diff --git a/README.md b/README.md index edb9c06612..eeef24dd72 100644 --- a/README.md +++ b/README.md @@ -196,6 +196,12 @@ checks: # Check if a string is contained within a JSON list. # Eg. "ftp":{"reply":["Opening BINARY mode data connection for temp.txt (1164 bytes).","Transfer complete."], } ftp.reply.__contains: 'Transfer complete.' + - filter: + # Check line number of an entry + count: 1 + match: + __lineno: 5 + alert.signature_id: 15 - stats: # Check values in the last stats event in eve.json. Keys are relative to diff --git a/createst.py b/createst.py index aac1a9c4a9..fe5c404292 100755 --- a/createst.py +++ b/createst.py @@ -37,7 +37,7 @@ yaml.add_representer(defaultdict, Representer.represent_dict) WIN32 = sys.platform == "win32" -suricata_bin = "src\suricata.exe" if WIN32 else "./src/suricata" +suricata_bin = "src\\suricata.exe" if WIN32 else "./src/suricata" suricata_yaml = "suricata.yaml" if WIN32 else "./suricata.yaml" CUR_DIR = os.path.dirname(os.path.realpath(__file__)) DEFAULT_TEST_DIR = os.path.join(CUR_DIR, "tests") diff --git a/run.py b/run.py index 610d6aea43..f80decc672 100755 --- a/run.py +++ b/run.py @@ -570,8 +570,11 @@ def run(self): count = 0 with open(json_filename, "r", encoding="utf-8") as fileobj: + lineno = 1 for line in fileobj: event = json.loads(line) + event["__lineno"] = lineno + lineno = lineno + 1 if self.match(event): count += 1 if count == self.config["count"]: diff --git a/tests/bug-1399/README.md b/tests/bug-1399/README.md new file mode 100644 index 0000000000..888c1ef9ce --- /dev/null +++ b/tests/bug-1399/README.md @@ -0,0 +1,11 @@ +# Test Description + +Test to check the ordering of flowbit signatures and expected order of alerts + +## PCAP + +From the redmine ticket. + +## Related issues + +https://redmine.openinfosecfoundation.org/issues/1399 diff --git a/tests/bug-1399/input.pcap b/tests/bug-1399/input.pcap new file mode 100644 index 0000000000..c196ba3307 Binary files /dev/null and b/tests/bug-1399/input.pcap differ diff --git a/tests/bug-1399/test.rules b/tests/bug-1399/test.rules new file mode 100644 index 0000000000..3eb9228471 --- /dev/null +++ b/tests/bug-1399/test.rules @@ -0,0 +1,3 @@ +alert tcp any any -> any any (msg:"First in chain"; content:"GET"; flowbits:set,1; sid:3;) +alert tcp any any -> any any (msg:"Second in chain"; content:"flow"; flowbits:isset,1; flowbits:set,2; sid:2;) +alert tcp any any -> any any (msg:"Third (Last) in chain"; content:"boss"; flowbits:isset,2; flowbits:set,3; sid:1;) diff --git a/tests/bug-1399/test.yaml b/tests/bug-1399/test.yaml new file mode 100644 index 0000000000..68c1d5dacc --- /dev/null +++ b/tests/bug-1399/test.yaml @@ -0,0 +1,33 @@ +requires: + min-version: 9 + +args: +- -k none + +checks: +- filter: + count: 1 + match: + alert.signature_id: 3 + event_type: alert +- filter: + count: 1 + match: + alert.signature_id: 2 + event_type: alert +- filter: + count: 1 + match: + alert.signature_id: 1 + event_type: alert +- filter: + count: 1 + match: + event_type: http + http.http_method: GET + http.http_user_agent: Suricata Testing + http.protocol: HTTP/1.1 + http.url: /flowboss.html + metadata.flowbits[0]: '1' + metadata.flowbits[1]: '2' + metadata.flowbits[2]: '3' diff --git a/tests/bug-7638/bug-7638-flowbits-sigorder-01/README.md b/tests/bug-7638/bug-7638-flowbits-sigorder-01/README.md new file mode 100644 index 0000000000..56822ae00c --- /dev/null +++ b/tests/bug-7638/bug-7638-flowbits-sigorder-01/README.md @@ -0,0 +1,20 @@ +Description +----------- + +Test to show the order of flowbits after dependency