ldap: add test for abandon request

Ticket: #7477

diff --git a/tests/ldap-abandon/Makefile b/tests/ldap-abandon/Makefile
new file mode 100644 (file)
index 0000000..318ba91
--- /dev/null
+++ b/tests/ldap-abandon/Makefile
@@ -0,0 +1,3 @@
+ldap.pcap: ldap.syn
+       flowsynth.py -f pcap -w $@ $^
+

diff --git a/tests/ldap-abandon/README.md b/tests/ldap-abandon/README.md
new file mode 100644 (file)
index 0000000..d8007d2
--- /dev/null
+++ b/tests/ldap-abandon/README.md
@@ -0,0 +1,9 @@
+# Test Purpose
+
+Test that LDAP Abandon operation is parsed correctly.
+
+## PCAP
+
+This PCAP was generated with flowsynth using
+this documentation as a reference:
+https://ldap.com/ldapv3-wire-protocol-reference-abandon/

diff --git a/tests/ldap-abandon/ldap.pcap b/tests/ldap-abandon/ldap.pcap
new file mode 100644 (file)
index 0000000..68699ef
Binary files /dev/null and b/tests/ldap-abandon/ldap.pcap differ

diff --git a/tests/ldap-abandon/ldap.syn b/tests/ldap-abandon/ldap.syn
new file mode 100644 (file)
index 0000000..e012d5c
--- /dev/null
+++ b/tests/ldap-abandon/ldap.syn
@@ -0,0 +1,2 @@
+flow default tcp 1.1.1.1:5555 > 2.2.2.2:389 (tcp.initialize; mss:9000;);
+default > (content:"\x30\x06\x02\x01\x06\x50\x01\x05";);
\ No newline at end of file

diff --git a/tests/ldap-abandon/test.yaml b/tests/ldap-abandon/test.yaml
new file mode 100644 (file)
index 0000000..63fc1d4
--- /dev/null
+++ b/tests/ldap-abandon/test.yaml
@@ -0,0 +1,15 @@
+requires:
+  min-version: 8
+
+args:
+  - -k none
+
+pcap: ldap.pcap
+
+checks:
+  - filter:
+      count: 1
+      match:
+        event_type: ldap
+        ldap.request.message_id: 6
+        ldap.request.operation: abandon_request