Flowbits tests/v8

README.md

@@ -196,6 +196,12 @@ checks:
         # Check if a string is contained within a JSON list.
         # Eg. "ftp":{"reply":["Opening BINARY mode data connection for temp.txt (1164 bytes).","Transfer complete."], }
         ftp.reply.__contains: 'Transfer complete.'
+  - filter:
+      # Check line number of an entry
+      count: 1
+      match:
+        __lineno: 5
+        alert.signature_id: 15
 
   - stats:
       # Check values in the last stats event in eve.json. Keys are relative to

createst.py

@@ -37,7 +37,7 @@
 yaml.add_representer(defaultdict, Representer.represent_dict)
 
 WIN32 = sys.platform == "win32"
-suricata_bin = "src\suricata.exe" if WIN32 else "./src/suricata"
+suricata_bin = "src\\suricata.exe" if WIN32 else "./src/suricata"
 suricata_yaml = "suricata.yaml" if WIN32 else "./suricata.yaml"
 CUR_DIR = os.path.dirname(os.path.realpath(__file__))
 DEFAULT_TEST_DIR = os.path.join(CUR_DIR, "tests")

run.py

@@ -570,8 +570,11 @@ def run(self):
 
         count = 0
         with open(json_filename, "r", encoding="utf-8") as fileobj:
+            lineno = 1
             for line in fileobj:
                 event = json.loads(line)
+                event["__lineno"] = lineno
+                lineno = lineno + 1
                 if self.match(event):
                     count += 1
         if count == self.config["count"]:

tests/bug-1399/README.md

@@ -0,0 +1,11 @@
+# Test Description
+
+Test to check the ordering of flowbit signatures and expected order of alerts
+
+## PCAP
+
+From the redmine ticket.
+
+## Related issues
+
+https://redmine.openinfosecfoundation.org/issues/1399

tests/bug-1399/test.rules

@@ -0,0 +1,3 @@
+alert tcp any any -> any any (msg:"First in chain"; content:"GET"; flowbits:set,1; sid:3;)
+alert tcp any any -> any any (msg:"Second in chain"; content:"flow"; flowbits:isset,1; flowbits:set,2; sid:2;)
+alert tcp any any -> any any (msg:"Third (Last) in chain"; content:"boss"; flowbits:isset,2; flowbits:set,3; sid:1;)

tests/bug-1399/test.yaml

@@ -0,0 +1,33 @@
+requires:
+  min-version: 9
+
+args:
+- -k none
+
+checks:
+- filter:
+    count: 1
+    match:
+      alert.signature_id: 3
+      event_type: alert
+- filter:
+    count: 1
+    match:
+      alert.signature_id: 2
+      event_type: alert
+- filter:
+    count: 1
+    match:
+      alert.signature_id: 1
+      event_type: alert
+- filter:
+    count: 1
+    match:
+      event_type: http
+      http.http_method: GET
+      http.http_user_agent: Suricata Testing
+      http.protocol: HTTP/1.1
+      http.url: /flowboss.html
+      metadata.flowbits[0]: '1'
+      metadata.flowbits[1]: '2'
+      metadata.flowbits[2]: '3'

tests/bug-7638/bug-7638-flowbits-sigorder-01/README.md

@@ -0,0 +1,20 @@
+Description
+-----------
+
+Test to show the order of flowbits after dependency resolution among the
+signatures with no cyclic dependencies.
+Correct order should be:
+sid: 11
+sid: 12
+sid: 10
+sid: 14
+
+PCAP
+----
+
+None
+
+Ticket
+------
+
+https://redmine.openinfosecfoundation.org/issues/7638

tests/bug-7638/bug-7638-flowbits-sigorder-01/test.rules

@@ -0,0 +1,4 @@
+alert http any any -> any any (http.uri; content:"down"; flowbits:set,uritest; sid:11;)
+alert http any any -> any any (http.user_agent; content:"Mozilla"; flowbits:isset, headtest; flowbits:set,moz; sid:10;)
+alert http any any -> any any (http.method; content:"GET"; flowbits:isset,uritest; flowbits:set,headtest; sid:12;)
+alert http any any -> any any (http.host; content:"ether"; flowbits:isset,moz; sid:14;)

