From 88660372f8ca7fefa62538ee05c25d9a41ece5e2 Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Tue, 20 Jan 2026 10:31:25 +0100 Subject: [PATCH] tests: add test for issue 4081 --- tests/bug-4081-01/README.md | 3 +++ tests/bug-4081-01/test.yaml | 22 ++++++++++++++++++++++ tests/bug-4081-01/test_icmpv6.rules | 3 +++ tests/bug-4081-01/v6.pcap | Bin 0 -> 28251 bytes 4 files changed, 28 insertions(+) create mode 100644 tests/bug-4081-01/README.md create mode 100644 tests/bug-4081-01/test.yaml create mode 100644 tests/bug-4081-01/test_icmpv6.rules create mode 100644 tests/bug-4081-01/v6.pcap diff --git a/tests/bug-4081-01/README.md b/tests/bug-4081-01/README.md new file mode 100644 index 000000000..ff6c21b7a --- /dev/null +++ b/tests/bug-4081-01/README.md @@ -0,0 +1,3 @@ +Pcap from https://gitlab.com/wireshark/wireshark/-/wikis/uploads/__moin_import__/attachments/SampleCaptures/v6.pcap + +https://redmine.openinfosecfoundation.org/issues/4081 diff --git a/tests/bug-4081-01/test.yaml b/tests/bug-4081-01/test.yaml new file mode 100644 index 000000000..84242fcad --- /dev/null +++ b/tests/bug-4081-01/test.yaml @@ -0,0 +1,22 @@ +args: + - -k none + - --set vars.address-groups.TEST_1=[127.0.0.1] + - --set vars.address-groups.TEST_2=[127.0.0.1,::1/128] + - --set vars.address-groups.TEST_3=[::1/128] + +checks: + - filter: + count: 9 + match: + event_type: alert + alert.signature_id: 1 + - filter: + count: 9 + match: + event_type: alert + alert.signature_id: 2 + - filter: + count: 9 + match: + event_type: alert + alert.signature_id: 3 diff --git a/tests/bug-4081-01/test_icmpv6.rules b/tests/bug-4081-01/test_icmpv6.rules new file mode 100644 index 000000000..e2cf3822a --- /dev/null +++ b/tests/bug-4081-01/test_icmpv6.rules @@ -0,0 +1,3 @@ +alert icmp !