diff --git a/tests/quic-ietf/README.md b/tests/quic-ietf/README.md new file mode 100644 index 000000000..95cb154b1 --- /dev/null +++ b/tests/quic-ietf/README.md @@ -0,0 +1,7 @@ +# Description + +Test quic ietf v1 parsing + +# PCAP + +The pcap comes from https://www.bortzmeyer.org/quic.html diff --git a/tests/quic-ietf/input.pcap b/tests/quic-ietf/input.pcap new file mode 100644 index 000000000..266ba94ad Binary files /dev/null and b/tests/quic-ietf/input.pcap differ diff --git a/tests/quic-ietf/test.rules b/tests/quic-ietf/test.rules new file mode 100644 index 000000000..f94109e51 --- /dev/null +++ b/tests/quic-ietf/test.rules @@ -0,0 +1,2 @@ +alert quic any any -> any any (msg:"QUIC SNI"; quic.sni; content:"msquic.net"; sid:4;) +alert quic any any -> any any (msg:"QUIC JA3"; quic.ja3; content:"771,4866,43-51-41"; sid:3;) diff --git a/tests/quic-ietf/test.yaml b/tests/quic-ietf/test.yaml new file mode 100644 index 000000000..611d3df5d --- /dev/null +++ b/tests/quic-ietf/test.yaml @@ -0,0 +1,22 @@ +requires: + min-version: 7.0.0 + +checks: + - filter: + count: 1 + match: + event_type: quic + quic.extensions[1].type: "ServerName" + quic.extensions[1].values[0]: "msquic.net" + quic.extensions[2].type: "ApplicationLayerProtocolNegotiation" + quic.extensions[2].values[0]: "h3-29" + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 4 + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 3