suricata

Commit Graph

Author	SHA1	Message	Date
Victor Julien	49783fa9f7	github-ci: add namespace based IPS tests Implementing a bridge test with af-packet IPS and a routing test with iptables + nfqueue. Very helpful explanation and guidance on network namespaces can be found here: https://www.redhat.com/en/blog/net-namespaces Sets up 3 network namespaces: 1. client - for running client tools like ping, curl, wget 2. server - for running a server, currently only Caddy 3. dut - for running Suricata, this namespace connects the client and server namespaces Validate IPS operations in 3 ways: 1. check return codes of the client tools 2. check Suricata's IPS stats 3. use tshark to validate expected drops Run Suricata in AF_PACKET IPS mode for both autofp and workers mode. Do the same for NFQUEUE. Tshark's JSON output is used with JQ to validate that pings are dropped. All tests are codecov enabled.	9 months ago

Author

SHA1

Message

Date

Victor Julien

49783fa9f7

github-ci: add namespace based IPS tests

Implementing a bridge test with af-packet IPS and a routing test
with iptables + nfqueue.

Very helpful explanation and guidance on network namespaces can be
found here: https://www.redhat.com/en/blog/net-namespaces

Sets up 3 network namespaces:
1. client - for running client tools like ping, curl, wget
2. server - for running a server, currently only Caddy
3. dut - for running Suricata, this namespace connects the client and
   server namespaces

Validate IPS operations in 3 ways:
1. check return codes of the client tools
2. check Suricata's IPS stats
3. use tshark to validate expected drops

Run Suricata in AF_PACKET IPS mode for both autofp and workers mode. Do
the same for NFQUEUE.

Tshark's JSON output is used with JQ to validate that pings are dropped.

All tests are codecov enabled.

1 Commits (0a86b0f79da512dd1a4af6d2af27fb847654792b)