$TEST_1 any -> any any (flow:stateless; msg:"ICMPv6 Test Sig 1 - IPv4 only"; itype:136; sid:1; rev:1;) +alert icmp !$TEST_2 any -> any any (flow:stateless; msg:"ICMPv6 Test Sig 2 - IPv4 and IPv6"; itype:136; sid:2; rev:1;) +alert icmp !$TEST_3 any -> any any (flow:stateless; msg:"ICMPv6 Test Sig 3 - IPv6 only"; itype:136; sid:3; rev:1;) diff --git a/tests/bug-4081-01/v6.pcap b/tests/bug-4081-01/v6.pcap new file mode 100644 index 0000000000000000000000000000000000000000..4dda39d09e4c0474f375735f37a24800f305b13b GIT binary patch literal 28251 zcmeHw2|SfeANHKha_no`gk&j&tnCV+2qi6K$zHZ(OR7WGO433_CGDkzRtbfYEFlyX zMT-_KWT_{n*LuHoZqz!%QUY`<;(+`&cKS+)08!$4w*a?6FgUsaVr8c{imz?E8ifKvjRtrYY-rq09Q)W-r^8&EZtUdR){6pEAnMkNS8IgU<35VaLi z5CD8$LvN1(VeXxcgRkMhQVY=AQ)ie9uVE1#nxGnP?%)KLPzNZn(4ExG-X6#uz4~;= zcyE``+XHnP30!ZZ>x1)gu=SCG5ejh^Cs+c@pv0^>Ab~-lTV+_It33*&oyvosW#rS# zA?rE;-2EJ=m{>&v$bq3?`llH0>DD8`fvKowgYzK=YF|Vs_)XmX9GH73fV9cp)ys?E;N<~OXF^~> zr}%&~Y#x-Dn**o9RtQ*wQ@M}~I6_bez`>|SVgUw~O6{G5aX<(Ff`^YPrZ#zk)DVGB zIS2#@o*Vz>k_fyso#5zT&-#;Mc+ZU-PJTXK-cGCwpwDZ-&j(^Iql!RuYG;5|BbNOX zGU+Qu&&Q`E0OAv=MdW__*em(Es-ycVhRv^tEs}xxeb%W~N(_pm-$AdN-}+rwV+f`{ z#M44PT|i7SrRVo`HH6}x{kyKlK>3@_5CxuzN>2M9KvlJnTQnOYokId8y!G9=xJQ?On7BIz*Ib2u9<8^tu`LzJLG#g<8&V zv=rvEIxufq-+QUFi0=6Qaxls>UOEJ1PlE9t{h~n4GaRjg$)%Mu9Bqfqqt#_}Z*PBQ zUpYq30*FhqH=dCPe^H@+763skHxiAnAjS(ieR-G<(|mws0qYFyDfGgcaQ7Famg9uI z6Z2BR*k)wY{VajGhWtlD@9}sL(A%^9KAG-6G#J5wM)ezybbv4;59QifuR02VA|sCg zhgeeYdwalw1++YB{pc7ts2N(jVNs!9Xue`p4gErG53T`OK#E$fe+bAZ2iX!ajA`wG z$%EIZ?E(2IY4a>n1_AoaKg_L2DXO^7c~znAwbVF!+w^YXU8JX zn>mky&7#{2VU@=MmohMqTIUc!?1xoQ9&SJ}pg`3hFSZyx4**__V`w@Z*hol|&@VdJ z536t^3;;winKV6Pb7*=-{c@r{y&%*Lg<2O(9<)Qt17IAsE>vy6Ji6A91u6y!0}6kY zBDTUPwxpT>Y~eeUSPU2x*%&a`zyX7zrje2ltOUItOao{%nnZ9Xp~}XzC0yU|md_qA4R4vR^$&0Jgs9^Qz_<5rrX2m(hnRA(9)?Rm z2SMhrO2kSy3}=ktg)sSWdVxF@EkFb|&_^h-Xcz?!9VjKHnH+WuPv`;SHU4eV$Urh) z3P@DLct#{8;|MS|;kd|vt9S*vhS20%F=)(VUj>diNVr(*gVBLFp@%n!)C3V_l7*$M zlkyN6v4DYwbDM+^5t`l?V*f~+c?