tests/bug-7638/bug-7638-flowbits-sigorder-01/test.yaml

@@ -0,0 +1,33 @@
+requires:
+    min-version: 9
+
+pcap: false
+
+args:
+  - --engine-analysis
+
+checks:
+- filter:
+    filename: rules.json
+    count: 1
+    match:
+      __lineno: 1
+      id: 11
+- filter:
+    filename: rules.json
+    count: 1
+    match:
+      __lineno: 2
+      id: 12
+- filter:
+    filename: rules.json
+    count: 1
+    match:
+      __lineno: 3
+      id: 10
+- filter:
+    filename: rules.json
+    count: 1
+    match:
+      __lineno: 4
+      id: 14

tests/bug-7638/bug-7638-flowbits-sigorder-02/README.md

@@ -0,0 +1,22 @@
+Description
+-----------
+
+Test to show the order of flowbits after dependency resolution among the
+signatures with cyclic dependencies.
+
+1 -> 2
+^    |
+|    |
+ ----
+
+Signatures must be rejected from loading as they can never meet at runtime.
+
+PCAP
+----
+
+None
+
+Ticket
+------
+
+https://redmine.openinfosecfoundation.org/issues/7638

tests/bug-7638/bug-7638-flowbits-sigorder-02/suricata.yaml

@@ -0,0 +1,12 @@
+%YAML 1.1
+---
+
+engine-analysis:
+  rules: yes
+
+logging:
+  outputs:
+    - file:
+        enabled: yes
+        filename: eve.json
+        type: json

tests/bug-7638/bug-7638-flowbits-sigorder-02/test.rules

@@ -0,0 +1,2 @@
+alert http any any -> any any (http.user_agent; content:"Mozilla"; flowbits:isset, headtest; flowbits:set,moz; sid:10;)
+alert http any any -> any any (http.method; content:"GET"; flowbits:isset,moz; flowbits:set,headtest; sid:12;)

tests/bug-7638/bug-7638-flowbits-sigorder-02/test.yaml

@@ -0,0 +1,16 @@
+requires:
+    min-version: 9
+
+pcap: false
+
+args:
+  - --engine-analysis
+
+exit-code: 1
+
+checks:
+  - filter:
+      count: 1
+      match:
+        log_level: Error
+        engine.message: "Flowbits have circular dependencies that cannot be met at runtime"

tests/bug-7638/bug-7638-flowbits-sigorder-03/README.md

@@ -0,0 +1,20 @@
+Description
+-----------
+
+Test to show the order of flowbits after dependency resolution among the
+signatures with long chained cyclic dependencies.
+
+1 -> 2 -> 3 -> 4 -> 5
+^                   |
+|                   |
+ -------------------
+
+PCAP
+----
+
+None
+
+Ticket
+------
+
+https://redmine.openinfosecfoundation.org/issues/7638

tests/bug-7638/bug-7638-flowbits-sigorder-03/suricata.yaml

@@ -0,0 +1,12 @@
+%YAML 1.1
+---
+
+engine-analysis:
+  rules: yes
+
+logging:
+  outputs:
+    - file:
+        enabled: yes
+        filename: eve.json
+        type: json

tests/bug-7638/bug-7638-flowbits-sigorder-03/test.rules

@@ -0,0 +1,6 @@
+alert http any any -> any any (flowbits:set,A; flowbits:isset,B; sid:1;)
+alert http any any -> any any (flowbits:set,B; flowbits:isset,C; sid:2;)
+alert http any any -> any any (flowbits:set,C; flowbits:isset,D; sid:3;)
+alert http any any -> any any (flowbits:set,D; flowbits:isset,E; sid:4;)
+alert http any any -> any any (flowbits:set,E; flowbits:isset,A; sid:5;)
+

tests/bug-7638/bug-7638-flowbits-sigorder-03/test.yaml

@@ -0,0 +1,16 @@
+requires:
+    min-version: 9
+
+pcap: false
+
+args:
+  - --engine-analysis
+
+exit-code: 1
+
+checks:
+  - filter:
+      count: 1
+      match:
+        log_level: Error
+        engine.message.__find: "Cyclic dependency found between flowbits from signatures"

