sip: adds checks for stat code keyword

Ticket: 7295 Ensures that stat-code and method do not share the same buffer in different directions
OISF · Nov 24, 2024 · a56568c · a56568c
1 parent b195d4b
commit a56568c
Show file tree

Hide file tree

Showing 4 changed files with 14 additions and 0 deletions.
diff --git a/tests/sip-method/test.rules b/tests/sip-method/test.rules
@@ -1 +1,2 @@
 alert sip any any -> any any (flow:to_server; sip.method; content:"REGISTER"; sid:1;)
+alert sip any any -> any any (sip.stat_code; content:"REGISTER"; sid:2;)
diff --git a/tests/sip-method/test.yaml b/tests/sip-method/test.yaml
@@ -14,3 +14,9 @@ checks:
       count: 18
       match:
         event_type: alert
+  - filter:
+  # only sid 1 triggered the 7 alerts
+      count: 18
+      match:
+        event_type: alert
+        alert.signature_id: 1
diff --git a/tests/sip-stat-code/test.rules b/tests/sip-stat-code/test.rules
@@ -1 +1,2 @@
 alert sip any any -> any any (flow:to_client; sip.stat_code; content:"100"; sid:1;)
+alert sip any any -> any any (sip.method; content:"100"; sid:2;)
diff --git a/tests/sip-stat-code/test.yaml b/tests/sip-stat-code/test.yaml
@@ -14,3 +14,9 @@ checks:
       count: 7
       match:
         event_type: alert
+  - filter:
+  # only sid 1 triggered the 7 alerts
+      count: 7
+      match:
+        event_type: alert
+        alert.signature_id: 1