From fab388343d572baa4810f6e1ddff7edd581c41cc Mon Sep 17 00:00:00 2001
From: Alice Akaki <akakialice@gmail.com>
Date: Mon, 13 Jan 2025 21:26:42 -0400
Subject: [PATCH] ldap: add test for abandon request

Ticket: #7477
---
 tests/ldap-abandon/Makefile  |   3 +++
 tests/ldap-abandon/README.md |   7 +++++++
 tests/ldap-abandon/ldap.pcap | Bin 0 -> 382 bytes
 tests/ldap-abandon/ldap.syn  |   2 ++
 tests/ldap-abandon/test.yaml |  15 +++++++++++++++
 5 files changed, 27 insertions(+)
 create mode 100644 tests/ldap-abandon/Makefile
 create mode 100644 tests/ldap-abandon/README.md
 create mode 100644 tests/ldap-abandon/ldap.pcap
 create mode 100644 tests/ldap-abandon/ldap.syn
 create mode 100644 tests/ldap-abandon/test.yaml

diff --git a/tests/ldap-abandon/Makefile b/tests/ldap-abandon/Makefile
new file mode 100644
index 000000000..318ba91b6
--- /dev/null
+++ b/tests/ldap-abandon/Makefile
@@ -0,0 +1,3 @@
+ldap.pcap: ldap.syn
+	flowsynth.py -f pcap -w $@ $^
+
diff --git a/tests/ldap-abandon/README.md b/tests/ldap-abandon/README.md
new file mode 100644
index 000000000..80a06d23f
--- /dev/null
+++ b/tests/ldap-abandon/README.md
@@ -0,0 +1,7 @@
+# Test Purpose
+
+Test that LDAP Abandon operation is parsed correctly.
+
+## PCAP
+
+This PCAP was generated with flowsynth.
diff --git a/tests/ldap-abandon/ldap.pcap b/tests/ldap-abandon/ldap.pcap
new file mode 100644
index 0000000000000000000000000000000000000000..68699ef52df1d2a15d1a3d6a2ab05db8ffa895fa
GIT binary patch
literal 382
zcmca|c+)~A1{MYw`2U}Qff2}2p4XcGqn(Ap49EsyyT3);mNf^{CKYWl<6v-QV9)?5
zb6_hu#RvpUKp?uAu@$J03y2v4m=qX_W<yMg>O`0#e#Mz(oi@Yz?x)W>QB47v05XZO
zRdh4ZfD|C+4iEyGq6RT#UKhfYzbeH)BX5T7^KujmLp23t0Fqm{fu^Je2mnn{hnS+)
z!@^((6a-;GtKj2?mv3EYSJwItHpKwyqeECtkx*c;*v-ITz{bSL7Qn~~3LlkTgqsw_
d%`!rYDr+|%jAuY~6PnLbfmREH-6YSz008z@NbUdt

literal 0
HcmV?d00001

diff --git a/tests/ldap-abandon/ldap.syn b/tests/ldap-abandon/ldap.syn
new file mode 100644
index 000000000..e012d5c8e
--- /dev/null
+++ b/tests/ldap-abandon/ldap.syn
@@ -0,0 +1,2 @@
+flow default tcp 1.1.1.1:5555 > 2.2.2.2:389 (tcp.initialize; mss:9000;);
+default > (content:"\x30\x06\x02\x01\x06\x50\x01\x05";);
\ No newline at end of file
diff --git a/tests/ldap-abandon/test.yaml b/tests/ldap-abandon/test.yaml
new file mode 100644
index 000000000..63fc1d4b5
--- /dev/null
+++ b/tests/ldap-abandon/test.yaml
@@ -0,0 +1,15 @@
+requires:
+  min-version: 8
+
+args:
+  - -k none
+
+pcap: ldap.pcap
+
+checks:
+  - filter:
+      count: 1
+      match:
+        event_type: ldap
+        ldap.request.message_id: 6
+        ldap.request.operation: abandon_request