tests/bug-7638/bug-7638-flowbits-sigorder-04/README.md

@@ -0,0 +1,21 @@
+Description
+-----------
+
+Test to show the order of flowbits after dependency resolution among the
+signatures with no cyclic dependencies.
+Correct order should be:
+sid: 4
+sid: 3
+sid: 2
+sid: 1
+sid: 5
+
+PCAP
+----
+
+None
+
+Ticket
+------
+
+https://redmine.openinfosecfoundation.org/issues/7638

tests/bug-7638/bug-7638-flowbits-sigorder-04/test.rules

@@ -0,0 +1,9 @@
+alert http any any -> any any (flowbits:set,A; flowbits:isset,B; sid:1;)
+alert http any any -> any any (flowbits:set,B; flowbits:isset,C; sid:2;)
+alert http any any -> any any (flowbits:set,C; flowbits:isset,D; sid:3;)
+# sid: 4 will never match but handling that is out of the scope of the
+# bugfix for 7638. suricata-update can easily handle such a dependency
+# resolution by commenting this rule out.
+alert http any any -> any any (flowbits:set,D; flowbits:isset,E; sid:4;)
+alert http any any -> any any (flowbits:unset,E; flowbits:isset,A; sid:5;)
+

tests/bug-7638/bug-7638-flowbits-sigorder-04/test.yaml

@@ -0,0 +1,40 @@
+requires:
+    min-version: 9
+
+pcap: false
+
+args:
+  - --engine-analysis
+
+checks:
+- filter:
+    filename: rules.json
+    count: 1
+    match:
+      __lineno: 1
+      id: 4
+- filter:
+    filename: rules.json
+    count: 1
+    match:
+      __lineno: 2
+      id: 3
+- filter:
+    filename: rules.json
+    count: 1
+    match:
+      __lineno: 3
+      id: 2
+- filter:
+    filename: rules.json
+    count: 1
+    match:
+      __lineno: 4
+      id: 1
+- filter:
+    filename: rules.json
+    count: 1
+    match:
+      __lineno: 5
+      id: 5
+

tests/bug-7638/bug-7638-flowbits-sigorder-05/README.md

@@ -0,0 +1,3 @@
+# Description
+
+Expected resolved order: 1, 2, 3, 4 (the only valid topological order).

tests/bug-7638/bug-7638-flowbits-sigorder-05/test.rules

@@ -0,0 +1,7 @@
+# The ONLY valid order is 1,2,3,4. sid 4 is a depth-1 neighbour of the
+# source (sid 1) but also depends on sid 3 at depth 2, so a BFS emits
+# sid 4 before sid 3 (order 1,4,2,3 or 1,2,4,3), breaking the 3->4 edge.
+alert http any any -> any any (msg:"S1 set A"; flowbits:isset,S; flowbits:set,A; sid:1;)
+alert http any any -> any any (msg:"S2 isset A set B"; flowbits:isset,A; flowbits:set,B; sid:2;)
+alert http any any -> any any (msg:"S3 isset B set C"; flowbits:isset,B; flowbits:set,C; sid:3;)
+alert http any any -> any any (msg:"S4 isset A,C set D"; flowbits:isset,A; flowbits:isset,C; flowbits:set,D; sid:4;)

tests/bug-7638/bug-7638-flowbits-sigorder-05/test.yaml

@@ -0,0 +1,33 @@
+requires:
+    min-version: 9
+
+pcap: false
+
+args:
+  - --engine-analysis
+
+checks:
+- filter:
+    filename: rules.json
+    count: 1
+    match:
+      __lineno: 1
+      id: 1
+- filter:
+    filename: rules.json
+    count: 1
+    match:
+      __lineno: 2
+      id: 2
+- filter:
+    filename: rules.json
+    count: 1
+    match:
+      __lineno: 3
+      id: 3
+- filter:
+    filename: rules.json
+    count: 1
+    match:
+      __lineno: 4
+      id: 4

tests/bug-7638/bug-7638-flowbits-sigorder-06/README.md

@@ -0,0 +1,20 @@
+Description
+-----------
+
+Test to show the order of flowbits after dependency resolution among the
+signatures with multiple cyclic dependencies.
+
+1 -> 2 -> 3 -> 4 -> 5 -> 6
+^    |    ^         |
+|    |    |         |
+ ----      ---------
+
+PCAP
+----
+
+None
+
+Ticket
+------
+
+https://redmine.openinfosecfoundation.org/issues/7638