Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

tests: adding rule type check for flowbits v4 #1441

Closed

Conversation

hadiqaalamdar
Copy link
Contributor

Task #6309
Related to
Issue: #6309

Redmine ticket: https://redmine.openinfosecfoundation.org/issues/6309
Previous PR: #1439

Suricata PR: OISF/suricata#9691

Output from console:

===> flowbits: Sub test #1: FAIL : expected 1 matches; got 0 for filter {'filename': 'rules.json', 'count': 1, 'match': {'id': 1, 'lists.packet.matches[0].name': 'flowbits', 'lists.packet.matches[0].flowbits.action': 'noalert'}}
===> flowbits: Sub test #8: FAIL : expected 1 matches; got 0 for filter {'filename': 'rules.json', 'count': 1, 'match': {'id': 8, 'lists.postmatch.matches[0].name': 'flowbits', 'lists.postmatch.matches[0].flowbits.cmd': 'isset', 'lists.postmatch.matches[0].flowbits.ored_flowbits': 2, 'lists.postmatch.matches[0].flowbits.ored_variables[0]': 'fb1', 'lists.postmatch.matches[0].flowbits.ored_variables[1]': 'fb2'}}
===> flowbits: Sub test #9: FAIL : expected 1 matches; got 0 for filter {'filename': 'rules.json', 'count': 1, 'match': {'id': 9, 'lists.packet.matches[0].name': 'flowbits', 'lists.packet.matches[0].flowbits.ored_flowbits': 1, 'lists.packet.matches[0].flowbits.cmd': 'isnotset', 'lists.packet.matches[0].flowbits.ored_variables[0]': 'fb1', 'lists.packet.matches[0].flowbits.ored_variables[1]': 'fb2'}}

@jufajardini jufajardini added the outreachy Contributions made by Outreachy applicants label Oct 26, 2023
Copy link
Contributor

@jufajardini jufajardini left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Improving, tests run now! :)

Please, ensure that the commit message complies with our guidelines. It is saying adding, but we use the imperative, so, it should be add ;) (note that this also applies to the Suricata PR!)

The check for rule with sid 1 seems to be failing because we must likely add a check in the code to ensure things work as expected when we don't have a variable name - which is the case when cd->cmd is NOALERT.

The other failures are probably likely to us not having the loop, yet, to actually check the or_list... ;)

@hadiqaalamdar
Copy link
Contributor Author

New PR: #1512

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
outreachy Contributions made by Outreachy applicants
Development

Successfully merging this pull request may close these issues.

2 participants