detect-icmp-seq: add test

Task: #5597

diff --git a/tests/detect-icmp-seq/README.md b/tests/detect-icmp-seq/README.md
new file mode 100644 (file)
index 0000000..4b3af19
--- /dev/null
+++ b/tests/detect-icmp-seq/README.md
@@ -0,0 +1,3 @@
+Test for checking the working of icmp_seq keyword by creating 2 rules and matching a packet against them. Only the first one shall trigger.
+
+PCAP created with scapy.

diff --git a/tests/detect-icmp-seq/input.pcap b/tests/detect-icmp-seq/input.pcap
new file mode 100644 (file)
index 0000000..12a05c2
Binary files /dev/null and b/tests/detect-icmp-seq/input.pcap differ

diff --git a/tests/detect-icmp-seq/test.rules b/tests/detect-icmp-seq/test.rules
new file mode 100644 (file)
index 0000000..7dc465f
--- /dev/null
+++ b/tests/detect-icmp-seq/test.rules
@@ -0,0 +1,2 @@
+alert icmp any any -> any any (icmp_seq:2216; sid:1;)
+alert icmp any any -> any any (icmp_seq:5000; sid:2;)

diff --git a/tests/detect-icmp-seq/test.yaml b/tests/detect-icmp-seq/test.yaml
new file mode 100644 (file)
index 0000000..f5402c7
--- /dev/null
+++ b/tests/detect-icmp-seq/test.yaml
@@ -0,0 +1,22 @@
+args:
+- -k none
+
+checks:
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 1
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 2
+- filter:
+    count: 1
+    match:
+      event_type: flow
+- filter:
+    count: 1
+    match:
+      event_type: stats