tests: add testmyids variant with midstream

diff --git a/tests/alert-testmyids-midstream/input.pcap b/tests/alert-testmyids-midstream/input.pcap
new file mode 100644 (file)
index 0000000..1f9abcf
Binary files /dev/null and b/tests/alert-testmyids-midstream/input.pcap differ

diff --git a/tests/alert-testmyids-midstream/test.rules b/tests/alert-testmyids-midstream/test.rules
new file mode 100644 (file)
index 0000000..9f1307b
--- /dev/null
+++ b/tests/alert-testmyids-midstream/test.rules
@@ -0,0 +1 @@
+alert ip any any -> any any (msg:"GPL ATTACK_RESPONSE id check returned root"; content:"uid=0|28|root|29|"; classtype:bad-unknown; sid:2100498; rev:7;)

diff --git a/tests/alert-testmyids-midstream/test.yaml b/tests/alert-testmyids-midstream/test.yaml
new file mode 100644 (file)
index 0000000..1a7d67a
--- /dev/null
+++ b/tests/alert-testmyids-midstream/test.yaml
@@ -0,0 +1,21 @@
+requires:
+  features:
+    - HAVE_LIBJANSSON
+  min-version: 5.0.0
+args:
+- --set stream.midstream=true
+
+checks:
+
+  # Check that we only have one alert event type in eve.
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        src_port: 80
+
+  - filter:
+      count: 1
+      match:
+        event_type: http
+        dest_port: 80