test: add test for dns.rcode v3

[hadiqaalamdar]

Feature #6621

Redmine ticket: https://redmine.openinfosecfoundation.org/issues/6621

Previous PR: #1567

Suricata PR: OISF/suricata#10126

Changes made:

• Changed the rcode:12 to rcode:3 which caused the schema.json error shown below. Changing the rcode value back to 12 got rid of this error
• added negated rule which also caused the schema.json error regardless of the rcode value

Output from console after running the sv test:

Finished release [optimized] target(s) in 0.16s
===> dns-rcode: Sub test #1: FAIL : expected 1 matches; got 0 for filter {'count': 1, 'match': {'alert.signature_id': 1, 'direction': 'to_client', 'app_proto': 'dns', 'dns.rcode': 3}}
===> dns-rcode: Sub test #2: FAIL : expected 1 matches; got 0 for filter {'count': 1, 'match': {'alert.signature_id': 1, 'direction': 'to_server', 'app_proto': 'dns', 'dns.rcode': 3}}
===> dns-rcode: Sub test #3: FAIL : expected 1 matches; got 0 for filter {'count': 1, 'match': {'alert.signature_id': 2, 'direction': 'to_server', 'app_proto': 'dns', 'dns.rcode': 3}}
===> dns-rcode: Sub test #4: FAIL : expected 1 matches; got 0 for filter {'count': 1, 'match': {'alert.signature_id': 3, 'direction': 'to_client', 'app_proto': 'dns', 'dns.rcode': 3}}
===> dns-rcode: Sub test #5: FAIL : expected 1 matches; got 0 for filter {'count': 1, 'match': {'alert.signature_id': 4, 'direction': 'to_client', 'app_proto': 'dns', 'dns.rcode': 3, 'dns.negate': True}}
/Users/hadiqa/suricata-verify/tests/dns/dns-rcode/output/eve.json - INVALID. Errors:
1./dns/answer Additional properties are not allowed ('authorities' was unexpected)
/Users/hadiqa/suricata-verify/tests/dns/dns-rcode/output/eve.json - INVALID. Errors:
1./dns/answer Additional properties are not allowed ('authorities' was unexpected)
===> dns-rcode: FAILED: Invalid JSON schema

PASSED:  0
FAILED:  1
SKIPPED: 0

Output after running cat output/eve.json | jq 'select(.dns) | .dns' output/eve.json:

{
  "type": "query",
  "id": 33429,
  "rrname": "dne.oisf.net",
  "rrtype": "A",
  "tx_id": 0,
  "opcode": 0
}
{
  "answer": {
    "version": 2,
    "type": "answer",
    "id": 33429,
    "flags": "8183",
    "qr": true,
    "rd": true,
    "ra": true,
    "opcode": 0,
    "rrname": "dne.oisf.net",
    "rrtype": "A",
    "rcode": "NXDOMAIN",
    "authorities": [
      {
        "rrname": "oisf.net",
        "rrtype": "SOA",
        "ttl": 899,
        "soa": {
          "mname": "ns-110.awsdns-13.com",
          "rname": "awsdns-hostmaster.amazon.com",
          "serial": 1,
          "refresh": 7200,
          "retry": 900,
          "expire": 1209600,
          "minimum": 86400
        }
      }
    ]
  }
}
{
  "answer": {
    "version": 2,
    "type": "answer",
    "id": 33429,
    "flags": "8183",
    "qr": true,
    "rd": true,
    "ra": true,
    "opcode": 0,
    "rrname": "dne.oisf.net",
    "rrtype": "A",
    "rcode": "NXDOMAIN",
    "authorities": [
      {
        "rrname": "oisf.net",
        "rrtype": "SOA",
        "ttl": 899,
        "soa": {
          "mname": "ns-110.awsdns-13.com",
          "rname": "awsdns-hostmaster.amazon.com",
          "serial": 1,
          "refresh": 7200,
          "retry": 900,
          "expire": 1209600,
          "minimum": 86400
        }
      }
    ]
  }
}
{
  "version": 2,
  "type": "answer",
  "id": 33429,
  "flags": "8183",
  "qr": true,
  "rd": true,
  "ra": true,
  "opcode": 0,
  "rrname": "dne.oisf.net",
  "rrtype": "A",
  "rcode": "NXDOMAIN",
  "authorities": [
    {
      "rrname": "oisf.net",
      "rrtype": "SOA",
      "ttl": 899,
      "soa": {
        "mname": "ns-110.awsdns-13.com",
        "rname": "awsdns-hostmaster.amazon.com",
        "serial": 1,
        "refresh": 7200,
        "retry": 900,
        "expire": 1209600,
        "minimum": 86400
      }
    }
  ]
}

Output from stdout file:

Notice: suricata: This is Suricata version 8.0.0-dev (8e0535dc2 2023-12-21) running in USER mode [LogVersion:suricata.c:1147]
Warning: threshold-config: Error opening file: "/usr/local/etc/suricata//threshold.config": Permission denied [SCThresholdConfInitContext:util-threshold-config.c:177]
Notice: threads: Threads created -> RX: 1 W: 12 FM: 1 FR: 1   Engine started. [TmThreadWaitOnThreadRunning:tm-threads.c:1891]
Notice: suricata: Signal Received.  Stopping engine. [SuricataMainLoop:suricata.c:2805]
Notice: pcap: read 1 file, 2 packets, 259 bytes [ReceivePcapFileThreadExitStats:source-pcap-file.c:389]

[jasonish]

This should only alert in one direction, the reply. As the request has an rcode of 0.

[jasonish]

This should not alert at all. As an rcode of 3 in the to server direction does not exist in this pcap.

[jasonish]

This one is good, we should see one alert for this.

[jasonish]

This won't alert either. I'd suggest a simpler rule like:

alert dns any any -> any any (dns.rcode: !3; sid:4; rev:1;)

which should alert one, with the DNS request as it has an rcode of 0.

[hadiqaalamdar]

New PR: #1578