OISF · victorjulien · Jul 10, 2024
diff --git a/tests/vxlan-decoder-04-strip/README.md b/tests/vxlan-decoder-04-strip/README.md
@@ -0,0 +1,7 @@
+# Description
+
+Test basic VXLAN decoding
+
+# PCAP
+
+Pcap from https://github.com/OISF/suricata/pull/3847/files
diff --git a/tests/vxlan-decoder-04-strip/input.pcap b/tests/vxlan-decoder-04-strip/input.pcap
diff --git a/tests/vxlan-decoder-04-strip/test.yaml b/tests/vxlan-decoder-04-strip/test.yaml
@@ -0,0 +1,22 @@
+requires:
+  features:
+    - HAVE_LIBJANSSON
+
+args:
+  - --set decoder.vxlan.enabled=true
+  - --set decoder.vxlan.mode=strip
+
+checks:
+  - filter:
+      count: 1
+      match:
+        event_type: flow
+        src_port: 53
+        dest_port: 12345
+  - filter:
+      count: 1
+      match:
+        event_type: flow
+        src_port: 32021
+        dest_port: 12345
+
diff --git a/tests/vxlan-decoder-05-strip/README.md b/tests/vxlan-decoder-05-strip/README.md
@@ -0,0 +1,7 @@
+# Description
+
+Test basic VXLAN decoding
+
+# PCAP
+
+https://github.com/the-tcpdump-group/tcpdump/blob/master/tests/vxlan.pcap
diff --git a/tests/vxlan-decoder-05-strip/test.rules b/tests/vxlan-decoder-05-strip/test.rules
@@ -0,0 +1 @@
+alert icmp any any -> any any (itype:8; sid:1;)
diff --git a/tests/vxlan-decoder-05-strip/test.yaml b/tests/vxlan-decoder-05-strip/test.yaml
@@ -0,0 +1,25 @@
+requires:
+  features:
+    - HAVE_LIBJANSSON
+args:
+  - --set decoder.vxlan.enabled=true
+  - --set decoder.vxlan.mode=strip
+
+checks:
+  - filter:
+      count: 1
+      match:
+        event_type: flow
+        proto: "ICMP"
+        flow.pkts_toserver: 4
+        flow.pkts_toclient: 4
+  - filter:
+      count: 0
+      match:
+        event_type: flow
+        dest_port: 4789
+  - filter:
+      count: 0
+      match:
+        event_type: alert
+        tunnel.dest_port: 4789
diff --git a/tests/vxlan-decoder-05-strip/vxlan.pcap b/tests/vxlan-decoder-05-strip/vxlan.pcap
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		alert icmp any any -> any any (itype:8; sid:1;)