diff --git a/server/modules/suricata/suricata_test.go b/server/modules/suricata/suricata_test.go index 5e976bf8b..587a7fe1a 100644 --- a/server/modules/suricata/suricata_test.go +++ b/server/modules/suricata/suricata_test.go @@ -270,7 +270,7 @@ func TestValidate(t *testing.T) { { Name: "Invalid Direction", Input: `alert http any any <-> any any (msg:"This rule has an invalid direction";)`, - ExpectedErr: "invalid direction, must be '<>' or '->', got <->", + ExpectedErr: "invalid direction, must be '<>', '->', or '=>', got <->", }, { Name: "Unexpected Suffix", @@ -432,6 +432,21 @@ func TestParse(t *testing.T) { } } +func TestParseTransactionalRules(t *testing.T) { + t.Parallel() + + rule := `alert http any any => any any (msg:"transactional"; sid:1;)` + detections, err := ParseSuricataRules(context.Background(), rule, "ruleset") + + assert.NoError(t, err) + if !assert.Len(t, detections, 1) { + return + } + assert.Equal(t, "1", detections[0].PublicID) + assert.Equal(t, "transactional", detections[0].Title) + assert.Equal(t, rule, detections[0].Content) +} + func TestExtractDetails(t *testing.T) { t.Parallel() diff --git a/server/modules/suricata/validate.go b/server/modules/suricata/validate.go index 9784544ee..c42253fce 100644 --- a/server/modules/suricata/validate.go +++ b/server/modules/suricata/validate.go @@ -81,7 +81,7 @@ func ParseSuricataRule(rule string) (*SuricataRule, error) { buf.WriteRune(ch) } case stateSource: - if ch == '<' || ch == '-' { + if ch == '<' || ch == '-' || ch == '=' { out.Source = strings.TrimSpace(buf.String()) buf.Reset() buf.WriteRune(ch) @@ -92,8 +92,8 @@ func ParseSuricataRule(rule string) (*SuricataRule, error) { case stateDirection: if ch == ' ' { out.Direction = strings.TrimSpace(buf.String()) - if out.Direction != "<>" && out.Direction != "->" { - return nil, fmt.Errorf("invalid direction, must be '<>' or '->', got %s", out.Direction) + if out.Direction != "<>" && out.Direction != "->" && out.Direction != "=>" { + return nil, fmt.Errorf("invalid direction, must be '<>', '->', or '=>', got %s", out.Direction) } buf.Reset() diff --git a/server/modules/suricata/validate_test.go b/server/modules/suricata/validate_test.go index 0896331ea..9cf23eebc 100644 --- a/server/modules/suricata/validate_test.go +++ b/server/modules/suricata/validate_test.go @@ -38,10 +38,25 @@ func TestParseSuricata(t *testing.T) { Options: []*RuleOption{}, }, }, + { + Name: "Transactional Rule", + Input: `alert http any any => any any (msg:"transactional"; sid:1;)`, + Output: &SuricataRule{ + Action: "alert", + Protocol: "http", + Source: "any any", + Direction: "=>", + Destination: "any any", + Options: []*RuleOption{ + {Name: "msg", Value: util.Ptr(`"transactional"`)}, + {Name: "sid", Value: util.Ptr("1")}, + }, + }, + }, { Name: "Bad Direction", Input: `a b source port <- destination port ()`, - Error: util.Ptr("invalid direction, must be '<>' or '->', got <-"), + Error: util.Ptr("invalid direction, must be '<>', '->', or '=>', got <-"), }, { Name: "Unnecessary Suffix",