]> git.ipfire.org Git - thirdparty/suricata-verify.git/commitdiff
geneve-test: simple test of the geneve decoder 372/head
authorJason Ish <jason.ish@oisf.net>
Fri, 4 Sep 2020 16:03:47 +0000 (10:03 -0600)
committerVictor Julien <victor@inliniac.net>
Thu, 3 Dec 2020 07:13:13 +0000 (08:13 +0100)
Just check the ICMP flow to see that decoding occurred.

tests/geneve-decoder/input.pcap [new file with mode: 0644]
tests/geneve-decoder/test.yaml [new file with mode: 0644]

diff --git a/tests/geneve-decoder/input.pcap b/tests/geneve-decoder/input.pcap
new file mode 100644 (file)
index 0000000..1180011
Binary files /dev/null and b/tests/geneve-decoder/input.pcap differ
diff --git a/tests/geneve-decoder/test.yaml b/tests/geneve-decoder/test.yaml
new file mode 100644 (file)
index 0000000..03776dc
--- /dev/null
@@ -0,0 +1,26 @@
+requires:
+  min-version: 6.0
+
+args:
+- -k none
+
+checks:
+- filter:
+    count: 1
+    match:
+      dest_ip: 10.0.0.2
+      event_type: flow
+      flow.age: 3
+      flow.alerted: false
+      flow.bytes_toclient: 392
+      flow.bytes_toserver: 392
+      flow.pkts_toclient: 4
+      flow.pkts_toserver: 4
+      flow.reason: shutdown
+      flow.state: established
+      icmp_code: 0
+      icmp_type: 8
+      proto: ICMP
+      response_icmp_code: 0
+      response_icmp_type: 0
+      src_ip: 10.0.0.1