From: Shivani Bhardwaj <shivanib134@gmail.com>
Date: Fri, 19 Feb 2021 07:47:02 +0000 (+0530)
Subject: http/connect: remove app proto from filter
X-Git-Tag: suricata-6.0.4~147
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=refs%2Fpull%2F445%2Fhead;p=thirdparty%2Fsuricata-verify.git

http/connect: remove app proto from filter

There is no DCERPC packet in the pcap. With the addition of probe
function in DCERPC, app_proto check for dcerpc causes the test to fail.
It is incorrect, remove it.
---

diff --git a/tests/http-connect/http-connect-fail/test.yaml b/tests/http-connect/http-connect-fail/test.yaml
index 6ece99ebd..f6fd050ca 100644
--- a/tests/http-connect/http-connect-fail/test.yaml
+++ b/tests/http-connect/http-connect-fail/test.yaml
@@ -21,7 +21,6 @@ checks:
       count: 1
       match:
         event_type: flow
-        app_proto: dcerpc
         app_proto_orig: http
   - filter:
       count: 0