From: Victor Julien Date: Thu, 31 Dec 2020 11:36:41 +0000 (+0100) Subject: nsh: add minimal detect testing X-Git-Tag: suricata-6.0.4~200 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=28fbf1a2cb200103402c98ad361d90ee3935a00c;p=thirdparty%2Fsuricata-verify.git nsh: add minimal detect testing --- diff --git a/tests/decode-nsh-type1/test.rules b/tests/decode-nsh-type1/test.rules new file mode 100644 index 000000000..9ccfe5756 --- /dev/null +++ b/tests/decode-nsh-type1/test.rules @@ -0,0 +1 @@ +alert udp any any -> any any (content:"data|0a 0a|"; startswith; endswith; sid:1;) diff --git a/tests/decode-nsh-type1/test.yaml b/tests/decode-nsh-type1/test.yaml index 4588cd441..0e3e9e9e8 100644 --- a/tests/decode-nsh-type1/test.yaml +++ b/tests/decode-nsh-type1/test.yaml @@ -5,6 +5,16 @@ args: - -k none checks: + - filter: + count: 1 + match: + event_type: alert + src_ip: 10.0.0.1 + dest_ip: 10.0.0.2 + proto: UDP + src_port: 52377 + dest_port: 52464 + alert.signature_id: 1 - filter: count: 1 match: diff --git a/tests/decode-nsh-type2/test.rules b/tests/decode-nsh-type2/test.rules new file mode 100644 index 000000000..9ccfe5756 --- /dev/null +++ b/tests/decode-nsh-type2/test.rules @@ -0,0 +1 @@ +alert udp any any -> any any (content:"data|0a 0a|"; startswith; endswith; sid:1;) diff --git a/tests/decode-nsh-type2/test.yaml b/tests/decode-nsh-type2/test.yaml index 4588cd441..0e3e9e9e8 100644 --- a/tests/decode-nsh-type2/test.yaml +++ b/tests/decode-nsh-type2/test.yaml @@ -5,6 +5,16 @@ args: - -k none checks: + - filter: + count: 1 + match: + event_type: alert + src_ip: 10.0.0.1 + dest_ip: 10.0.0.2 + proto: UDP + src_port: 52377 + dest_port: 52464 + alert.signature_id: 1 - filter: count: 1 match: