diff --git a/tests/rules/app-layer-protocol/test.rules b/tests/rules/app-layer-protocol/test.rules new file mode 100644 index 000000000..d97f65c90 --- /dev/null +++ b/tests/rules/app-layer-protocol/test.rules @@ -0,0 +1,2 @@ +drop tcp any any -> any any (flow:established; app-layer-protocol:!tls; sid:1;) +drop tcp any any -> any any (flow:established; app-layer-protocol:!tls; prefilter; sid:2;) diff --git a/tests/rules/app-layer-protocol/test.yaml b/tests/rules/app-layer-protocol/test.yaml new file mode 100644 index 000000000..cb336126b --- /dev/null +++ b/tests/rules/app-layer-protocol/test.yaml @@ -0,0 +1,18 @@ +requires: + min-version: 7.0 + pcap: false + +args: + - --engine-analysis + +checks: +- filter: + filename: rules.json + count: 1 + match: + id: 1 +- filter: + filename: rules.json + count: 1 + match: + id: 2