ldap: add tests for udp and frames

tests/ldap-frames/README.md

@@ -0,0 +1,7 @@
+# Test Purpose
+
+Test that LDAP over UDP is parsed correctly.
+
+## PCAP
+
+PCAP downloaded from cloudshark.

tests/ldap-frames/suricata.yaml

@@ -0,0 +1,8 @@
+%YAML 1.1
+---
+
+outputs:
+  - eve-log:
+      enabled: yes
+      types:
+        - frame

tests/ldap-frames/test.yaml

@@ -0,0 +1,34 @@
+requires:
+  min-version: 8
+
+args:
+  - -k none
+
+pcap: ../ldap-udp/cldap.pcap
+
+checks:
+  - filter:
+      count: 1
+      match:
+        pcap_cnt: 1
+        event_type: frame
+        frame.direction: toserver
+        frame.length: 137
+        frame.complete: true
+  - filter:
+      count: 1
+      match:
+        pcap_cnt: 2
+        event_type: frame
+        frame.direction: toclient
+        frame.length: 137
+        frame.complete: true
+  - filter:
+      count: 1
+      match:
+        pcap_cnt: 2
+        event_type: frame
+        frame.direction: toclient
+        frame.length: 14
+        frame.complete: true
+        frame.tx_id: 1

tests/ldap-udp/README.md

@@ -0,0 +1,7 @@
+# Test Purpose
+
+Test that LDAP over UDP is parsed correctly.
+
+## PCAP
+
+PCAP downloaded from cloudshark.

tests/ldap-udp/test.yaml

@@ -0,0 +1,29 @@
+requires:
+  min-version: 8
+
+args:
+  - -k none
+
+pcap: cldap.pcap
+
+checks:
+  - filter:
+      count: 1
+      match:
+        event_type: ldap
+        ldap.request.message_id: 1
+        ldap.request.operation: search_request
+        ldap.request.search_request.base_object: ""
+        ldap.request.search_request.scope: 0
+        ldap.request.search_request.deref_alias: 0
+        ldap.request.search_request.size_limit: 0
+        ldap.request.search_request.time_limit: 0
+        ldap.request.search_request.types_only: false
+        ldap.request.search_request.attributes[0]: Netlogon
+        ldap.responses[0].operation: search_result_entry
+        ldap.responses[0].search_result_entry.base_object: ""
+        ldap.responses[0].search_result_entry.attributes[0].type: netlogon
+        ldap.responses[1].operation: search_result_done
+        ldap.responses[1].search_result_done.result_code: success
+        ldap.responses[1].search_result_done.matched_dn: ""
+        ldap.responses[1].search_result_done.message: ""