tests: http body keywords parsing tests

Esp for testing with pcre.

Ticket: #7573.

diff --git a/tests/rules/http-request-body/test.rules b/tests/rules/http-request-body/test.rules
new file mode 100644 (file)
index 0000000..87eb5f1
--- /dev/null
+++ b/tests/rules/http-request-body/test.rules
@@ -0,0 +1,3 @@
+alert http any any -> any any (http.request_body; content:"one"; sid:1;)
+alert http any any -> any any (http.request_body; pcre:"/one/R"; sid:2;)
+alert http any any -> any any (http.request_body; content:"one"; pcre:"/one/R"; sid:3;)

diff --git a/tests/rules/http-request-body/test.yaml b/tests/rules/http-request-body/test.yaml
new file mode 100644 (file)
index 0000000..f4b2c7c
--- /dev/null
+++ b/tests/rules/http-request-body/test.yaml
@@ -0,0 +1,59 @@
+requires:
+    min-version: 7
+    pcap: false
+
+args:
+    - --engine-analysis
+
+checks:
+- filter:
+    filename: rules.json
+    count: 1
+    match:
+      id: 1
+      mpm.buffer: "http_client_body"
+      mpm.pattern: "one"
+      # checks that all engines are toclient
+      engines[0].name: "http_client_body"
+      engines[0].direction: "toserver"
+      engines[0].app_proto: "http2"
+      engines[0].matches[0].name: "content"
+      engines[1].name: "http_client_body"
+      engines[1].direction: "toserver"
+      engines[1].app_proto: "http"
+      engines[1].matches[0].name: "content"
+      engines.__len: 2
+- filter:
+    filename: rules.json
+    count: 1
+    match:
+      id: 2
+      # checks that all engines are toserver
+      engines[0].name: "http_client_body"
+      engines[0].direction: "toserver"
+      engines[0].app_proto: "http"
+      engines[0].matches[0].name: "pcre"
+      engines[1].name: "http_client_body"
+      engines[1].direction: "toserver"
+      engines[1].app_proto: "http2"
+      engines[1].matches[0].name: "pcre"
+      engines.__len: 2
+- filter:
+    filename: rules.json
+    count: 1
+    match:
+      id: 3
+      mpm.buffer: "http_client_body"
+      mpm.pattern: "one"
+      # checks that all engines are toserver
+      engines[0].name: "http_client_body"
+      engines[0].direction: "toserver"
+      engines[0].app_proto: "http2"
+      engines[0].matches[0].name: "content"
+      engines[0].matches[1].name: "pcre"
+      engines[1].name: "http_client_body"
+      engines[1].direction: "toserver"
+      engines[1].app_proto: "http"
+      engines[1].matches[0].name: "content"
+      engines[1].matches[1].name: "pcre"
+      engines.__len: 2

diff --git a/tests/rules/http-response-body/test.rules b/tests/rules/http-response-body/test.rules
index 16e963bb5a645840a56b7b7f8f169d82cf76783c..5a4c2da5ff26f91a703f159d380a9cf83d165419 100644 (file)
--- a/tests/rules/http-response-body/test.rules
+++ b/tests/rules/http-response-body/test.rules
@@ -1 +1,3 @@
 alert http any any -> any any (http.response_body; content:"one"; sid:1;)
+alert http any any -> any any (http.response_body; pcre:"/one/R"; sid:2;)
+alert http any any -> any any (http.response_body; content:"one"; pcre:"/one/R"; sid:3;)

diff --git a/tests/rules/http-response-body/test.yaml b/tests/rules/http-response-body/test.yaml
index f373c820fa9a5ca1d3d2cf4e3ed1abba66d9f51d..9996ebad8e4785e56ecf04b6ab146b25b0db7397 100644 (file)
--- a/tests/rules/http-response-body/test.yaml
+++ b/tests/rules/http-response-body/test.yaml
@@ -17,7 +17,43 @@ checks:
       engines[0].name: "file_data"
       engines[0].direction: "toclient"
       engines[0].app_proto: "http2"
+      engines[0].matches[0].name: "content"
       engines[1].name: "file_data"
       engines[1].direction: "toclient"
       engines[1].app_proto: "http"
+      engines[1].matches[0].name: "content"
+      engines.__len: 2
+- filter:
+    filename: rules.json
+    count: 1
+    match:
+      id: 2
+      # checks that all engines are toclient
+      engines[0].name: "file_data"
+      engines[0].direction: "toclient"
+      engines[0].app_proto: "http"
+      engines[0].matches[0].name: "pcre"
+      engines[1].name: "file_data"
+      engines[1].direction: "toclient"
+      engines[1].app_proto: "http2"
+      engines[1].matches[0].name: "pcre"
+      engines.__len: 2
+- filter:
+    filename: rules.json
+    count: 1
+    match:
+      id: 3
+      mpm.buffer: "file_data"
+      mpm.pattern: "one"
+      # checks that all engines are toclient
+      engines[0].name: "file_data"
+      engines[0].direction: "toclient"
+      engines[0].app_proto: "http2"
+      engines[0].matches[0].name: "content"
+      engines[0].matches[1].name: "pcre"
+      engines[1].name: "file_data"
+      engines[1].direction: "toclient"
+      engines[1].app_proto: "http"
+      engines[1].matches[0].name: "content"
+      engines[1].matches[1].name: "pcre"
       engines.__len: 2