From: Philippe Antoine <pantoine@oisf.net>
Date: Tue, 22 Apr 2025 12:45:20 +0000 (+0200)
Subject: http1: adds test about request line matching
X-Git-Tag: suricata-7.0.11~82
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=refs%2Fpull%2F2464%2Fhead;p=thirdparty%2Fsuricata-verify.git

http1: adds test about request line matching

Ticket: 7668

Test that it matches as soon as possible
---

diff --git a/tests/http-request-line-packet/README.md b/tests/http-request-line-packet/README.md
new file mode 100644
index 000000000..50e574eb7
--- /dev/null
+++ b/tests/http-request-line-packet/README.md
@@ -0,0 +1,11 @@
+# Test Description
+
+Test HTTP1 request line matches on earliest packet possible
+
+## Related issue
+
+https://redmine.openinfosecfoundation.org/issues/7668
+
+## PCAP
+
+Reused from another test
diff --git a/tests/http-request-line-packet/test.rules b/tests/http-request-line-packet/test.rules
new file mode 100644
index 000000000..bdc6065a1
--- /dev/null
+++ b/tests/http-request-line-packet/test.rules
@@ -0,0 +1 @@
+alert http1 any any -> any any (http.method; content:"GET"; alert; sid:1;)
diff --git a/tests/http-request-line-packet/test.yaml b/tests/http-request-line-packet/test.yaml
new file mode 100644
index 000000000..9f7696df9
--- /dev/null
+++ b/tests/http-request-line-packet/test.yaml
@@ -0,0 +1,16 @@
+requires:
+  min-version: 7
+
+pcap: ../firewall/ruletype-firewall-31-retrans-of-drop/input.pcap
+
+args:
+  - --simulate-ips
+  - -k none
+
+checks:
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 1
+      pcap_cnt: 4
\ No newline at end of file