From: Victor Julien Date: Tue, 11 Jun 2019 17:23:47 +0000 (+0200) Subject: tests: add testmyids variant with midstream X-Git-Tag: suricata-6.0.4~392 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=8822ffc62ff06e9743927a3cb559af638daa26fe;p=thirdparty%2Fsuricata-verify.git tests: add testmyids variant with midstream --- diff --git a/tests/alert-testmyids-midstream/input.pcap b/tests/alert-testmyids-midstream/input.pcap new file mode 100644 index 000000000..1f9abcf60 Binary files /dev/null and b/tests/alert-testmyids-midstream/input.pcap differ diff --git a/tests/alert-testmyids-midstream/test.rules b/tests/alert-testmyids-midstream/test.rules new file mode 100644 index 000000000..9f1307bdb --- /dev/null +++ b/tests/alert-testmyids-midstream/test.rules @@ -0,0 +1 @@ +alert ip any any -> any any (msg:"GPL ATTACK_RESPONSE id check returned root"; content:"uid=0|28|root|29|"; classtype:bad-unknown; sid:2100498; rev:7;) diff --git a/tests/alert-testmyids-midstream/test.yaml b/tests/alert-testmyids-midstream/test.yaml new file mode 100644 index 000000000..1a7d67a2a --- /dev/null +++ b/tests/alert-testmyids-midstream/test.yaml @@ -0,0 +1,21 @@ +requires: + features: + - HAVE_LIBJANSSON + min-version: 5.0.0 +args: +- --set stream.midstream=true + +checks: + + # Check that we only have one alert event type in eve. + - filter: + count: 1 + match: + event_type: alert + src_port: 80 + + - filter: + count: 1 + match: + event_type: http + dest_port: 80