]> git.ipfire.org Git - thirdparty/suricata-verify.git/commitdiff
dns-udp-eve-log-mx-only: add dns eve v2 test
authorJason Ish <jason.ish@oisf.net>
Mon, 15 Mar 2021 21:55:13 +0000 (15:55 -0600)
committerJason Ish <jason.ish@oisf.net>
Tue, 16 Mar 2021 04:25:35 +0000 (22:25 -0600)
tests/dns-udp-eve-log-mx-only-v1/check.sh [moved from tests/dns-udp-eve-log-mx-only/check.sh with 100% similarity]
tests/dns-udp-eve-log-mx-only-v1/dns-udp-google.com-a-aaaa-mx.pcap [new file with mode: 0644]
tests/dns-udp-eve-log-mx-only-v1/suricata.yaml [new file with mode: 0644]
tests/dns-udp-eve-log-mx-only-v1/test.yaml [new file with mode: 0644]
tests/dns-udp-eve-log-mx-only/suricata.yaml
tests/dns-udp-eve-log-mx-only/test.yaml

diff --git a/tests/dns-udp-eve-log-mx-only-v1/dns-udp-google.com-a-aaaa-mx.pcap b/tests/dns-udp-eve-log-mx-only-v1/dns-udp-google.com-a-aaaa-mx.pcap
new file mode 100644 (file)
index 0000000..def918f
Binary files /dev/null and b/tests/dns-udp-eve-log-mx-only-v1/dns-udp-google.com-a-aaaa-mx.pcap differ
diff --git a/tests/dns-udp-eve-log-mx-only-v1/suricata.yaml b/tests/dns-udp-eve-log-mx-only-v1/suricata.yaml
new file mode 100644 (file)
index 0000000..a27aeb3
--- /dev/null
@@ -0,0 +1,12 @@
+%YAML 1.1
+---
+
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular
+      filename: eve.json
+      types:
+        - dns:
+            version: 1
+            custom: [mx]
diff --git a/tests/dns-udp-eve-log-mx-only-v1/test.yaml b/tests/dns-udp-eve-log-mx-only-v1/test.yaml
new file mode 100644 (file)
index 0000000..9ee272d
--- /dev/null
@@ -0,0 +1,4 @@
+requires:
+  features:
+    - HAVE_LIBJANSSON
+  lt-version: 7
index a27aeb3e19f8208e746610def63215dba876b1ae..4db14a4e80ea310e2d0fdc933b134e8646c06faf 100644 (file)
@@ -8,5 +8,4 @@ outputs:
       filename: eve.json
       types:
         - dns:
-            version: 1
-            custom: [mx]
+            types: [mx]
index 56ea9b0d57173b93569d9c72c9b1372ce9234d13..6bbfff9ced965602bef2725919cf7b702ad318bd 100644 (file)
@@ -1,3 +1,23 @@
 requires:
   features:
     - HAVE_LIBJANSSON
+
+checks:
+  - filter:
+      count: 1
+      match:
+        dns.type: query
+        dns.rrtype: "MX"
+  - filter:
+      count: 1
+      match:
+        dns.type: query
+  - filter:
+      count: 1
+      match:
+        dns.type: answer
+        dns.answers[0].rrtype: "MX"
+  - filter:
+      count: 1
+      match:
+        dns.type: answer