From 0d623471919191368bbcf27aa0a3c2a8289623d8 Mon Sep 17 00:00:00 2001 From: Yatin Kanetkar Date: Thu, 24 Aug 2023 07:11:23 -0500 Subject: [PATCH] dhcp: Validate dhcp option 60 is being logged --- tests/dhcp-eve-extended-option-60/README.md | 11 +++++ tests/dhcp-eve-extended-option-60/input.pcap | Bin 0 -> 396 bytes .../dhcp-eve-extended-option-60/suricata.yaml | 12 ++++++ tests/dhcp-eve-extended-option-60/test.yaml | 38 ++++++++++++++++++ 4 files changed, 61 insertions(+) create mode 100644 tests/dhcp-eve-extended-option-60/README.md create mode 100644 tests/dhcp-eve-extended-option-60/input.pcap create mode 100644 tests/dhcp-eve-extended-option-60/suricata.yaml create mode 100644 tests/dhcp-eve-extended-option-60/test.yaml diff --git a/tests/dhcp-eve-extended-option-60/README.md b/tests/dhcp-eve-extended-option-60/README.md new file mode 100644 index 000000000..7e01dc5e2 --- /dev/null +++ b/tests/dhcp-eve-extended-option-60/README.md @@ -0,0 +1,11 @@ +# Test Description + +Validate that dhcp option 60 (vendor class identifier) is being logged by suricata + +## PCAP + +Extracted a single packet from a pcap that had the vendor-class-id option present + +## Related issues +[Feature 4587](https://redmine.openinfosecfoundation.org/issues/4587) + diff --git a/tests/dhcp-eve-extended-option-60/input.pcap b/tests/dhcp-eve-extended-option-60/input.pcap new file mode 100644 index 0000000000000000000000000000000000000000..c11b5708417603e58e6f46a9f5dbfa8c23da3411 GIT binary patch literal 396 zcmca|c+)~A1{MYcU}0bca;{5v1?{}f%#Z@)fbf4X&^UkVPH!0pgDV4L7|%%th6X{M z^B|odNd^}NXGSNbrHqVh3=d?EOCU@{ups&o{GrZDZVFB|Wn{KxXN367h~>Zv#(W+g wzs%(9V&BAMr~LfvKz^Vvkp*lxe1qLW6ioFD%y}63nb~yo^yL*Re`@~+0O>R~SpWb4 literal 0 HcmV?d00001 diff --git a/tests/dhcp-eve-extended-option-60/suricata.yaml b/tests/dhcp-eve-extended-option-60/suricata.yaml new file mode 100644 index 000000000..cba2138a3 --- /dev/null +++ b/tests/dhcp-eve-extended-option-60/suricata.yaml @@ -0,0 +1,12 @@ +%YAML 1.1 +--- + +outputs: + - eve-log: + enabled: true + filename: eve.json + types: + - alert + - dhcp: + extended: true + - flow diff --git a/tests/dhcp-eve-extended-option-60/test.yaml b/tests/dhcp-eve-extended-option-60/test.yaml new file mode 100644 index 000000000..b875a1970 --- /dev/null +++ b/tests/dhcp-eve-extended-option-60/test.yaml @@ -0,0 +1,38 @@ +requires: + min-version: 7 + +checks: +- filter: + count: 1 + match: + dest_port: 67 + dhcp.id: 3759982360 + dhcp.params[0]: subnet_mask + dhcp.params[1]: domain + dhcp.params[2]: router + dhcp.params[3]: dns_server + dhcp.type: request + dhcp.vendor_class_identifier: MSFT 5.0 + event_type: dhcp + pcap_cnt: 1 + proto: UDP + src_ip: 0.0.0.0 + src_port: 68 +- filter: + count: 1 + match: + app_proto: dhcp + dest_ip: 255.255.255.255 + dest_port: 67 + event_type: flow + flow.age: 0 + flow.alerted: false + flow.bytes_toclient: 0 + flow.bytes_toserver: 356 + flow.pkts_toclient: 0 + flow.pkts_toserver: 1 + flow.reason: shutdown + flow.state: new + proto: UDP + src_ip: 0.0.0.0 + src_port: 68