tests: add md5 test to datajson

diff --git a/tests/datajson/datajson-04-sha256/badsha.lst b/tests/datajson/datajson-04-hashes/badsha.lst
similarity index 100%
rename from tests/datajson/datajson-04-sha256/badsha.lst
rename to tests/datajson/datajson-04-hashes/badsha.lst

diff --git a/tests/datajson/datajson-04-sha256/input.pcap b/tests/datajson/datajson-04-hashes/input.pcap
similarity index 100%
rename from tests/datajson/datajson-04-sha256/input.pcap
rename to tests/datajson/datajson-04-hashes/input.pcap

diff --git a/tests/datajson/datajson-04-sha256/test.rules b/tests/datajson/datajson-04-hashes/test.rules
similarity index 50%
rename from tests/datajson/datajson-04-sha256/test.rules
rename to tests/datajson/datajson-04-hashes/test.rules
index 0181730486ca70a06e5bcf9029716505c332f47a..af67a6908481000d406ff4c7b3e5abab680e1a9b 100644 (file)
--- a/tests/datajson/datajson-04-sha256/test.rules
+++ b/tests/datajson/datajson-04-hashes/test.rules
@@ -1 +1,2 @@
 alert http any any -> any any (flow:established,to_server; http.host; content: "testmyids"; to_sha256; datajson:isset,badcat,type sha256,load badsha.lst,key bad_sha; sid:1; rev:1;)
+alert http any any -> any any (flow:established,to_server; http.host; content: "testmyids"; to_md5; datajson:isset,badmd5,type md5,load badmd5.lst,key bad_md5; sid:2; rev:1;)

diff --git a/tests/datajson/datajson-04-sha256/test.yaml b/tests/datajson/datajson-04-hashes/test.yaml
similarity index 70%
rename from tests/datajson/datajson-04-sha256/test.yaml
rename to tests/datajson/datajson-04-hashes/test.yaml
index 4dad013b4334c58a9212d9edcc7465a250ad0d06..716171874fc523ed3b79c15ec65c9ceaaa45a4ea 100644 (file)
--- a/tests/datajson/datajson-04-sha256/test.yaml
+++ b/tests/datajson/datajson-04-hashes/test.yaml
@@ -9,7 +9,7 @@ args:
 
 checks:
   - filter:
-      count: 1
+      count: 2
       match:
         event_type: alert
   - filter:
@@ -18,3 +18,9 @@ checks:
         event_type: alert
         alert.signature_id: 1
         alert.extra.bad_sha.year: 2005
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 2
+        alert.extra.bad_md5.year: 2007