tests: Add file_data/strip-ws transform tests

diff --git a/tests/detect-strip_whitespace-01/input.rules b/tests/detect-strip_whitespace-01/input.rules
new file mode 100644 (file)
index 0000000..f10a3ec
--- /dev/null
+++ b/tests/detect-strip_whitespace-01/input.rules
@@ -0,0 +1 @@
+alert http any any -> any any (msg:"HTTP strip_whitespace 1"; flow:established; file_data; strip_whitespace; content:"embrace holistically"; sid:1;)

diff --git a/tests/detect-strip_whitespace-01/test.yaml b/tests/detect-strip_whitespace-01/test.yaml
new file mode 100644 (file)
index 0000000..086536f
--- /dev/null
+++ b/tests/detect-strip_whitespace-01/test.yaml
@@ -0,0 +1,12 @@
+requires:
+    min-version: 6
+    pcap: false
+
+exit-code: 1
+args:
+ - --engine-analysis
+
+checks:
+  - shell:
+      args: grep "incompatible with strip_whitespace transform" stderr| wc -l | xargs
+      expect: 1

diff --git a/tests/detect-strip_whitespace-02/input.pcap b/tests/detect-strip_whitespace-02/input.pcap
new file mode 100644 (file)
index 0000000..cc069dc
Binary files /dev/null and b/tests/detect-strip_whitespace-02/input.pcap differ

diff --git a/tests/detect-strip_whitespace-02/input.rules b/tests/detect-strip_whitespace-02/input.rules
new file mode 100644 (file)
index 0000000..63c453c
--- /dev/null
+++ b/tests/detect-strip_whitespace-02/input.rules
@@ -0,0 +1 @@
+alert http any any -> any any (msg:"HTTP strip_whitespace 1"; flow:established; file_data; strip_whitespace; content:"embraceholistically"; sid:1;)

diff --git a/tests/detect-strip_whitespace-02/test.yaml b/tests/detect-strip_whitespace-02/test.yaml
new file mode 100644 (file)
index 0000000..808abea
--- /dev/null
+++ b/tests/detect-strip_whitespace-02/test.yaml
@@ -0,0 +1,12 @@
+requires:
+    min-version: 6
+
+args:
+ - -k none
+
+checks:
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 1