resolution among the +signatures with no cyclic dependencies. +Correct order should be: +sid: 11 +sid: 12 +sid: 10 +sid: 14 + +PCAP +---- + +None + +Ticket +------ + +https://redmine.openinfosecfoundation.org/issues/7638 diff --git a/tests/bug-7638/bug-7638-flowbits-sigorder-01/test.rules b/tests/bug-7638/bug-7638-flowbits-sigorder-01/test.rules new file mode 100644 index 0000000000..59c8c19bd3 --- /dev/null +++ b/tests/bug-7638/bug-7638-flowbits-sigorder-01/test.rules @@ -0,0 +1,4 @@ +alert http any any -> any any (http.uri; content:"down"; flowbits:set,uritest; sid:11;) +alert http any any -> any any (http.user_agent; content:"Mozilla"; flowbits:isset, headtest; flowbits:set,moz; sid:10;) +alert http any any -> any any (http.method; content:"GET"; flowbits:isset,uritest; flowbits:set,headtest; sid:12;) +alert http any any -> any any (http.host; content:"ether"; flowbits:isset,moz; sid:14;) diff --git a/tests/bug-7638/bug-7638-flowbits-sigorder-01/test.yaml b/tests/bug-7638/bug-7638-flowbits-sigorder-01/test.yaml new file mode 100644 index 0000000000..abe0bfdaab --- /dev/null +++ b/tests/bug-7638/bug-7638-flowbits-sigorder-01/test.yaml @@ -0,0 +1,33 @@ +requires: + min-version: 9 + +pcap: false + +args: + - --engine-analysis + +checks: +- filter: + filename: rules.json + count: 1 + match: + __lineno: 1 + id: 11 +- filter: + filename: rules.json + count: 1 + match: + __lineno: 2 + id: 12 +- filter: + filename: rules.json + count: 1 + match: + __lineno: 3 + id: 10 +- filter: + filename: rules.json + count: 1 + match: + __lineno: 4 + id: 14 diff --git a/tests/bug-7638/bug-7638-flowbits-sigorder-02/README.md b/tests/bug-7638/bug-7638-flowbits-sigorder-02/README.md new file mode 100644 index 0000000000..0c539e1a34 --- /dev/null +++ b/tests/bug-7638/bug-7638-flowbits-sigorder-02/README.md @@ -0,0 +1,22 @@ +Description +----------- + +Test to show the order of flowbits after dependency resolution among the +signatures with cyclic dependencies. + +1 -> 2 +^ | +| | + ---- + +Signatures must be rejected from loading as they can never meet at runtime. + +PCAP +---- + +None + +Ticket +------ + +https://redmine.openinfosecfoundation.org/issues/7638 diff --git a/tests/bug-7638/bug-7638-flowbits-sigorder-02/suricata.yaml b/tests/bug-7638/bug-7638-flowbits-sigorder-02/suricata.yaml new file mode 100644 index 0000000000..fb8c821fd7 --- /dev/null +++ b/tests/bug-7638/bug-7638-flowbits-sigorder-02/suricata.yaml @@ -0,0 +1,12 @@ +%YAML 1.1 +--- + +engine-analysis: + rules: yes + +logging: + outputs: + - file: + enabled: yes + filename: eve.json + type: json diff --git a/tests/bug-7638/bug-7638-flowbits-sigorder-02/test.rules b/tests/bug-7638/bug-7638-flowbits-sigorder-02/test.rules new file mode 100644 index 0000000000..9b8e76a838 --- /dev/null +++ b/tests/bug-7638/bug-7638-flowbits-sigorder-02/test.rules @@ -0,0 +1,2 @@ +alert http any any -> any any (http.user_agent; content:"Mozilla"; flowbits:isset, headtest; flowbits:set,moz; sid:10;) +alert http any any -> any any (http.method; content:"GET"; flowbits:isset,moz; flowbits:set,headtest; sid:12;) diff --git a/tests/bug-7638/bug-7638-flowbits-sigorder-02/test.yaml b/tests/bug-7638/bug-7638-flowbits-sigorder-02/test.yaml new file mode 100644 index 0000000000..7261f468dd --- /dev/null +++ b/tests/bug-7638/bug-7638-flowbits-sigorder-02/test.yaml @@ -0,0 +1,16 @@ +requires: + min-version: 9 + +pcap: false + +args: + - --engine-analysis + +exit-code: 1 + +checks: + - filter: + count: 1 + match: + log_level: Error + engine.message: "Flowbits have circular dependencies