dns-udp-unsolicited-response: dns eve v1 and v2 tests

diff --git a/tests/dns-udp-unsolicited-response-v1/README.md b/tests/dns-udp-unsolicited-response-v1/README.md
new file mode 100644 (file)
index 0000000..e202ff9
--- /dev/null
+++ b/tests/dns-udp-unsolicited-response-v1/README.md
@@ -0,0 +1,11 @@
+Test the following sequence of DNS messages on a flow:
+
+- DNS request with ID 0x99ab.
+- DNS response with ID 0x9941 (unsolicited response).
+- DNS response with ID 0x99ab (expected response).
+
+Check that all 3 DNS message are logged, and that an unsolicted dns
+response event is logged.
+
+NOTE: Unsolicited responses do not exist with the Rust DNS parser as
+it doesn't correlate responses with requests.

diff --git a/tests/dns-udp-unsolicited-response-v1/dns-response-2x.pcap b/tests/dns-udp-unsolicited-response-v1/dns-response-2x.pcap
new file mode 100644 (file)
index 0000000..bad14f6
Binary files /dev/null and b/tests/dns-udp-unsolicited-response-v1/dns-response-2x.pcap differ

diff --git a/tests/dns-udp-unsolicited-response-v1/suricata.yaml b/tests/dns-udp-unsolicited-response-v1/suricata.yaml
new file mode 100644 (file)
index 0000000..f4b03a5
--- /dev/null
+++ b/tests/dns-udp-unsolicited-response-v1/suricata.yaml
@@ -0,0 +1,11 @@
+%YAML 1.1
+---
+
+outputs:
+  - eve-log:
+      enabled: true
+      filename: eve.json
+      types:
+        - alert
+        - dns:
+            version: 1

diff --git a/tests/dns-udp-unsolicited-response-v1/test.yaml b/tests/dns-udp-unsolicited-response-v1/test.yaml
new file mode 100644 (file)
index 0000000..60334a5
--- /dev/null
+++ b/tests/dns-udp-unsolicited-response-v1/test.yaml
@@ -0,0 +1,16 @@
+requires:
+  features:
+    - HAVE_LIBJANSSON
+  lt-version: 7
+
+checks:
+  - filter:
+      count: 1
+      match:
+        event_type: dns
+        dns.type: query
+  - filter:
+      count: 2
+      match:
+        event_type: dns
+        dns.type: answer

diff --git a/tests/dns-udp-unsolicited-response/suricata.yaml b/tests/dns-udp-unsolicited-response/suricata.yaml
index f4b03a5c5fbed1949699dfca539b201d485f5dd0..43de9cdb67396d8b739a250a96c55488569b201e 100644 (file)
--- a/tests/dns-udp-unsolicited-response/suricata.yaml
+++ b/tests/dns-udp-unsolicited-response/suricata.yaml
@@ -8,4 +8,3 @@ outputs:
       types:
         - alert
         - dns:
-            version: 1

diff --git a/tests/dns-udp-unsolicited-response/test.yaml b/tests/dns-udp-unsolicited-response/test.yaml
index e26348f01464d9fc88d387de2fe851fd652dd369..b19fa65e7fda5daae4f5949798322e7b91fa6aa3 100644 (file)
--- a/tests/dns-udp-unsolicited-response/test.yaml
+++ b/tests/dns-udp-unsolicited-response/test.yaml
@@ -1,7 +1,3 @@
-requires:
-  features:
-    - HAVE_LIBJANSSON
-
 checks:
   - filter:
       count: 1