diff --git a/tests/detect-uint-enum/README.md b/tests/detect-uint-enum/README.md new file mode 100644 index 000000000..0572f3524 --- /dev/null +++ b/tests/detect-uint-enum/README.md @@ -0,0 +1,7 @@ +Test for checking the working of function detect_parse_uint_enum +when passing negated strings. + + +PCAP from ../websocket-ping/input.pcap + +redmine ticket: https://redmine.openinfosecfoundation.org/issues/7513 \ No newline at end of file diff --git a/tests/detect-uint-enum/test.rules b/tests/detect-uint-enum/test.rules new file mode 100644 index 000000000..006d6f3da --- /dev/null +++ b/tests/detect-uint-enum/test.rules @@ -0,0 +1,2 @@ +alert websocket any any -> any any (msg:"There is no pong opcode in this packet"; websocket.opcode:!pong; sid:1;) +alert websocket any any -> any any (msg:"There is no ping opcode in this packet"; websocket.opcode:!ping; sid:2;) \ No newline at end of file diff --git a/tests/detect-uint-enum/test.yaml b/tests/detect-uint-enum/test.yaml new file mode 100644 index 000000000..c3e8d1aeb --- /dev/null +++ b/tests/detect-uint-enum/test.yaml @@ -0,0 +1,19 @@ +requires: + min-version: 8 + +pcap: ../websocket-ping/input.pcap + +args: + - -k none --set stream.inline=true + +checks: +- filter: + count: 1 + match: + event_type: alert + pcap_cnt: 8 +- filter: + count: 1 + match: + event_type: alert + pcap_cnt: 11 \ No newline at end of file