that cannot be met at runtime" diff --git a/tests/bug-7638/bug-7638-flowbits-sigorder-03/README.md b/tests/bug-7638/bug-7638-flowbits-sigorder-03/README.md new file mode 100644 index 0000000000..da09c7b2e2 --- /dev/null +++ b/tests/bug-7638/bug-7638-flowbits-sigorder-03/README.md @@ -0,0 +1,20 @@ +Description +----------- + +Test to show the order of flowbits after dependency resolution among the +signatures with long chained cyclic dependencies. + +1 -> 2 -> 3 -> 4 -> 5 +^ | +| | + ------------------- + +PCAP +---- + +None + +Ticket +------ + +https://redmine.openinfosecfoundation.org/issues/7638 diff --git a/tests/bug-7638/bug-7638-flowbits-sigorder-03/suricata.yaml b/tests/bug-7638/bug-7638-flowbits-sigorder-03/suricata.yaml new file mode 100644 index 0000000000..fb8c821fd7 --- /dev/null +++ b/tests/bug-7638/bug-7638-flowbits-sigorder-03/suricata.yaml @@ -0,0 +1,12 @@ +%YAML 1.1 +--- + +engine-analysis: + rules: yes + +logging: + outputs: + - file: + enabled: yes + filename: eve.json + type: json diff --git a/tests/bug-7638/bug-7638-flowbits-sigorder-03/test.rules b/tests/bug-7638/bug-7638-flowbits-sigorder-03/test.rules new file mode 100644 index 0000000000..90577e6955 --- /dev/null +++ b/tests/bug-7638/bug-7638-flowbits-sigorder-03/test.rules @@ -0,0 +1,6 @@ +alert http any any -> any any (flowbits:set,A; flowbits:isset,B; sid:1;) +alert http any any -> any any (flowbits:set,B; flowbits:isset,C; sid:2;) +alert http any any -> any any (flowbits:set,C; flowbits:isset,D; sid:3;) +alert http any any -> any any (flowbits:set,D; flowbits:isset,E; sid:4;) +alert http any any -> any any (flowbits:set,E; flowbits:isset,A; sid:5;) + diff --git a/tests/bug-7638/bug-7638-flowbits-sigorder-03/test.yaml b/tests/bug-7638/bug-7638-flowbits-sigorder-03/test.yaml new file mode 100644 index 0000000000..22dd2afaf4 --- /dev/null +++ b/tests/bug-7638/bug-7638-flowbits-sigorder-03/test.yaml @@ -0,0 +1,16 @@ +requires: + min-version: 9 + +pcap: false + +args: + - --engine-analysis + +exit-code: 1 + +checks: + - filter: + count: 1 + match: + log_level: Error + engine.message.__find: "Cyclic dependency found between flowbits from signatures" diff --git a/tests/bug-7638/bug-7638-flowbits-sigorder-04/README.md b/tests/bug-7638/bug-7638-flowbits-sigorder-04/README.md new file mode 100644 index 0000000000..9cc88c3b7f --- /dev/null +++ b/tests/bug-7638/bug-7638-flowbits-sigorder-04/README.md @@ -0,0 +1,21 @@ +Description +----------- + +Test to show the order of flowbits after dependency resolution among the +signatures with no cyclic dependencies. +Correct order should be: +sid: 4 +sid: 3 +sid: 2 +sid: 1 +sid: 5 + +PCAP +---- + +None + +Ticket +------ + +https://redmine.openinfosecfoundation.org/issues/7638 diff --git a/tests/bug-7638/bug-7638-flowbits-sigorder-04/test.rules b/tests/bug-7638/bug-7638-flowbits-sigorder-04/test.rules new file mode 100644 index 0000000000..9221728003 --- /dev/null +++ b/tests/bug-7638/bug-7638-flowbits-sigorder-04/test.rules @@ -0,0 +1,9 @@ +alert http any any -> any any (flowbits:set,A; flowbits:isset,B; sid:1;) +alert http any any -> any any (flowbits:set,B; flowbits:isset,C; sid:2;) +alert http any any -> any any (flowbits:set,C; flowbits:isset,D; sid:3;) +# sid: 4 will never match but handling that is out of the scope of the +# bugfix for 7638. suricata-update can easily handle such a dependency +# resolution by commenting this rule out. +alert http any any -> any any (flowbits:set,D; flowbits:isset,E; sid:4;) +alert http any any -> any any (flowbits:unset,E; flowbits:isset,A; sid:5;) + diff --git a/tests/bug-7638/bug-7638-flowbits-sigorder-04/test.yaml b/tests/bug-7638/bug-7638-flowbits-sigorder-04/test.yaml new file mode 100644 index 0000000000..c8e9902170 --- /dev/null +++ b/tests/bug-7638/bug-7638-flowbits-sigorder-04/test.yaml @@ -0,0 +1,40 @@ +requires: + min-version: 9 + +pcap: false + +args: + - --engine-analysis + +checks: +- filter: + filename: rules.json + count: 1 + match: + __lineno: 1 + id: 4 +- filter: + filename: rules.json + count: 1 + match: + __lineno: 2 + id: 3 +- filter: + filename: rules.json + count: 1 + match: + __lineno: 3 + id: 2 +- filter: + filename: rules.json + count: 1 + match: + __lineno: 4 + id: 1 +- filter: + filename: rules.json + count: 1 + match: + __lineno: 5 + id: 5 + diff --git a/tests/bug-7638/bug-7638-flowbits-sigorder-05/README.md b/tests/bug-7638/bug-7638-flowbits-sigorder-05/README.md new file mode 100644 index 0000000000..44ca874f88 --- /dev/null +++ b/tests/bug-7638/bug-7638-flowbits-sigorder-05/README.md @@ -0,0 +1,3 @@ +# Description + +Expected resolved order: 1, 2, 3, 4 (the only valid topological order). diff --git a/tests/bug-7638/bug-7638-flowbits-sigorder-05/test.rules b/tests/bug-7638/bug-7638-flowbits-sigorder-05/test.rules new file mode 100644 index 0000000000..1ca43c525b --- /dev/null +++ b/tests/bug-7638/bug-7638-flowbits-sigorder-05/test.rules @@ -0,0 +1,7 @@ +# The ONLY valid order is 1,2,3,4. sid 4 is a depth-1 neighbour of the +# source (sid 1) but also depends on sid 3 at depth 2, so a BFS emits +# sid 4 before sid 3 (order 1,4,2,3 or 1,2,4,3), breaking the 3->4 edge. +alert http any any -> any any (msg:"S1 set A"; flowbits:isset,S; flowbits:set,A; sid:1;) +alert http any any -> any any (msg:"S2 isset A set B"; flowbits:isset,A; flowbits:set,B; sid:2;) +alert http any any -> any any (msg:"S3 isset B set C"; flowbits:isset,B; flowbits:set,C; sid:3;) +alert http any any -> any any (msg:"S4 isset A,C set D"; flowbits:isset,A; flowbits:isset,C; flowbits:set,D; sid:4;) diff --git a/tests/bug-7638/bug-7638-flowbits-sigorder-05/test.yaml b/tests/bug-7638/bug-7638-flowbits-sigorder-05/test.yaml new file mode 100644 index 0000000000..cf1ea26b4f --- /dev/null +++ b/tests/bug-7638/bug-7638-flowbits-sigorder-05/test.yaml @@ -0,0 +1,33 @@ +requires: + min-version: 9 + +pcap: false + +args: + - --engine-analysis + +checks: +- filter: + filename: rules.json + count: 1 + match: + __lineno: 1 + id: 1 +- filter: + filename: rules.json + count: 1 + match: + __lineno: 2 + id: 2 +- filter: + filename: rules.json + count: 1 + match: + __lineno: 3 + id: 3 +- filter: + filename: rules.json + count: 1 + match: + __lineno: 4 + id: 4 diff --git a/tests/bug-7638/bug-7638-flowbits-sigorder-06/README.md b/tests/bug-7638/bug-7638-flowbits-sigorder-06/README.md new file mode 100644 index 0000000000..1ac41a5b21 --- /dev/null +++ b/tests/bug-7638/bug-7638-flowbits-sigorder-06/README.md @@ -0,0 +1,20 @@ +Description +----------- + +Test to show the order of flowbits after dependency resolution among the +signatures with multiple cyclic dependencies. + +1 -> 2 -> 3 -> 4 -> 5 -> 6 +^ | ^ | +| | | | + ---- --------- + +PCAP +---- + +None + +Ticket +------ + +https://redmine.openinfosecfoundation.org/issues/7638 diff --git a/tests/bug-7638/bug-7638-flowbits-sigorder-06/test.rules b/tests/bug-7638/bug-7638-flowbits-sigorder-06/test.rules new file mode 100644 index 0000000000..030554abca --- /dev/null +++ b/tests/bug-7638/bug-7638-flowbits-sigorder-06/test.rules @@ -0,0 +1,9 @@ +alert http any any -> any any (flowbits:set,A; flowbits:isset,B; sid:1;) +alert