dns tests: update for keyword name changes

- dns.query.name -> dns.queries.rrname
- dns.answer.name -> dns.answers.rrname

diff --git a/tests/dns/dns-additionals-rrname/test.rules b/tests/dns/dns-additionals-rrname/test.rules
index 8941fdcbc22adef4e78588c03e7df9c94abd1ed0..63eabfe99f7882736a699f608833db068678a941 100644 (file)
--- a/tests/dns/dns-additionals-rrname/test.rules
+++ b/tests/dns/dns-additionals-rrname/test.rules
@@ -1,4 +1,4 @@
-alert dns any any -> any any (dns.query.name; content:"suricata.io"; sid:1; rev:1;)
+alert dns any any -> any any (dns.queries.rrname; content:"suricata.io"; sid:1; rev:1;)
 alert dns any any -> any any (dns.authorities.rrname; content:"io"; sid:2; rev:1;)
 alert dns any any -> any any (dns.additionals.rrname; content:"a0.nic.io"; sid:3; rev:1;)
 alert dns any any -> any any (dns.additionals.rrname; content:"c0.nic.io"; sid:4; rev:1;)

diff --git a/tests/dns/dns-answer-name/README.md b/tests/dns/dns-answer-name/README.md
index bf5513fec507aed8b94c81ea728ed3155f6e4bf1..7a5117c08efa23b112484423d3cecb64c90cbd43 100644 (file)
--- a/tests/dns/dns-answer-name/README.md
+++ b/tests/dns/dns-answer-name/README.md
@@ -1,4 +1,4 @@
-Test the `dns.answer.name` sticky buffer.
+Test the `dns.answers.rrname` sticky buffer.
 
 The PCAP here was a request created with Scapy to include answers in
 the request. However the response is from a real DNS server with the

diff --git a/tests/dns/dns-answer-name/test.rules b/tests/dns/dns-answer-name/test.rules
index 0544ae1639dfc0e04b68d02542db59894e898e31..e6b01526f030a9972bd322182b3b0647d8e2b7fb 100644 (file)
--- a/tests/dns/dns-answer-name/test.rules
+++ b/tests/dns/dns-answer-name/test.rules
@@ -1,8 +1,8 @@
 # Should alert in both directions as no flow is provided.
-alert dns any any -> any any (dns.answer.name; content:"oisf"; sid:1; rev:1;)
+alert dns any any -> any any (dns.answers.rrname; content:"oisf"; sid:1; rev:1;)
 
 # Should only alert in the request direction.
-alert dns any any -> any any (dns.answer.name; content:"oisf"; flow:to_server; sid:2; rev:1;)
+alert dns any any -> any any (dns.answers.rrname; content:"oisf"; flow:to_server; sid:2; rev:1;)
 
 # Should only alert in the response direction.
-alert dns any any -> any any (dns.answer.name; content:"oisf"; flow:to_client; sid:3; rev:1;)
+alert dns any any -> any any (dns.answers.rrname; content:"oisf"; flow:to_client; sid:3; rev:1;)

diff --git a/tests/dns/dns-query-name/README.md b/tests/dns/dns-query-name/README.md
index 59e9c46be7f3cb5688219cc56816215a55376634..3d231f148de282de4b970750cbf373b2787652ce 100644 (file)
--- a/tests/dns/dns-query-name/README.md
+++ b/tests/dns/dns-query-name/README.md
@@ -1 +1 @@
-Test the `dns.query.name` sticky buffer.
+Test the `dns.queries.rrname` sticky buffer.

diff --git a/tests/dns/dns-query-name/test.rules b/tests/dns/dns-query-name/test.rules
index 3657ec7ee0ee8590de3506602e71860d9716502e..756e3b89504f8d655271780a075e0b94b815276b 100644 (file)
--- a/tests/dns/dns-query-name/test.rules
+++ b/tests/dns/dns-query-name/test.rules
@@ -1,8 +1,8 @@
 # Will alert in both directions as no direction is specified.
-alert dns any any -> any any (dns.query.name; content:"suricata"; sid:1; rev:1;)
+alert dns any any -> any any (dns.queries.rrname; content:"suricata"; sid:1; rev:1;)
 
 # Only alert on requests.
-alert dns any any -> any any (dns.query.name; content:"suricata"; flow:to_server; sid:2; rev:1;)
+alert dns any any -> any any (dns.queries.rrname; content:"suricata"; flow:to_server; sid:2; rev:1;)
 
