tests/dataset: coverage for the cidr datset type - #3304
Open
jlucovsky wants to merge 5 commits into
Open
Conversation
Ten suricata-verify tests covering the cidr dataset type: IPv4 isset/isnotset, dst matching, multi-rule, IPv6 isset/isnotset, mixed IPv4+IPv6, /32 host-exact precision, boundary conditions, and empty dataset behavior. All tests require min-version: 9 and verify per-IP alert counts alongside total alert counts. Issue: 8124
Nine suricata-verify tests covering additional CIDR behaviors: - datasets-cidr-11-set: dataset:set fires once per unique source host - datasets-cidr-12-unset: dataset:unset removes pre-loaded host entries; fires once per address then not again - datasets-cidr-13-save-reject: save option rejected at parse time - datasets-cidr-14-state-reject: state option rejected at parse time - datasets-cidr-15-mask: dataset:set with mask 24 fires once per unique /24 prefix, not once per host - datasets-cidr-16-lua: Lua can retrieve a CIDR dataset via dataset.get() - datasets-cidr-17-mask-hex-prefix: mask 0x18 (hex) behaves like mask 24 - datasets-cidr-18-mask-bitmask: mask 0xffffff00 (IPv4 bitmask) behaves like mask 24 - datasets-cidr-19-unset-mask: dataset:unset with mask 24 removes the pre-loaded /24 netblock on first match; does not fire on subsequent packets from the same /24 after removal Issue: 8124
- tests 05/06/07: add a per-test suricata.yaml with ipv6-compress: yes so eve.json IPv6 addresses appear in RFC5952 compressed form, matching the human-readable src_ip filters in test.yaml. - tests 15/17/18: replace different-source-IP pcap with same-5-tuple packets per /24 so intra-/24 ordering is deterministic (same flow -> same worker -> serial processing). - test 16: add --set default-rule-path=. so the Lua script is found relative to the test directory rather than the system rules dir. Issue: 8124
Seven suricata-verify tests: - datasets-cidr-20-ipv6-set: dataset:set on IPv6 sources, fires once per unique host (mirror of test 11 for IPv6). - datasets-cidr-21-ipv6-unset: dataset:unset on preloaded IPv6 hosts. - datasets-cidr-22-mask-isset-reject: mask option rejected at rule load when combined with isset. - datasets-cidr-23-mask-out-of-range: non-contiguous bitmask (0x00ff00ff) rejected at rule load. - datasets-cidr-24-mask-non-cidr-reject: mask option rejected when used with a non-CIDR dataset type. - datasets-cidr-25-datarep-cidr-reject: datarep keyword rejected at rule load when combined with type cidr. - datasets-cidr-26-mask-zero-reject: mask 0 rejected at rule load. Rejection tests use --engine-analysis and grep suricata.log for the specific error message; they require exit-code 1. Issue: 8124
Two rules mirror the semantics of tests/lua/lua-transform-09 without per-packet Lua invocation. That test uses luaxform to mask an IPv4 address to a network and content-matches the resulting CIDR string; here isset on a type-cidr dataset walks a radix tree that already contains the target prefix. Reuses ../../lua/lua-transform-01/test.pcap so the alert counts (4 for sid:1 on ip.src in 10.20.48.0/24, 4 for sid:2 on ip.dst in 10.50.0.0/16) are directly comparable to lua-transform-09. Issue: 8124
This was referenced Aug 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Test coverage for the
type cidrdatasetWhat's covered
27 tests grouped by what they exercise:
isset/isnotsetfor IPv4, IPv6, mixed dual-stack,/32host-exact precision,/16boundary, empty dataset.setandunseton IPv4.saveandstateoptions rejected at rule load (CIDR is load-only).maskoption in all three notations: decimal prefix (mask 24), hex prefix (mask 0x18), IPv4 bitmask (mask 0xffffff00).dataset:get.unsetwithmaskremoves the correct/Nnetblock.setandunseton IPv6.maskonisset, non-contiguous IPv4 netmask,maskon a non-CIDR type,datarepwithtype cidr,mask 0.tests/lua/lua-transform-09, reusing that test's pcap to prove the CIDR type replaces the luaxformIP -> CIDR stringworkaround with the same alert counts and no per-packet Lua invocation.Tests 05, 06, 07, 20, 21 ship a per-test
suricata.yamlwithipv6-compress: yessosrc_ipfilters intest.yamlcompareagainst compressed RFC 5952 IPv6 output. Test 16 uses
--set default-rule-path=.so the Lua script is found relative to the test directory rather than the system rules dir.Rejection tests (13, 14, 22-26) run
--engine-analysiswithexit-code: 1and grepsuricata.logfor the exact error string.Behavioral tests use small hand-built pcaps generated by
writepcap.pyscripts kept in each test's directory; testsdownstream reuse pcaps from earlier tests where possible (mapped in
tests/datasets-cidr/README.md).Redmine ticket: https://redmine.openinfosecfoundation.org/issues/8124