next/sv/698/20250123/v1

tests/detect-ldap-operation/README.md

@@ -0,0 +1,5 @@
+Test ldap.request.operation, ldap.responses.operation and ldap.responses.count keywords.
+
+PCAP from ../ldap-search/ldap.pcap
+
+Redmine ticket: https://redmine.openinfosecfoundation.org/issues/7453

tests/detect-ldap-operation/test.rules

@@ -0,0 +1,16 @@
+alert tcp any any -> any any (msg:"Test search request number argument"; ldap.request.operation:3; sid:1;)
+alert tcp any any -> any any (msg:"Test search request str argument"; ldap.request.operation:search_request; sid:2;)
+alert tcp any any -> any any (msg:"Test search result entry"; ldap.responses.operation:search_result_entry; sid:3;)
+alert tcp any any -> any any (msg:"Test search result done"; ldap.responses.operation:search_result_done; sid:4;)
+alert tcp any any -> any any (msg:"Test search result done at index 1"; ldap.responses.operation:search_result_done,1; sid:5;)
+alert tcp any any -> any any (msg:"Test search result done at any index"; ldap.responses.operation:search_result_done,any; sid:6;)
+alert tcp any any -> any any (msg:"Test search result done at last index"; ldap.responses.operation:search_result_done,-1; sid:7;)
+alert tcp any any -> any any (msg:"Test number of LDAP responses is 2"; ldap.responses.count:2; sid:8;)
+alert tcp any any -> any any (msg:"Test number of LDAP responses is greater than 0"; ldap.responses.count:>0; sid:9;)
+
+# The following signatures do not match:
+
+alert tcp any any -> any any (msg:"Test search result done at index 0"; ldap.responses.operation:search_result_done,0; sid:10;)
+alert tcp any any -> any any (msg:"Test number of LDAP responses is 10"; ldap.responses.count:10; sid:11;)
+alert tcp any any -> any any (msg:"Test number of LDAP responses is greater than 2"; ldap.responses.count:>2; sid:12;)
+alert tcp any any -> any any (msg:"Test all LDAP responses are search_result_done"; ldap.responses.operation:search_result_done,all; sid:13;)

tests/detect-ldap-operation/test.yaml

@@ -0,0 +1,90 @@
+requires:
+  min-version: 8
+
+pcap: ../ldap-search/ldap.pcap
+
+args:
+  - -k none --set stream.inline=true
+
+checks:
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        pcap_cnt: 4
+        ldap.request.operation: search_request
+        alert.signature_id: 1
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        pcap_cnt: 4
+        ldap.request.operation: search_request
+        alert.signature_id: 2
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        pcap_cnt: 6
+        ldap.responses[0].operation: search_result_entry
+        alert.signature_id: 3
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        pcap_cnt: 8
+        ldap.responses[1].operation: search_result_done
+        alert.signature_id: 4
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        pcap_cnt: 8
+        ldap.responses[1].operation: search_result_done
+        alert.signature_id: 5
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        pcap_cnt: 8
+        ldap.responses[1].operation: search_result_done
+        alert.signature_id: 6
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        pcap_cnt: 8
+        ldap.responses[1].operation: search_result_done
+        alert.signature_id: 7
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        pcap_cnt: 8
+        alert.signature_id: 8
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 9
+  - filter:
+      count: 0
+      match:
+        event_type: alert
+        alert.signature_id: 10
+  - filter:
+      count: 0
+      match:
+        event_type: alert
+        pcap_cnt: 8
+        alert.signature_id: 11
+  - filter:
+      count: 0
+      match:
+        event_type: alert
+        alert.signature_id: 12
+  - filter:
+      count: 0
+      match:
+        event_type: alert
+        alert.signature_id: 13

tests/lua/lua-hashlib-output/README.md

@@ -0,0 +1,3 @@
+A rather simple test to make sure that out built-in libraries can be
+loaded by a Lua output script.
+

tests/lua/lua-hashlib-output/suricata.yaml

@@ -0,0 +1,13 @@
+%YAML 1.1
+---
+
+include: ../../../etc/suricata-3.1.2.yaml
+
+rule-files:
+
+outputs:
+  - lua:
+      enabled: yes
+      scripts-dir: .
+      scripts:
+        - test.lua

tests/lua/lua-hashlib-output/test.lua

@@ -0,0 +1,43 @@
+local hashlib = require("suricata.hashlib")
+
+-- We don't actually use, but the script will fail to run if it fails
+-- to "require".
+local dataset = require("suricata.dataset")
+
+-- www.suricata-ids.org
+local expected_md5 = "27170ec0609347c6a158bb5b694822a5"
+
+filename = "results.log"
+
+function init (args)
+   local needs = {}
+   needs["protocol"] = "dns"
+   return needs
+end
+
+function setup (args)
+   SCLogNotice("lua: setup()")
+   file = assert(io.open(SCLogPath() .. "/" .. filename, "w"))
+end
+
+function log(args)
+   queries = DnsGetQueries()
+   if queries ~= nil then
+      for n, t in pairs(queries) do
+         if hashlib.md5_hexdigest(t["rrname"]) == expected_md5 then
+            msg = "OK"
+         else
+            msg = "FAIL"
+         end
+	 write(msg)
+      end
+   end
+end
+
+function deinit(args)
+   file:close(file)
+end
+
+function write(msg)
+   file:write(msg .. "\n")
+end

