tests: some overlapping ipv4 fragments are reassembled with a data hole

tests/ipv4-defrag-overlaps/test_407/suricata.yaml

@@ -0,0 +1,15 @@
+%YAML 1.1
+---
+
+# Configure the type of alert (and other) logging you would like.
+outputs:
+  # Extensible Event Format (nicknamed EVE) event log in JSON format
+  - eve-log:
+      enabled: yes
+      filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
+      filename: eve.json
+      types:
+        - alert:
+            payload: yes             # enable dumping payload in Base64
+            payload-printable: yes   # enable dumping payload in printable (lossy) format
+            packet: yes              # enable dumping of packet (without stream segments)

tests/ipv4-defrag-overlaps/test_407/test.rules

@@ -0,0 +1 @@
+alert icmp any any -> 192.168.10.63 any (msg:"Bad keyword 000004ok detected !!!"; content:"000004ok"; classtype:bad-unknown; sid:1; rev:7; )

tests/ipv4-defrag-overlaps/test_407/test.yaml

@@ -0,0 +1,9 @@
+# *** Add configuration here ***
+
+args:
+- -k none
+
+checks:
+- shell:
+    args: grep '"payload_printable":".*\.\.\.\.\.\.\.\..*"' eve.json | wc -l | xargs
+    expect: 0

tests/ipv4-defrag-overlaps/test_428/suricata.yaml

@@ -0,0 +1,15 @@
+%YAML 1.1
+---
+
+# Configure the type of alert (and other) logging you would like.
+outputs:
+  # Extensible Event Format (nicknamed EVE) event log in JSON format
+  - eve-log:
+      enabled: yes
+      filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
+      filename: eve.json
+      types:
+        - alert:
+            payload: yes             # enable dumping payload in Base64
+            payload-printable: yes   # enable dumping payload in printable (lossy) format
+            packet: yes              # enable dumping of packet (without stream segments)

tests/ipv4-defrag-overlaps/test_428/test.rules

@@ -0,0 +1,2 @@
+alert icmp any any -> 192.168.10.63 any (msg:"Bad keyword 000004ok detected !!!"; content:"000004ok"; classtype:bad-unknown; sid:9; rev:7; )
+

tests/ipv4-defrag-overlaps/test_428/test.yaml

@@ -0,0 +1,9 @@
+# *** Add configuration here ***
+
+args:
+- -k none
+
+checks:
+- shell:
+    args: grep '"payload_printable":".*\.\.\.\.\.\.\.\..*"' eve.json | wc -l | xargs
+    expect: 0

tests/ipv4-defrag-overlaps/test_430/suricata.yaml

@@ -0,0 +1,15 @@
+%YAML 1.1
+---
+
+# Configure the type of alert (and other) logging you would like.
+outputs:
+  # Extensible Event Format (nicknamed EVE) event log in JSON format
+  - eve-log:
+      enabled: yes
+      filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
+      filename: eve.json
+      types:
+        - alert:
+            payload: yes             # enable dumping payload in Base64
+            payload-printable: yes   # enable dumping payload in printable (lossy) format
+            packet: yes              # enable dumping of packet (without stream segments)

tests/ipv4-defrag-overlaps/test_430/test.rules

@@ -0,0 +1,2 @@
+alert icmp any any -> 192.168.10.63 any (msg:"Bad keyword 000003ol detected !!!"; content:"000003ol"; classtype:bad-unknown; sid:1; rev:7; )
+

tests/ipv4-defrag-overlaps/test_430/test.yaml

@@ -0,0 +1,9 @@
+# *** Add configuration here ***
+
+args:
+- -k none
+
+checks:
+- shell:
+    args: grep '"payload_printable":".*\.\.\.\.\.\.\.\..*"' eve.json | wc -l | xargs
+    expect: 0

tests/ipv4-defrag-overlaps/test_435/suricata.yaml

@@ -0,0 +1,15 @@
+%YAML 1.1
+---
+
+# Configure the type of alert (and other) logging you would like.
+outputs:
+  # Extensible Event Format (nicknamed EVE) event log in JSON format
+  - eve-log:
+      enabled: yes
+      filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
+      filename: eve.json
+      types:
+        - alert:
+            payload: yes             # enable dumping payload in Base64
+            payload-printable: yes   # enable dumping payload in printable (lossy) format
+            packet: yes              # enable dumping of packet (without stream segments)

tests/ipv4-defrag-overlaps/test_435/test.rules

@@ -0,0 +1 @@
+alert icmp any any -> 192.168.10.63 any (msg:"Bad keyword 000003ol detected !!!"; content:"000003ol"; classtype:bad-unknown; sid:1; rev:7; )

tests/ipv4-defrag-overlaps/test_435/test.yaml

@@ -0,0 +1,9 @@
+# *** Add configuration here ***
+
+args:
+- -k none
+
+checks:
+- shell:
+    args: grep '"payload_printable":".*\.\.\.\.\.\.\.\..*"' eve.json | wc -l | xargs
+    expect: 0