>MYHa8iF*h~?Ww!Xg~YOjwIL_#RjKqJ26)a{%9mRGcsIatI9wQ*NC0J{5@x=R za9?`GsdajnZ|-gYBs57X+F_1VumN zpYPlW{FS}xE-Gg|J5pp=&Ye5{P|}O4FZVa|7}mC}$`@KNL1oh6B{#OzR=TI&Nai_w zaYon4)Qffzxuo~U^%R0dg3lHwyhwZ-!XaQuA8)R%==Zf`4p0%up^&QQsNSiIH|L?rJKqlpB2e^g;^yE z%Gcdri>eb#E=xlm=(6SM@5{`QLyBGPadJZKm7=~}SisPp9E=z%5sH%nKR~c3F)JJ> z{X-P!XC=phD9|iPs{F+5N3z6tgxEZVAFP9!D6wc+b+%i!6t=7gYS}fpjFw#mTUHL* z73khJF0=mUZ7bU`qiYXNJ|p)TBG*BMjR;o}=+T!58FzL7*HsXibZ(>Zyjri0T!c7# zIRHOkCQ2;07O>6rCFD8*AqGQ3^q|$p^`P+m9`nvF&$iImL(!2M!P05C?*>!Wuh;u# zu<_vJ>uQ>DAEFdDv}Y7kPJK;SEy?+ErbCnYU1y!SlYE3TW4_5RO~`JM@2>xJ*zh66 z=jp1H-NI}9ar2kxymq-A)Hx+vJ74|$xs7)cHtk5ZTYUBCzUh_iS=KTyGqw~En@6q4 zSao;z)lr_R9-Hh>yub8Wz2>>n+p`8+PUlT_+~pPV_LuXoc;HzTmZ+ESPdW)$@#>Q(ROB^f4e0a{*{N( zf~swkI|WCs_kafo@wPh=yn=0s5({mova4+>uUyokIe7zk$wRx5$3pk!b!VpOo>YHx z)n2CvRClzhruon2Z98NbQVhiI67GLBe`PYY<#_MXeGbd2r1K0UtIqFEJ@`_kAnZe? zmt169#m;(n9Kri5ajaVY;iI|9xeD=u$@9HeCp#;x*Nza8Ul{s%Z+^AB*pvmQ(^W4mZvOV;V)PF8I)V#_YuCkRTdeO^iduE@R1%7UN_oEL>2@BSGEZ+> zW$S_qzH`3kw}i&)*?-?8n%*gEVr8>@Nww{&hD$Y4bxAsL7f!8tKdbs}?+LYik8>_c zzD!Aacy9Dw#nS7+i?>+45GtASHvX;Y_o;h|y~~~ET78rF6zE@Qo-hWrahEB_h-mk_ z5N{CIVx-;tnFHGxp;-Oo1U|5_QDUK_+3YHbjspGq8O}E8J!Cb!BOoP-EpRnp+ z_gr-~e`mAu7%uaPe52%eAEO$Gf9C?BunW4%6mKu`059QxTmX}CQ*(~I{#Y47K^Xm(h($o)AWkftsjVf#~3wgtc8sDcv z&j%pS-~Bq!CkSP|BY8xk23J5IZ<$#P-U={kAl@XCMRV#;rg|46#3B!Je;;Dz#dg%7 z^4g9(eG5)QFm0^>5w|;uJ;^R_j(6f8UYLh+Iw)L7 zS>ivXOKT9Ij7v`8Y{qYK=v@-ucbHxE2``5|2j9pPsb~ zF%FC185tjMhd#cE81M0B_VE^10?>%s`~o3XCSwqpeXPWGf4T{^6N?bdE;IR<6rN?# zT-g2SJwkNL4#z^sF%cn#onYp;ARy0U zJZb#yFA(w0ApmycX^A;T;8(I8BN8FU3WWH-Kq-&|j1P{v2tfrRgA1`dks_%+rG!IzLdt%)7 z{=tVcLExAH>%t)ogb@q zsm_$R?T{h&3+}*oZb_boo6R>DDL!cXk~=TwUF*g+%cagKCmf!g`g-!