# We should get a "SURICATA Applayer Mismatch protocol both
# directions" alert.
-n=$(cat output/eve.json | jq -c 'select(.alert.signature_id == 2260000)' | wc -l)
+n=$(cat output/eve.json | \
+ jq -c 'select(.alert.signature_id == 2260000)' | \
+ wc -l | xargs)
if [ "$n" != 1 ]; then
echo "expected 1 event with SID 2260000"
failed=yes
fi
# We should have a flow event with app_proto = http and app_proto_tc = ssh.
-n=$(cat output/eve.json | jq -c 'select(.event_type == "flow") | select(.app_proto == "http") | select(.app_proto_tc == "ssh")' | wc -l)
+n=$(cat output/eve.json | \
+ jq -c 'select(.event_type == "flow") | select(.app_proto == "http") | select(.app_proto_tc == "ssh")' | \
+ wc -l | xargs)
if [ "$n" != 1 ]; then
echo "expected 1 event with app_proto http and app_proto_tc ssh"
failed=yes
tests="${tests} ${private}"
fi
-export ASAN_OPTIONS="detect_leaks=${DETECT_LEAKS:=1},disable_core=1"
+case $(uname) in
+ Darwin)
+ true
+ ;;
+ *)
+ export ASAN_OPTIONS="detect_leaks=${DETECT_LEAKS:=1},disable_core=1"
+ ;;
+esac
export LSAN_OPTIONS="suppressions=qa/lsan.suppress"
run_test() {
#! /bin/sh
run() {
+ mkdir -p ${TEST_DIR}/output
if ! ./src/suricata -T -c ${TEST_DIR}/suricata.yaml -vvv \
- --set default-rule-path="${TEST_DIR}"; then
+ -l ${TEST_DIR}/output --set default-rule-path="${TEST_DIR}"; then
exit 1
fi
}