Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

next/sv/683/20250110/v1 #2227

Merged
merged 5 commits into from
Jan 10, 2025
+862 −2
Merged

next/sv/683/20250110/v1 #2227

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
57a2297
dns: adds test for corrupt additionals
catenacyber Sep 10, 2024
06bc7e2
tests: update for stricter timeout handling
victorjulien Sep 20, 2024
ba743e5
tests: don't enforce shutdown flow logging
victorjulien Dec 20, 2024
5499db2
tests: add bug 7422 tests
victorjulien Nov 30, 2024
275089e
tests: add RST with unacked data file tests
victorjulien Dec 3, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions tests/dns/dns-corrupt-additionals/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
# Description

Test logging of DNS with corrupt additionals

https://redmine.openinfosecfoundation.org/issues/7228

# PCAP

The pcap is from https://redmine.openinfosecfoundation.org/issues/7228
(crafted to corrupt additionals)
12 changes: 12 additions & 0 deletions tests/dns/dns-corrupt-additionals/dns-events.rules
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
# Malformed data in request. Malformed means length fields are wrong, etc.
alert dns any any -> any any (msg:"SURICATA DNS malformed request data"; flow:to_server; app-layer-event:dns.malformed_data; classtype:protocol-command-decode; sid:2240002; rev:2;)
alert dns any any -> any any (msg:"SURICATA DNS malformed response data"; flow:to_client; app-layer-event:dns.malformed_data; classtype:protocol-command-decode; sid:2240003; rev:2;)
# Response flag set on to_server packet
alert dns any any -> any any (msg:"SURICATA DNS Not a request"; flow:to_server; app-layer-event:dns.not_a_request; classtype:protocol-command-decode; sid:2240004; rev:2;)
# Response flag not set on to_client packet
alert dns any any -> any any (msg:"SURICATA DNS Not a response"; flow:to_client; app-layer-event:dns.not_a_response; classtype:protocol-command-decode; sid:2240005; rev:2;)
# Z flag (reserved) not 0
alert dns any any -> any any (msg:"SURICATA DNS Z flag set"; app-layer-event:dns.z_flag_set; classtype:protocol-command-decode; sid:2240006; rev:2;)
alert dns any any -> any any (msg:"SURICATA DNS Invalid opcode"; app-layer-event:dns.invalid_opcode; classtype:protocol-command-decode; sid:2240007; rev:1;)
alert dns any any -> any any (msg:"SURICATA DNS invalid additionals"; app-layer-event:dns.invalid_additionals; classtype:protocol-command-decode; sid:2240008; rev:1;)
alert dns any any -> any any (msg:"SURICATA DNS invalid authorities"; app-layer-event:dns.invalid_authorities; classtype:protocol-command-decode; sid:2240009; rev:1;)
Binary file added tests/dns/dns-corrupt-additionals/input.pcap
View file
Open in desktop
Binary file not shown.
18 changes: 18 additions & 0 deletions tests/dns/dns-corrupt-additionals/test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,18 @@
requires:
min-version: 8

args:
- -k none

checks:
- filter:
count: 1
match:
event_type: dns
dns.answers[0].rrname: "_sip._udp.sip.voice.google.com"
- filter:
count: 1
match:
event_type: alert
alert.signature_id: 2240008
dns.queries[0].rrtype: SRV
2 changes: 0 additions & 2 deletions tests/pgsql/pgsql-ssl-rejected-md5-auth-simple-query/test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -141,7 +141,6 @@ checks:
flow.bytes_toserver: 1180
flow.pkts_toclient: 12
flow.pkts_toserver: 15
flow.reason: shutdown
flow.state: closed
proto: TCP
src_ip: 10.16.1.10
Expand All @@ -168,7 +167,6 @@ checks:
flow.bytes_toserver: 626
flow.pkts_toclient: 6
flow.pkts_toserver: 8
flow.reason: shutdown
flow.state: closed
proto: TCP
src_ip: 10.16.1.10
Expand Down
8 changes: 8 additions & 0 deletions tests/tcp-rst-unacked-stream-01-raw/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
Test
====

Test series that tests if a RST that comes in before all data is ACK'd the
unACK'd data is still reassembled and inspected, but does not trigger a GAP
event.

