Enip rust 3958 v1

tests/enip-alert/test.yaml

@@ -3,7 +3,7 @@ requires:
 
 # disables checksum verification
 args:
-- -k none --set stream.midstream=true --set app-layer.protocols.enip.enabled=yes
+- -k none --set app-layer.protocols.enip.enabled=yes
 
 checks:
   - filter:

tests/enip-keywords/test.yaml

@@ -2,15 +2,24 @@ requires:
   min-version: 7
 
 # disables checksum verification
+# use stream inline to match Wireshark as last packet does not get acked
 args:
-- -k none --set stream.midstream=true --set app-layer.protocols.enip.enabled=yes
+- -k none --set stream.inline=true --set stream.midstream=true --set app-layer.protocols.enip.enabled=yes
 
 checks:
   - filter:
+      lt-version: 8
       count: 41
       match:
         event_type: alert
         alert.signature_id: 1
+  - filter:
+      # version 8 also works on responses
+      min-version: 8
+      count: 81
+      match:
+        event_type: alert
+        alert.signature_id: 1
   - filter:
       count: 267
       match:

tests/enip-log/README.md

@@ -0,0 +1,8 @@
+# Description
+
+Test ENIP logging
+And enip_command keyword with enumeration string
+
+# PCAP
+
+The pcap comes from https://redmine.openinfosecfoundation.org/issues/3886

tests/enip-log/suricata.yaml

@@ -0,0 +1,19 @@
+%YAML 1.1
+---
+
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
+      filename: eve.json
+
+      types:
+        - alert
+        - anomaly
+        - enip
+        - flow
+
+app-layer:
+  protocols:
+    enip:
+      enabled: yes

tests/enip-log/test.rules

@@ -0,0 +1 @@
+alert enip any any -> any any (msg:"SURICATA enip test command string";enip_command:ListIdentity ; sid:1;)

tests/enip-log/test.yaml

@@ -0,0 +1,21 @@
+requires:
+  min-version: 8
+
+pcap:  ../enip-alert/enip_test1.pcap
+
+# disables checksum verification
+args:
+- -k none
+
+checks:
+  - filter:
+      count: 2
+      match:
+        event_type: alert
+        alert.signature_id: 1
+  - filter:
+      count: 1
+      match:
+        event_type: enip
+        enip.request.command: ListIdentity
+        enip.response.status: Success