From 2515eeb613077765843a4f7f4054eb0e4635eccb Mon Sep 17 00:00:00 2001 From: Shivani Bhardwaj Date: Fri, 23 Aug 2024 12:33:40 +0530 Subject: [PATCH 1/2] flow/pkts: add rules w new syntax --- tests/detect-flow-pkts/README.md | 2 +- tests/detect-flow-pkts/test.rules | 3 ++- tests/detect-flow-pkts/test.yaml | 5 +++++ 3 files changed, 8 insertions(+), 2 deletions(-) diff --git a/tests/detect-flow-pkts/README.md b/tests/detect-flow-pkts/README.md index 6691a2c40..2d9c13602 100644 --- a/tests/detect-flow-pkts/README.md +++ b/tests/detect-flow-pkts/README.md @@ -1,7 +1,7 @@ Test ==== -Test `flow.pkts_toclient` and alike (bytes, server) keywords +Test `flow.pkts:toclient`.. and alike (bytes, server) keywords PCAP ==== diff --git a/tests/detect-flow-pkts/test.rules b/tests/detect-flow-pkts/test.rules index d808c07d9..5aaa2bbd3 100644 --- a/tests/detect-flow-pkts/test.rules +++ b/tests/detect-flow-pkts/test.rules @@ -1 +1,2 @@ -alert ip any any -> any any (msg:"Flow has 10 packets"; flow.pkts_toclient:10; flow.pkts_toserver:10; flow.bytes_toserver:<3000; flow.bytes_toclient:>8000; sid:1;) +alert ip any any -> any any (msg:"Flow has 10 packets"; flow.pkts:toclient,=10; flow.pkts:toserver,=10; flow.bytes:toserver,<3000; flow.bytes:toclient,>8000; sid:1;) +alert ip any any -> any any (msg:"Flow has 10 packets (old syntax)"; flow.pkts_toclient:10; flow.pkts_toserver:10; flow.bytes_toserver:<3000; flow.bytes_toclient:>8000; sid:2;) diff --git a/tests/detect-flow-pkts/test.yaml b/tests/detect-flow-pkts/test.yaml index 440484ffc..7bb601c11 100644 --- a/tests/detect-flow-pkts/test.yaml +++ b/tests/detect-flow-pkts/test.yaml @@ -12,3 +12,8 @@ checks: match: event_type: alert alert.signature_id: 1 +- filter: + count: 1 + match: + event_type: alert + alert.signature_id: 2 From ece253cea969ccd8dd8317bf068dab09737fc56b Mon Sep 17 00:00:00 2001 From: Shivani Bhardwaj Date: Fri, 23 Aug 2024 12:36:50 +0530 Subject: [PATCH 2/2] flow/pkt: add test for either dir --- tests/detect-flow-pkts-either/README.md | 13 ++++++++ tests/detect-flow-pkts-either/test.rules | 5 ++++ tests/detect-flow-pkts-either/test.yaml | 38 ++++++++++++++++++++++++ 3 files changed, 56 insertions(+) create mode 100644 tests/detect-flow-pkts-either/README.md create mode 100644 tests/detect-flow-pkts-either/test.rules create mode 100644 tests/detect-flow-pkts-either/test.yaml diff --git a/tests/detect-flow-pkts-either/README.md b/tests/detect-flow-pkts-either/README.md new file mode 100644 index 000000000..89bdf91cd --- /dev/null +++ b/tests/detect-flow-pkts-either/README.md @@ -0,0 +1,13 @@ +Test +==== + +Test `flow.pkts:either`.. and `flow.bytes:either`.. keywords + +PCAP +==== + +From existing s-v test. + +Related tickets +============== +https://redmine.openinfosecfoundation.org/issues/5646 diff --git a/tests/detect-flow-pkts-either/test.rules b/tests/detect-flow-pkts-either/test.rules new file mode 100644 index 000000000..3a02f7a2d --- /dev/null +++ b/tests/detect-flow-pkts-either/test.rules @@ -0,0 +1,5 @@ +alert ip any any -> any any (msg:"Flow has more than 3000 bytes and 10 pkts in either direction";flow.pkts:either,=10;flow.bytes:either,>3000; sid:1;) +alert ip any any -> any any (msg:"Flow has 10 pkts in toserver direction";flow.pkts:toserver,=10;sid:2;) +alert ip any any -> any any (msg:"Flow has 10 pkts in toclient direction";flow.pkts:toclient,=10;sid:3;) +alert ip any any -> any any (msg:"Flow has more than 3000 bytes in toserver direction";flow.bytes:toserver,>3000; sid:4;) +alert ip any any -> any any (msg:"Flow has more than 3000 bytes in toclient direction";flow.bytes:toclient,>3000; threshold: type backoff, track by_flow, count 2, multiplier 10; sid:5;) diff --git a/tests/detect-flow-pkts-either/test.yaml b/tests/detect-flow-pkts-either/test.yaml new file mode 100644 index 000000000..634b6a034 --- /dev/null +++ b/tests/detect-flow-pkts-either/test.yaml @@ -0,0 +1,38 @@ +requires: + min-version: 8 + +pcap: ../decode-teredo-01/input.pcap + +args: +- -k none + +checks: +- filter: + count: 3 + match: + event_type: alert + alert.signature_id: 1 + +- filter: + count: 3 + match: + event_type: alert + alert.signature_id: 2 + +- filter: + count: 1 + match: + event_type: alert + alert.signature_id: 3 + +- filter: + count: 0 + match: + event_type: alert + alert.signature_id: 4 + +- filter: + count: 2 + match: + event_type: alert + alert.signature_id: 5