tests: add midstream protocol detection test

In midstream protocol detection, the protocol must be detected
if the server message is split

diff --git a/tests/mqtt-midstream-split/README.md b/tests/mqtt-midstream-split/README.md
new file mode 100644 (file)
index 0000000..cf5b973
--- /dev/null
+++ b/tests/mqtt-midstream-split/README.md
@@ -0,0 +1,9 @@
+# Description
+
+Test protocol detection when flow starts from midstream from 'to client' direction
+
+# PCAP
+
+The pcap is a mqtt communication with missing client request.
+It starts from the server response and the first message is split between 2 TCP segments.
+So probing parser returns 'incomplete' after the first one.

diff --git a/tests/mqtt-midstream-split/mqtt-midstream-split.pcap b/tests/mqtt-midstream-split/mqtt-midstream-split.pcap
new file mode 100644 (file)
index 0000000..c10b559
Binary files /dev/null and b/tests/mqtt-midstream-split/mqtt-midstream-split.pcap differ

diff --git a/tests/mqtt-midstream-split/test.yaml b/tests/mqtt-midstream-split/test.yaml
new file mode 100644 (file)
index 0000000..562b4f4
--- /dev/null
+++ b/tests/mqtt-midstream-split/test.yaml
@@ -0,0 +1,42 @@
+requires:
+  features:
+    - HAVE_LIBJANSSON
+  min-version: 6.0.0
+
+# disables checksum verification, and uses midstream
+args:
+- -k none --set stream.midstream=true --set app-layer.protocols.mqtt.enabled=yes
+
+checks:
+  - filter:
+      count: 1
+      match:
+        event_type: flow
+        app_proto: mqtt
+
+  - filter:
+      count: 1
+      match:
+        event_type: mqtt
+        mqtt.connack.qos: 0
+        mqtt.connack.retain: false
+        mqtt.connack.dup: false
+        mqtt.connack.session_present: false
+        mqtt.connack.return_code: 0
+
+  - filter:
+      count: 1
+      match:
+        event_type: mqtt
+        mqtt.publish.qos: 0
+        mqtt.publish.retain: false
+        mqtt.publish.dup: false
+        mqtt.publish.topic: topicX
+
+  - filter:
+      count: 1
+      match:
+        event_type: mqtt
+        mqtt.disconnect.qos: 0
+        mqtt.disconnect.retain: false
+        mqtt.disconnect.dup: false