tests/lua/lua-hashlib-output/test.yaml

@@ -0,0 +1,10 @@
+requires:
+  min-version: 8
+
+pcap: ../../cond-log-dns-dig/input.pcap
+
+checks:
+  - shell:
+      args: grep "OK" results.log | wc -l
+      expect: 2
+

tests/lua/lua-hashlib/README.md

@@ -0,0 +1,5 @@
+Test Lua hashing lib:
+
+```
+local hashing = require("suricata.hashing")
+```

tests/lua/lua-hashlib/test-hashing.lua

@@ -0,0 +1,149 @@
+local hashlib = require("suricata.hashlib")
+
+local expected_sha256 = "080bdfdfcd8c2c7fce747f9be4603ced6253caac70894ad89d605309588c60f6"
+local expected_sha1 = "00f495ffd50c8b5ef3645f61486dae496db0fe2e"
+local expected_md5 = "27170ec0609347c6a158bb5b694822a5"
+
+function init (args)
+   local needs = {}
+   needs["dns.rrname"] = tostring(true)
+   return needs
+end
+
+local function tohex(str)
+    local hex = {}
+    for i = 1, #str do
+        hex[i] = string.format("%02x", string.byte(str, i))
+    end
+    return table.concat(hex)
+end
+
+function test_sha256(name)
+   -- Test one shot digest.
+   hash = hashlib.sha256_digest(name)
+   if tohex(hash) ~= expected_sha256 then
+      return false
+   end
+
+   -- Test one shot hex digest.
+   hash = hashlib.sha256_hexdigest(name)
+   if hash ~= expected_sha256 then
+      return false
+   end
+
+   -- Test hash with multiple updates.
+   hasher = hashlib.sha256()
+   hasher:update("www.")
+   hasher:update("suricata-ids.")
+   hasher:update("org")
+   hash = hasher:finalize()
+   if tohex(hash) ~= expected_sha256 then
+      return false
+   end
+
+   -- Test hash with multiple updates and hex finalization.
+   hasher = hashlib.sha256()
+   hasher:update("www.")
+   hasher:update("suricata-ids.")
+   hasher:update("org")
+   hash = hasher:finalize_to_hex()
+   if hash ~= expected_sha256 then
+      return false
+   end
+
+   return true
+end
+
+function test_sha1(name)
+   -- Test one shot digest.
+   hash = hashlib.sha1_digest(name)
+   if tohex(hash) ~= expected_sha1 then
+      return false
+   end
+
+   -- Test one shot hex digest.
+   hash = hashlib.sha1_hexdigest(name)
+   if hash ~= expected_sha1 then
+      return false
+   end
+
+   -- Test hash with multiple updates.
+   hasher = hashlib.sha1()
+   hasher:update("www.")
+   hasher:update("suricata-ids.")
+   hasher:update("org")
+   hash = hasher:finalize()
+   if tohex(hash) ~= expected_sha1 then
+      return false
+   end
+
+   -- Test hash with multiple updates and hex finalization.
+   hasher = hashlib.sha1()
+   hasher:update("www.")
+   hasher:update("suricata-ids.")
+   hasher:update("org")
+   hash = hasher:finalize_to_hex()
+   if hash ~= expected_sha1 then
+      return false
+   end
+
+   return true
+end
+
+function test_md5(name)
+   -- One shot digest.
+   hash = hashlib.md5_digest(name)
+   if tohex(hash) ~= expected_md5 then
+      return false
+   end
+
+   -- One shot hex digest.
+   hash = hashlib.md5_hexdigest(name)
+   if hash ~= expected_md5 then
+      return false
+   end
+
+   -- Test hash with multiple updates.
+   hasher = hashlib.md5()
+   hasher:update("www.")
+   hasher:update("suricata-ids.")
+   hasher:update("org")
+   hash = hasher:finalize()
+   if tohex(hash) ~= expected_md5 then
+      return false
+   end
+
+   -- Test hash with multiple updates and hex finalization.
+   hasher = hashlib.md5()
+   hasher:update("www.")
+   hasher:update("suricata-ids.")
+   hasher:update("org")
+   hash = hasher:finalize_to_hex()
+   if hash ~= expected_md5 then
+      return false
+   end
+
+   return true
+end
+
+function match(args)
+   rrname = tostring(args["dns.rrname"])
+
+   if not test_sha256(rrname) then
+      SCLogError("test_sha256 failed")
+      return 0
+   end
+
+   if not test_sha1(rrname) then
+      SCLogError("test_sha1 failed")
+      return 0
+   end
+
+   if not test_md5(rrname) then
+      SCLogError("test_md5 failed")
+      return 0
+   end
+
+   return 1
+end
+

tests/lua/lua-hashlib/test.rules

@@ -0,0 +1,3 @@
+alert dns any any -> any any (msg:"TEST DNS LUA dns.rrname"; \
+      dns.query.name; content: "www.suricata-ids.org"; \
+      lua:test-hashing.lua; sid:1; rev:1;)

tests/lua/lua-hashlib/test.yaml

@@ -0,0 +1,14 @@
+pcap: ../../cond-log-dns-dig/input.pcap
+
+requires:
+  min-version: 8
+
+args:
+  - --set security.lua.allow-rules=true
+  - --set default-rule-path=.
+
+checks:
+  - filter:
+      count: 1
+      match:
+        alert.signature_id: 1