From 65ccd846467cace2f7aaaa47476ec606ac58d9c8 Mon Sep 17 00:00:00 2001 From: Jeff Lucovsky Date: Mon, 12 Jun 2023 09:41:57 -0400 Subject: [PATCH] detect/bytemath: Test multiplier operator Issue: 6070 This commit adds a test for the byte-math multiplication operator. The operator was missing from 6.0.x; however, this test applies to 6.0.x and later once the Suricata PR is merged. --- tests/detect-bytemath-mult-04/README.md | 11 +++++++++++ tests/detect-bytemath-mult-04/test.rules | 6 ++++++ tests/detect-bytemath-mult-04/test.yaml | 11 +++++++++++ 3 files changed, 28 insertions(+) create mode 100644 tests/detect-bytemath-mult-04/README.md create mode 100644 tests/detect-bytemath-mult-04/test.rules create mode 100644 tests/detect-bytemath-mult-04/test.yaml diff --git a/tests/detect-bytemath-mult-04/README.md b/tests/detect-bytemath-mult-04/README.md new file mode 100644 index 000000000..80e0ff64d --- /dev/null +++ b/tests/detect-bytemath-mult-04/README.md @@ -0,0 +1,11 @@ +Description +=========== +Test byte_math multiplication operator + +PCAP +==== +PCAP comes from the suricata verify test[detect-bytemath-01] + +Redmine ticket +============== +https://redmine.openinfosecfoundation.org/issues/6070 diff --git a/tests/detect-bytemath-mult-04/test.rules b/tests/detect-bytemath-mult-04/test.rules new file mode 100644 index 000000000..fcbc622f2 --- /dev/null +++ b/tests/detect-bytemath-mult-04/test.rules @@ -0,0 +1,6 @@ +alert tcp any any -> any any (msg:"byte_math multiplication operator"; \ + ipv4.hdr; \ + byte_extract: 1, 5, extracted_val, relative; \ + byte_math: bytes 1, offset 1, oper *,rvalue extracted_val, result var; \ + byte_test: 1, = , var, 1; \ + sid: 1;) diff --git a/tests/detect-bytemath-mult-04/test.yaml b/tests/detect-bytemath-mult-04/test.yaml new file mode 100644 index 000000000..af93fd70b --- /dev/null +++ b/tests/detect-bytemath-mult-04/test.yaml @@ -0,0 +1,11 @@ +requires: + min-version: 6.0.12 + +pcap: ../detect-bytemath-01/input.pcap + +checks: + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 1