From: Ilya Bakhtin <ilya.bakhtin@gmail.com>
Date: Mon, 15 Feb 2021 18:04:39 +0000 (+0100)
Subject: tests: add midstream protocol detection test
X-Git-Tag: suricata-6.0.4~145
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=dbd50978f9b0edfca3698e649b51ae901cc18e41;p=thirdparty%2Fsuricata-verify.git

tests: add midstream protocol detection test

In midstream protocol detection, the protocol must be detected
if the server message is split
---

diff --git a/tests/mqtt-midstream-split/README.md b/tests/mqtt-midstream-split/README.md
new file mode 100644
index 000000000..cf5b973a8
--- /dev/null
+++ b/tests/mqtt-midstream-split/README.md
@@ -0,0 +1,9 @@
+# Description
+
+Test protocol detection when flow starts from midstream from 'to client' direction
+
+# PCAP
+
+The pcap is a mqtt communication with missing client request.
+It starts from the server response and the first message is split between 2 TCP segments.
+So probing parser returns 'incomplete' after the first one.
diff --git a/tests/mqtt-midstream-split/mqtt-midstream-split.pcap b/tests/mqtt-midstream-split/mqtt-midstream-split.pcap
new file mode 100644
index 000000000..c10b559bc
Binary files /dev/null and b/tests/mqtt-midstream-split/mqtt-midstream-split.pcap differ
diff --git a/tests/mqtt-midstream-split/test.yaml b/tests/mqtt-midstream-split/test.yaml
new file mode 100644
index 000000000..562b4f4a8
--- /dev/null
+++ b/tests/mqtt-midstream-split/test.yaml
@@ -0,0 +1,42 @@
+requires:
+  features:
+    - HAVE_LIBJANSSON
+  min-version: 6.0.0
+
+# disables checksum verification, and uses midstream
+args:
+- -k none --set stream.midstream=true --set app-layer.protocols.mqtt.enabled=yes
+
+checks:
+  - filter:
+      count: 1
+      match:
+        event_type: flow
+        app_proto: mqtt
+
+  - filter:
+      count: 1
+      match:
+        event_type: mqtt
+        mqtt.connack.qos: 0
+        mqtt.connack.retain: false
+        mqtt.connack.dup: false
+        mqtt.connack.session_present: false
+        mqtt.connack.return_code: 0
+
+  - filter:
+      count: 1
+      match:
+        event_type: mqtt
+        mqtt.publish.qos: 0
+        mqtt.publish.retain: false
+        mqtt.publish.dup: false
+        mqtt.publish.topic: topicX
+
+  - filter:
+      count: 1
+      match:
+        event_type: mqtt
+        mqtt.disconnect.qos: 0
+        mqtt.disconnect.retain: false
+        mqtt.disconnect.dup: false