This test tests raw reassembly inspection of unack'd data w/o GAP.
Binary file added tests/tcp-rst-unacked-stream-01-raw/input.pcap
View file
Open in desktop
Binary file not shown.
2 changes: 2 additions & 0 deletions tests/tcp-rst-unacked-stream-01-raw/test.rules
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
alert tcp any any -> any any (content:"Let Me In"; sid:1;)
alert tcp any any -> any any (msg:"SURICATA STREAM reassembly sequence GAP -- missing packet(s)"; stream-event:reassembly_seq_gap; threshold:type backoff, track by_flow, count 1, multiplier 10; classtype:protocol-command-decode; sid:2210048; rev:3;)
20 changes: 20 additions & 0 deletions tests/tcp-rst-unacked-stream-01-raw/test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,20 @@
requires:
min-version: 8

checks:
- filter:
count: 1
match:
event_type: alert
alert.signature_id: 1
pkt_src: "stream (flow timeout)"
- filter:
count: 0
match:
event_type: alert
alert.signature_id: 2210048
- filter:
count: 1
match:
event_type: stats
stats.tcp.reassembly_gap: 0
15 changes: 15 additions & 0 deletions tests/tcp-rst-unacked-stream-01-raw/writepcap.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
#!/usr/bin/env python
from scapy.all import *

pkts = []

pkts += Ether(dst='05:04:03:02:01:00', src='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(src='1.1.1.1', dst='2.2.2.2')/TCP(dport=8080,sport=12345,flags='S',seq=1,options=[('WScale', 14)])
pkts += Ether(src='05:04:03:02:01:00', dst='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(dst='1.1.1.1', src='2.2.2.2')/TCP(sport=8080,dport=12345,flags='SA',seq=1000,ack=2,options=[('WScale', 14)],window=65535)
pkts += Ether(dst='05:04:03:02:01:00', src='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(src='1.1.1.1', dst='2.2.2.2')/TCP(dport=8080,sport=12345,flags='A',seq=2,ack=1001,window=65535)
pkts += Ether(src='05:04:03:02:01:00', dst='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(dst='1.1.1.1', src='2.2.2.2')/TCP(sport=8080,dport=12345,flags='AP',seq=1001,ack=2,window=65535)/"Please "
pkts += Ether(src='05:04:03:02:01:00', dst='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(dst='1.1.1.1', src='2.2.2.2')/TCP(sport=8080,dport=12345,flags='AP',seq=1008,ack=2,window=65535)/"Let "
pkts += Ether(src='05:04:03:02:01:00', dst='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(dst='1.1.1.1', src='2.2.2.2')/TCP(sport=8080,dport=12345,flags='AP',seq=1012,ack=2,window=65535)/"Me "
pkts += Ether(src='05:04:03:02:01:00', dst='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(dst='1.1.1.1', src='2.2.2.2')/TCP(sport=8080,dport=12345,flags='AP',seq=1015,ack=2,window=65535)/"In!"
pkts += Ether(dst='05:04:03:02:01:00', src='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(src='1.1.1.1', dst='2.2.2.2')/TCP(dport=8080,sport=12345,flags='RA',seq=2,ack=1008,window=65535)/"Access Denied"

wrpcap('input.pcap', pkts)
8 changes: 8 additions & 0 deletions tests/tcp-rst-unacked-stream-02-raw-ips/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
Test
====

Test series that tests if a RST that comes in before all data is ACK'd the
unACK'd data is still reassembled and inspected, but does not trigger a GAP
event.

This test tests raw reassembly inspection of unack'd data w/o GAP in IPS mode.
Binary file added tests/tcp-rst-unacked-stream-02-raw-ips/input.pcap
View file
Open in desktop
Binary file not shown.
2 changes: 2 additions & 0 deletions tests/tcp-rst-unacked-stream-02-raw-ips/test.rules
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
alert tcp any any -> any any (content:"Let Me In"; sid:1;)
alert tcp any any -> any any (msg:"SURICATA STREAM reassembly sequence GAP -- missing packet(s)"; stream-event:reassembly_seq_gap; threshold:type backoff, track by_flow, count 1, multiplier 10; classtype:protocol-command-decode; sid:2210048; rev:3;)
20 changes: 20 additions & 0 deletions tests/tcp-rst-unacked-stream-02-raw-ips/test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,20 @@
requires:
min-version: 8

checks:
- filter:
count: 1
match:
event_type: alert
alert.signature_id: 1
pcap_cnt: 7
- filter:
count: 0
match:
event_type: alert
alert.signature_id: 2210048
- filter:
count: 1
match:
event_type: stats
stats.tcp.reassembly_gap: 0
15 changes: 15 additions & 0 deletions tests/tcp-rst-unacked-stream-02-raw-ips/writepcap.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
#!/usr/bin/env python
from scapy.all import *

