From: Eric Leblond Date: Mon, 9 Jun 2025 14:32:11 +0000 (+0200) Subject: tests: add ipv4 datajson test X-Git-Tag: suricata-7.0.11~13 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=refs%2Fpull%2F2565%2Fhead;p=thirdparty%2Fsuricata-verify.git tests: add ipv4 datajson test --- diff --git a/tests/datajson/datajson-11-ipv4/input.pcap b/tests/datajson/datajson-11-ipv4/input.pcap new file mode 100644 index 000000000..8fb6832de Binary files /dev/null and b/tests/datajson/datajson-11-ipv4/input.pcap differ diff --git a/tests/datajson/datajson-11-ipv4/src.lst b/tests/datajson/datajson-11-ipv4/src.lst new file mode 100644 index 000000000..7553335cf --- /dev/null +++ b/tests/datajson/datajson-11-ipv4/src.lst @@ -0,0 +1 @@ +[{"ip": "10.16.1.11", "test": "success", "context":3}] diff --git a/tests/datajson/datajson-11-ipv4/test.rules b/tests/datajson/datajson-11-ipv4/test.rules new file mode 100644 index 000000000..e2e5f21cd --- /dev/null +++ b/tests/datajson/datajson-11-ipv4/test.rules @@ -0,0 +1 @@ +alert http any any -> any any (flow:established,to_server; http.host; content:"testmyids.com"; ip.src; dataset:isset,src_ip,type ipv4,load src.lst,format json, context_key src_ip, value_key ip; sid:1;) diff --git a/tests/datajson/datajson-11-ipv4/test.yaml b/tests/datajson/datajson-11-ipv4/test.yaml new file mode 100644 index 000000000..d0c3ba592 --- /dev/null +++ b/tests/datajson/datajson-11-ipv4/test.yaml @@ -0,0 +1,17 @@ +requires: + min-version: 8 + +args: + - -k none --set datasets.enabled=yes + +checks: + - filter: + count: 1 + match: + event_type: alert + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 1 + alert.context.src_ip.test: success