ips-state: test flow pass for ip-only rule with negation

Ticket: #5361

diff --git a/tests/ips-state-1/README.md b/tests/ips-state-1/README.md
new file mode 100644 (file)
index 0000000..61eb271
--- /dev/null
+++ b/tests/ips-state-1/README.md
@@ -0,0 +1,13 @@
+## PCAP
+
+This PCAP contains 3 flows.  2 are http and one is TLS. The HTTP flows should
+be full passed with no alerts, while the TLS flow should be dropped.
+
+## Current Observations
+
+- HTTP response packets are being logged as dropped, however the transaction is
+  logged suggesting the drop is only in logging only, but not actually
+  occurring.
+
+- All the TLS packets apear to be getting dropped, but `flow.action` is never
+  set to true.

diff --git a/tests/ips-state-1/input.pcap b/tests/ips-state-1/input.pcap
new file mode 100644 (file)
index 0000000..90f3610
Binary files /dev/null and b/tests/ips-state-1/input.pcap differ

diff --git a/tests/ips-state-1/test.rules b/tests/ips-state-1/test.rules
new file mode 100644 (file)
index 0000000..1812fb1
--- /dev/null
+++ b/tests/ips-state-1/test.rules
@@ -0,0 +1,2 @@
+pass tcp $HOME_NET any -> $EXTERNAL_NET 80 (sid:1;)
+drop ip any any -> any any (msg:"DROP ALL"; flow:stateless; sid:2;)

diff --git a/tests/ips-state-1/test.yaml b/tests/ips-state-1/test.yaml
new file mode 100644 (file)
index 0000000..7dce2b0
--- /dev/null
+++ b/tests/ips-state-1/test.yaml
@@ -0,0 +1,45 @@
+requires:
+  min-version: 6
+
+args:
+- -k none --simulate-ips
+
+checks:
+- filter:
+    # We should see 2 http transactions as the pass rule should allow http
+    # flows.
+    #
+    # This fails.
+    count: 2
+    match:
+      event_type: http
+
+- filter:
+    # There should be no alerts for http.
+    count: 0
+    match:
+      event_type: alert
+      app_proto: http
+
+- filter:
+    # There should be 2 http flow events without alerts.
+    count: 2
+    match:
+      event_type: flow
+      app_proto: http
+      flow.alerted: false 
+
+- filter:
+    # We should see NO drops (or alerts) for http
+    count: 0
+    match:
+      event_type: alert
+      app_proto: http
+
+- filter:
+    # There should be one tls flow that is alerted
+    count: 1
+    match:
+      event_type: flow
+      dest_port: 443
+      flow.alerted: true