pkts = []

pkts += Ether(dst='05:04:03:02:01:00', src='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(src='1.1.1.1', dst='2.2.2.2')/TCP(dport=8080,sport=12345,flags='S',seq=1,options=[('WScale', 14)])
pkts += Ether(src='05:04:03:02:01:00', dst='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(dst='1.1.1.1', src='2.2.2.2')/TCP(sport=8080,dport=12345,flags='SA',seq=1000,ack=2,options=[('WScale', 14)],window=65535)
pkts += Ether(dst='05:04:03:02:01:00', src='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(src='1.1.1.1', dst='2.2.2.2')/TCP(dport=8080,sport=12345,flags='A',seq=2,ack=1001,window=65535)
pkts += Ether(src='05:04:03:02:01:00', dst='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(dst='1.1.1.1', src='2.2.2.2')/TCP(sport=8080,dport=12345,flags='AP',seq=1001,ack=2,window=65535)/"Please "
pkts += Ether(src='05:04:03:02:01:00', dst='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(dst='1.1.1.1', src='2.2.2.2')/TCP(sport=8080,dport=12345,flags='AP',seq=1008,ack=2,window=65535)/"Let "
pkts += Ether(src='05:04:03:02:01:00', dst='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(dst='1.1.1.1', src='2.2.2.2')/TCP(sport=8080,dport=12345,flags='AP',seq=1012,ack=2,window=65535)/"Me "
pkts += Ether(src='05:04:03:02:01:00', dst='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(dst='1.1.1.1', src='2.2.2.2')/TCP(sport=8080,dport=12345,flags='AP',seq=1015,ack=2,window=65535)/"In!"
pkts += Ether(dst='05:04:03:02:01:00', src='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(src='1.1.1.1', dst='2.2.2.2')/TCP(dport=8080,sport=12345,flags='RA',seq=2,ack=1008,window=65535)/"Access Denied"

wrpcap('input.pcap', pkts)
8 changes: 8 additions & 0 deletions tests/tcp-rst-unacked-stream-03-gap/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
Test
====

Test series that tests if a RST that comes in before all data is ACK'd the
unACK'd data is still reassembled and inspected, but does not trigger a GAP
event.

This test tests raw reassembly inspection of unack'd data with GAP.
Binary file added tests/tcp-rst-unacked-stream-03-gap/input.pcap
View file
Open in desktop
Binary file not shown.
2 changes: 2 additions & 0 deletions tests/tcp-rst-unacked-stream-03-gap/test.rules
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
alert tcp any any -> any any (content:"Me In"; sid:1;)
alert tcp any any -> any any (msg:"SURICATA STREAM reassembly sequence GAP -- missing packet(s)"; stream-event:reassembly_seq_gap; threshold:type backoff, track by_flow, count 1, multiplier 10; classtype:protocol-command-decode; sid:2210048; rev:3;)
20 changes: 20 additions & 0 deletions tests/tcp-rst-unacked-stream-03-gap/test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,20 @@
requires:
min-version: 8

checks:
- filter:
count: 1
match:
event_type: alert
alert.signature_id: 1
pkt_src: "stream (flow timeout)"
- filter:
count: 0
match:
event_type: alert
alert.signature_id: 2210048
- filter:
count: 1
match:
event_type: stats
stats.tcp.reassembly_gap: 0
15 changes: 15 additions & 0 deletions tests/tcp-rst-unacked-stream-03-gap/writepcap.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
#!/usr/bin/env python
from scapy.all import *

pkts = []