 # Only alert on responses.
-alert dns any any -> any any (dns.query.name; content:"suricata"; flow:to_client; sid:3; rev:1;)
+alert dns any any -> any any (dns.queries.rrname; content:"suricata"; flow:to_client; sid:3; rev:1;)

diff --git a/tests/dns/task-7018-ids-dns-keywords/README.md b/tests/dns/task-7018-ids-dns-keywords/README.md
index 73b7cf43012a79d3b909bd42bf74e8effc867167..e79d52f2e6036298b76e4acdb0a15b7d77f594ab 100644 (file)
--- a/tests/dns/task-7018-ids-dns-keywords/README.md
+++ b/tests/dns/task-7018-ids-dns-keywords/README.md
@@ -12,7 +12,7 @@ Query 1: suricata.io
 Query 2: oisf.net
 Query 3: suricata.org
 
-We match those against a single rule with `dns.query.name` and inspecting
+We match those against a single rule with `dns.queries.rrname` and inspecting
 content `suricata`, so the expectation is to have 4 alerts.
 
 ## Related issues

diff --git a/tests/dns/task-7018-ids-dns-keywords/test.rules b/tests/dns/task-7018-ids-dns-keywords/test.rules
index 4ba624ad9dc9ee8eedb374f96412dcab3de3fdaf..aff249e7e7bcfb668f5dfe8aae01b3fc78d8aa04 100644 (file)
--- a/tests/dns/task-7018-ids-dns-keywords/test.rules
+++ b/tests/dns/task-7018-ids-dns-keywords/test.rules
@@ -1 +1 @@
-alert dns any any -> any any (msg:"DNS suricata query.name"; dns.query.name; content:"suricata"; sid:1; rev:1;)
+alert dns any any -> any any (msg:"DNS suricata query.name"; dns.queries.rrname; content:"suricata"; sid:1; rev:1;)

diff --git a/tests/dns/task-7018-ips-dns-keywords/README.md b/tests/dns/task-7018-ips-dns-keywords/README.md
index 0178fdac9d099bfce908fbd368922dfb78628d81..d88923d80d1f4cbce0ddfab0c8d341008f3571fc 100644 (file)
--- a/tests/dns/task-7018-ips-dns-keywords/README.md
+++ b/tests/dns/task-7018-ips-dns-keywords/README.md
@@ -14,7 +14,7 @@ Query 1: suricata.io
 Query 2: oisf.net
 Query 3: suricata.org
 
-We match those against a single rule with `dns.query.name` and inspecting
+We match those against a single rule with `dns.queries.rrname` and inspecting
 content `suricata`, so the expectation is to have 4 alerts.
 
 ## Related issues

diff --git a/tests/dns/task-7018-ips-dns-keywords/test.rules b/tests/dns/task-7018-ips-dns-keywords/test.rules
index 4ba624ad9dc9ee8eedb374f96412dcab3de3fdaf..aff249e7e7bcfb668f5dfe8aae01b3fc78d8aa04 100644 (file)
--- a/tests/dns/task-7018-ips-dns-keywords/test.rules
+++ b/tests/dns/task-7018-ips-dns-keywords/test.rules
@@ -1 +1 @@
-alert dns any any -> any any (msg:"DNS suricata query.name"; dns.query.name; content:"suricata"; sid:1; rev:1;)
+alert dns any any -> any any (msg:"DNS suricata query.name"; dns.queries.rrname; content:"suricata"; sid:1; rev:1;)

diff --git a/tests/lua/lua-base64/test.rules b/tests/lua/lua-base64/test.rules
index 23b702759f89fb80e7ea7e5f8564e6a595414321..f1bf9ac739ef5b579c3ae08c87178e21a4784627 100644 (file)
--- a/tests/lua/lua-base64/test.rules
+++ b/tests/lua/lua-base64/test.rules
@@ -1,3 +1,3 @@
 alert dns any any -> any any (msg:"TEST DNS LUA dns.rrname"; \
-      dns.query.name; content: "www.suricata-ids.org"; \
+      dns.queries.rrname; content: "www.suricata-ids.org"; \
       lua:rule.lua; sid:1; rev:1;)

diff --git a/tests/lua/lua-hashlib/test.rules b/tests/lua/lua-hashlib/test.rules
index eef4c1fac76f04e1edbd86e6dc70f8acd990b4fe..bc91123e13168657b32114bd2a47fa06d73da9ac 100644 (file)
--- a/tests/lua/lua-hashlib/test.rules
+++ b/tests/lua/lua-hashlib/test.rules
@@ -1,3 +1,3 @@
 alert dns any any -> any any (msg:"TEST DNS LUA dns.rrname"; \
-      dns.query.name; content: "www.suricata-ids.org"; \
+      dns.queries.rrname; content: "www.suricata-ids.org"; \
       lua:test-hashing.lua; sid:1; rev:1;)