tests/datasets: test for dataset write disabled

Test the configuration flag to disable dataset writes from rules.

Ticket: #6123

diff --git a/tests/datasets/datasets-deny-save/README.md b/tests/datasets/datasets-deny-save/README.md
new file mode 100644 (file)
index 0000000..154f6e3
--- /dev/null
+++ b/tests/datasets/datasets-deny-save/README.md
@@ -0,0 +1,2 @@
+Test that a dataset rule trying to use an absolute path results in an
+initialization error.

diff --git a/tests/datasets/datasets-deny-save/one-packet.pcap b/tests/datasets/datasets-deny-save/one-packet.pcap
new file mode 100644 (file)
index 0000000..00c2b34
Binary files /dev/null and b/tests/datasets/datasets-deny-save/one-packet.pcap differ

diff --git a/tests/datasets/datasets-deny-save/suricata.yaml b/tests/datasets/datasets-deny-save/suricata.yaml
new file mode 100644 (file)
index 0000000..e3360a1
--- /dev/null
+++ b/tests/datasets/datasets-deny-save/suricata.yaml
@@ -0,0 +1,13 @@
+%YAML 1.1
+---
+
+logging:
+  outputs:
+    - file:
+        enabled: yes
+        filename: eve.json
+        type: json
+
+datasets:
+  rules:
+    allow-write: false

diff --git a/tests/datasets/datasets-deny-save/test.rules b/tests/datasets/datasets-deny-save/test.rules
new file mode 100644 (file)
index 0000000..14d1a3b
--- /dev/null
+++ b/tests/datasets/datasets-deny-save/test.rules
@@ -0,0 +1 @@
+alert dns any any -> any any (dns.query; dataset: isnotset, dns-seen, type string, state dns-seen.txt; sid:1; rev:1;)

diff --git a/tests/datasets/datasets-deny-save/test.yaml b/tests/datasets/datasets-deny-save/test.yaml
new file mode 100644 (file)
index 0000000..0bb9b1c
--- /dev/null
+++ b/tests/datasets/datasets-deny-save/test.yaml
@@ -0,0 +1,7 @@
+exit-code: 1
+
+checks:
+  - filter:
+      count: 1
+      match:
+        engine.message: "Rules containing save/state datasets have been disabled"