]> git.ipfire.org Git - thirdparty/suricata-verify.git/commitdiff
tests: ERSPAN Type I packet decode if config 289/head
authorJeff Lucovsky <jeff@lucovsky.org>
Thu, 5 Mar 2020 13:25:36 +0000 (08:25 -0500)
committerVictor Julien <victor@inliniac.net>
Sun, 2 Aug 2020 12:33:04 +0000 (14:33 +0200)
This commit adds tests for ERSPAN Type I decoding based on configuration
settings.

tests/decode-erspan-typeI-02/README.md [new file with mode: 0644]
tests/decode-erspan-typeI-02/input.pcap [new file with mode: 0644]
tests/decode-erspan-typeI-02/test.yaml [new file with mode: 0644]
tests/decode-erspan-typeI-03/README.md [new file with mode: 0644]
tests/decode-erspan-typeI-03/input.pcap [new file with mode: 0644]
tests/decode-erspan-typeI-03/test.yaml [new file with mode: 0644]

diff --git a/tests/decode-erspan-typeI-02/README.md b/tests/decode-erspan-typeI-02/README.md
new file mode 100644 (file)
index 0000000..18aaf21
--- /dev/null
@@ -0,0 +1 @@
+Ensure ERSPAN Type I packets are decoded when configured
diff --git a/tests/decode-erspan-typeI-02/input.pcap b/tests/decode-erspan-typeI-02/input.pcap
new file mode 100644 (file)
index 0000000..9610750
Binary files /dev/null and b/tests/decode-erspan-typeI-02/input.pcap differ
diff --git a/tests/decode-erspan-typeI-02/test.yaml b/tests/decode-erspan-typeI-02/test.yaml
new file mode 100644 (file)
index 0000000..eb966e6
--- /dev/null
@@ -0,0 +1,35 @@
+requires:
+
+  min-version: 5.0.0
+
+
+args:
+    - --set decoder.erspan.typeI.enabled=true
+
+checks:
+
+    - filter:
+        count: 2
+        match:
+            event_type: flow
+
+    - filter:
+        count: 1
+        match:
+            event_type: flow
+            src_ip: 100.95.2.201
+            proto: ICMP
+            vlan: [1011]
+
+    - filter:
+        count: 1
+        match:
+            event_type: flow
+            src_ip: 100.95.3.105
+            proto: ICMP
+            vlan: [999]
+
+    - stats:
+        decoder.ipv4: 84
+        decoder.gre: 42
+        decoder.erspan: 42
diff --git a/tests/decode-erspan-typeI-03/README.md b/tests/decode-erspan-typeI-03/README.md
new file mode 100644 (file)
index 0000000..18aaf21
--- /dev/null
@@ -0,0 +1 @@
+Ensure ERSPAN Type I packets are decoded when configured
diff --git a/tests/decode-erspan-typeI-03/input.pcap b/tests/decode-erspan-typeI-03/input.pcap
new file mode 100644 (file)
index 0000000..9610750
Binary files /dev/null and b/tests/decode-erspan-typeI-03/input.pcap differ
diff --git a/tests/decode-erspan-typeI-03/test.yaml b/tests/decode-erspan-typeI-03/test.yaml
new file mode 100644 (file)
index 0000000..cfed3ce
--- /dev/null
@@ -0,0 +1,18 @@
+requires:
+
+  min-version: 5
+  lt-version: 6
+
+
+args:
+    - --set decoder.erspan.typeI.enabled=false
+
+checks:
+
+    - filter:
+        count: 0
+        match:
+            event_type: flow
+
+    - stats:
+        decoder.erspan: 0