From: Victor Julien Date: Sun, 17 Jan 2021 18:45:56 +0000 (+0100) Subject: tests: add http.start test X-Git-Tag: suricata-6.0.4~197 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=9b25f4cb69b2ad8ff0d9eca43d0e5d63ab406f3e;p=thirdparty%2Fsuricata-verify.git tests: add http.start test --- diff --git a/tests/http-sticky-start/input.pcap b/tests/http-sticky-start/input.pcap new file mode 100644 index 000000000..05246db5c Binary files /dev/null and b/tests/http-sticky-start/input.pcap differ diff --git a/tests/http-sticky-start/test.rules b/tests/http-sticky-start/test.rules new file mode 100644 index 000000000..accf51b7f --- /dev/null +++ b/tests/http-sticky-start/test.rules @@ -0,0 +1 @@ +alert http any any -> any any (flow:to_server; http.start; content:"GET"; depth:3; content:"Host:"; distance:0; sid:1;) diff --git a/tests/http-sticky-start/test.yaml b/tests/http-sticky-start/test.yaml new file mode 100644 index 000000000..bc454bbcc --- /dev/null +++ b/tests/http-sticky-start/test.yaml @@ -0,0 +1,11 @@ +requires: + features: + - HAVE_LIBJANSSON + min-version: 5.0.0 + +checks: + - filter: + count: 3 + match: + event_type: alert + alert.signature_id: 1