http any any -> any any (flowbits:set,B; flowbits:isset,C; sid:2;) +alert http any any -> any any (flowbits:set,C; flowbits:isset,D; sid:3;) +alert http any any -> any any (flowbits:set,D; flowbits:isset,C; sid:4;) +alert http any any -> any any (flowbits:set,E; flowbits:isset,D; sid:5;) +alert http any any -> any any (flowbits:set,F; flowbits:isset,E; sid:6;) +alert http any any -> any any (flowbits:set,G; flowbits:isset,F; sid:7;) +alert http any any -> any any (flowbits:set,F; flowbits:isset,G; sid:8;) + diff --git a/tests/bug-7638/bug-7638-flowbits-sigorder-06/test.yaml b/tests/bug-7638/bug-7638-flowbits-sigorder-06/test.yaml new file mode 100644 index 0000000000..1cf81453e5 --- /dev/null +++ b/tests/bug-7638/bug-7638-flowbits-sigorder-06/test.yaml @@ -0,0 +1,9 @@ +requires: + min-version: 9 + +pcap: false + +args: + - --engine-analysis + +exit-code: 1 diff --git a/tests/bug-7638/bug-7638-flowbits-sigorder-07/README.md b/tests/bug-7638/bug-7638-flowbits-sigorder-07/README.md new file mode 100644 index 0000000000..da09c7b2e2 --- /dev/null +++ b/tests/bug-7638/bug-7638-flowbits-sigorder-07/README.md @@ -0,0 +1,20 @@ +Description +----------- + +Test to show the order of flowbits after dependency resolution among the +signatures with long chained cyclic dependencies. + +1 -> 2 -> 3 -> 4 -> 5 +^ | +| | + ------------------- + +PCAP +---- + +None + +Ticket +------ + +https://redmine.openinfosecfoundation.org/issues/7638 diff --git a/tests/bug-7638/bug-7638-flowbits-sigorder-07/suricata.yaml b/tests/bug-7638/bug-7638-flowbits-sigorder-07/suricata.yaml new file mode 100644 index 0000000000..fb8c821fd7 --- /dev/null +++ b/tests/bug-7638/bug-7638-flowbits-sigorder-07/suricata.yaml @@ -0,0 +1,12 @@ +%YAML 1.1 +--- + +engine-analysis: + rules: yes + +logging: + outputs: + - file: + enabled: yes + filename: eve.json + type: json diff --git a/tests/bug-7638/bug-7638-flowbits-sigorder-07/test.rules b/tests/bug-7638/bug-7638-flowbits-sigorder-07/test.rules new file mode 100644 index 0000000000..5f630e506b --- /dev/null +++ b/tests/bug-7638/bug-7638-flowbits-sigorder-07/test.rules @@ -0,0 +1,3 @@ +alert http any any -> any any (http.user_agent; content:"Mozilla"; flowbits:isset, headtest; flowbits:isset,other; flowbits:set,moz; sid:10;) +alert http any any -> any any (http.method; content:"GET"; flowbits:set,headtest; flowbits:isset,moz; sid:12;) +alert http any any -> any any (http.host; content:"example"; flowbits:set,other; sid:20;) diff --git a/tests/bug-7638/bug-7638-flowbits-sigorder-07/test.yaml b/tests/bug-7638/bug-7638-flowbits-sigorder-07/test.yaml new file mode 100644 index 0000000000..22dd2afaf4 --- /dev/null +++ b/tests/bug-7638/bug-7638-flowbits-sigorder-07/test.yaml @@ -0,0 +1,16 @@ +requires: + min-version: 9 + +pcap: false + +args: + - --engine-analysis + +exit-code: 1 + +checks: + - filter: + count: 1 + match: + log_level: Error + engine.message.__find: "Cyclic dependency found between flowbits from signatures" diff --git a/tests/flowbits-max-cycle-resolution/README.md b/tests/flowbits-max-cycle-resolution/README.md new file mode 100644 index 0000000000..812929aaca --- /dev/null +++ b/tests/flowbits-max-cycle-resolution/README.md @@ -0,0 +1,19 @@ +Description +----------- + +Test to show cycle resolution limit taking into effect. + +1 -> 2 -> 3 -> 4 -> 5 + ^ | ^ | + | | | | + ---- ----- + +PCAP +---- + +None + +Ticket +------ + +https://redmine.openinfosecfoundation.org/issues/7638 diff --git a/tests/flowbits-max-cycle-resolution/suricata.yaml b/tests/flowbits-max-cycle-resolution/suricata.yaml