pkts += Ether(dst='05:04:03:02:01:00', src='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(src='1.1.1.1', dst='2.2.2.2')/TCP(dport=8080,sport=12345,flags='S',seq=1,options=[('WScale', 14)])
pkts += Ether(src='05:04:03:02:01:00', dst='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(dst='1.1.1.1', src='2.2.2.2')/TCP(sport=8080,dport=12345,flags='SA',seq=1000,ack=2,options=[('WScale', 14)],window=65535)
pkts += Ether(dst='05:04:03:02:01:00', src='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(src='1.1.1.1', dst='2.2.2.2')/TCP(dport=8080,sport=12345,flags='A',seq=2,ack=1001,window=65535)
pkts += Ether(src='05:04:03:02:01:00', dst='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(dst='1.1.1.1', src='2.2.2.2')/TCP(sport=8080,dport=12345,flags='AP',seq=1001,ack=2,window=65535)/"Please "
#pkts += Ether(src='05:04:03:02:01:00', dst='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(dst='1.1.1.1', src='2.2.2.2')/TCP(sport=8080,dport=12345,flags='AP',seq=1008,ack=2,window=65535)/"Let "
pkts += Ether(src='05:04:03:02:01:00', dst='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(dst='1.1.1.1', src='2.2.2.2')/TCP(sport=8080,dport=12345,flags='AP',seq=1012,ack=2,window=65535)/"Me "
pkts += Ether(src='05:04:03:02:01:00', dst='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(dst='1.1.1.1', src='2.2.2.2')/TCP(sport=8080,dport=12345,flags='AP',seq=1015,ack=2,window=65535)/"In!"
pkts += Ether(dst='05:04:03:02:01:00', src='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(src='1.1.1.1', dst='2.2.2.2')/TCP(dport=8080,sport=12345,flags='RA',seq=2,ack=1008,window=65535)/"Access Denied"

wrpcap('input.pcap', pkts)
8 changes: 8 additions & 0 deletions tests/tcp-rst-unacked-stream-04-gap-ips/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
Test
====

Test series that tests if a RST that comes in before all data is ACK'd the
unACK'd data is still reassembled and inspected, but does not trigger a GAP
event.

This test tests raw reassembly inspection of unack'd data with GAP in IPS mode.
Binary file added tests/tcp-rst-unacked-stream-04-gap-ips/input.pcap
View file
Open in desktop
Binary file not shown.
2 changes: 2 additions & 0 deletions tests/tcp-rst-unacked-stream-04-gap-ips/test.rules
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
alert tcp any any -> any any (content:"Me In"; sid:1;)
alert tcp any any -> any any (msg:"SURICATA STREAM reassembly sequence GAP -- missing packet(s)"; stream-event:reassembly_seq_gap; threshold:type backoff, track by_flow, count 1, multiplier 10; classtype:protocol-command-decode; sid:2210048; rev:3;)
20 changes: 20 additions & 0 deletions tests/tcp-rst-unacked-stream-04-gap-ips/test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,20 @@
requires:
min-version: 8

checks:
- filter:
count: 1
match:
event_type: alert
alert.signature_id: 1
pcap_cnt: 6
- filter:
count: 0
match:
event_type: alert
alert.signature_id: 2210048
- filter:
count: 1
match:
event_type: stats
stats.tcp.reassembly_gap: 0
15 changes: 15 additions & 0 deletions tests/tcp-rst-unacked-stream-04-gap-ips/writepcap.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
#!/usr/bin/env python
from scapy.all import *

pkts = []

pkts += Ether(dst='05:04:03:02:01:00', src='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(src='1.1.1.1', dst='2.2.2.2')/TCP(dport=8080,sport=12345,flags='S',seq=1,options=[('WScale', 14)])
pkts += Ether(src='05:04:03:02:01:00', dst='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(dst='1.1.1.1', src='2.2.2.2')/TCP(sport=8080,dport=12345,flags='SA',seq=1000,ack=2,options=[('WScale', 14)],window=65535)
pkts += Ether(dst='05:04:03:02:01:00', src='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(src='1.1.1.1', dst='2.2.2.2')/TCP(dport=8080,sport=12345,flags='A',seq=2,ack=1001,window=65535)
pkts += Ether(src='05:04:03:02:01:00', dst='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(dst='1.1.1.1', src='2.2.2.2')/TCP(sport=8080,dport=12345,flags='AP',seq=1001,ack=2,window=65535)/"Please "
#pkts += Ether(src='05:04:03:02:01:00', dst='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(dst='1.1.1.1', src='2.2.2.2')/TCP(sport=8080,dport=12345,flags='AP',seq=1008,ack=2,window=65535)/"Let "
pkts += Ether(src='05:04:03:02:01:00', dst='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(dst='1.1.1.1', src='2.2.2.2')/TCP(sport=8080,dport=12345,flags='AP',seq=1012,ack=2,window=65535)/"Me "
pkts += Ether(src='05:04:03:02:01:00', dst='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(dst='1.1.1.1', src='2.2.2.2')/TCP(sport=8080,dport=12345,flags='AP',seq=1015,ack=2,window=65535)/"In!"
pkts += Ether(dst='05:04:03:02:01:00', src='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(src='1.1.1.1', dst='2.2.2.2')/TCP(dport=8080,sport=12345,flags='RA',seq=2,ack=1001,window=65535)/"Access Denied"

wrpcap('input.pcap', pkts)
8 changes: 8 additions & 0 deletions tests/tcp-rst-unacked-stream-05-http-nogap/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
Test
====

Test series that tests if a RST that comes in before all data is ACK'd the
unACK'd data is still reassembled and inspected, but does not trigger a GAP
event.

