detect-lua: add tests

tests/detect-lua/README.md

@@ -0,0 +1 @@
+Test http buffer

tests/detect-lua/suricata.yaml

@@ -0,0 +1,12 @@
+%YAML 1.1
+---
+
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular
+      filename: eve.json
+      types:
+        - alert
+        - flow
+

tests/detect-lua/test.rules

@@ -0,0 +1,6 @@
+alert http any any -> any any (flow:to_server; lua:test1.lua; sid:1;)
+alert tcp any any -> any any (flow:to_server; lua:test2.lua; sid:2;)
+alert tcp any any -> any any (flow:to_server; lua:test3.lua; sid:3;)
+alert http any any -> any any (flow:to_server; lua:test4.lua; sid:4;)
+alert http any any -> any any (flow:to_server; lua:test4.lua; sid:5;)
+alert http any any -> any any (flow:to_server; lua:test6.lua; sid:6;)

tests/detect-lua/test.yaml

@@ -0,0 +1,38 @@
+requires:
+  features:
+    - HAVE_LUA
+
+args:
+ - -k none
+
+checks:
+ - filter:
+      count: 0
+      match:
+        event_type: alert
+        alert.signature_id: 1
+ - filter:
+      count: 0
+      match:
+        event_type: alert
+        alert.signature_id: 2
+ - filter:
+      count: 2
+      match:
+        event_type: alert
+        alert.signature_id: 3
+ - filter:
+      count: 0
+      match:
+        event_type: alert
+        alert.signature_id: 4
+ - filter:
+      count: 0
+      match:
+        event_type: alert
+        alert.signature_id: 5
+ - filter:
+      count: 0
+      match:
+        event_type: alert
+        alert.signature_id: 6

tests/detect-lua/test1.lua

@@ -0,0 +1,27 @@
+function init (args)
+    local needs = {}
+    needs["http.request_headers"] = tostring(true)
+    needs["flowvar"] = {"cnt"}
+    return needs
+    end
+
+function match(args)
+    a = ScFlowvarGet(0)
+    if a then
+        a = tostring(tonumber(a)+1)
+        print (a)
+        ScFlowvarSet(0, a, #a)
+    else
+        a = tostring(1)
+        print (a)
+        ScFlowvarSet(0, a, #a)
+    end
+
+    print ("pre check: " .. (a))
+    if tonumber(a) == 2 then
+        print "match"
+        return 1
+    end
+    return 0
+end
+return 0

tests/detect-lua/test2.lua

@@ -0,0 +1,27 @@
+function init (args)
+    local needs = {}
+    needs["payload"] = tostring(true)
+    needs["flowvar"] = {"cnt"}
+    return needs
+    end
+
+function match(args)
+    a = ScFlowvarGet(0)
+    if a then
+        a = tostring(tonumber(a)+1)
+        print (a)
+        ScFlowvarSet(0, a, #a)
+    else
+        a = tostring(1)
+        print (a)
+        ScFlowvarSet(0, a, #a)
+    end
+
+    print ("pre check: " .. (a))
+    if tonumber(a) == 2 then
+        print "match"
+        return 1
+    end
+    return 0
+end
+return 0

tests/detect-lua/test3.lua

@@ -0,0 +1,27 @@
+function init (args)
+    local needs = {}
+    needs["packet"] = tostring(true)
+    needs["flowvar"] = {"cnt"}
+    return needs
+    end
+
+function match(args)
+    a = ScFlowvarGet(0)
+    if a then
+        a = tostring(tonumber(a)+1)
+        print (a)
+        ScFlowvarSet(0, a, #a)
+    else
+        a = tostring(1)
+        print (a)
+        ScFlowvarSet(0, a, #a)
+    end
+
+    print ("pre check: " .. (a))
+    if tonumber(a) == 2 then
+        print "match"
+        return 1
+    end
+    return 0
+end
+return 0

tests/detect-lua/test4.lua

@@ -0,0 +1,24 @@
+function init (args)
+    local needs = {}
+    needs["http.request_headers"] = tostring(true)
+    needs["flowint"] = {"cnt"}
+    return needs
+    end
+
+function match(args)
+    print "inspecting"
+    a = ScFlowintGet(0)
+    if a then
+        ScFlowintSet(0, a + 1)
+    else
+        ScFlowintSet(0, 1)
+    end
+
+    a = ScFlowintGet(0)
+    if a == 2 then
+        print "match"
+        return 1
+    end
+    return 0
+end
+return 0

tests/detect-lua/test5.lua

@@ -0,0 +1,17 @@
+function init (args)
+    local needs = {}
+    needs["http.request_headers"] = tostring(true)
+    needs["flowint"] = {"cnt"}
+    return needs
+    end
+
+function match(args)
+    print "inspecting"
+    a = ScFlowintIncr(0)
+    if a == 2 then
+        print "match"
+        return 1
+    end
+    return 0
+end
+return 0

tests/detect-lua/test6.lua

@@ -0,0 +1,22 @@
+function init (args)
+    local needs = {}
+    needs["http.request_headers"] = tostring(true)
+    needs["flowint"] = {"cnt"}
+    return needs
+    end
+
+function match(args)
+    print "inspecting"
+    a = ScFlowintGet(0)
+    if a == nil then
+        print "new var set to 2"
+        ScFlowintSet(0, 2)
+    end
+    a = ScFlowintDecr(0)
+    if a == 0 then
+        print "match"
+        return 1
+    end
+    return 0
+end
+return 0

tests/detect-lua/writepcap.py

@@ -0,0 +1,13 @@
+#!/usr/bin/env python
+from scapy.all import *
+
+pkts = []
+
+pkts += Ether(dst='ff:ff:ff:ff:ff:ff', src='00:01:02:03:04:05')/ \
+    Dot1Q(vlan=6)/ \
+    IP(dst='192.168.1.1', src='192.168.1.5')/TCP(sport=53, dport=80, flags='P''A')/"POST / HTTP/1.1\r\nHost: www.emergingthreats.net\r\n\r\n"
+pkts += Ether(dst='ff:ff:ff:ff:ff:ff', src='00:01:02:03:04:05')/ \
+    Dot1Q(vlan=6)/ \
+    IP(dst='192.168.1.1', src='192.168.1.5')/TCP(sport=80, dport=53, flags='P''A')/"POST / HTTP/1.1\r\nHost: www.openinfosecfoundation.org\r\n\r\n"
+
+wrpcap('input.pcap', pkts)