From: Eric Leblond Date: Tue, 23 Aug 2022 14:29:07 +0000 (+0200) Subject: tests: add tests for domain keyword X-Git-Tag: suricata-7.0.11~103 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=bbd9fc9b077f5adac17b567e00425497c13f9d4b;p=thirdparty%2Fsuricata-verify.git tests: add tests for domain keyword --- diff --git a/tests/domain-keyword/input.pcap b/tests/domain-keyword/input.pcap new file mode 100644 index 000000000..e11d35e05 Binary files /dev/null and b/tests/domain-keyword/input.pcap differ diff --git a/tests/domain-keyword/test.rules b/tests/domain-keyword/test.rules new file mode 100644 index 000000000..7d612eb26 --- /dev/null +++ b/tests/domain-keyword/test.rules @@ -0,0 +1,2 @@ +alert dns any any -> any any (msg:"dns suricata"; dns.query; domain; content:"suricata.io"; startswith; endswith; sid:1; rev:1;) +alert dns any any -> any any (msg:"dns bbc"; dns.query; domain; content:"bbc.co.uk"; startswith; endswith; sid:2; rev:1;) diff --git a/tests/domain-keyword/test.yaml b/tests/domain-keyword/test.yaml new file mode 100644 index 000000000..4832fedcf --- /dev/null +++ b/tests/domain-keyword/test.yaml @@ -0,0 +1,8 @@ +requires: + min-version: 8.0.0 + +checks: + - filter: + count: 1 + match: + alert.signature_id: 1