Gain,1
17+
config classification: successful-admin,Successful Administrator Privilege Gain,1
18+
19+
# NEW CLASSIFICATIONS
20+
config classification: rpc-portmap-decode,Decode of an RPC Query,2
21+
config classification: shellcode-detect,Executable code was detected,1
22+
config classification: string-detect,A suspicious string was detected,3
23+
config classification: suspicious-filename-detect,A suspicious filename was detected,2
24+
config classification: suspicious-login,An attempted login using a suspicious username was detected,2
25+
config classification: system-call-detect,A system call was detected,2
26+
config classification: tcp-connection,A TCP connection was detected,4
27+
config classification: trojan-activity,A Network Trojan was detected, 1
28+
config classification: unusual-client-port-connection,A client was using an unusual port,2
29+
config classification: network-scan,Detection of a Network Scan,3
30+
config classification: denial-of-service,Detection of a Denial of Service Attack,2
31+
config classification: non-standard-protocol,Detection of a non-standard protocol or event,2
32+
config classification: protocol-command-decode,Generic Protocol Command Decode,3
33+
config classification: web-application-activity,access to a potentially vulnerable web application,2
34+
config classification: web-application-attack,Web Application Attack,1
35+
config classification: misc-activity,Misc activity,3
36+
config classification: misc-attack,Misc Attack,2
37+
config classification: icmp-event,Generic ICMP event,3
38+
config classification: inappropriate-content,Inappropriate Content was Detected,1
39+
config classification: policy-violation,Potential Corporate Privacy Violation,1
40+
config classification: default-login-attempt,Attempt to login by a default username and password,2
41+
42+
# Update
43+
config classification: targeted-activity,Targeted Malicious Activity was Detected,1
44+
config classification: exploit-kit,Exploit Kit Activity Detected,1
45+
config classification: external-ip-check,Device Retrieving External IP Address Detected,2
46+
config classification: domain-c2,Domain Observed Used for C2 Detected,1
47+
config classification: pup-activity,Possibly Unwanted Program Detected,2
48+
config classification: credential-theft,Successful Credential Theft Detected,1
49+
config classification: social-engineering,Possible Social Engineering Attempted,2
50+
config classification: coin-mining,Crypto Currency Mining Activity Detected,2
51+
config classification: command-and-control,Malware Command and Control Activity Detected,1
Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
# config reference: system URL
2+
3+
config reference: bugtraq http://www.securityfocus.com/bid/
4+
config reference: bid http://www.securityfocus.com/bid/
5+
config reference: cve http://cve.mitre.org/cgi-bin/cvename.cgi?name=
6+
#config reference: cve http://cvedetails.com/cve/
7+
config reference: secunia http://www.secunia.com/advisories/
8+
9+
#whitehats is unfortunately gone
10+
config reference: arachNIDS http://www.whitehats.com/info/IDS
11+
12+
config reference: McAfee http://vil.nai.com/vil/content/v_
13+
config reference: nessus http://cgi.nessus.org/plugins/dump.php3?id=
14+
config reference: url http://
15+
config reference: et http://doc.emergingthreats.net/
16+
config reference: etpro http://doc.emergingthreatspro.com/
17+
config reference: telus http://
18+
config reference: osvdb http://osvdb.org/show/osvdb/
19+
config reference: threatexpert http://www.threatexpert.com/report.aspx?md5=
20+
config reference: md5 http://www.threatexpert.com/report.aspx?md5=
21+
config reference: exploitdb http://www.exploit-db.com/exploits/
22+
config reference: openpacket https://www.openpacket.org/capture/grab/
23+
config reference: securitytracker http://securitytracker.com/id?
24+
config reference: secunia http://secunia.com/advisories/
25+
config reference: xforce http://xforce.iss.net/xforce/xfdb/
26+
config reference: msft http://technet.microsoft.com/security/bulletin/
Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
%YAML 1.1
2+
---
3+
4+
classification-file: classification.config
5+
reference-config-file: reference.config
6+
7+
include: tenant.yaml

0 commit comments

Comments
 (0)