diff --git a/tests/ldap-abandon/Makefile b/tests/ldap-abandon/Makefile new file mode 100644 index 000000000..318ba91b6 --- /dev/null +++ b/tests/ldap-abandon/Makefile @@ -0,0 +1,3 @@ +ldap.pcap: ldap.syn + flowsynth.py -f pcap -w $@ $^ + diff --git a/tests/ldap-abandon/README.md b/tests/ldap-abandon/README.md new file mode 100644 index 000000000..d8007d277 --- /dev/null +++ b/tests/ldap-abandon/README.md @@ -0,0 +1,9 @@ +# Test Purpose + +Test that LDAP Abandon operation is parsed correctly. + +## PCAP + +This PCAP was generated with flowsynth using +this documentation as a reference: +https://ldap.com/ldapv3-wire-protocol-reference-abandon/ diff --git a/tests/ldap-abandon/ldap.pcap b/tests/ldap-abandon/ldap.pcap new file mode 100644 index 000000000..68699ef52 Binary files /dev/null and b/tests/ldap-abandon/ldap.pcap differ diff --git a/tests/ldap-abandon/ldap.syn b/tests/ldap-abandon/ldap.syn new file mode 100644 index 000000000..e012d5c8e --- /dev/null +++ b/tests/ldap-abandon/ldap.syn @@ -0,0 +1,2 @@ +flow default tcp 1.1.1.1:5555 > 2.2.2.2:389 (tcp.initialize; mss:9000;); +default > (content:"\x30\x06\x02\x01\x06\x50\x01\x05";); \ No newline at end of file diff --git a/tests/ldap-abandon/test.yaml b/tests/ldap-abandon/test.yaml new file mode 100644 index 000000000..63fc1d4b5 --- /dev/null +++ b/tests/ldap-abandon/test.yaml @@ -0,0 +1,15 @@ +requires: + min-version: 8 + +args: + - -k none + +pcap: ldap.pcap + +checks: + - filter: + count: 1 + match: + event_type: ldap + ldap.request.message_id: 6 + ldap.request.operation: abandon_request