From: Victor Julien <victor@inliniac.net>
Date: Wed, 31 May 2023 14:14:34 +0000 (+0200)
Subject: tests: fix drop tests
X-Git-Tag: suricata-6.0.13~29
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=ecfd34a16b4c6ba87a4a2f715614bb94f4fde6ed;p=thirdparty%2Fsuricata-verify.git

tests: fix drop tests
---

diff --git a/tests/bug-5802/test.rules b/tests/bug-5802/test.rules
index ca13c4b2a..f5a1cf38f 100644
--- a/tests/bug-5802/test.rules
+++ b/tests/bug-5802/test.rules
@@ -1,2 +1,2 @@
 alert tcp any any -> any any (flow:to_server; sid:1;)
-drop udp any any -> any any (flow:to_server; sid:2;)
+drop udp 200.57.7.195 any -> any any (sid:2;)
diff --git a/tests/bug-5802/test.yaml b/tests/bug-5802/test.yaml
index 2e06568c2..47a95af7a 100644
--- a/tests/bug-5802/test.yaml
+++ b/tests/bug-5802/test.yaml
@@ -10,11 +10,16 @@ checks:
         event_type: alert
         alert.signature_id: 1
   - filter:
-      count: 4
+      count: 1
       match:
         event_type: alert
         alert.signature_id: 2
+        alert.action: blocked
   - filter:
-      count: 3
+      count: 1
       match:
         event_type: sip
+  - filter:
+      count: 10
+      match:
+        event_type: drop
diff --git a/tests/droped-flow-applayer-event-logged-dcerpc/test.yaml b/tests/droped-flow-applayer-event-logged-dcerpc/test.yaml
index f3622529e..a65ab9b13 100644
--- a/tests/droped-flow-applayer-event-logged-dcerpc/test.yaml
+++ b/tests/droped-flow-applayer-event-logged-dcerpc/test.yaml
@@ -5,7 +5,16 @@ args:
 
 checks:
   - filter:
-      count: 0
+      count: 1
+      match:
+        pcap_cnt: 2
+        event_type: alert
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+  - filter:
+      count: 1
       match:
         pcap_cnt: 2
         event_type: smb
diff --git a/tests/droped-flow-applayer-event-logged-smb/test.yaml b/tests/droped-flow-applayer-event-logged-smb/test.yaml
index 3cfc1fb67..53d197869 100644
--- a/tests/droped-flow-applayer-event-logged-smb/test.yaml
+++ b/tests/droped-flow-applayer-event-logged-smb/test.yaml
@@ -1,15 +1,23 @@
 args:
 - --simulate-ips
+- --set stream.midstream=true
 - --set stream.reassembly.depth=0
-- --set stream.midstream-policy=drop-flow
 - -k none
 
 checks:
   - filter:
       count: 1
       match:
-        event_type: smb
+        event_type: alert
+  - filter:
+      count: 1
+      match:
+        event_type: alert
         pcap_cnt: 2
+  - filter:
+      count: 1
+      match:
+        event_type: smb
   - filter:
       count: 53
       match: