From: Shivani Bhardwaj <shivanib134@gmail.com>
Date: Wed, 5 Aug 2020 06:41:56 +0000 (+0530)
Subject: dcerpc: Add test for gap handling
X-Git-Tag: suricata-6.0.4~254
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=refs%2Fpull%2F296%2Fhead;p=thirdparty%2Fsuricata-verify.git

dcerpc: Add test for gap handling
---

diff --git a/tests/dcerpc/dce-gap-handling/input.pcap b/tests/dcerpc/dce-gap-handling/input.pcap
new file mode 100644
index 000000000..8b2cad1e1
Binary files /dev/null and b/tests/dcerpc/dce-gap-handling/input.pcap differ
diff --git a/tests/dcerpc/dce-gap-handling/test.yaml b/tests/dcerpc/dce-gap-handling/test.yaml
new file mode 100644
index 000000000..35618625c
--- /dev/null
+++ b/tests/dcerpc/dce-gap-handling/test.yaml
@@ -0,0 +1,38 @@
+requires:
+  min-version: 6.0.0
+
+args:
+- -k none
+
+checks:
+- filter:
+    count: 1
+    match:
+      dcerpc.call_id: 1
+      dcerpc.interfaces[0].ack_result: 0
+      dcerpc.interfaces[0].uuid: 12345778-1234-abcd-ef00-0123456789ac
+      dcerpc.interfaces[0].version: '1.0'
+      dcerpc.request: BIND
+      dcerpc.response: BINDACK
+      dcerpc.rpc_version: '5.0'
+      dest_ip: 172.31.9.211
+      dest_port: 49154
+      event_type: dcerpc
+      pcap_cnt: 9
+      proto: TCP
+      src_ip: 172.31.9.1
+      src_port: 59374
+- filter:
+    count: 1
+    match:
+      dcerpc.call_id: 1
+      dcerpc.request: REQUEST_LOST
+      dcerpc.response: ALTER_CONTEXT_RESP
+      dcerpc.rpc_version: '5.0'
+      dest_ip: 172.31.9.211
+      dest_port: 49154
+      event_type: dcerpc
+      pcap_cnt: 12
+      proto: TCP
+      src_ip: 172.31.9.1
+      src_port: 59374