Skip to content

Commit

Permalink
tests/requires: test failure case
Browse files Browse the repository at this point in the history
Break the requires test into 2 tests.  One that runs to success so we
can verify the output.

A second that is expected to fail due to fatal init errors.

Ticket: #6710
  • Loading branch information
jasonish committed Jan 24, 2024
1 parent 0c0d2f5 commit baa6587
Show file tree
Hide file tree
Showing 6 changed files with 36 additions and 2 deletions.
3 changes: 3 additions & 0 deletions tests/requires-fail/README.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
Similar to `../requires-ok` but does include one rule that will fail
to load. This is to test that a bad rule after "skipped" rule fails
out and is not recorded as skipped.
File renamed without changes.
12 changes: 12 additions & 0 deletions tests/requires-fail/test.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
requires:
min-version: 7.0.3

pcap: ../eve-metadata/testmyids.pcap

args:
- -v

# As we have a bad rule, expect exit-code 1.
exit-code: 1

# No checks, as no stats are written on exit code 0.
File renamed without changes.
15 changes: 15 additions & 0 deletions tests/requires-ok/test.rules
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
# Rule for Suricata >= 7 and < 8.
alert http any any -> any any (msg:"TEST Suricata >= 7 and < 8"; content:"uid=0"; requires: version >= 7 < 8; sid:7; rev:1;)

# Rule for Suricata >= 7.0.3 but less than 8... Or >= 8.0.1
alert http any any -> any any (content:"uid=0"; requires: version >= 7.0.3 < 8 | >= 8.0.1; sid:9; rev:1;)

# Rule for Suricata >= 8.
alert http any any -> any any (msg:"TEST Suricata >= 8"; content:"uid=0"; requires: version >= 8.0.0; sid:8; rev:1;)

# These rules have something invalid about them, but do follow the general rule
# structure, so should be eliminated by the requires statement.
alert vxlan any any -> any any (requires: version >= 10; sid:1;)
alert udp any any -> any any (vxlan_vni:10; requires: version >= 10; sid:2;)
alert http any any => any any (requires: version >= 10; sid:3;)
alert tcp any any -> any any (frame:smtp.not_supported; requires: version >= 10; sid:4;)
8 changes: 6 additions & 2 deletions tests/requires/test.yaml → tests/requires-ok/test.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -50,12 +50,16 @@ checks:
count: 1
match:
event_type: stats
stats.detect.engines[0].rules_skipped: 6
stats.detect.engines[0].rules_skipped: 5
stats.detect.engines[0].rules_loaded: 2
stats.detect.engines[0].rules_failed: 0

- filter:
requires:
min-version: 8
count: 1
match:
event_type: stats
stats.detect.engines[0].rules_skipped: 7
stats.detect.engines[0].rules_skipped: 6
stats.detect.engines[0].rules_loaded: 1
stats.detect.engines[0].rules_failed: 0

0 comments on commit baa6587

Please sign in to comment.