tests: add more midstream test variants

diff --git a/tests/alert-testmyids-midstream3/input.pcap b/tests/alert-testmyids-midstream3/input.pcap
new file mode 100644 (file)
index 0000000..00604d5
Binary files /dev/null and b/tests/alert-testmyids-midstream3/input.pcap differ

diff --git a/tests/alert-testmyids-midstream3/suricata.yaml b/tests/alert-testmyids-midstream3/suricata.yaml
new file mode 100644 (file)
index 0000000..2c7f4cc
--- /dev/null
+++ b/tests/alert-testmyids-midstream3/suricata.yaml
@@ -0,0 +1,37 @@
+%YAML 1.1
+---
+
+logging:
+  default-log-level: notice
+  default-output-filter:
+  outputs:
+  - console:
+      enabled: yes
+
+outputs:
+  - fast:
+      enabled: yes
+      filename: fast.log
+      append: yes
+
+  - eve-log:
+      enabled: yes
+      filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
+      filename: eve.json
+      types:
+        - alert:
+            payload: yes
+            payload-buffer-size: 4kb
+            payload-printable: yes
+            packet: yes
+            http: yes
+            tls: yes
+            ssh: yes
+            smtp: yes
+            xff:
+              enabled: yes
+              mode: extra-data
+              deployment: reverse
+              header: X-Forwarded-For
+        - flow
+        - http

diff --git a/tests/alert-testmyids-midstream3/test.rules b/tests/alert-testmyids-midstream3/test.rules
new file mode 100644 (file)
index 0000000..9f1307b
--- /dev/null
+++ b/tests/alert-testmyids-midstream3/test.rules
@@ -0,0 +1 @@
+alert ip any any -> any any (msg:"GPL ATTACK_RESPONSE id check returned root"; content:"uid=0|28|root|29|"; classtype:bad-unknown; sid:2100498; rev:7;)

diff --git a/tests/alert-testmyids-midstream3/test.yaml b/tests/alert-testmyids-midstream3/test.yaml
new file mode 100644 (file)
index 0000000..9cef3c7
--- /dev/null
+++ b/tests/alert-testmyids-midstream3/test.yaml
@@ -0,0 +1,30 @@
+requires:
+  features:
+    - HAVE_LIBJANSSON
+
+args:
+- --set stream.midstream=true
+
+checks:
+
+  # Check that we only have one alert event type in eve.
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        src_port: 80
+  - filter:
+      count: 1
+      match:
+        event_type: flow
+        dest_port: 80
+  - filter:
+      count: 1
+      match:
+        event_type: http
+        dest_port: 80
+
+  # Check how many lines were logged to fast.log.
+  - shell:
+      args: cat fast.log | wc -l | xargs
+      expect: 1

diff --git a/tests/alert-testmyids-midstream5/input.pcap b/tests/alert-testmyids-midstream5/input.pcap
new file mode 100644 (file)
index 0000000..7a89ef1
Binary files /dev/null and b/tests/alert-testmyids-midstream5/input.pcap differ

diff --git a/tests/alert-testmyids-midstream5/suricata.yaml b/tests/alert-testmyids-midstream5/suricata.yaml
new file mode 100644 (file)
index 0000000..2c7f4cc
--- /dev/null
+++ b/tests/alert-testmyids-midstream5/suricata.yaml
@@ -0,0 +1,37 @@
+%YAML 1.1
+---
+
+logging:
+  default-log-level: notice
+  default-output-filter:
+  outputs:
+  - console:
+      enabled: yes
+
+outputs:
+  - fast:
+      enabled: yes
+      filename: fast.log
+      append: yes
+
+  - eve-log:
+      enabled: yes
+      filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
+      filename: eve.json
+      types:
+        - alert:
+            payload: yes
+            payload-buffer-size: 4kb
+            payload-printable: yes
+            packet: yes
+            http: yes
+            tls: yes
+            ssh: yes
+            smtp: yes
+            xff:
+              enabled: yes
+              mode: extra-data
+              deployment: reverse
+              header: X-Forwarded-For
+        - flow
+        - http

diff --git a/tests/alert-testmyids-midstream5/test.rules b/tests/alert-testmyids-midstream5/test.rules
new file mode 100644 (file)
index 0000000..9f1307b
--- /dev/null
+++ b/tests/alert-testmyids-midstream5/test.rules
@@ -0,0 +1 @@
+alert ip any any -> any any (msg:"GPL ATTACK_RESPONSE id check returned root"; content:"uid=0|28|root|29|"; classtype:bad-unknown; sid:2100498; rev:7;)

diff --git a/tests/alert-testmyids-midstream5/test.yaml b/tests/alert-testmyids-midstream5/test.yaml
new file mode 100644 (file)
index 0000000..8f28e58
--- /dev/null
+++ b/tests/alert-testmyids-midstream5/test.yaml
@@ -0,0 +1,31 @@
+requires:
+  features:
+    - HAVE_LIBJANSSON
+  min-version: 5.0.0
+
+args:
+- --set stream.midstream=true
+
+checks:
+
+  # Check that we only have one alert event type in eve.
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        src_port: 80
+  - filter:
+      count: 1
+      match:
+        event_type: flow
+        dest_port: 80
+  - filter:
+      count: 1
+      match:
+        event_type: http
+        dest_port: 80
+
+  # Check how many lines were logged to fast.log.
+  - shell:
+      args: cat fast.log | wc -l | xargs
+      expect: 1