tests: add bug 2511 test

diff --git a/tests/bug-2511/1.rules b/tests/bug-2511/1.rules
new file mode 100644 (file)
index 0000000..7f308c0
--- /dev/null
+++ b/tests/bug-2511/1.rules
@@ -0,0 +1 @@
+alert http any any -> any any (msg:"SURICATA HTTP too many layers"; flow:to_server,established; app-layer-event:http.too_many_encoding_layers; flowint:http.anomaly.count,+,1; sid:1; rev:1;)

diff --git a/tests/bug-2511/response_identity_identity_gzip_identity_gzip_gzip.pcap b/tests/bug-2511/response_identity_identity_gzip_identity_gzip_gzip.pcap
new file mode 100644 (file)
index 0000000..0a25f62
Binary files /dev/null and b/tests/bug-2511/response_identity_identity_gzip_identity_gzip_gzip.pcap differ

diff --git a/tests/bug-2511/test.yaml b/tests/bug-2511/test.yaml
new file mode 100644 (file)
index 0000000..cc25071
--- /dev/null
+++ b/tests/bug-2511/test.yaml
@@ -0,0 +1,16 @@
+requires:
+  features:
+    - HAVE_LIBJANSSON
+
+checks:
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 1
+
+