From: Victor Julien Date: Mon, 18 Jan 2021 07:47:19 +0000 (+0100) Subject: tests: add simple sctp decoder test X-Git-Tag: suricata-6.0.4~193 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=refs%2Fpull%2F404%2Fhead;p=thirdparty%2Fsuricata-verify.git tests: add simple sctp decoder test --- diff --git a/tests/decode-sctp-01/README.md b/tests/decode-sctp-01/README.md new file mode 100644 index 000000000..651f69601 --- /dev/null +++ b/tests/decode-sctp-01/README.md @@ -0,0 +1,4 @@ +PCAP +==== + +https://redmine.openinfosecfoundation.org/issues/1370 diff --git a/tests/decode-sctp-01/input.pcap b/tests/decode-sctp-01/input.pcap new file mode 100644 index 000000000..c6623cf16 Binary files /dev/null and b/tests/decode-sctp-01/input.pcap differ diff --git a/tests/decode-sctp-01/test.rules b/tests/decode-sctp-01/test.rules new file mode 100644 index 000000000..48e5e12ce --- /dev/null +++ b/tests/decode-sctp-01/test.rules @@ -0,0 +1 @@ +alert sctp any 7 -> any 7 (sid:1;) diff --git a/tests/decode-sctp-01/test.yaml b/tests/decode-sctp-01/test.yaml new file mode 100644 index 000000000..5306529f5 --- /dev/null +++ b/tests/decode-sctp-01/test.yaml @@ -0,0 +1,26 @@ +# *** Add configuration here *** + +args: +- -k none + +checks: +- filter: + count: 1 + match: + dest_ip: 192.168.170.8 + dest_port: 7 + event_type: alert + proto: SCTP + src_ip: 192.168.170.56 + src_port: 7 + alert.signature_id: 1 + +- filter: + count: 1 + match: + dest_ip: 192.168.170.8 + dest_port: 7 + event_type: flow + proto: SCTP + src_ip: 192.168.170.56 + src_port: 7