Adds test with multiple HTTP 100 responses

diff --git a/tests/http-multiple100/README.md b/tests/http-multiple100/README.md
new file mode 100644 (file)
index 0000000..4007fa3
--- /dev/null
+++ b/tests/http-multiple100/README.md
@@ -0,0 +1,5 @@
+# HTTP multiple 100
+
+This test verifies that Suricata continues parsing even if a HTTP server replies multiple times the status 100 Continue.
+
+The pcap file is downloaded from https://github.com/OISF/libhtp/issues/377

diff --git a/tests/http-multiple100/input.pcap b/tests/http-multiple100/input.pcap
new file mode 100644 (file)
index 0000000..9aeb6c1
Binary files /dev/null and b/tests/http-multiple100/input.pcap differ

diff --git a/tests/http-multiple100/test.yaml b/tests/http-multiple100/test.yaml
new file mode 100644 (file)
index 0000000..0692cb1
--- /dev/null
+++ b/tests/http-multiple100/test.yaml
@@ -0,0 +1,15 @@
+args:
+  - -k none
+
+checks:
+  - filter:
+      count: 1
+      match:
+        event_type: fileinfo
+        fileinfo.size: 34293
+
+  - filter:
+      count: 1
+      match:
+        event_type: http
+        http.status: 200