tests: conditional logging tests for http and dns

diff --git a/tests/cond-log-dns-dig/README.md b/tests/cond-log-dns-dig/README.md
new file mode 100644 (file)
index 0000000..93b240c
--- /dev/null
+++ b/tests/cond-log-dns-dig/README.md
@@ -0,0 +1 @@
+Conditional logging with DNS EVE v2 test of a dig against www.suricata-ids.org.

diff --git a/tests/cond-log-dns-dig/input.pcap b/tests/cond-log-dns-dig/input.pcap
new file mode 100644 (file)
index 0000000..663a679
Binary files /dev/null and b/tests/cond-log-dns-dig/input.pcap differ

diff --git a/tests/cond-log-dns-dig/test.rules b/tests/cond-log-dns-dig/test.rules
new file mode 100644 (file)
index 0000000..9bc7ac4
--- /dev/null
+++ b/tests/cond-log-dns-dig/test.rules
@@ -0,0 +1 @@
+config dns any any -> any any (dns.query; content:"suricata"; config: logging disable, type tx, scope tx; sid:1;)

diff --git a/tests/cond-log-dns-dig/test.yaml b/tests/cond-log-dns-dig/test.yaml
new file mode 100644 (file)
index 0000000..d2370d5
--- /dev/null
+++ b/tests/cond-log-dns-dig/test.yaml
@@ -0,0 +1,10 @@
+requires:
+  features:
+    - HAVE_LIBJANSSON
+  min-version: 6.0.0
+
+checks:
+- filter:
+    count: 0
+    match:
+      event_type: dns

diff --git a/tests/cond-log-http-testmyids/input.pcap b/tests/cond-log-http-testmyids/input.pcap
new file mode 100644 (file)
index 0000000..8fb6832
Binary files /dev/null and b/tests/cond-log-http-testmyids/input.pcap differ

diff --git a/tests/cond-log-http-testmyids/test.rules b/tests/cond-log-http-testmyids/test.rules
new file mode 100644 (file)
index 0000000..6abd642
--- /dev/null
+++ b/tests/cond-log-http-testmyids/test.rules
@@ -0,0 +1 @@
+config http any any -> any any (http.host; content:"test"; config:logging disable, type tx, scope tx; sid:1;)

diff --git a/tests/cond-log-http-testmyids/test.yaml b/tests/cond-log-http-testmyids/test.yaml
new file mode 100644 (file)
index 0000000..11f8f17
--- /dev/null
+++ b/tests/cond-log-http-testmyids/test.yaml
@@ -0,0 +1,14 @@
+requires:
+  features:
+    - HAVE_LIBJANSSON
+  min-version: 6.0.0
+
+checks:
+  - filter:
+      count: 0
+      match:
+        event_type: alert
+  - filter:
+      count: 0
+      match:
+        event_type: http