nsh: add minimal detect testing

diff --git a/tests/decode-nsh-type1/test.rules b/tests/decode-nsh-type1/test.rules
new file mode 100644 (file)
index 0000000..9ccfe57
--- /dev/null
+++ b/tests/decode-nsh-type1/test.rules
@@ -0,0 +1 @@
+alert udp any any -> any any (content:"data|0a 0a|"; startswith; endswith; sid:1;)

diff --git a/tests/decode-nsh-type1/test.yaml b/tests/decode-nsh-type1/test.yaml
index 4588cd4417064bbfd64d564dcd96ae8b5f6fc84f..0e3e9e9e85eaeb7bd89cb5aca42cdd0e39b16fc7 100644 (file)
--- a/tests/decode-nsh-type1/test.yaml
+++ b/tests/decode-nsh-type1/test.yaml
@@ -5,6 +5,16 @@ args:
 - -k none
 
 checks:
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        src_ip: 10.0.0.1
+        dest_ip: 10.0.0.2
+        proto: UDP
+        src_port: 52377
+        dest_port: 52464
+        alert.signature_id: 1
   - filter:
       count: 1
       match:

diff --git a/tests/decode-nsh-type2/test.rules b/tests/decode-nsh-type2/test.rules
new file mode 100644 (file)
index 0000000..9ccfe57
--- /dev/null
+++ b/tests/decode-nsh-type2/test.rules
@@ -0,0 +1 @@
+alert udp any any -> any any (content:"data|0a 0a|"; startswith; endswith; sid:1;)

diff --git a/tests/decode-nsh-type2/test.yaml b/tests/decode-nsh-type2/test.yaml
index 4588cd4417064bbfd64d564dcd96ae8b5f6fc84f..0e3e9e9e85eaeb7bd89cb5aca42cdd0e39b16fc7 100644 (file)
--- a/tests/decode-nsh-type2/test.yaml
+++ b/tests/decode-nsh-type2/test.yaml
@@ -5,6 +5,16 @@ args:
 - -k none
 
 checks:
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        src_ip: 10.0.0.1
+        dest_ip: 10.0.0.2
+        proto: UDP
+        src_port: 52377
+        dest_port: 52464
+        alert.signature_id: 1
   - filter:
       count: 1
       match: