http1: adds test about request line matching

Ticket: 7668

Test that it matches as soon as possible

diff --git a/tests/http-request-line-packet/README.md b/tests/http-request-line-packet/README.md
new file mode 100644 (file)
index 0000000..50e574e
--- /dev/null
+++ b/tests/http-request-line-packet/README.md
@@ -0,0 +1,11 @@
+# Test Description
+
+Test HTTP1 request line matches on earliest packet possible
+
+## Related issue
+
+https://redmine.openinfosecfoundation.org/issues/7668
+
+## PCAP
+
+Reused from another test

diff --git a/tests/http-request-line-packet/test.rules b/tests/http-request-line-packet/test.rules
new file mode 100644 (file)
index 0000000..bdc6065
--- /dev/null
+++ b/tests/http-request-line-packet/test.rules
@@ -0,0 +1 @@
+alert http1 any any -> any any (http.method; content:"GET"; alert; sid:1;)

diff --git a/tests/http-request-line-packet/test.yaml b/tests/http-request-line-packet/test.yaml
new file mode 100644 (file)
index 0000000..9f7696d
--- /dev/null
+++ b/tests/http-request-line-packet/test.yaml
@@ -0,0 +1,16 @@
+requires:
+  min-version: 7
+
+pcap: ../firewall/ruletype-firewall-31-retrans-of-drop/input.pcap
+
+args:
+  - --simulate-ips
+  - -k none
+
+checks:
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 1
+      pcap_cnt: 4
\ No newline at end of file