_)o9P#}SWd#vB`I_^;=uZeZ2`~H<1;_No3|FBL`OL9K(?ttpzw@&7>5`v?&O-K%T?VU|+ zCH_5EjSY-;y)j&o65gw*ze?RV@RNV#-Jiz|BBQ57PpN+O&;e)a+I~4W;AVWi%+L0j zLZ@vOZnd_QnsQ^Iw#W8u`=j%()BRm!HS-8)HoJX*T-DbHf(jXZK#_jG5NrGx z@?7!#q{D&tpGmZ(>T1Ubwzm2%72klEMkI*mXDZLi0X!8E3ekvjM8*T;&wV_f zG%@j%Kdoc)SNK7mZmsgP_bqNDcYT9o4a3VNOVyO??1juSHVJH_w2&yHHli9`cO9Ye z0OZXxmdd+-J;WNeui{sTl5(1NMCRs5MGytXxQtH>@7f>~sAqB|SYtgi$Hnc~s>#`R z?Jn&{$UDFA^&>MYi|v&*p0Uv5uMx7y2ZqO$pt8_%FInL&x3%elYumbAVszj9AU#6J zoNX9n<~s@7>k;2yL(a+&+3-AE{iTmc5N9QXTvE8aI%(W|2ftzpFdtne@C_ovZ-PgL zvohq|jX0mnVdm_uoYGdB^D!YL$*f<-H@{`;%p1= zjC9VneVo7UiL<;tvyF0n9Zu(9?(#Rt52=3gy>ry8i)v&dcI)o(4?wjk3BZkvA9QQ{ zJEV~xwENcvP}`&LV0fCwJj*!~YXb_`_T0ahuQ?SVcNSuhhtc*O($Ehp5OSd>vmf?s z-yl`2)HOM&Q9PWIOK8km zh>&N9V~~f#Sp#xjkJ|pjtpS|TP91VyvfP)-yp!%R4W%lhmgBk+a;qhAWH_&foQ)9Y z%e$F5S1(SjvP^f4pJDGXUhvX{-3Zxw6$W`YoQ)voZHV*7{xwIWcPi&aaWiIJ*yLj| z`kcb}*$XmE5Hj&OX=FHWgPhkO&h4tqoNa?2JUDkFV^7&UkKF(kr%Q`BohXuNdst%Yy2thB!UfLiNnXC7jjjva8xJCuPlr~c>=F9z> zv$18yx%h0ugGq0es)=4BUKqEp5nntir1((42ggW$O%wi%^&cxXG|aV3pG&bZ^!sY| zEkgUdiuopM)9;NxLmFMyr2SMd^Q+YptZkEA^wgv_WoOf&i$)FKg*E?j;fpdo(4D#Q z&BPy*PTqAnKeNlRVErhE-kLjG-7gnwyb%oDG|#lHa#h9dh`+9fs^9N2e;4V|QtH9C zx2Qc?_cfod#EvVJ0|q~Se$I%_th;SHQ~svY*cb(|!^_f6g_noeRnMrtII}49RfO-S zCvs=_Go=G&t7JF4%Xds_1i@n(r<^#srRe8Gi&{VV2Jxn{539gv?km5ReJ&>S6c`*m zyf7(oY4a()v8lIPd7WI<4|N@$!M(J>^fRvfM1pG>pUIBAFpJB$DF=>J>|56$YLYLu z$GB*sS|;Fis#v?2a@J@&t2Qo))AN_7%^&stMI2)K0e$p zJ}c>6kN&ASmw2BNA0A~`bDYyvF8ui1xm;2_+Ye^8J@VLh_}J^C%kgn9TE13Rw9izxA38b?ska>f*GwDg|ZvVo%5{b zCBFG})%sLgbm1eU&MUs$fS&~Si^9Y_k0U-|cMQw-kg85NQns&RR%h%=)pYIjF!IVD zpIh%`kJ|8r|D&hpcdMp33-(rZ1e022=kRY!d709c8+Z8AqSzg6uflR3Oi43&nY=zI zU*$pmd3|-O?&Im(GX(0UY@f4fmq=Ek1?OUeaY0F6CrXWrdj7!o{`KPr>thYc6MF9Z zj51bixikJ&9+R`; zT1}klk4=2{?0W38sT=N%KO+$Jp<0D(r`~xd|Kz#pH^w~9NWpECTZlejO@Qu9SawSwvz zOU=m9uhT5m(mL*4S|m3gSFmJZ`*zn)T1|SXy)!ey!