dns test fix: only include relevant rules

Remove app-layer dns rules for events not relevant to
test as some of them are scheduled for removal.

Also convert check.sh to test.yaml.

diff --git a/tests/dns-lua-rules/test-response.lua b/tests/dns-lua-rules/test-response.lua
index ebf13043abfe6c0ca7714eb74dcea8337c966ed5..6c1c846410ba1d9be251fe0a788346b003063e95 100644 (file)
--- a/tests/dns-lua-rules/test-response.lua
+++ b/tests/dns-lua-rules/test-response.lua
@@ -40,6 +40,9 @@ function match(args)
       return 0
    end
 
+   local rcode = DnsGetRcode()
+   print(rcode)
+
    local answers = DnsGetAnswers()
    if answers == nil then return 0 end
    if count(answers) ~= 3 then return 0 end

diff --git a/tests/dns-udp-z-flag-fp/check.sh b/tests/dns-udp-z-flag-fp/check.sh
deleted file mode 100755 (executable)
index 406a19a..0000000
--- a/tests/dns-udp-z-flag-fp/check.sh
+++ /dev/null
@@ -1,7 +0,0 @@
-#! /bin/sh
-
-. ${TOPDIR}/util/functions.sh
-
-# Check that there are no events.
-n=$(cat fast.log | wc -l | xargs)
-assert_eq 0 "$n" "no events expected"

diff --git a/tests/dns-udp-z-flag-fp/dns-events.rules b/tests/dns-udp-z-flag-fp/dns-events.rules
index 82ee6331136886c8ee48206f427df1f574b27de4..1f9f869b70609ab8c9cb666c73cf7c715ec3a1cb 100644 (file)
--- a/tests/dns-udp-z-flag-fp/dns-events.rules
+++ b/tests/dns-udp-z-flag-fp/dns-events.rules
@@ -1,15 +1,2 @@
-# Response (answer) we didn't see a Request for. Could be packet loss.
-alert dns any any -> any any (msg:"SURICATA DNS Unsolicited response"; flow:to_client; app-layer-event:dns.unsollicited_response; sid:2240001; rev:1;)
-# Malformed data in request. Malformed means length fields are wrong, etc.
-alert dns any any -> any any (msg:"SURICATA DNS malformed request data"; flow:to_server; app-layer-event:dns.malformed_data; sid:2240002; rev:1;)
-alert dns any any -> any any (msg:"SURICATA DNS malformed response data"; flow:to_client; app-layer-event:dns.malformed_data; sid:2240003; rev:1;)
-# Response flag set on to_server packet
-alert dns any any -> any any (msg:"SURICATA DNS Not a request"; flow:to_server; app-layer-event:dns.not_a_request; sid:2240004; rev:1;)
-# Response flag not set on to_client packet
-alert dns any any -> any any (msg:"SURICATA DNS Not a response"; flow:to_client; app-layer-event:dns.not_a_response; sid:2240005; rev:1;)
 # Z flag (reserved) not 0
 alert dns any any -> any any (msg:"SURICATA DNS Z flag set"; app-layer-event:dns.z_flag_set; sid:2240006; rev:1;)
-# Request Flood Detected
-alert dns any any -> any any (msg:"SURICATA DNS request flood detected"; flow:to_server; app-layer-event:dns.flooded; sid:2240007; rev:1;)
-# Per-flow (state) memcap reached. Relates to the app-layer.protocols.dns.state-memcap setting.
-alert dns any any -> any any (msg:"SURICATA DNS flow memcap reached"; flow:to_server; app-layer-event:dns.state_memcap_reached; sid:2240008; rev:2;)

diff --git a/tests/dns-udp-z-flag-fp/test.yaml b/tests/dns-udp-z-flag-fp/test.yaml
new file mode 100644 (file)
index 0000000..2cb9cc0
--- /dev/null
+++ b/tests/dns-udp-z-flag-fp/test.yaml
@@ -0,0 +1,5 @@
+checks:
+  - filter:
+      count: 0
+      match:
+        event_type: alert