From 81087e48c41443653bc5b4009a94d991401a7329 Mon Sep 17 00:00:00 2001 From: Philippe Antoine Date: Mon, 27 Jul 2026 21:15:11 +0200 Subject: [PATCH] tests/datasets: adds a test about hashes overread Ticket: 8768 --- tests/datarep-8768/datarep.rules | 2 ++ tests/datarep-8768/dns_md5.rep | 1 + tests/datarep-8768/dns_sha256.rep | 1 + tests/datarep-8768/test.yaml | 13 +++++++++++++ 4 files changed, 17 insertions(+) create mode 100644 tests/datarep-8768/datarep.rules create mode 100644 tests/datarep-8768/dns_md5.rep create mode 100644 tests/datarep-8768/dns_sha256.rep create mode 100644 tests/datarep-8768/test.yaml diff --git a/tests/datarep-8768/datarep.rules b/tests/datarep-8768/datarep.rules new file mode 100644 index 0000000000..fd0bdd8f46 --- /dev/null +++ b/tests/datarep-8768/datarep.rules @@ -0,0 +1,2 @@ +alert dns any any -> any any (dns.query; to_md5; datarep:dns_md5, >, 200, load dns_md5.rep, type md5; sid:1;) +alert dns any any -> any any (dns.query; to_sha256; datarep:dns_sha256, >, 200, load dns_sha256.rep, type sha256; sid:2;) diff --git a/tests/datarep-8768/dns_md5.rep b/tests/datarep-8768/dns_md5.rep new file mode 100644 index 0000000000..64a94672de --- /dev/null +++ b/tests/datarep-8768/dns_md5.rep @@ -0,0 +1 @@ +5ababd603b2278,101 diff --git a/tests/datarep-8768/dns_sha256.rep b/tests/datarep-8768/dns_sha256.rep new file mode 100644 index 0000000000..64a94672de --- /dev/null +++ b/tests/datarep-8768/dns_sha256.rep @@ -0,0 +1 @@ +5ababd603b2278,101 diff --git a/tests/datarep-8768/test.yaml b/tests/datarep-8768/test.yaml new file mode 100644 index 0000000000..1b68ebc8fa --- /dev/null +++ b/tests/datarep-8768/test.yaml @@ -0,0 +1,13 @@ +requires: + min-version: 9 + +pcap: ../datarep-01/input.pcap + +args: + - -k none + +checks: + - filter: + count: 0 + match: + event_type: alert