Adds test with dataset and pcrexform for unique param

diff --git a/tests/datasets-pcrexform/expected/uri-param-seen.csv b/tests/datasets-pcrexform/expected/uri-param-seen.csv
new file mode 100644 (file)
index 0000000..cd54e8d
--- /dev/null
+++ b/tests/datasets-pcrexform/expected/uri-param-seen.csv
@@ -0,0 +1,3 @@
+cGFyYW0y
+cGFyYW0z
+cGFyYW0=

diff --git a/tests/datasets-pcrexform/input.pcap b/tests/datasets-pcrexform/input.pcap
new file mode 100644 (file)
index 0000000..4d32719
Binary files /dev/null and b/tests/datasets-pcrexform/input.pcap differ

diff --git a/tests/datasets-pcrexform/test.rules b/tests/datasets-pcrexform/test.rules
new file mode 100644 (file)
index 0000000..f7e040b
--- /dev/null
+++ b/tests/datasets-pcrexform/test.rules
@@ -0,0 +1 @@
+alert http any any -> any any (msg:"HTTP unique first parameter"; http.uri; content: "?"; pcrexform:"/[^\?]+\?([^&=]+)"; dataset:set,uri-param-seen, type string, state uri-param-seen.csv; sid:8000001;)

diff --git a/tests/datasets-pcrexform/test.yaml b/tests/datasets-pcrexform/test.yaml
new file mode 100644 (file)
index 0000000..5e4560f
--- /dev/null
+++ b/tests/datasets-pcrexform/test.yaml
@@ -0,0 +1,14 @@
+requires:
+  min-version: 6
+  features:
+    - HAVE_LIBJANSSON
+  files:
+    - src/datasets.c
+
+args:
+ - -k none --data-dir=output
+
+checks:
+  - file-compare:
+      filename: uri-param-seen.csv
+      expected: expected/uri-param-seen.csv