From: Juliana Fajardini <jufajardini@gmail.com>
Date: Mon, 20 Jan 2025 20:33:45 +0000 (-0300)
Subject: tests: engine-analysis app_layer rule type tests
X-Git-Tag: suricata-7.0.9~65
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=05b933bd73bda9b6f9895a24be49fc080d752e8f;p=thirdparty%2Fsuricata-verify.git

tests: engine-analysis app_layer rule type tests

Add tests for the app_layer rule type for the engine-analysis report to
accompany rule types documentation.

Related to
Task #7031
---

diff --git a/tests/rules/rule-type-app-layer/test.rules b/tests/rules/rule-type-app-layer/test.rules
new file mode 100644
index 000000000..5f767e52a
--- /dev/null
+++ b/tests/rules/rule-type-app-layer/test.rules
@@ -0,0 +1,5 @@
+# Application Layer Protocol Rules
+alert dns any any -> any any (msg:"app-layer, dns"; sid:404;)
+alert http any any -> any any (msg:"http, no content"; sid:601;)
+pass tls any any -> any any (msg:"tls, pkt or app-layer? pass"; sid:605;)
+alert tls any any -> any any (msg:"tls, pkt or app-layer?"; flowint:tls_error_int,=,0; sid:613;)
diff --git a/tests/rules/rule-type-app-layer/test.yaml b/tests/rules/rule-type-app-layer/test.yaml
new file mode 100644
index 000000000..8e3a62e05
--- /dev/null
+++ b/tests/rules/rule-type-app-layer/test.yaml
@@ -0,0 +1,25 @@
+requires:
+  min-version: 7
+  pcap: false
+args:
+- --engine-analysis
+checks:
+  - filter:
+      filename: rules.json
+      count: 1
+      match:
+        id: 404
+        type: "app_layer"
+  - filter:
+      filename: rules.json
+      count: 1
+      match:
+        raw: "alert http any any -> any any (msg:\"http, no content\"; sid:601;)"
+        id: 601
+        type: "app_layer"
+  - filter:
+      filename: rules.json
+      count: 1
+      match:
+        id: 613
+        type: "app_layer"