dns-udp-nxdomain-soa: v1 and v2 dns eve tests

diff --git a/tests/dns-udp-nxdomain-soa-v1/README.md b/tests/dns-udp-nxdomain-soa-v1/README.md
new file mode 100644 (file)
index 0000000..1dd7a6d
--- /dev/null
+++ b/tests/dns-udp-nxdomain-soa-v1/README.md
@@ -0,0 +1,2 @@
+Verify the eve output for a DNS request resulting in an NXDOMAIN error
+and an SOA record.

diff --git a/tests/dns-udp-nxdomain-soa-v1/dns-udp-nxdomain-soa.pcap b/tests/dns-udp-nxdomain-soa-v1/dns-udp-nxdomain-soa.pcap
new file mode 100644 (file)
index 0000000..eb47bad
Binary files /dev/null and b/tests/dns-udp-nxdomain-soa-v1/dns-udp-nxdomain-soa.pcap differ

diff --git a/tests/dns-udp-nxdomain-soa-v1/suricata.yaml b/tests/dns-udp-nxdomain-soa-v1/suricata.yaml
new file mode 100644 (file)
index 0000000..ea4c8d6
--- /dev/null
+++ b/tests/dns-udp-nxdomain-soa-v1/suricata.yaml
@@ -0,0 +1,11 @@
+%YAML 1.1
+---
+
+outputs:
+  - eve-log:
+      enabled: yes
+      filename: eve.json
+      types:
+        - dns:
+            version: 1
+            

diff --git a/tests/dns-udp-nxdomain-soa-v1/test.yaml b/tests/dns-udp-nxdomain-soa-v1/test.yaml
new file mode 100644 (file)
index 0000000..8e8bee4
--- /dev/null
+++ b/tests/dns-udp-nxdomain-soa-v1/test.yaml
@@ -0,0 +1,12 @@
+requires:
+  features:
+    - HAVE_LIBJANSSON
+  lt-version: 7
+
+checks:
+  - filter:
+      count: 2
+      match:
+        event_type: dns
+        dns.rcode: NXDOMAIN
+    

diff --git a/tests/dns-udp-nxdomain-soa/suricata.yaml b/tests/dns-udp-nxdomain-soa/suricata.yaml
index ea4c8d626ba2018f2c7b5ace67bf4db8f2bd17c6..d65eee5d11348fa6c9c90e7e2ac078ec7aaa33cc 100644 (file)
--- a/tests/dns-udp-nxdomain-soa/suricata.yaml
+++ b/tests/dns-udp-nxdomain-soa/suricata.yaml
@@ -7,5 +7,4 @@ outputs:
       filename: eve.json
       types:
         - dns:
-            version: 1
             

diff --git a/tests/dns-udp-nxdomain-soa/test.yaml b/tests/dns-udp-nxdomain-soa/test.yaml
index fd8ea68f035083ee57fc2f123de919d36b3fb44d..c5c46a86e43201e9c419b91e9eb9a940fbea03f3 100644 (file)
--- a/tests/dns-udp-nxdomain-soa/test.yaml
+++ b/tests/dns-udp-nxdomain-soa/test.yaml
@@ -4,7 +4,7 @@ requires:
 
 checks:
   - filter:
-      count: 2
+      count: 1
       match:
         event_type: dns
         dns.rcode: NXDOMAIN