tcp: add test for bug 5379

diff --git a/tests/tcp-5379/README.md b/tests/tcp-5379/README.md
new file mode 100644 (file)
index 0000000..c51e3f4
--- /dev/null
+++ b/tests/tcp-5379/README.md
@@ -0,0 +1,8 @@
+Description
+===========
+Illustration that if there are trailing bytes in a TCP packet, unlike UDP, TCP parses the
+correct data and alerts on it too.
+
+PCAP
+====
+Created with Scapy.

diff --git a/tests/tcp-5379/input.pcap b/tests/tcp-5379/input.pcap
new file mode 100644 (file)
index 0000000..5508813
Binary files /dev/null and b/tests/tcp-5379/input.pcap differ

diff --git a/tests/tcp-5379/test.rules b/tests/tcp-5379/test.rules
new file mode 100644 (file)
index 0000000..2d48726
--- /dev/null
+++ b/tests/tcp-5379/test.rules
@@ -0,0 +1,2 @@
+alert tcp any any -> any any (msg:"Ends with AAA"; content:"AAA"; endswith; sid:1; rev:1;)
+alert tcp any any -> any any (msg:"Ends with DDD"; content:"DDD"; endswith; sid:2; rev:1;)

diff --git a/tests/tcp-5379/test.yaml b/tests/tcp-5379/test.yaml
new file mode 100644 (file)
index 0000000..7c3296d
--- /dev/null
+++ b/tests/tcp-5379/test.yaml
@@ -0,0 +1,13 @@
+args:
+- -k none
+
+checks:
+- filter:
+    count: 1
+    match:
+      alert.signature_id: 1
+
+- filter:
+    count: 0
+    match:
+      alert.signature_id: 2