#~c^&pCWI(XUXsg%DdAB$AuP zmCVud%U46;O=tXky$53U)(3a1r9V_K&negNG?*d#*!jVDEveUI@F5k?(gNO2Qr8)? zJgV@v_{BBLR%~$T)SadyrfU4Wb483qPFco_=omTeyhR7L8QD`72M1^Py^h^+1Z2(i ziqs3W9;de)mzUl^Y1{0q`{+;_T9uMc($y}!5WM%Z`u6WU+WfbUv^neN#7iWPF2@j-)xxOQQ+2jitHJD%=%q|n6cd2t(V>INbg*z zVq*SX!PEZdS@Y_-c{Xyk+z#Q@?XOOSq>4dk(&mSvtx& z;hP?qPq1h?w?%FxU&4|?zMmC;HNLymW8u)O62!PbN$V1l*i^P9`gum zx$)BKUFm(#AF;AmT%vp)sh6Hs_cGlw`?iW!?(y0xZI`P#8%I4^Z&0uaXVhq-Iel$= z<2{k=?Y$ES(oa1?3$5zN>K|{3^>$@9G%c2r<(@QJo$qDl!!gNSk1Mp-B*orcv3O-1 z*Yh2=71F1B*;xzCiC;$3w<>o-FA21an zx33iDcRryxZ$GDTqh2y4vDS-BdT=aOmB_{MQF_L&St4Dl13bUQJr_8Bv-eBIwvVTI z)AhVO=Qi5R^<0~-+UDo*F;s5S{OpVE(YJ7knHsYxQ&oiDwiKjZ&7hp|G6}o*WYlFf zA+NLJjCW1kzQ?0m#wug&;|sE8znso>xV~s>y#MN`#i4tdN$Tp((oL4iX?O8%yLaT` z)fU>V)mC3MNoLvpPIIICSLH4?%|5clV{+}e($xR)$YkxM;X=%OHC5!Ma$vzS}4 zTT(U!7n%QKyfN7w$6qPqPE3!v^!(;Cjy0*$XJV2pcD5QE4A580@JxF%>+OsEd(~fL z*N@*ce-GDkbFDo_d-z@Bx#Cu4v|ljtUp`(j4o0n~(l*{VQeG?OXr6Fhj-un_;E|bU zc5L7c65fvHnb!|6Mh$joq=ZnsK9Rv>IAcJGIR@j}*^R-%a7~mpLePA|h{4m)=yzwf z?S%a$$AlLo#K`bZ8Q(r*AHHqk>fQwj%lBn;U*~FaKJsLP)yKk#*~Oh(#EfvdZ@w-Q zzb4uH%+z(d|Mc_APj?g-SLodm7tYApT=qc!cD<&8hvNY}A=KrjSeU?5yI{kF$Lj=> zS0{z_ybFuV`KzgXSIKe%Z^`P&lvV3izny!c)KTvasY%THu%CvEkI2F2(-ZyO%+F7* zb>9C=RLNJ(bE~56$LF$|K~MSd&p&*q-SLqtZC63Of+>f_9+JM2@tuMhHhZsBMt@l` z`TY1F{vQ-Rj*)Pv8XL3V#!U%n{T-Cj=tY|jnmxZaO3C`oiik(fxN~g>J}a9|tU2`3 zUEHDUVS4dN4T*cI4s+)Em|O_{7;ImqvK_b2n^VN-Kw zLat)*zRI#^9C*qAw+D0=4bPXtDsNS~rBkUp>G4bbPbHmFZ&!U)Y5Xee+5 zD+Tv3(&xwauop~&vL{!`tkDQiH8)-UOXRWQ3vOPCx5w=(KD1` z&#;HcV%cp=imy1ns?0hdSErO39PyR!T~9;C$9t#-m;Fa(g{=dAUoEfydw8bZgp zDI=8EPH<-xtO`oZ5dg5g-XprPk7w0iOgy=76UHUWzZhq0x`v;Vsa z=6Mm@-;PlEMWWeB-E&6Uu0{MHA(9TIBTDPY`ez8SN1khBG#dv!8c7j?nspzDh)~j2 zV^Ek^(AeHDBpL}l8V6C#t_BY9=vsu*Y>h!-_8!