From d2031f53eaaa039f2794ecb1d78887cd73b3a155 Mon Sep 17 00:00:00 2001
From: Philippe Antoine <pantoine@oisf.net>
Date: Mon, 29 Jan 2024 15:24:47 +0100
Subject: [PATCH] drop: adds test with a protocol change

Ticket: 6305
---
 tests/drop-protocol-change/README.md  |  11 +++++++++++
 tests/drop-protocol-change/input.pcap | Bin 0 -> 1223 bytes
 tests/drop-protocol-change/test.rules |   1 +
 tests/drop-protocol-change/test.yaml  |  19 +++++++++++++++++++
 4 files changed, 31 insertions(+)
 create mode 100644 tests/drop-protocol-change/README.md
 create mode 100644 tests/drop-protocol-change/input.pcap
 create mode 100644 tests/drop-protocol-change/test.rules
 create mode 100644 tests/drop-protocol-change/test.yaml

diff --git a/tests/drop-protocol-change/README.md b/tests/drop-protocol-change/README.md
new file mode 100644
index 000000000..ab06a10b4
--- /dev/null
+++ b/tests/drop-protocol-change/README.md
@@ -0,0 +1,11 @@
+# Test Description
+
+Test that we drop even on protocol change
+
+## PCAP
+
+Crafted from oss-fuzz reproducer
+
+## Related issues
+
+https://redmine.openinfosecfoundation.org/issues/6305
diff --git a/tests/drop-protocol-change/input.pcap b/tests/drop-protocol-change/input.pcap
new file mode 100644
index 0000000000000000000000000000000000000000..7a8a8141534d0d234e15a7ffb679ee104a4b6c5b
GIT binary patch
literal 1223
zc-p&ic+)~A1{MYcU}0bck_Yn&qE)7GF?<2CLAa~dVP25*q%zBW2OBvUTp1Xi^%OXy
zq?V*6m*^$tq!yL5J=(?)usF-GXNjShW`hL7Qz0G(21Z5>E|;hAIal_4ly-LwQP3~S
zPs%ST)+?zfQSb-}3D7sxGvwv+$S*FjQpiisC@Cp0(#tPO=j945PA$@POi#@NN+g#S
z<>;I1nHlOC@NzjOC#Mzw1-10Gc)6VO^YVZW$jr~PQV1<bFG@^F)d8Dpq#K-CQj(dM
zUJNt}B4MSFVU!HC3q{sS!O_vz(b3T<+tD$|5du8HBrg{)*CAjSe6D6;SOWAv2t#}i
z2?<~rC@@UBz1D%jlr18$dr@^87bgP~L%^eLApbAUGO`1P!D}67NElq%^C=7z4lq9}
z7#bKV1ea%)BxeAfp%74%Uy`4kpHqz0OXyzU<ziqEg2os#5T^j6OaMp&qfLPU<mS>^
z7KSLGKoquk^XVyaU~piY%LZ~U$lZ{5GqMA^yBid5f<>@+OFRm4cR-M*f)*sUj6gBK
z%N6Vk3!Q^Nn__{s#A36_zo!^%6BC+EVQ`yDQEdWwO9-6$fIt@LEe8;T2}FP_dknP9
z8_4!Xvdjc#nQc!A*fL=>%L?I^C8Jx$z`_VK`UlYHFdz?v(PNp><MujGEQhZ{i{)-u
zEc<rDV>tp8%M1)h7(wyF*pWExZf?96i<fiGDGtU;huwt}VluRnF7A(S_pDjk^+Ix0
z&b0fPbyJv6WymjOVc4@Ea>s3R7FENH`~1S)|Dt6U$`o;?dH?wz)Y5;+tDm2j$;`;1
z|I?Oa^`NUtm!}ko9bMy9-^TQSVNT}$vbI&3muCI>U(+r$)z>OGe!fHZr!Cv~CatNu
zlzgSX^DbYH)V3!_C;L0}eA+%mG3$+$m&=T=^<Dh8rp$9XD9f%M?=a!hM*bl0pfLYc
zr#8O!><_YUUGZYYrPB-ycHk&s1ZT-aNS4&%a>*=C%*n|ww^HEZ3eGG^%}p$@Qqb2&
r%EbD`5MjNF+#CgPYWWWgWq+Vi{@7BBV^1kK0{PG)unH8?1Wg722oH-?

literal 0
Hc-jL100001

diff --git a/tests/drop-protocol-change/test.rules b/tests/drop-protocol-change/test.rules
new file mode 100644
index 000000000..4401a9512
--- /dev/null
+++ b/tests/drop-protocol-change/test.rules
@@ -0,0 +1 @@
+drop http any any -> any any (msg:"drop http"; sid:1; rev:1;)
diff --git a/tests/drop-protocol-change/test.yaml b/tests/drop-protocol-change/test.yaml
new file mode 100644
index 000000000..5d44c49c1
--- /dev/null
+++ b/tests/drop-protocol-change/test.yaml
@@ -0,0 +1,19 @@
+requires:
+  min-version: 8
+
+args:
+  - -k none --set stream.midstream=true
+
+checks:
+  - filter:
+      count: 1
+      match:
+        event_type: flow
+        app_proto: http2
+        app_proto_orig: http
+        flow.action: drop
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 1
-- 
2.47.2