From: Jason Ish <jason.ish@oisf.net>
Date: Fri, 12 Mar 2021 23:31:38 +0000 (-0600)
Subject: dns-eve: dns eve v1 and v2 versions
X-Git-Tag: suricata-6.0.4~115
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=60b37489ccf2b393d0a75f0c2c586921a53a501e;p=thirdparty%2Fsuricata-verify.git

dns-eve: dns eve v1 and v2 versions
---

diff --git a/tests/dns-eve/check.sh b/tests/dns-eve-v1/check.sh
similarity index 100%
rename from tests/dns-eve/check.sh
rename to tests/dns-eve-v1/check.sh
diff --git a/tests/dns-eve-v1/input.pcap b/tests/dns-eve-v1/input.pcap
new file mode 100644
index 000000000..5c9ee35b3
Binary files /dev/null and b/tests/dns-eve-v1/input.pcap differ
diff --git a/tests/dns-eve-v1/suricata.yaml b/tests/dns-eve-v1/suricata.yaml
new file mode 100644
index 000000000..cda656a47
--- /dev/null
+++ b/tests/dns-eve-v1/suricata.yaml
@@ -0,0 +1,80 @@
+%YAML 1.1
+---
+
+stats:
+  enabled: yes
+  # The interval field (in seconds) controls at what interval
+  # the loggers are invoked.
+  interval: 8
+
+# Configure the type of alert (and other) logging you would like.
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular
+      filename: eve.json
+      types:
+        - alert:
+            # payload: yes             # enable dumping payload in Base64
+            # payload-buffer-size: 4kb # max size of payload buffer to output in eve-log
+            # payload-printable: yes   # enable dumping payload in printable (lossy) format
+            # packet: yes              # enable dumping of packet (without stream segments)
+            # http: yes                # enable dumping of http fields
+            # tls: yes                 # enable dumping of tls fields
+            # ssh: yes                 # enable dumping of ssh fields
+            # smtp: yes                # enable dumping of smtp fields
+
+            # HTTP X-Forwarded-For support by adding an extra field or overwriting
+            # the source or destination IP address (depending on flow direction)
+            # with the one reported in the X-Forwarded-For HTTP header. This is
+            # helpful when reviewing alerts for traffic that is being reverse
+            # or forward proxied.
+            xff:
+              enabled: no
+              # Two operation modes are available, "extra-data" and "overwrite".
+              mode: extra-data
+              # Two proxy deployments are supported, "reverse" and "forward". In
+              # a "reverse" deployment the IP address used is the last one, in a
+              # "forward" deployment the first IP address is used.
+              deployment: reverse
+              # Header name where the actual IP address will be reported, if more
+              # than one IP address is present, the last IP address will be the
+              # one taken into consideration.
+              header: X-Forwarded-For
+        - http:
+            extended: yes     # enable this for extended logging information
+            # custom allows additional http fields to be included in eve-log
+            # the example below adds three additional fields when uncommented
+            #custom: [Accept-Encoding, Accept-Language, Authorization]
+        - dns:
+            version: 1
+        - tls:
+            extended: yes     # enable this for extended logging information
+        - files:
+            force-magic: no   # force logging magic on all logged files
+            force-md5: no     # force logging of md5 checksums
+        #- drop:
+        #    alerts: no       # log alerts that caused drops
+        - smtp:
+            #extended: yes # enable this for extended logging information
+            # this includes: bcc, message-id, subject, x_mailer, user-agent
+            # custom fields logging from the list:
+            #  reply-to, bcc, message-id, subject, x-mailer, user-agent, received,
+            #  x-originating-ip, in-reply-to, references, importance, priority,
+            #  sensitivity, organization, content-md5, date
+            #custom: [received, x-mailer, x-originating-ip, relays, reply-to, bcc]
+            # output md5 of fields: body, subject
+            # for the body you need to set app-layer.protocols.smtp.mime.body-md5
+            # to yes
+            #md5: [body, subject]
+
+        - ssh
+        # - stats:
+        #     totals: yes       # stats for all threads merged together
+        #     threads: no       # per thread stats
+        #     deltas: no        # include delta values
+        # bi-directional flows
+        #- flow
+        # uni-directional flows
+        #- netflow
+
diff --git a/tests/dns-eve-v1/test.yaml b/tests/dns-eve-v1/test.yaml
new file mode 100644
index 000000000..9ee272d75
--- /dev/null
+++ b/tests/dns-eve-v1/test.yaml
@@ -0,0 +1,4 @@
+requires:
+  features:
+    - HAVE_LIBJANSSON
+  lt-version: 7
diff --git a/tests/dns-eve/suricata.yaml b/tests/dns-eve/suricata.yaml
index cda656a47..c1058c333 100644
--- a/tests/dns-eve/suricata.yaml
+++ b/tests/dns-eve/suricata.yaml
@@ -47,7 +47,6 @@ outputs:
             # the example below adds three additional fields when uncommented
             #custom: [Accept-Encoding, Accept-Language, Authorization]
         - dns:
-            version: 1
         - tls:
             extended: yes     # enable this for extended logging information
         - files:
diff --git a/tests/dns-eve/test.yaml b/tests/dns-eve/test.yaml
index 56ea9b0d5..ef6d02622 100644
--- a/tests/dns-eve/test.yaml
+++ b/tests/dns-eve/test.yaml
@@ -1,3 +1,13 @@
 requires:
   features:
     - HAVE_LIBJANSSON
+
+checks:
+  - filter:
+      count: 4
+      match:
+        dns.type: query
+  - filter:
+      count: 4
+      match:
+        dns.type: answer