tests: add tests for negated protocol matching

Ticket: #4921

diff --git a/tests/detect-app-layer-protocol-03/README.md b/tests/detect-app-layer-protocol-03/README.md
new file mode 100644 (file)
index 0000000..90374c8
--- /dev/null
+++ b/tests/detect-app-layer-protocol-03/README.md
@@ -0,0 +1,5 @@
+Test `app-layer-protocol:!http` when toserver detection failed.
+
+PCAP extracted from output-eve-ftp-data pcap.
+
+https://redmine.openinfosecfoundation.org/issues/4921

diff --git a/tests/detect-app-layer-protocol-03/input.pcap b/tests/detect-app-layer-protocol-03/input.pcap
new file mode 100644 (file)
index 0000000..b839d25
Binary files /dev/null and b/tests/detect-app-layer-protocol-03/input.pcap differ

diff --git a/tests/detect-app-layer-protocol-03/test.rules b/tests/detect-app-layer-protocol-03/test.rules
new file mode 100644 (file)
index 0000000..2533090
--- /dev/null
+++ b/tests/detect-app-layer-protocol-03/test.rules
@@ -0,0 +1,2 @@
+alert tcp any any -> any [80,443] (msg:"non-HTTP traffic over HTTP/S standard port"; flow:to_server; app-layer-protocol:!http,final; app-layer-protocol:!tls,final; sid:1; )
+alert tcp any [80,443] -> any any (msg:"non-HTTP traffic over HTTP/S standard port"; flow:to_client; app-layer-protocol:!http,final; app-layer-protocol:!tls,final; sid:2; )

diff --git a/tests/detect-app-layer-protocol-03/test.yaml b/tests/detect-app-layer-protocol-03/test.yaml
new file mode 100644 (file)
index 0000000..1474c73
--- /dev/null
+++ b/tests/detect-app-layer-protocol-03/test.yaml
@@ -0,0 +1,14 @@
+requires:
+  min-version: 8
+
+checks:
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 1
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 2