smb: add dce_opnum tests

diff --git a/tests/smb-dce_opnum/input.pcap b/tests/smb-dce_opnum/input.pcap
new file mode 100644 (file)
index 0000000..1897e46
Binary files /dev/null and b/tests/smb-dce_opnum/input.pcap differ

diff --git a/tests/smb-dce_opnum/test.rules b/tests/smb-dce_opnum/test.rules
new file mode 100644 (file)
index 0000000..b182b14
--- /dev/null
+++ b/tests/smb-dce_opnum/test.rules
@@ -0,0 +1,2 @@
+alert smb any any -> any any (msg: "smb dcerpc.opnum 10"; dcerpc.opnum: 10; sid: 10;)
+alert smb any any -> any any (msg: "smb dcerpc.opnum 89"; dcerpc.opnum: 89; sid: 89;)
\ No newline at end of file

diff --git a/tests/smb-dce_opnum/test.yaml b/tests/smb-dce_opnum/test.yaml
new file mode 100644 (file)
index 0000000..864d64f
--- /dev/null
+++ b/tests/smb-dce_opnum/test.yaml
@@ -0,0 +1,17 @@
+requires:
+  min-version: 7
+
+args:
+- -k none
+
+checks:
+- filter:
+    count: 4
+    match:
+      event_type: alert
+      alert.signature_id: 10
+- filter:
+    count: 2
+    match:
+      event_type: alert
+      alert.signature_id: 89