From: Philippe Antoine <pantoine@oisf.net>
Date: Thu, 28 Mar 2024 15:51:03 +0000 (+0100)
Subject: doh: adds test for dns over http2 with post
X-Git-Tag: suricata-7.0.7~35
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=refs%2Fpull%2F1980%2Fhead;p=thirdparty%2Fsuricata-verify.git

doh: adds test for dns over http2 with post

Ticket: 5773
---

diff --git a/tests/dns-over-http2-post/README.md b/tests/dns-over-http2-post/README.md
new file mode 100644
index 000000000..0afd21b71
--- /dev/null
+++ b/tests/dns-over-http2-post/README.md
@@ -0,0 +1,9 @@
+# Description
+
+Test DNS over HTTP2 with POST
+https://redmine.openinfosecfoundation.org/issues/5773
+
+# PCAP
+
+The pcap comes from https://redmine.openinfosecfoundation.org/issues/5773
+
diff --git a/tests/dns-over-http2-post/dns_over_https_POST.pcap b/tests/dns-over-http2-post/dns_over_https_POST.pcap
new file mode 100644
index 000000000..930c06251
Binary files /dev/null and b/tests/dns-over-http2-post/dns_over_https_POST.pcap differ
diff --git a/tests/dns-over-http2-post/test.yaml b/tests/dns-over-http2-post/test.yaml
new file mode 100644
index 000000000..c8858b0f6
--- /dev/null
+++ b/tests/dns-over-http2-post/test.yaml
@@ -0,0 +1,24 @@
+requires:
+  min-version: 8.0.0
+
+# disables checksum verification
+args:
+  - -k none
+
+checks:
+  - filter:
+      count: 1
+      match:
+        event_type: dns
+        dns.queries[0].rrname: example.com
+        dns.queries[0].rrtype: NS
+        dns.answers[0].rrname: example.com
+        dns.answers[0].rrtype: NS
+        dns.answers[0].rdata: b.iana-servers.net
+        dns.grouped.NS[0]: b.iana-servers.net
+  - filter:
+      count: 1
+      match:
+        event_type: flow
+        app_proto: doh2
+        app_proto_orig: http2