detect: add tests for file.data

tests/file-match-crossed/README.md

@@ -0,0 +1,7 @@
+# Description
+
+Test `file.data` with HTTP1 multipart small files
+
+Cf https://redmine.openinfosecfoundation.org/issues/7577
+
+Pcap crafted

tests/file-match-crossed/test.rules

@@ -0,0 +1,13 @@
+# matching ones
+alert http any any -> any any (msg:"test"; file.data; content:"bateau"; file.name; content:"titi.txt"; sid:1;)
+alert http any any -> any any (msg:"test"; file.data; content:"bateau"; file.name; content:"toto.txt"; sid:2;)
+alert http any any -> any any (msg:"test"; file.data; content:"Titi"; sid:3;)
+alert http any any -> any any (msg:"test"; file.data; content:"minet"; sid:4;)
+alert http any any -> any any (msg:"test"; file.data; content:"Titi"; file.data; content:"minet"; sid:5;)
+alert http any any -> any any (msg:"test"; file.data; content:"minet"; fast_pattern; sid:6;)
+
+# matching as different file.data have each content
+alert http any any -> any any (msg:"test"; file.data; content:"bateau"; file.data; content:"minet"; sid:7;)
+# not matching as not the same file.data has both contents
+alert http any any -> any any (msg:"test"; file.data; content:"bateau"; content:"minet"; sid:8;)
+

tests/file-match-crossed/test.yaml

@@ -0,0 +1,47 @@
+requires:
+  min-version: 8
+
+args:
+  - -k none
+
+checks:
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 1
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 2
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 3
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 4
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 5
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 6
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 7
+  - filter:
+      count: 0
+      match:
+        event_type: alert
+        alert.signature_id: 8

tests/file-match-crossed/titi.txt

@@ -0,0 +1 @@
+Titi a vu un gros minet.

tests/file-match-crossed/toto.txt

@@ -0,0 +1 @@
+toto est dans un bateau