From: Victor Julien <victor@inliniac.net>
Date: Sun, 17 Jan 2021 19:12:36 +0000 (+0100)
Subject: tests: update krb test to do detection
X-Git-Tag: suricata-6.0.4~196
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=eb357ad913341f47c233c7018331d58e8e478603;p=thirdparty%2Fsuricata-verify.git

tests: update krb test to do detection
---

diff --git a/tests/krb5-request-frag-log/suricata.yaml b/tests/krb5-request-frag-log/suricata.yaml
index 955cf95e2..2cfa66955 100644
--- a/tests/krb5-request-frag-log/suricata.yaml
+++ b/tests/krb5-request-frag-log/suricata.yaml
@@ -6,3 +6,4 @@ outputs:
       enabled: true
       types:
         - krb5
+        - alert
diff --git a/tests/krb5-request-frag-log/test.rules b/tests/krb5-request-frag-log/test.rules
new file mode 100644
index 000000000..d3809b059
--- /dev/null
+++ b/tests/krb5-request-frag-log/test.rules
@@ -0,0 +1,2 @@
+alert krb5 any any -> any any (krb5.sname; content:"test"; sid:1;)
+alert krb5 any any -> any any (krb5.cname; content:"user01"; sid:2;)
diff --git a/tests/krb5-request-frag-log/test.yaml b/tests/krb5-request-frag-log/test.yaml
index 900f14d46..c14054c65 100644
--- a/tests/krb5-request-frag-log/test.yaml
+++ b/tests/krb5-request-frag-log/test.yaml
@@ -8,8 +8,18 @@ requires:
 
 args:
   - --set pcap-file.checksum-checks=no
-checks:
 
+checks:
+  - filter:
+      count: 2
+      match:
+        event_type: alert
+        alert.signature_id: 1
+  - filter:
+      count: 2
+      match:
+        event_type: alert
+        alert.signature_id: 2
   - filter:
       comment: authentication service (AS) response
       count: 1