next/sv/125/20230904/v1

tests/reputation-config/iprep-categories.txt

@@ -0,0 +1,2 @@
+1,BadHosts,Known bad hosts
+2,Google,Known google host

tests/reputation-config/reputation-config-cr-lf/iprep-data.txt

@@ -0,0 +1,3 @@
+1.2.3.4,1,101
+1.2.3.5,1,101
+1.1.1.0/24,6,88

tests/reputation-config/reputation-config-cr-lf/test.yaml

@@ -0,0 +1,24 @@
+command: |
+  ${SRCDIR}/src/suricata -c "${SRCDIR}/suricata.yaml" -l "${OUTPUT_DIR}" \
+   --set "threshold-file=${TEST_DIR}/../threshold.config" \
+   --set "classification-file="${SRCDIR}`[ -f ${SRCDIR}/etc/classification.config ] && printf '/etc'`/classification.config \
+   --set "reference-config-file="${SRCDIR}`[ -f ${SRCDIR}/etc/reference.config ] && printf '/etc'`/reference.config \
+   -S "${TEST_DIR}/../test.rules" \
+   --set "reputation-categories-file=${TEST_DIR}/../iprep-categories.txt" \
+   --set "default-reputation-path=$TEST_DIR" \
+   --set "reputation-files.0=${TEST_DIR}/iprep-data.txt" \
+   --engine-analysis
+
+checks:
+  - shell:
+      args: grep 'Loading reputation file' suricata.log | wc -l | xargs
+      expect: 1
+  - shell:
+      args: grep '1 rule files processed. 2 rules successfully loaded, 0 rules failed' suricata.log | wc -l | xargs
+      expect: 1
+  - shell:
+      args: grep '2 signatures processed' suricata.log | wc -l | xargs
+      expect: 1
+  - shell:
+      args: grep 'Error[:]' suricata.log | wc -l | xargs
+      expect: 0

tests/reputation-config/reputation-config-cr/iprep-data.txt

@@ -0,0 +1 @@
+1.2.3.4,1,1011.2.3.5,1,1011.1.1.0/24,6,88

tests/reputation-config/reputation-config-cr/test.yaml

@@ -0,0 +1,24 @@
+command: |
+  ${SRCDIR}/src/suricata -c "${SRCDIR}/suricata.yaml" -l "${OUTPUT_DIR}" \
+   --set "threshold-file=${TEST_DIR}/../threshold.config" \
+   --set "classification-file="${SRCDIR}`[ -f ${SRCDIR}/etc/classification.config ] && printf '/etc'`/classification.config \
+   --set "reference-config-file="${SRCDIR}`[ -f ${SRCDIR}/etc/reference.config ] && printf '/etc'`/reference.config \
+   -S "${TEST_DIR}/../test.rules" \
+   --set "reputation-categories-file=${TEST_DIR}/../iprep-categories.txt" \
+   --set "default-reputation-path=$TEST_DIR" \
+   --set "reputation-files.0=${TEST_DIR}/iprep-data.txt" \
+   --engine-analysis
+
+checks:
+  - shell:
+      args: grep 'Loading reputation file' suricata.log | wc -l | xargs
+      expect: 1
+  - shell:
+      args: grep '1 rule files processed. 2 rules successfully loaded, 0 rules failed' suricata.log | wc -l | xargs
+      expect: 1
+  - shell:
+      args: grep '2 signatures processed' suricata.log | wc -l | xargs
+      expect: 1
+  - shell:
+      args: grep 'Error[:]' suricata.log | wc -l | xargs
+      expect: 0

tests/reputation-config/reputation-config-lf/iprep-data.txt

@@ -0,0 +1,3 @@
+1.2.3.4,1,101
+1.2.3.5,1,101
+1.1.1.0/24,6,88

tests/reputation-config/reputation-config-lf/test.yaml

@@ -0,0 +1,24 @@
+command: |
+  ${SRCDIR}/src/suricata -c "${SRCDIR}/suricata.yaml" -l "${OUTPUT_DIR}" \
+   --set "threshold-file=${TEST_DIR}/../threshold.config" \
+   --set "classification-file="${SRCDIR}`[ -f ${SRCDIR}/etc/classification.config ] && printf '/etc'`/classification.config \
+   --set "reference-config-file="${SRCDIR}`[ -f ${SRCDIR}/etc/reference.config ] && printf '/etc'`/reference.config \
+   -S "${TEST_DIR}/../test.rules" \
+   --set "reputation-categories-file=${TEST_DIR}/../iprep-categories.txt" \
+   --set "default-reputation-path=$TEST_DIR" \
+   --set "reputation-files.0=${TEST_DIR}/iprep-data.txt" \
+   --engine-analysis
+
+checks:
+  - shell:
+      args: grep 'Loading reputation file' suricata.log | wc -l | xargs
+      expect: 1
+  - shell:
+      args: grep '1 rule files processed. 2 rules successfully loaded, 0 rules failed' suricata.log | wc -l | xargs
+      expect: 1
+  - shell:
+      args: grep '2 signatures processed' suricata.log | wc -l | xargs
+      expect: 1
+  - shell:
+      args: grep 'Error[:]' suricata.log | wc -l | xargs
+      expect: 0

tests/reputation-config/test.py

@@ -0,0 +1,20 @@
+from pathlib import Path
+
+# Create config files with a mix syntax
+test = 'reputation-config'
+test_options = [
+    { 'path': f'{test}-lf',    'eol': '\n' },
+    { 'path': f'{test}-cr',    'eol': '\r' },
+    { 'path': f'{test}-cr-lf', 'eol': '\r\n' },
+]
+
+# Categories and IPs from
+# https://docs.suricata.io/en/suricata-6.0.0/reputation/ipreputation/ip-reputation-format.html
+
+for test in test_options:
+    path, eol = Path(test['path']), test['eol']
+
+    with open(path / 'iprep-data.txt', 'w') as rep_cfg:
+        rep_cfg.write(f'1.2.3.4,1,101{eol}')
+        rep_cfg.write(f'1.2.3.5,1,101{eol}')
+        rep_cfg.write(f'1.1.1.0/24,6,88{eol}')

tests/reputation-config/test.rules

@@ -0,0 +1,2 @@
+alert ip any any -> any any (msg:"BadHosts: Some bad hosts have been detected"; iprep:any,BadHosts,>,30; sid:1; rev:1;)
+alert ip any any -> any any (msg:"Google: Some google host has been detected"; iprep:any,Google,>,30; sid:2; rev:1;)