From d692e4a7368a8714b7488bde36a13f8f496619b4 Mon Sep 17 00:00:00 2001
From: Jeff Lucovsky <jlucovsky@oisf.net>
Date: Mon, 8 Aug 2022 08:20:49 -0400
Subject: [PATCH] test/vlan: 3-level VLAN test

Issue: 2816

This commit tests for 3-level VLAN encapsulations.
---
 tests/eve-flow-vlan-02/input.pcap    | Bin 0 -> 222 bytes
 tests/eve-flow-vlan-02/suricata.yaml |  10 ++++++++++
 tests/eve-flow-vlan-02/test.yaml     |  24 ++++++++++++++++++++++++
 tests/eve-flow-vlan-02/writepcap.py  |  21 +++++++++++++++++++++
 4 files changed, 55 insertions(+)
 create mode 100644 tests/eve-flow-vlan-02/input.pcap
 create mode 100644 tests/eve-flow-vlan-02/suricata.yaml
 create mode 100644 tests/eve-flow-vlan-02/test.yaml
 create mode 100755 tests/eve-flow-vlan-02/writepcap.py

diff --git a/tests/eve-flow-vlan-02/input.pcap b/tests/eve-flow-vlan-02/input.pcap
new file mode 100644
index 0000000000000000000000000000000000000000..10d17a9121939d8dac9e07aee7af718b71a5ec5b
GIT binary patch
literal 222
zc-p&ic+)~A1{MYw`2U}Qfe}di{QHp9JCBD!56IR7i-Q0IBNH<VYa;^#8wZ0c1A`1m
zsRQFK^8+gw7(wzJ4B!7VKy_bP%EMp;WE)}XW&~m`!X`{x!^2<(WSikI0f<xZn*son
Cr$U$j

literal 0
Hc-jL100001

diff --git a/tests/eve-flow-vlan-02/suricata.yaml b/tests/eve-flow-vlan-02/suricata.yaml
new file mode 100644
index 000000000..04706a563
--- /dev/null
+++ b/tests/eve-flow-vlan-02/suricata.yaml
@@ -0,0 +1,10 @@
+%YAML 1.1
+---
+
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular
+      filename: eve.json
+      types:
+        - flow
diff --git a/tests/eve-flow-vlan-02/test.yaml b/tests/eve-flow-vlan-02/test.yaml
new file mode 100644
index 000000000..ec3e92633
--- /dev/null
+++ b/tests/eve-flow-vlan-02/test.yaml
@@ -0,0 +1,24 @@
+requires:
+  min-version: 7
+
+checks:
+  - filter:
+      comment: single vlan
+      count: 1
+      match:
+        event_type: flow
+        vlan: [6]
+
+  - filter:
+      comment: double-tagged vlan
+      count: 1
+      match:
+        event_type: flow
+        vlan: [1, 10]
+
+  - filter:
+      comment: triple-tagged vlan
+      count: 1
+      match:
+        event_type: flow
+        vlan: [1, 10, 100]
diff --git a/tests/eve-flow-vlan-02/writepcap.py b/tests/eve-flow-vlan-02/writepcap.py
new file mode 100755
index 000000000..faf856c40
--- /dev/null
+++ b/tests/eve-flow-vlan-02/writepcap.py
@@ -0,0 +1,21 @@
+#!/usr/bin/env python
+from scapy.all import *
+
+pkts = []
+
+# VLAN tagged packet
+pkts += Ether(dst='ff:ff:ff:ff:ff:ff', src='00:01:02:03:04:05')/ \
+    Dot1Q(vlan=6)/ \
+    IP(dst='255.255.255.255', src='192.168.0.1')/ICMP()
+
+# Double-tagged VLAN (QinQ) packet
+pkts += Ether(dst='ff:ff:ff:ff:ff:ff', src='00:01:02:03:04:05')/ \
+    Dot1Q(vlan=1)/Dot1Q(vlan=10)/ \
+    IP(dst='255.255.255.255', src='192.168.0.1')/ICMP()
+
+# Triple-tagged VLAN (QinQinQ) packet
+pkts += Ether(dst='ff:ff:ff:ff:ff:ff', src='00:01:02:03:04:05')/ \
+    Dot1Q(vlan=1)/Dot1Q(vlan=10)/Dot1Q(vlan=100)/ \
+    IP(dst='255.255.255.255', src='192.168.0.1')/ICMP()
+
+wrpcap('input.pcap', pkts)
-- 
2.47.2