tests: add tests for udp.hdr and tcp.hdr

diff --git a/tests/tcp-hdr-keyword/input.pcap b/tests/tcp-hdr-keyword/input.pcap
new file mode 100644 (file)
index 0000000..a6372de
Binary files /dev/null and b/tests/tcp-hdr-keyword/input.pcap differ

diff --git a/tests/tcp-hdr-keyword/test.rules b/tests/tcp-hdr-keyword/test.rules
new file mode 100644 (file)
index 0000000..a1aa40a
--- /dev/null
+++ b/tests/tcp-hdr-keyword/test.rules
@@ -0,0 +1 @@
+alert tcp any any -> any any (tcp.mss:<536; sid:1234; rev:5;)

diff --git a/tests/tcp-hdr-keyword/test.yaml b/tests/tcp-hdr-keyword/test.yaml
new file mode 100644 (file)
index 0000000..b658eca
--- /dev/null
+++ b/tests/tcp-hdr-keyword/test.yaml
@@ -0,0 +1,12 @@
+requires:
+  min-version: 5.0.0
+  features:
+    - HAVE_LIBJANSSON
+
+checks:
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 1234 
+

diff --git a/tests/tcp-hdr-keyword/writepcap.py b/tests/tcp-hdr-keyword/writepcap.py
new file mode 100755 (executable)
index 0000000..27d1089
--- /dev/null
+++ b/tests/tcp-hdr-keyword/writepcap.py
@@ -0,0 +1,10 @@
+#!/usr/bin/env python
+from scapy.all import *
+
+pkts = []
+
+pkts += Ether(dst='ff:ff:ff:ff:ff:ff', src='00:01:02:03:04:05')/ \
+    Dot1Q(vlan=6)/ \
+    IP(dst='255.255.255.255', src='192.168.0.1')/TCP(dport=80,flags="S",options=[("NOP",None),("MSS", 8)])
+
+wrpcap('input.pcap', pkts)

diff --git a/tests/udp-hdr-keyword/input.pcap b/tests/udp-hdr-keyword/input.pcap
new file mode 100644 (file)
index 0000000..e35b3fb
Binary files /dev/null and b/tests/udp-hdr-keyword/input.pcap differ

diff --git a/tests/udp-hdr-keyword/test.rules b/tests/udp-hdr-keyword/test.rules
new file mode 100644 (file)
index 0000000..6079eb8
--- /dev/null
+++ b/tests/udp-hdr-keyword/test.rules
@@ -0,0 +1 @@
+alert udp any any -> any any (udp.hdr; content:"|00 08|"; offset:4; depth:2; sid:1234;)

diff --git a/tests/udp-hdr-keyword/test.yaml b/tests/udp-hdr-keyword/test.yaml
new file mode 100644 (file)
index 0000000..b658eca
--- /dev/null
+++ b/tests/udp-hdr-keyword/test.yaml
@@ -0,0 +1,12 @@
+requires:
+  min-version: 5.0.0
+  features:
+    - HAVE_LIBJANSSON
+
+checks:
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 1234 
+

diff --git a/tests/udp-hdr-keyword/writepcap.py b/tests/udp-hdr-keyword/writepcap.py
new file mode 100755 (executable)
index 0000000..b03b8f7
--- /dev/null
+++ b/tests/udp-hdr-keyword/writepcap.py
@@ -0,0 +1,10 @@
+#!/usr/bin/env python
+from scapy.all import *
+
+pkts = []
+
+pkts += Ether(dst='ff:ff:ff:ff:ff:ff', src='00:01:02:03:04:05')/ \
+    Dot1Q(vlan=6)/ \
+    IP(dst='255.255.255.255', src='192.168.0.1')/UDP(dport=80)
+
+wrpcap('input.pcap', pkts)