~289ES`D2QUkic1v^a~B#em%R|h zlogji0tRI`T=r7A2(so))6u)~;451X5aP>c9#mr?G&xv(I>+@2%hP!3j7HyesD%koRZrG&m*@T-M2S0O& zwoD_qEp=SO-!g3rntLU-eh;BQI5xISTMn^hnsJTAmg&gfY?+P(f4pVd@^7|GqkOn! z8hMKFg^Rj7a}m-Db4L*s!VTWEJa|)cvR`N-5Dndlo`gaczklMQ{*?d91%jYalvvyb z^k(*N#{Qe9p$MQ8-r!)h&_Bbd$;F>sAOV^{i3LY{Hume=L-E;D3b%Ijiw|dybHdHQ zY2vhSD)2XF>K`qbqXP4$!+%v_!u~rS;AKH{8GCK;dsH{L&%6>4i{A;XMf{zoaSvaLNkH`DV)SqrvbaNuoBDILGWUO8 ziY#lAqBa5?j{s4BeFB|huPTk>Hue7kN0v3Yq5T_<=s~d|pTdA4hDF@nJ?(Hub6DT-w9?uo~1SpU|_R)Q9($lDOg;ylh;R~U?f7{OncALByU0V|bmpR9g?ToSDJ&8|4t(I^9|bFxH8~MS9&WI5K*1_> z%+@YUutLFTs6QGwb(|V?Bt#2ZzYA7p?~#E%w2u;tU?sp-uyVi&P6d)>gl8dhIRV6fiXMFuH=$mCt8aqdT z;|U<@x`~_4k<>xsxKxtoKi`L0*2G?(XXrSEo}B(&oH_|a%MHjxTAVsEiH91eytsIW z=J?ykSaC#=e>zWNS(7t-yu*!Cj?_Vw_ttJqoN|IuNDW3REf|mb=4sA2N0{S4k4}A2 zOcj=(&D(|=R2`Ym3p!wgLWwy}fjqY2lq1Mn`E6@AW}Y^Z)nvq}6+nn-k)&^y#{d{mNiLV&NqCHr-5k7 zC|)|pd&~H!9Jw|5|MMJ~Y62d>{ZlUFA)lFNV{ya@b~*+9vzcrAI~_WZ2s?sDH!U1Q z`#~Xr1+W-O%zX#P%U0iU!tsv&D|2l)ZDEc82&~Xx7a&2^qEpa>h)$l4UfAkTGvMJt zuvXL()FD6SXcauXh7Kq}pB8|}5Me)yxr9zYBKdl)-!#BDrho|gtdE1e1HsqP4e#KE zCNnS#mY}YFKtBu=Y9NZpZ>!?~y3jaEEJVu3mPlQ2d@ZXp9m0`F z(fToAM61~s;907>Z@LUG4mDk-UuH239XxQwsx{_u-j#v<20K+oW7xbK*z!@?c<53Y zeT<%%mzmj8={z@oDd`ebQ2 zi$$GkZ26eS1nAN^NM2~(D9zjs2&nM{T|6PaZalj~+l1A>|ImLWe z9D$RA5sE+txqnv+^BsK{CkG2a>nkVmgSpVVC{d3ygBShjTIS%o%i?DLx$d z!6ypgYz$g+cO(FR_&Z8eYxEP4>DF{G)>t2oii-dXC+PrAxF69^1%65YuJ2%1G~a_8 z*PaoGI(gI+wW+6S_a8HhuA-MHti|!W!(ImB-&_0kk1LqI{f9H}(Gbn58MA|m zxqYAt7<-xiaBmYr@qdju)RtLm!`Rz|tc#!L2XKQTH8D>Y!9BL7i|fEWNlk0taK?0z zmB-+C8oOdaTkfT60ki7BwD$sgjp*pPQH20EZS;M&ia84%?Zg-gWAJCGBWRq8DcZw< zS3@1c%B;0^eBVHpW^ET^oIeR3ns()_xQgYQ>`b&9Oqy;3~T>?QEqqT;9fsye^_$!fO1Q+_WyrLZeyX` z_!=JS z&*CQ-tA8lB)l639pATDZUR1ehSO@+~azjqIG=2o+<^^iZj#>x)+j7$yT5eiw%Z+ac zxuwzMHXiyWu0-||-vk)}cD&svJH43o)e{KE`=7PcB literal 0 HcmV?d00001