Flowbits tests/v2

README.md

@@ -180,7 +180,12 @@ checks:
         # Check if a string is contained within a JSON list.
         # Eg. "ftp":{"reply":["Opening BINARY mode data connection for temp.txt (1164 bytes).","Transfer complete."], }
         ftp.reply.__contains: 'Transfer complete.'
-
+  - filter:
+      # Check line number of an entry
+      count: 1
+      match:
+        __lineno: 5
+        alert.signature_id: 15
   - shell:
       # A simple shell check. If the command exits with a non-0 exit code the
       # check will fail. The script is run in the output directory of the

run.py

@@ -574,8 +574,11 @@ def run(self):
 
         count = 0
         with open(json_filename, "r", encoding="utf-8") as fileobj:
+            lineno = 1
             for line in fileobj:
                 event = json.loads(line)
+                event["__lineno"] = lineno
+                lineno = lineno + 1
                 if self.match(event):
                     count += 1
         if count == self.config["count"]:

tests/bug-7638-flowbits-sigorder-01/test.rules

@@ -0,0 +1,4 @@
+alert http any any -> any any (http.uri; content:"down"; flowbits:set,uritest; sid:11;)
+alert http any any -> any any (http.user_agent; content:"Mozilla"; flowbits:isset, headtest; flowbits:set,moz; sid:10;)
+alert http any any -> any any (http.method; content:"GET"; flowbits:isset,uritest; flowbits:set,headtest; sid:12;)
+alert http any any -> any any (http.host; content:"ether"; flowbits:isset,moz; sid:14;)

tests/bug-7638-flowbits-sigorder-01/test.yaml

@@ -0,0 +1,33 @@
+requires:
+    min-version: 8.0
+
+pcap: false
+
+args:
+  - --engine-analysis
+
+checks:
+- filter:
+    filename: rules.json
+    count: 1
+    match:
+      __lineno: 1
+      id: 11
+- filter:
+    filename: rules.json
+    count: 1
+    match:
+      __lineno: 2
+      id: 12
+- filter:
+    filename: rules.json
+    count: 1
+    match:
+      __lineno: 3
+      id: 10
+- filter:
+    filename: rules.json
+    count: 1
+    match:
+      __lineno: 4
+      id: 14