tests: add test for sctp keywords

Ticket #4251

Author: glongo

tests/sctp-keywords/README.md

@@ -0,0 +1,7 @@
+# Description
+
+Test SCTP sticky buffers and keywords
+
+# PCAP
+
+Extracted from https://www.cloudshark.org/captures/839e9b681d59

tests/sctp-keywords/input.pcap

@@ -0,0 +1,7 @@
+alert sctp any any -> any any (sctp.hdr; content:"|01 00 00 20|"; sid:1;)
+alert sctp any any -> any any (sctp.chunk_type:2; sid:2;)
+alert sctp any any -> any any (sctp.chunk_cnt:1; sid:3;)
+alert sctp any any -> any any (sctp.vtag:3559606418; sid:4;)
+alert sctp any any -> any any (sctp.has_init; sid:5;)
+alert sctp any any -> any any (sctp.has_data; sid:6;)
+alert sctp any any -> any any (sctp.data; content:"|01 00 03 01|"; sid:7;)

tests/sctp-keywords/test.rules

@@ -0,0 +1,123 @@
+args:
+- -k none
+
+checks:
+- filter:
+    count: 1
+    match:
+      src_ip: 10.173.48.13
+      src_port: 2906
+      dest_ip: 88.82.6.134
+      dest_port: 6303
+      event_type: alert
+      proto: SCTP
+      pcap_cnt: 1
+      alert.signature_id: 1
+      sctp.vtag: 0
+      sctp.first_chunk: 1
+      sctp.chunk_cnt: 1
+      sctp.has_init: true
+      sctp.has_data: false
+      sctp.has_abort: false
+- filter:
+    count: 1
+    match:
+      src_ip: 88.82.6.134 
+      src_port: 6303
+      dest_ip: 10.173.48.13
+      dest_port: 2906
+      event_type: alert
+      proto: SCTP
+      pcap_cnt: 2
+      alert.signature_id: 2
+      sctp.vtag: 3714634557
+      sctp.first_chunk: 2
+      sctp.chunk_cnt: 1
+      sctp.has_init: true
+      sctp.has_data: false
+      sctp.has_abort: false
+- filter:
+    count: 1
+    match:
+      src_ip: 10.173.48.13
+      src_port: 2906
+      dest_ip: 88.82.6.134
+      dest_port: 6303
+      event_type: alert
+      proto: SCTP
+      pcap_cnt: 3
+      alert.signature_id: 3
+      sctp.vtag: 3559606418
+      sctp.first_chunk: 10
+      sctp.chunk_cnt: 1
+      sctp.has_init: false
+      sctp.has_data: false
+      sctp.has_abort: false
+- filter:
+    count: 1
+    match:
+      src_ip: 10.173.48.13
+      src_port: 2906
+      dest_ip: 88.82.6.134
+      dest_port: 6303
+      event_type: alert
+      proto: SCTP
+      pcap_cnt: 3
+      alert.signature_id: 4
+      sctp.vtag: 3559606418
+      sctp.first_chunk: 10
+      sctp.chunk_cnt: 1
+      sctp.has_init: false
+      sctp.has_data: false
+      sctp.has_abort: false
+- filter:
+    count: 1
+    match:
+      src_ip: 10.173.48.13
+      src_port: 2906
+      dest_ip: 88.82.6.134
+      dest_port: 6303
+      event_type: alert
+      proto: SCTP
+      pcap_cnt: 1
+      alert.signature_id: 5
+      sctp.vtag: 0
+      sctp.first_chunk: 1
+      sctp.chunk_cnt: 1
+      sctp.has_init: true
+      sctp.has_data: false
+      sctp.has_abort: false
+- filter:
+    count: 1
+    match:
+      src_ip: 88.82.6.134 
+      src_port: 6303
+      dest_ip: 10.173.48.13
+      dest_port: 2906
+      event_type: alert
+      proto: SCTP
+      pcap_cnt: 15
+      alert.signature_id: 6
+      sctp.vtag: 3714634557 
+      sctp.first_chunk: 3
+      sctp.chunk_cnt: 4
+      sctp.has_init: false
+      sctp.has_data: true
+      sctp.has_abort: false
+- filter:
+    count: 1
+    match:
+      src_ip: 10.173.48.13
+      src_port: 2906
+      dest_ip: 88.82.6.134
+      dest_port: 6303
+      event_type: alert
+      proto: SCTP
+      pcap_cnt: 5
+      alert.signature_id: 7
+      sctp.vtag: 3559606418
+      sctp.first_chunk: 0
+      sctp.chunk_cnt: 1
+      sctp.has_init: false
+      sctp.has_data: true
+      sctp.has_abort: false