Skip to content

Commit

Permalink
tests: add rule type checks for iprep rules
Browse files Browse the repository at this point in the history
Added these separately, as they require extra config files.
As the test name still includes `rule-types`, it's still possible to
both batches of tests at once.

Related to
Task #https://redmine.openinfosecfoundation.org/issues/7031
  • Loading branch information
jufajardini committed Nov 29, 2024
1 parent a5b3cb0 commit a6898cf
Show file tree
Hide file tree
Showing 6 changed files with 27,616 additions and 0 deletions.
5 changes: 5 additions & 0 deletions tests/iprep-12-rule-types/README.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
# Test Description

Check rule types with iprep keyword present: set, isset and isnotset options.

Test setup copied and adapted from test `iprep-11-isset`.
6 changes: 6 additions & 0 deletions tests/iprep-12-rule-types/iprep.rules
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
alert ip any any -> any any (sid:1; iprep:dst,2402000,isset;)
alert ip any any -> any any (sid:2; iprep:dst,2402000,isnotset;)
alert ip any any -> any any (sid:3; iprep:dst,2402000,=,0;)
alert http any any -> any any (sid:4; iprep:dst,2402000,=,0;)
alert http any any -> any any (sid:5; iprep:dst,2402000,isset;)
alert http any any -> any any (sid:6; iprep:dst,2402000,isnotset;)
10 changes: 10 additions & 0 deletions tests/iprep-12-rule-types/scirius-categories.txt
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
1,2520000,ET TOR Known Tor Exit Node Traffic
2,2522000,ET TOR Known Tor Relay/Router (Not Exit) Node Traffic
3,2403300,ET CINS Active Threat Intelligence Poor Reputation IP
4,2525000,ET 3CORESec Poor Reputation IP
5,2400000,ET DROP Spamhaus DROP Listed Traffic Inbound
6,2500000,ET COMPROMISED Known Compromised or Hostile Host Traffic
7,2404033,ET CNC Shadowserver Reported CnC Server
8,2404000,ET CNC Shadowserver Reported CnC Server IP
9,2404300,ET CNC Feodo Tracker Reported CnC Server
10,2402000,ET DROP Dshield Block Listed Source
Loading

0 comments on commit a6898cf

Please sign in to comment.