tests: test that triggers a rule with established though 3whs missing

diff --git a/tests/alert-no-3whs-established/no-3whs.pcap b/tests/alert-no-3whs-established/no-3whs.pcap
new file mode 100644 (file)
index 0000000..6a1a2be
Binary files /dev/null and b/tests/alert-no-3whs-established/no-3whs.pcap differ

diff --git a/tests/alert-no-3whs-established/test.rules b/tests/alert-no-3whs-established/test.rules
new file mode 100644 (file)
index 0000000..823a421
--- /dev/null
+++ b/tests/alert-no-3whs-established/test.rules
@@ -0,0 +1 @@
+alert tcp 127.0.0.1 any -> 127.0.0.1 1212 ( msg:"RULE:to_server,established #1"; content:"MATCH?"; flow:to_server,established; priority:3; sid:13371340;)

diff --git a/tests/alert-no-3whs-established/test.yaml b/tests/alert-no-3whs-established/test.yaml
new file mode 100644 (file)
index 0000000..961a6e5
--- /dev/null
+++ b/tests/alert-no-3whs-established/test.yaml
@@ -0,0 +1,11 @@
+requires:
+    features:
+        - HAVE_LIBJANSSON
+    min-version: 6.0.0
+
+checks:
+    - filter:
+        count: 0
+        match:
+            event_type: alert
+            alert.signature_id: 13371340