tests: update ips-state-1 test

This test indicated that there were FP drops for HTTP transactions,
leading the `http` events check to fail. This is no longer the case.

flow.action is still not set to drop for tls.

diff --git a/tests/ips-state-1/README.md b/tests/ips-state-1/README.md
index 61eb27126f89e6e0307ef757d9654d6e252e6d83..98f11c237c2ce1806cfd7d617855f65eceaab5bd 100644 (file)
--- a/tests/ips-state-1/README.md
+++ b/tests/ips-state-1/README.md
@@ -5,9 +5,7 @@ be full passed with no alerts, while the TLS flow should be dropped.
 
 ## Current Observations
 
-- HTTP response packets are being logged as dropped, however the transaction is
-  logged suggesting the drop is only in logging only, but not actually
-  occurring.
+- HTTP flows are logged as `passed`, as expected.
 
-- All the TLS packets apear to be getting dropped, but `flow.action` is never
-  set to true.
+- All the TLS packets appear to be getting dropped, but `flow.action` is never
+  set to drop.

diff --git a/tests/ips-state-1/suricata.yaml b/tests/ips-state-1/suricata.yaml
new file mode 100644 (file)
index 0000000..1a78c89
--- /dev/null
+++ b/tests/ips-state-1/suricata.yaml
@@ -0,0 +1,21 @@
+%YAML 1.1
+---
+
+vars:
+  address-groups:
+    HOME_NET: "[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]"
+    EXTERNAL_NET: "!$HOME_NET"
+
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
+      filename: eve.json
+      types:
+        - alert
+        - drop:
+            flows: all
+            alerts: true
+        - http
+        - tls
+        - flow

diff --git a/tests/ips-state-1/test.yaml b/tests/ips-state-1/test.yaml
index 7dce2b00ecb9d2935aff757ac98e7ce5d738b7f4..f1b405f19f8849bc38421973399090fa8e0634de 100644 (file)
--- a/tests/ips-state-1/test.yaml
+++ b/tests/ips-state-1/test.yaml
@@ -8,8 +8,6 @@ checks:
 - filter:
     # We should see 2 http transactions as the pass rule should allow http
     # flows.
-    #
-    # This fails.
     count: 2
     match:
       event_type: http
@@ -28,12 +26,13 @@ checks:
       event_type: flow
       app_proto: http
       flow.alerted: false 
+      flow.action: pass
 
 - filter:
-    # We should see NO drops (or alerts) for http
+    # We should see NO drops for http
     count: 0
     match:
-      event_type: alert
+      event_type: drop
       app_proto: http
 
 - filter: