From: Jason Ish <jason.ish@oisf.net>
Date: Fri, 5 Jul 2024 00:00:32 +0000 (-0600)
Subject: dns-incomplete: dns v2 and v3 tests
X-Git-Tag: suricata-7.0.7~51
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=3ad691703c54f6a06bdf09b3d1f63bd4afcfbd52;p=thirdparty%2Fsuricata-verify.git

dns-incomplete: dns v2 and v3 tests
---

diff --git a/tests/dns-incomplete/README.md b/tests/dns/dns-incomplete/README.md
similarity index 100%
rename from tests/dns-incomplete/README.md
rename to tests/dns/dns-incomplete/README.md
diff --git a/tests/dns-incomplete/input.pcap b/tests/dns/dns-incomplete/input.pcap
similarity index 100%
rename from tests/dns-incomplete/input.pcap
rename to tests/dns/dns-incomplete/input.pcap
diff --git a/tests/dns-incomplete/input.txt b/tests/dns/dns-incomplete/input.txt
similarity index 100%
rename from tests/dns-incomplete/input.txt
rename to tests/dns/dns-incomplete/input.txt
diff --git a/tests/dns-incomplete/test.rules b/tests/dns/dns-incomplete/test.rules
similarity index 100%
rename from tests/dns-incomplete/test.rules
rename to tests/dns/dns-incomplete/test.rules
diff --git a/tests/dns/dns-incomplete/test.yaml b/tests/dns/dns-incomplete/test.yaml
new file mode 100644
index 000000000..2c3fb679a
--- /dev/null
+++ b/tests/dns/dns-incomplete/test.yaml
@@ -0,0 +1,19 @@
+requires:
+  min-version: 8
+
+# disables checksum verification
+args:
+- -k none --set app-layer.protocols.dns.detection-ports.dp=5353
+
+checks:
+  - filter:
+      count: 1
+      match:
+        event_type: dns
+        dns.queries[0].rrname: google.com
+        dns.type: request
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 1
diff --git a/tests/dns-incomplete/txt2pcap.py b/tests/dns/dns-incomplete/txt2pcap.py
similarity index 100%
rename from tests/dns-incomplete/txt2pcap.py
rename to tests/dns/dns-incomplete/txt2pcap.py
diff --git a/tests/dns/v2/dns-incomplete/README.md b/tests/dns/v2/dns-incomplete/README.md
new file mode 100644
index 000000000..babffdac5
--- /dev/null
+++ b/tests/dns/v2/dns-incomplete/README.md
@@ -0,0 +1,7 @@
+# Description
+
+Test DNS incomplete parsing
+
+# PCAP
+
+The pcap comes from running script txt2pcap.py input.txt
diff --git a/tests/dns/v2/dns-incomplete/test.rules b/tests/dns/v2/dns-incomplete/test.rules
new file mode 100644
index 000000000..1473e8048
--- /dev/null
+++ b/tests/dns/v2/dns-incomplete/test.rules
@@ -0,0 +1 @@
+alert dns any any -> any any (msg:"Test dns_query option"; dns_query; content:"google.com"; nocase; sid:1;)
diff --git a/tests/dns-incomplete/test.yaml b/tests/dns/v2/dns-incomplete/test.yaml
similarity index 82%
rename from tests/dns-incomplete/test.yaml
rename to tests/dns/v2/dns-incomplete/test.yaml
index 85a743807..357d505a1 100644
--- a/tests/dns-incomplete/test.yaml
+++ b/tests/dns/v2/dns-incomplete/test.yaml
@@ -1,10 +1,15 @@
 requires:
   min-version: 6.0
 
+pcap: ../../dns-incomplete/input.pcap
+
 # disables checksum verification
 args:
 - -k none --set app-layer.protocols.dns.detection-ports.dp=5353
 
+env:
+  SURICATA_EVE_DNS_VERSION: 2
+
 checks:
   - filter:
       count: 1