From: Victor Julien Date: Thu, 19 Mar 2020 08:34:22 +0000 (+0100) Subject: tests: conditional logging tests for http and dns X-Git-Tag: suricata-6.0.4~279 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=280c6617360629117c80c1f70ee717f6bcf52e08;p=thirdparty%2Fsuricata-verify.git tests: conditional logging tests for http and dns --- diff --git a/tests/cond-log-dns-dig/README.md b/tests/cond-log-dns-dig/README.md new file mode 100644 index 000000000..93b240c0f --- /dev/null +++ b/tests/cond-log-dns-dig/README.md @@ -0,0 +1 @@ +Conditional logging with DNS EVE v2 test of a dig against www.suricata-ids.org. diff --git a/tests/cond-log-dns-dig/input.pcap b/tests/cond-log-dns-dig/input.pcap new file mode 100644 index 000000000..663a6797f Binary files /dev/null and b/tests/cond-log-dns-dig/input.pcap differ diff --git a/tests/cond-log-dns-dig/test.rules b/tests/cond-log-dns-dig/test.rules new file mode 100644 index 000000000..9bc7ac4ae --- /dev/null +++ b/tests/cond-log-dns-dig/test.rules @@ -0,0 +1 @@ +config dns any any -> any any (dns.query; content:"suricata"; config: logging disable, type tx, scope tx; sid:1;) diff --git a/tests/cond-log-dns-dig/test.yaml b/tests/cond-log-dns-dig/test.yaml new file mode 100644 index 000000000..d2370d57e --- /dev/null +++ b/tests/cond-log-dns-dig/test.yaml @@ -0,0 +1,10 @@ +requires: + features: + - HAVE_LIBJANSSON + min-version: 6.0.0 + +checks: +- filter: + count: 0 + match: + event_type: dns diff --git a/tests/cond-log-http-testmyids/input.pcap b/tests/cond-log-http-testmyids/input.pcap new file mode 100644 index 000000000..8fb6832de Binary files /dev/null and b/tests/cond-log-http-testmyids/input.pcap differ diff --git a/tests/cond-log-http-testmyids/test.rules b/tests/cond-log-http-testmyids/test.rules new file mode 100644 index 000000000..6abd64225 --- /dev/null +++ b/tests/cond-log-http-testmyids/test.rules @@ -0,0 +1 @@ +config http any any -> any any (http.host; content:"test"; config:logging disable, type tx, scope tx; sid:1;) diff --git a/tests/cond-log-http-testmyids/test.yaml b/tests/cond-log-http-testmyids/test.yaml new file mode 100644 index 000000000..11f8f17be --- /dev/null +++ b/tests/cond-log-http-testmyids/test.yaml @@ -0,0 +1,14 @@ +requires: + features: + - HAVE_LIBJANSSON + min-version: 6.0.0 + +checks: + - filter: + count: 0 + match: + event_type: alert + - filter: + count: 0 + match: + event_type: http