eve/http: add request/response headers test

diff --git a/tests/http-all-headers/README.md b/tests/http-all-headers/README.md
new file mode 100644 (file)
index 0000000..fc88fc3
--- /dev/null
+++ b/tests/http-all-headers/README.md
@@ -0,0 +1,15 @@
+# HTTP dump headers
+
+This test verifies that the flag outputs.eve-log.types.http.dump-all-headers set
+to "both" will make suricata dump all headers per HTTP transaction, for both
+requests and response.
+
+To simplify the test, the check will verify the length of the headers in the json
+object and the header name and value of one request header and one response
+header.
+
+The pcap file is downloaded from
+
+```
+https://wiki.wireshark.org/SampleCaptures?action=AttachFile&do=get&target=http.cap
+```

diff --git a/tests/http-all-headers/check.sh b/tests/http-all-headers/check.sh
new file mode 100755 (executable)
index 0000000..2d7b37b
--- /dev/null
+++ b/tests/http-all-headers/check.sh
@@ -0,0 +1,21 @@
+#! /bin/sh
+
+. ${TOPDIR}/util/functions.sh
+
+# 9 request headers (2 rows per header + start and end of list).
+n=$(jq '.http.request_headers | length' eve.json)
+assert_eq 9 "$n"
+
+# Simplified test: check 1 request header
+# Arbitrary decision to check "Host": "www.ethereal.com"
+n=$(jq ".http.request_headers[] | select(.name | contains(\"Host\")) | select(.value | contains(\"www.ethereal.com\"))" eve.json)
+test -n "$n"
+
+# 9 request headers (2 rows per header).
+n=$(jq '.http.response_headers | length ' eve.json)
+assert_eq 9 "$n"
+
+# Simplified test: check 1 response header
+# Arbitrary decision to check "Content-Length": "18070"
+n=$(jq ".http.response_headers[] | select(.name | contains(\"Content-Length\")) | select(.value | contains(\"18070\"))" eve.json)
+test -n "$n"

diff --git a/tests/http-all-headers/input.pcap b/tests/http-all-headers/input.pcap
new file mode 100644 (file)
index 0000000..bf5caeb
Binary files /dev/null and b/tests/http-all-headers/input.pcap differ

diff --git a/tests/http-all-headers/suricata.yaml b/tests/http-all-headers/suricata.yaml
new file mode 100644 (file)
index 0000000..1987f04
--- /dev/null
+++ b/tests/http-all-headers/suricata.yaml
@@ -0,0 +1,11 @@
+%YAML 1.1
+---
+
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular
+      filename: eve.json
+      types:
+        - http:
+            dump-all-headers: both

diff --git a/tests/http-all-headers/test.yaml b/tests/http-all-headers/test.yaml
new file mode 100644 (file)
index 0000000..10c069e
--- /dev/null
+++ b/tests/http-all-headers/test.yaml
@@ -0,0 +1,10 @@
+requires:
+    min-version: 5.0.0
+    features:
+        - HAVE_LIBJANSSON
+
+checks:
+    - filter:
+            count: 1
+            match:
+                event_type: http