Added cuckoo.network.suricata() function (#115)

avast · Jul 24, 2020 · cf66a6c · cf66a6c
1 parent 6e01107
commit cf66a6c
Show file tree

Hide file tree

Showing 2 changed files with 23 additions and 0 deletions.
diff --git a/src/types/modules/cuckoo_module.cpp b/src/types/modules/cuckoo_module.cpp
@@ -43,6 +43,7 @@ bool CuckooModule::initialize(ImportFeatures features)
 		networkStruct->addAttribute(std::make_shared<FunctionSymbol>("connection_ip", Type::Int, Type::Regexp));
 		networkStruct->addAttribute(std::make_shared<FunctionSymbol>("connection_country", Type::Int, Type::Regexp));
 		networkStruct->addAttribute(std::make_shared<FunctionSymbol>("irc_command", Type::Int, Type::Regexp, Type::Regexp));
+		networkStruct->addAttribute(std::make_shared<FunctionSymbol>("suricata", Type::Int, Type::Regexp));
 	}
 	cuckooStruct->addAttribute(networkStruct);
 

diff --git a/tests/cpp/parser_tests.cpp b/tests/cpp/parser_tests.cpp
@@ -6435,6 +6435,28 @@ rule abc
 	EXPECT_EQ(expected, driver.getParsedFile().getTextFormatted());
 }
 
+TEST_F(ParserTests,
+CuckooSuricataModuleFunction) {
+	prepareInput(
+R"(
+import "cuckoo"
+
+rule cuckoo_suricata
+{
+	condition:
+		cuckoo.network.suricata(/SomeEvilSuricataSignature/)
+}
+)");
+
+	EXPECT_TRUE(driver.parse(input));
+	ASSERT_EQ(1u, driver.getParsedFile().getRules().size());
+
+	const auto& rule = driver.getParsedFile().getRules()[0];
+	EXPECT_EQ(R"(cuckoo.network.suricata(/SomeEvilSuricataSignature/))", rule->getCondition()->getText());
+
+	EXPECT_EQ(input_text, driver.getParsedFile().getTextFormatted());
+}
+
 TEST_F(ParserTests,
 CuckooScheduledTaskModuleFunction) {
 	prepareInput(