added auto_dl 5 tests

diff --git a/test/conf/auto_dl_5_192.168.10.55 b/test/conf/auto_dl_5_192.168.10.55
new file mode 100644 (file)
index 0000000..75418ce
--- /dev/null
+++ b/test/conf/auto_dl_5_192.168.10.55
@@ -0,0 +1,26 @@
+#
+#############################################################################
+#
+# This file is used by psad to elevate/decrease the danger levels of IP
+# addresses (or networks in CIDR notation) so that psad does not have to
+# apply the normal signature logic.  This is useful if certain IP addresses
+# or networks are known trouble makers and should automatically be assigned
+# higher danger levels than would normally be assigned.  Also, psad can be
+# made to ignore certain IP addresses or networks if a danger level of "0" is
+# specified.  Optionally, danger levels for IPs/networks can be influenced
+# based on protocol (tcp, udp, icmp).
+#
+#############################################################################
+#
+
+#  <IP address>  <danger level>  <optional protocol>/<optional ports>;
+#
+# Examples:
+#
+#  10.111.21.23    5;          # Very bad IP.
+#  127.0.0.1       0;          # Ignore this IP.
+#  10.10.1.0/24    0;          # Ignore traffic from this entire class C.
+#  192.168.10.4    3    tcp;   # Assign danger level 3 if protocol is tcp.
+#  10.10.1.0/24    3    tcp/1-1024;  # Danger level 3 for tcp port range
+
+192.168.10.55       5;

diff --git a/test/test-psad.pl b/test/test-psad.pl
index d45d5c6..b9b04eb 100755 (executable)
--- a/test/test-psad.pl
+++ b/test/test-psad.pl
@@ -13,6 +13,7 @@ my $scans_dir      = 'scans';
 my $syn_scan_file  = 'syn_scan_1000_1500';
 my $udp_scan_file  = 'udp_scan_1000_1150';
 my $ignore_ipv4_auto_dl_file = "$conf_dir/auto_dl_ignore_192.168.10.55";
+my $dl5_ipv4_auto_dl_file = "$conf_dir/auto_dl_5_192.168.10.55";
 
 my $psadCmd        = 'psad-install/usr/sbin/psad';
 
@@ -210,6 +211,36 @@ my @tests = (
         'exec_err'  => $NO,
         'fatal'     => $NO
     },
+    {
+        'category'  => 'operations',
+        'detail'    => 'DL5 IPv4 SYN scan source',
+        'err_msg'   => 'did not set SYN scan source to DL5',
+        'positive_output_matches' => [qr/Top\s\d+\sattackers/i,
+                qr/scanned\sports.*?1000\-1500/i,
+                qr/IP\sstatus/i,
+                qr/192\.168\.10\.55,\sDL\:\s5/],
+        'match_all' => $MATCH_ALL_RE,
+        'function'  => \&generic_exec,
+        'cmdline'   => "$psadCmd -A --auto-dl $dl5_ipv4_auto_dl_file " .
+                "-m $scans_dir/" .  &fw_type() . "/$syn_scan_file -c $default_conf",
+        'exec_err'  => $NO,
+        'fatal'     => $NO
+    },
+    {
+        'category'  => 'operations',
+        'detail'    => 'DL5 IPv4 UDP scan source',
+        'err_msg'   => 'did not set UDP scan source to DL5',
+        'positive_output_matches' => [qr/Top\s\d+\sattackers/i,
+                qr/scanned\sports.*?1000\-1150/i,
+                qr/IP\sstatus/i,
+                qr/192\.168\.10\.55,\sDL\:\s5/],
+        'match_all' => $MATCH_ALL_RE,
+        'function'  => \&generic_exec,
+        'cmdline'   => "$psadCmd -A --auto-dl $dl5_ipv4_auto_dl_file " .
+                "-m $scans_dir/" .  &fw_type() . "/$udp_scan_file -c $default_conf",
+        'exec_err'  => $NO,
+        'fatal'     => $NO
+    },
 
 );