stream/tcp: Test verifies the behavior when direction of TCP flow is changed by the...

pcap file contains 2 http transactions. The request is missing for the first one.
The second transaction is fully complete. So eve.json must contain one and only anomaly event.

Also common flow details are verified.
It must be http, to port 80 with specified number of bytes_toclient and bytes_toserver

diff --git a/tests/tcp-stream-after-swap/README.md b/tests/tcp-stream-after-swap/README.md
new file mode 100644 (file)
index 0000000..40f0e61
--- /dev/null
+++ b/tests/tcp-stream-after-swap/README.md
@@ -0,0 +1,13 @@
+# Description
+
+Test verifies the behavior when direction of TCP flow is changed by the probing parser.
+Probing parser may change the direction of flow processing packet that contains payload.
+This payload must be added to the proper direction stream.
+
+Also common flow details are verified.
+It must be http, to port 80 with specified number of bytes_toclient and bytes_toserver
+
+# PCAP
+
+pcap file contains 2 http transactions. The request is missing for the first one.
+The second transaction is fully complete. So eve.json must contain one and only anomaly event.

diff --git a/tests/tcp-stream-after-swap/http-start-from-response.pcap b/tests/tcp-stream-after-swap/http-start-from-response.pcap
new file mode 100644 (file)
index 0000000..21ecfe7
Binary files /dev/null and b/tests/tcp-stream-after-swap/http-start-from-response.pcap differ

diff --git a/tests/tcp-stream-after-swap/test.yaml b/tests/tcp-stream-after-swap/test.yaml
new file mode 100644 (file)
index 0000000..ae2ec36
--- /dev/null
+++ b/tests/tcp-stream-after-swap/test.yaml
@@ -0,0 +1,24 @@
+requires:
+  features:
+    - HAVE_LIBJANSSON
+  min-version: 5.0.0
+
+# disables checksum verification, and uses midstream
+args:
+- -k none --set stream.midstream=true
+
+checks:
+  - filter:
+      count: 1
+      match:
+        event_type: anomaly
+        anomaly.event: "UNABLE_TO_MATCH_RESPONSE_TO_REQUEST"
+
+  - filter:
+      count: 1
+      match:
+        event_type: flow
+        app_proto: http
+        dest_port: 80
+        flow.bytes_toserver: 608
+        flow.bytes_toclient: 1037