detect-http-protocol: test inspect/mpm v2 apis

diff --git a/tests/http-protocol-inspect-v2/README.md b/tests/http-protocol-inspect-v2/README.md
new file mode 100644 (file)
index 0000000..ecec6eb
--- /dev/null
+++ b/tests/http-protocol-inspect-v2/README.md
@@ -0,0 +1 @@
+Test that http-protocol keyword works with the new inspect/mpm engines.

diff --git a/tests/http-protocol-inspect-v2/http.pcap b/tests/http-protocol-inspect-v2/http.pcap
new file mode 100644 (file)
index 0000000..54f6f29
Binary files /dev/null and b/tests/http-protocol-inspect-v2/http.pcap differ

diff --git a/tests/http-protocol-inspect-v2/test.rules b/tests/http-protocol-inspect-v2/test.rules
new file mode 100644 (file)
index 0000000..78ae462
--- /dev/null
+++ b/tests/http-protocol-inspect-v2/test.rules
@@ -0,0 +1,4 @@
+alert http any any -> any any (flow:to_client; http_protocol; content:"HTTP/1.1"; sid:1;)
+alert http any any -> any any (flow:to_server; http_protocol; content:"HTTP/1.1"; sid:2;)
+alert http any any -> any any (flow:to_client; http.protocol; content:"HTTP/1.1"; sid:3;)
+alert http any any -> any any (flow:to_server; http.protocol; content:"HTTP/1.1"; sid:4;)

diff --git a/tests/http-protocol-inspect-v2/test.yaml b/tests/http-protocol-inspect-v2/test.yaml
new file mode 100644 (file)
index 0000000..10fb03b
--- /dev/null
+++ b/tests/http-protocol-inspect-v2/test.yaml
@@ -0,0 +1,35 @@
+requires:
+  features:
+    - HAVE_LIBJANSSON
+  min-version: 5.0.0
+
+args:
+  - -k none
+
+pcap: http.pcap
+
+checks:
+  - filter:
+      count: 4
+      match:
+        event_type: alert
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 1
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 2
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 3
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 4