test: truncated ipv4 test

Test that no src_ip, dest_ip are logged instead of just empty strings.

Ticket: https://redmine.openinfosecfoundation.org/issues/7460

diff --git a/tests/ipv4-truncated/README.md b/tests/ipv4-truncated/README.md
new file mode 100644 (file)
index 0000000..7e3f006
--- /dev/null
+++ b/tests/ipv4-truncated/README.md
@@ -0,0 +1,3 @@
+Test that alerts that have unknown IP addresses and ports don't log them.
+
+Ticket: https://redmine.openinfosecfoundation.org/issues/7460

diff --git a/tests/ipv4-truncated/decoder-events.rules b/tests/ipv4-truncated/decoder-events.rules
new file mode 100644 (file)
index 0000000..c7ffb26
--- /dev/null
+++ b/tests/ipv4-truncated/decoder-events.rules
@@ -0,0 +1 @@
+alert pkthdr any any -> any any (msg:"SURICATA IPv4 truncated packet"; decode-event:ipv4.trunc_pkt; classtype:protocol-command-decode; sid:2200003; rev:2;)

diff --git a/tests/ipv4-truncated/test.yaml b/tests/ipv4-truncated/test.yaml
new file mode 100644 (file)
index 0000000..80d4513
--- /dev/null
+++ b/tests/ipv4-truncated/test.yaml
@@ -0,0 +1,9 @@
+checks:
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        src_ip: null
+        dest_ip: null
+        src_port: null
+        dest_port: null

diff --git a/tests/ipv4-truncated/truncated.pcap b/tests/ipv4-truncated/truncated.pcap
new file mode 100644 (file)
index 0000000..1d7f1c0
Binary files /dev/null and b/tests/ipv4-truncated/truncated.pcap differ