Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

tests: add rule type check for flowbits v5 #1512

Closed

Conversation

hadiqaalamdar
Copy link
Contributor

@hadiqaalamdar hadiqaalamdar commented Dec 5, 2023

Task #6309
Related to
Issue: #6309

Redmine ticket: https://redmine.openinfosecfoundation.org/issues/6309
Previous PR: #1441

Suricata PR: OISF/suricata#10006

Output from console:

===> flowbits: Sub test #11: FAIL : expected 1 matches; got 0 for filter {'filename': 'rules.json', 'count': 1, 'match': {'id': 11, 'lists.packet.matches[0].name': 'flowbits', 'lists.packet.matches[0].flowbits.action': 'noalert'}}

Output from stdout file:

Notice: suricata: This is Suricata version 7.0.3-dev (2fe2d8250 2023-10-19) running in USER mode [LogVersion:suricata.c:1149]
Warning: threshold-config: Error opening file: "/usr/local/etc/suricata//threshold.config": Permission denied [SCThresholdConfInitContext:util-threshold-config.c:177]
Warning: detect-flowbits: flowbit 'fb3' is checked but not set. Checked in 4 and 1 other sigs [DetectFlowbitsAnalyze:detect-flowbits.c:602]
Warning: detect-flowbits: flowbit 'fb4' is checked but not set. Checked in 5 and 0 other sigs [DetectFlowbitsAnalyze:detect-flowbits.c:602]

Copy link
Contributor

@jufajardini jufajardini left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice work, most tests are passing, and the output seems to be very close to what we're expecting it to look like!

I've noticed that on the previous Suricata PR, Shivani had requested the addition of two other types of rules (cf OISF/suricata#9691 (comment)), could you please ensure we have those cases covered here, too? :)

I have left a comment review on the Suricata PR about my guess on why is the last check for the tests here failing.

@@ -0,0 +1,100 @@
requires:
min-version: 7.0.0
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For now, let's keep min-version: 8.0, as we're not sure if we will bring this work to suricata 7, yet :)

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

got it.

@hadiqaalamdar
Copy link
Contributor Author

New branch: #1526

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

Successfully merging this pull request may close these issues.

2 participants