Skip to content

dns: adds test for sshfp#1588

Closed
catenacyber wants to merge 1 commit intoOISF:masterfrom
catenacyber:dns-sshfp-schema-5642-v1
Closed

dns: adds test for sshfp#1588
catenacyber wants to merge 1 commit intoOISF:masterfrom
catenacyber:dns-sshfp-schema-5642-v1

Conversation

@catenacyber
Copy link
Collaborator

Ticket

Redmine ticket: https://redmine.openinfosecfoundation.org/issues/5642
Or rather https://redmine.openinfosecfoundation.org/issues/6478

But I think there should be its own subticket for dns

Meant to pass with OISF/suricata#10193

@catenacyber catenacyber added the requires suricata pr Depends on a PR in Suricata label Jan 18, 2024
@catenacyber
Copy link
Collaborator Author

Current failure :

/Users/catena/catena/prod/suricata-verify/tests/dns/dns-sshfp/output/eve.json - INVALID. Errors:
1./dns/answers/0 Additional properties are not allowed ('sshfp' was unexpected)
2./dns/answers/1 Additional properties are not allowed ('sshfp' was unexpected)
3./dns/grouped Additional properties are not allowed ('SSHFP' was unexpected)
4./dns Additional properties are not allowed ('tc' was unexpected)
===> dns-sshfp: FAILED: Invalid JSON schema

@jasonish is this normal to have uppercase dns.grouped.SSHFP ?

@jasonish
Copy link
Member

@jasonish is this normal to have uppercase dns.grouped.SSHFP ?

Normal I don't know, per our code its expected - all the type names are logged in uppercase in the groupings.

@catenacyber
Copy link
Collaborator Author

@jasonish is this normal to have uppercase dns.grouped.SSHFP ?

Normal I don't know, per our code its expected - all the type names are logged in uppercase in the groupings.

@hadiqaalamdar your job is to make this SV test pass then ;-) also with dns.grouped.SSHFP

@hadiqaalamdar
Copy link
Contributor

hadiqaalamdar commented Feb 13, 2024

created the new schema.json PR: OISF/suricata#10401

@hadiqaalamdar
Copy link
Contributor

New schema.json PR: OISF/suricata#10429

@victorjulien
Copy link
Member

Merged in #1663, thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

requires suricata pr Depends on a PR in Suricata

Development

Successfully merging this pull request may close these issues.

4 participants