This test tests HTTP reassembly inspection of unack'd data w/o GAP.
Binary file added tests/tcp-rst-unacked-stream-05-http-nogap/input.pcap
View file
Open in desktop
Binary file not shown.
2 changes: 2 additions & 0 deletions tests/tcp-rst-unacked-stream-05-http-nogap/test.rules
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
alert tcp any any -> any any (content:"User-Agent: Mozilla"; sid:1;)
alert tcp any any -> any any (msg:"SURICATA STREAM reassembly sequence GAP -- missing packet(s)"; stream-event:reassembly_seq_gap; threshold:type backoff, track by_flow, count 1, multiplier 10; classtype:protocol-command-decode; sid:2210048; rev:3;)
20 changes: 20 additions & 0 deletions tests/tcp-rst-unacked-stream-05-http-nogap/test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,20 @@
requires:
min-version: 8

checks:
- filter:
count: 1
match:
event_type: alert
alert.signature_id: 1
pkt_src: "stream (flow timeout)"
- filter:
count: 0
match:
event_type: alert
alert.signature_id: 2210048
- filter:
count: 1
match:
event_type: stats
stats.tcp.reassembly_gap: 0
17 changes: 17 additions & 0 deletions tests/tcp-rst-unacked-stream-05-http-nogap/writepcap.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
#!/usr/bin/env python
from scapy.all import *

pkts = []

pkts += Ether(dst='05:04:03:02:01:00', src='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(src='1.1.1.1', dst='2.2.2.2')/TCP(dport=8080,sport=12345,flags='S',seq=1,options=[('WScale', 14)])
pkts += Ether(src='05:04:03:02:01:00', dst='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(dst='1.1.1.1', src='2.2.2.2')/TCP(sport=8080,dport=12345,flags='SA',seq=1000,ack=2,options=[('WScale', 14)],window=65535)
pkts += Ether(dst='05:04:03:02:01:00', src='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(src='1.1.1.1', dst='2.2.2.2')/TCP(dport=8080,sport=12345,flags='A',seq=2,ack=1001,window=65535)

pkts += Ether(dst='05:04:03:02:01:00', src='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(src='1.1.1.1', dst='2.2.2.2')/TCP(dport=8080,sport=12345,flags='A',seq=2,ack=1001,window=65535)/"GET / HTTP/1.0\r\n"
pkts += Ether(dst='05:04:03:02:01:00', src='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(src='1.1.1.1', dst='2.2.2.2')/TCP(dport=8080,sport=12345,flags='A',seq=18,ack=1001,window=65535)/"Cookie: abcdef\r\n"
pkts += Ether(dst='05:04:03:02:01:00', src='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(src='1.1.1.1', dst='2.2.2.2')/TCP(dport=8080,sport=12345,flags='A',seq=34,ack=1001,window=65535)/"User-Agent: "
pkts += Ether(dst='05:04:03:02:01:00', src='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(src='1.1.1.1', dst='2.2.2.2')/TCP(dport=8080,sport=12345,flags='A',seq=46,ack=1001,window=65535)/"Mozilla\r\n\r\n"

pkts += Ether(src='05:04:03:02:01:00', dst='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(dst='1.1.1.1', src='2.2.2.2')/TCP(sport=8080,dport=12345,flags='RA',seq=1001,ack=18,window=65535)

wrpcap('input.pcap', pkts)
8 changes: 8 additions & 0 deletions tests/tcp-rst-unacked-stream-06-http-nogap-ips/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
Test
====

Test series that tests if a RST that comes in before all data is ACK'd the
unACK'd data is still reassembled and inspected, but does not trigger a GAP
event.

