tests: add test for alert-then-pass issue 5466

[victorjulien]

https://redmine.openinfosecfoundation.org/issues/5466

#1579 with another test and a rebase

[inashivb]

For the following suricata.yaml:

%YAML 1.1
---

action-order:
  - drop
  - reject
  - alert
  - pass

outputs:
  - eve-log:
      enabled: yes
      filetype: regular
      types:
        - alert
        - drop:
            flows: all
            alerts: yes
        - files
        - http
        - flow

and rules

pass tcp any any -> any 22 (alert; sid:2; gid:10000003; msg:"PASS SSH";)
drop tcp any any -> any any (sid:1; rev:1; msg:"DROP all TCP";)

I see the following in the logs. Is that expected?

cat output/eve.json | jq 'select(.event_type=="alert")' -c

{"timestamp":"2021-09-10T05:24:00.665156+0000","flow_id":42075232040771,"pcap_cnt":15,"event_type":"alert","src_ip":"192.168.0.30","src_port":42116,"dest_ip":"192.168.0.123","dest_port":22,"proto":"TCP","pkt_src":"wire/pcap","alert":{"action":"blocked","gid":1,"signature_id":1,"rev":1,"signature":"DROP all TCP","category":"","severity":3},"direction":"to_server","flow":{"pkts_toserver":1,"pkts_toclient":0,"bytes_toserver":74,"bytes_toclient":0,"start":"2021-09-10T05:24:00.665156+0000","src_ip":"192.168.0.30","dest_ip":"192.168.0.123","src_port":42116,"dest_port":22}}
{"timestamp":"2021-09-10T05:24:00.665156+0000","flow_id":42075232040771,"pcap_cnt":15,"event_type":"alert","src_ip":"192.168.0.30","src_port":42116,"dest_ip":"192.168.0.123","dest_port":22,"proto":"TCP","pkt_src":"wire/pcap","alert":{"action":"allowed","gid":10000003,"signature_id":2,"rev":0,"signature":"PASS SSH","category":"","severity":3},"direction":"to_server","flow":{"pkts_toserver":1,"pkts_toclient":0,"bytes_toserver":74,"bytes_toclient":0,"start":"2021-09-10T05:24:00.665156+0000","src_ip":"192.168.0.30","dest_ip":"192.168.0.123","src_port":42116,"dest_port":22}}

[victorjulien]

For the following suricata.yaml:

%YAML 1.1
---

action-order:
  - drop
  - reject
  - alert
  - pass

outputs:
  - eve-log:
      enabled: yes
      filetype: regular
      types:
        - alert
        - drop:
            flows: all
            alerts: yes
        - files
        - http
        - flow

and rules

pass tcp any any -> any 22 (alert; sid:2; gid:10000003; msg:"PASS SSH";)
drop tcp any any -> any any (sid:1; rev:1; msg:"DROP all TCP";)

I see the following in the logs. Is that expected?

cat output/eve.json | jq 'select(.event_type=="alert")' -c

{"timestamp":"2021-09-10T05:24:00.665156+0000","flow_id":42075232040771,"pcap_cnt":15,"event_type":"alert","src_ip":"192.168.0.30","src_port":42116,"dest_ip":"192.168.0.123","dest_port":22,"proto":"TCP","pkt_src":"wire/pcap","alert":{"action":"blocked","gid":1,"signature_id":1,"rev":1,"signature":"DROP all TCP","category":"","severity":3},"direction":"to_server","flow":{"pkts_toserver":1,"pkts_toclient":0,"bytes_toserver":74,"bytes_toclient":0,"start":"2021-09-10T05:24:00.665156+0000","src_ip":"192.168.0.30","dest_ip":"192.168.0.123","src_port":42116,"dest_port":22}}
{"timestamp":"2021-09-10T05:24:00.665156+0000","flow_id":42075232040771,"pcap_cnt":15,"event_type":"alert","src_ip":"192.168.0.30","src_port":42116,"dest_ip":"192.168.0.123","dest_port":22,"proto":"TCP","pkt_src":"wire/pcap","alert":{"action":"allowed","gid":10000003,"signature_id":2,"rev":0,"signature":"PASS SSH","category":"","severity":3},"direction":"to_server","flow":{"pkts_toserver":1,"pkts_toclient":0,"bytes_toserver":74,"bytes_toclient":0,"start":"2021-09-10T05:24:00.665156+0000","src_ip":"192.168.0.30","dest_ip":"192.168.0.123","src_port":42116,"dest_port":22}}

Yes, this seems a bit odd but it works as expected. The drop rule is not a terminating action for this packet, so it will still eval the other rule. Previously this would silently match (just pass) but now it will alert due to the alert keyword. I've added a test based on your comment.

[victorjulien]

replaced by #1903