tests: add bug 2558 tests

diff --git a/tests/bug-2558-01/1.rules b/tests/bug-2558-01/1.rules
new file mode 100644 (file)
index 0000000..06f8d0c
--- /dev/null
+++ b/tests/bug-2558-01/1.rules
@@ -0,0 +1,4 @@
+alert http any any -> any any (filestore; fileext:!"mp4"; sid:1; rev:1;)
+alert http any any -> any any (filestore; filename:!"2008.mp4"; sid:2; rev:1;)
+alert http any any -> any any (filestore; filename:!"tar.gz"; sid:3; rev:1;)
+

diff --git a/tests/bug-2558-01/2008.mp4.pcap b/tests/bug-2558-01/2008.mp4.pcap
new file mode 100644 (file)
index 0000000..3f2cf52
Binary files /dev/null and b/tests/bug-2558-01/2008.mp4.pcap differ

diff --git a/tests/bug-2558-01/test.yaml b/tests/bug-2558-01/test.yaml
new file mode 100644 (file)
index 0000000..7d7c55e
--- /dev/null
+++ b/tests/bug-2558-01/test.yaml
@@ -0,0 +1,20 @@
+requires:
+  features:
+    - HAVE_LIBJANSSON
+
+checks:
+  - filter:
+      count: 0
+      match:
+        event_type: alert
+        alert.signature_id: 1
+  - filter:
+      count: 0
+      match:
+        event_type: alert
+        alert.signature_id: 2
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 3

diff --git a/tests/bug-2558-02/1.rules b/tests/bug-2558-02/1.rules
new file mode 100644 (file)
index 0000000..26593b9
--- /dev/null
+++ b/tests/bug-2558-02/1.rules
@@ -0,0 +1,4 @@
+alert http any any -> any any (filestore; fileext:!"mp4"; sid:1; rev:1;)
+alert http any any -> any any (filestore; file.name; content:!"2008.mp4"; sid:2; rev:1;)
+alert http any any -> any any (filestore; file.name; content:!"tar.gz"; sid:3; rev:1;)
+alert http any any -> any any (file.name; content:"/a/expl/2008.mp4"; startswith; endswith; sid:4; rev:1;)

diff --git a/tests/bug-2558-02/2008.mp4.pcap b/tests/bug-2558-02/2008.mp4.pcap
new file mode 100644 (file)
index 0000000..3f2cf52
Binary files /dev/null and b/tests/bug-2558-02/2008.mp4.pcap differ

diff --git a/tests/bug-2558-02/test.yaml b/tests/bug-2558-02/test.yaml
new file mode 100644 (file)
index 0000000..3e79c8c
--- /dev/null
+++ b/tests/bug-2558-02/test.yaml
@@ -0,0 +1,26 @@
+requires:
+  features:
+    - HAVE_LIBJANSSON
+  min-version: 5.0.0
+
+checks:
+  - filter:
+      count: 0
+      match:
+        event_type: alert
+        alert.signature_id: 1
+  - filter:
+      count: 0
+      match:
+        event_type: alert
+        alert.signature_id: 2
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 3
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 4