This test tests HTTP reassembly inspection of unack'd data w/o GAP in IPS mode.
Binary file added tests/tcp-rst-unacked-stream-06-http-nogap-ips/input.pcap
View file
Open in desktop
Binary file not shown.
2 changes: 2 additions & 0 deletions tests/tcp-rst-unacked-stream-06-http-nogap-ips/test.rules
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
alert tcp any any -> any any (content:"User-Agent: Mozilla"; sid:1;)
alert tcp any any -> any any (msg:"SURICATA STREAM reassembly sequence GAP -- missing packet(s)"; stream-event:reassembly_seq_gap; threshold:type backoff, track by_flow, count 1, multiplier 10; classtype:protocol-command-decode; sid:2210048; rev:3;)
20 changes: 20 additions & 0 deletions tests/tcp-rst-unacked-stream-06-http-nogap-ips/test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,20 @@
requires:
min-version: 8

checks:
- filter:
count: 1
match:
event_type: alert
alert.signature_id: 1
pcap_cnt: 7
- filter:
count: 0
match:
event_type: alert
alert.signature_id: 2210048
- filter:
count: 1
match:
event_type: stats
stats.tcp.reassembly_gap: 0
17 changes: 17 additions & 0 deletions tests/tcp-rst-unacked-stream-06-http-nogap-ips/writepcap.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
#!/usr/bin/env python
from scapy.all import *

pkts = []

pkts += Ether(dst='05:04:03:02:01:00', src='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(src='1.1.1.1', dst='2.2.2.2')/TCP(dport=8080,sport=12345,flags='S',seq=1,options=[('WScale', 14)])
pkts += Ether(src='05:04:03:02:01:00', dst='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(dst='1.1.1.1', src='2.2.2.2')/TCP(sport=8080,dport=12345,flags='SA',seq=1000,ack=2,options=[('WScale', 14)],window=65535)
pkts += Ether(dst='05:04:03:02:01:00', src='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(src='1.1.1.1', dst='2.2.2.2')/TCP(dport=8080,sport=12345,flags='A',seq=2,ack=1001,window=65535)

pkts += Ether(dst='05:04:03:02:01:00', src='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(src='1.1.1.1', dst='2.2.2.2')/TCP(dport=8080,sport=12345,flags='A',seq=2,ack=1001,window=65535)/"GET / HTTP/1.0\r\n"
pkts += Ether(dst='05:04:03:02:01:00', src='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(src='1.1.1.1', dst='2.2.2.2')/TCP(dport=8080,sport=12345,flags='A',seq=18,ack=1001,window=65535)/"Cookie: abcdef\r\n"
pkts += Ether(dst='05:04:03:02:01:00', src='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(src='1.1.1.1', dst='2.2.2.2')/TCP(dport=8080,sport=12345,flags='A',seq=34,ack=1001,window=65535)/"User-Agent: "
pkts += Ether(dst='05:04:03:02:01:00', src='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(src='1.1.1.1', dst='2.2.2.2')/TCP(dport=8080,sport=12345,flags='A',seq=46,ack=1001,window=65535)/"Mozilla\r\n\r\n"

pkts += Ether(src='05:04:03:02:01:00', dst='00:01:02:03:04:05')/Dot1Q(vlan=6)/IP(dst='1.1.1.1', src='2.2.2.2')/TCP(sport=8080,dport=12345,flags='RA',seq=1001,ack=18,window=65535)

wrpcap('input.pcap', pkts)
8 changes: 8 additions & 0 deletions tests/tcp-rst-unacked-stream-07-http/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
Test
====

Test series that tests if a RST that comes in before all data is ACK'd the
unACK'd data is still reassembled and inspected, but does not trigger a GAP
event.

This test tests HTTP reassembly inspection of unack'd data with GAP.
Binary file added tests/tcp-rst-unacked-stream-07-http/input.pcap
View file
Open in desktop
Binary file not shown.
2 changes: 2 additions & 0 deletions tests/tcp-rst-unacked-stream-07-http/test.rules
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
alert tcp any any -> any any (content:"User-Agent: Mozilla"; sid:1;)
alert tcp any any -> any any (msg:"SURICATA STREAM reassembly sequence GAP -- missing packet(s)"; stream-event:reassembly_seq_gap; threshold:type backoff, track by_flow, count 1, multiplier 10; classtype:protocol-command-decode; sid:2210048; rev:3;)
20 changes: 20 additions & 0 deletions tests/tcp-rst-unacked-stream-07-http/test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,20 @@
requires:
min-version: 8

checks:
- filter:
count: 1
match:
event_type: alert
alert.signature_id: 1
pkt_src: "stream (flow timeout)"
- filter:
count: 0
match:
event_type: alert
alert.signature_id: 2210048
- filter:
count: 1
match:
event_type: stats
stats.tcp.reassembly_gap: 0
Loading
Loading