Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

dns: adds test for sshfp #1588

Closed

Conversation

catenacyber
Copy link
Collaborator

Ticket

Redmine ticket: https://redmine.openinfosecfoundation.org/issues/5642
Or rather https://redmine.openinfosecfoundation.org/issues/6478

But I think there should be its own subticket for dns

Meant to pass with OISF/suricata#10193

@catenacyber catenacyber added the requires suricata pr Depends on a PR in Suricata label Jan 18, 2024
@catenacyber
Copy link
Collaborator Author

Current failure :

/Users/catena/catena/prod/suricata-verify/tests/dns/dns-sshfp/output/eve.json - INVALID. Errors:
1./dns/answers/0 Additional properties are not allowed ('sshfp' was unexpected)
2./dns/answers/1 Additional properties are not allowed ('sshfp' was unexpected)
3./dns/grouped Additional properties are not allowed ('SSHFP' was unexpected)
4./dns Additional properties are not allowed ('tc' was unexpected)
===> dns-sshfp: FAILED: Invalid JSON schema

@jasonish is this normal to have uppercase dns.grouped.SSHFP ?

@jasonish
Copy link
Member

@jasonish is this normal to have uppercase dns.grouped.SSHFP ?

Normal I don't know, per our code its expected - all the type names are logged in uppercase in the groupings.

@catenacyber
Copy link
Collaborator Author

@jasonish is this normal to have uppercase dns.grouped.SSHFP ?

Normal I don't know, per our code its expected - all the type names are logged in uppercase in the groupings.

@hadiqaalamdar your job is to make this SV test pass then ;-) also with dns.grouped.SSHFP

@hadiqaalamdar
Copy link
Contributor

hadiqaalamdar commented Feb 13, 2024

created the new schema.json PR: OISF/suricata#10401

@hadiqaalamdar
Copy link
Contributor

New schema.json PR: OISF/suricata#10429

@victorjulien
Copy link
Member

Merged in #1663, thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
requires suricata pr Depends on a PR in Suricata
Development

Successfully merging this pull request may close these issues.

4 participants