tests: add test for issue 4394

diff --git a/tests/bug-4394-pdonly-drop/input.pcap b/tests/bug-4394-pdonly-drop/input.pcap
new file mode 100644 (file)
index 0000000..8fb6832
Binary files /dev/null and b/tests/bug-4394-pdonly-drop/input.pcap differ

diff --git a/tests/bug-4394-pdonly-drop/suricata.yaml b/tests/bug-4394-pdonly-drop/suricata.yaml
new file mode 100644 (file)
index 0000000..973db9b
--- /dev/null
+++ b/tests/bug-4394-pdonly-drop/suricata.yaml
@@ -0,0 +1,21 @@
+%YAML 1.1
+---
+
+action-order:
+  - drop
+  - reject
+  - alert
+  - pass
+
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
+      filename: eve.json
+      types:
+        - alert
+        - drop:
+            flows: all
+            alerts: true
+        - http
+        - anomaly

diff --git a/tests/bug-4394-pdonly-drop/test.rules b/tests/bug-4394-pdonly-drop/test.rules
new file mode 100644 (file)
index 0000000..f0efa91
--- /dev/null
+++ b/tests/bug-4394-pdonly-drop/test.rules
@@ -0,0 +1,3 @@
+drop tcp any any -> any 80 (app-layer-protocol:!tls; sid:1; rev:1;)
+reject tcp any any -> any 80 (app-layer-protocol:!dns; sid:2; rev:1;)
+pass tcp any any -> any 80 (app-layer-protocol:!ssh; sid:3; rev:1;)

diff --git a/tests/bug-4394-pdonly-drop/test.yaml b/tests/bug-4394-pdonly-drop/test.yaml
new file mode 100644 (file)
index 0000000..bdf2dde
--- /dev/null
+++ b/tests/bug-4394-pdonly-drop/test.yaml
@@ -0,0 +1,66 @@
+requires:
+  features:
+    - HAVE_LIBJANSSON
+    - LIBNET1.1
+
+args:
+- --simulate-ips
+
+checks:
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.action: blocked
+        alert.signature_id: 1
+        pcap_cnt: 4
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.action: blocked
+        alert.signature_id: 2
+        pcap_cnt: 4
+  - filter:
+      count: 0
+      match:
+        event_type: alert
+        alert.signature_id: 3
+
+  - filter:
+      count: 1
+      match:
+        event_type: drop
+        alert.action: blocked
+        alert.signature_id: 1
+        pcap_cnt: 4
+  - filter:
+      count: 1
+      match:
+        event_type: drop
+        pcap_cnt: 5
+  - filter:
+      count: 1
+      match:
+        event_type: drop
+        pcap_cnt: 6
+  - filter:
+      count: 1
+      match:
+        event_type: drop
+        pcap_cnt: 7
+  - filter:
+      count: 1
+      match:
+        event_type: drop
+        pcap_cnt: 8
+  - filter:
+      count: 1
+      match:
+        event_type: drop
+        pcap_cnt: 9
+  - filter:
+      count: 1
+      match:
+        event_type: drop
+        pcap_cnt: 10