new file mode 100644 index 0000000000..5e918a9cc8 --- /dev/null +++ b/tests/flowbits-max-cycle-resolution/suricata.yaml @@ -0,0 +1,16 @@ +%YAML 1.1 +--- + +detect: + flowbits: + max-cycle-resolution: 1 + +engine-analysis: + rules: yes + +logging: + outputs: + - file: + enabled: yes + filename: eve.json + type: json diff --git a/tests/flowbits-max-cycle-resolution/test.rules b/tests/flowbits-max-cycle-resolution/test.rules new file mode 100644 index 0000000000..408946a658 --- /dev/null +++ b/tests/flowbits-max-cycle-resolution/test.rules @@ -0,0 +1,6 @@ +alert http any any -> any any (flowbits:set,A; sid:1;) +alert http any any -> any any (flowbits:set,B; flowbits:isset,A; flowbits:isset,C; sid:2;) +alert http any any -> any any (flowbits:set,C; flowbits:isset,B; sid:3;) +alert http any any -> any any (flowbits:set,D; flowbits:isset,C; sid:4;) +alert http any any -> any any (flowbits:set,C; flowbits:isset,D; sid:5;) + diff --git a/tests/flowbits-max-cycle-resolution/test.yaml b/tests/flowbits-max-cycle-resolution/test.yaml new file mode 100644 index 0000000000..6be33f97ff --- /dev/null +++ b/tests/flowbits-max-cycle-resolution/test.yaml @@ -0,0 +1,16 @@ +requires: + min-version: 9 + +pcap: false + +args: + - --engine-analysis + +exit-code: 1 + +checks: + - filter: + count: 1 + match: + log_level: Error + engine.message: "Maximum tries (1) reached while trying to resolve cycles" diff --git a/tests/flowbits-priority-combination/README.md b/tests/flowbits-priority-combination/README.md new file mode 100644 index 0000000000..852a20482b --- /dev/null +++ b/tests/flowbits-priority-combination/README.md @@ -0,0 +1,14 @@ +Description +----------- + +Test to show the order if flowbits are used with priority keyword. + +PCAP +---- + +None + +Ticket +------ + +https://redmine.openinfosecfoundation.org/issues/7638 diff --git a/tests/flowbits-priority-combination/test.rules b/tests/flowbits-priority-combination/test.rules new file mode 100644 index 0000000000..67f99b6d45 --- /dev/null +++ b/tests/flowbits-priority-combination/test.rules @@ -0,0 +1,9 @@ +alert http any any -> any any (flowbits:set,A; flowbits:isset,B; priority:5; sid:1;) +alert http any any -> any any (flowbits:set,B; flowbits:isset,C; priority:2; sid:2;) +alert http any any -> any any (flowbits:set,C; flowbits:isset,D; priority:4; sid:3;) +# sid: 4 will never match but handling that is out of the scope of the +# bugfix for 7638. suricata-update can easily handle such a dependency +# resolution by commenting this rule out. +alert http any any -> any any (flowbits:set,D; flowbits:isset,E; priority:1; sid:4;) +alert http any any -> any any (flowbits:unset,E; flowbits:isset,A; priority:3; sid:5;) + diff --git a/tests/flowbits-priority-combination/test.yaml b/tests/flowbits-priority-combination/test.yaml new file mode 100644 index 0000000000..8aa7537a7f --- /dev/null +++ b/tests/flowbits-priority-combination/test.yaml @@ -0,0 +1,42 @@ +requires: + min-version: 9 + +pcap: false + +args: + - --engine-analysis + +checks: +- filter: + filename: rules.json + count: 1 + match: + __lineno: 1 + id: 4 +- filter: + filename: rules.json + count: 1 + match: + __lineno: 2 + id: 3 +- filter: + filename: rules.json + count: 1 + match: + __lineno: 3 + id: 2 +- filter: + filename: rules.json + count: 1 + match: + __lineno: 4 + id: 1 +- filter: + filename: rules.json + count: 1 + match: + __lineno: 5 + id: 5 +- shell: + args: 'grep "detect: sid 4: explicitly set priority is overridden by flowbits dependency resolution ordering" suricata.log | wc -l' + expect: 1