rules/test: add app-layer-protocol negated test

To complement bug-7241 tests.

diff --git a/tests/lua/lua-transform-05/README.md b/tests/lua/lua-transform-05/README.md
new file mode 100644 (file)
index 0000000..4c158e2
--- /dev/null
+++ b/tests/lua/lua-transform-05/README.md
@@ -0,0 +1 @@
+Ensure Lua transform that returns nil is treated as though no transformation took place and the buffer is unchanged.

diff --git a/tests/lua/lua-transform-05/test.rules b/tests/lua/lua-transform-05/test.rules
new file mode 100644 (file)
index 0000000..c3588b9
--- /dev/null
+++ b/tests/lua/lua-transform-05/test.rules
@@ -0,0 +1 @@
+alert http any any -> any any (msg:"TEST"; http.uri; luaxform:transform.lua, bytes 0, offset 2;content:"exec_post.php";  sid:1; rev:1;)

diff --git a/tests/lua/lua-transform-05/test.yaml b/tests/lua/lua-transform-05/test.yaml
new file mode 100644 (file)
index 0000000..5c54f08
--- /dev/null
+++ b/tests/lua/lua-transform-05/test.yaml
@@ -0,0 +1,17 @@
+requires:
+  min-version: 8
+
+args:
+  - --set default-rule-path=${TEST_DIR}
+  - --set security.lua.allow-rules=true
+
+pcap: ../lua-transform-01/test.pcap
+
+checks:
+
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 1
+        http.url: /exec_post.php

diff --git a/tests/lua/lua-transform-05/transform.lua b/tests/lua/lua-transform-05/transform.lua
new file mode 100644 (file)
index 0000000..fc7f577
--- /dev/null
+++ b/tests/lua/lua-transform-05/transform.lua
@@ -0,0 +1,8 @@
+function init (args)
+    local needs = {}
+    return needs
+end
+
+function transform(input_len, input, argc, args)
+    return nil
+end