Packetbeat: System tests for HTTP unmatched requests

Added tests for the HTTP unmatched requests and responses.

- test_unmatched_response: Checks that a response received out of order
  inside a stream is reported as an Error.

- test_unmatched_request: Tests that a single stream containing only one
  request is reported after the stream times out. This tests can't be
  run with packetbeat's -t flag as it needs to wait 10s for the stream to
  expire. This timeout is currently not configurable.

packetbeat/tests/system/config/packetbeat.yml.j2

@@ -81,6 +81,7 @@ packetbeat.protocols:
   ]
 {%- endif %}
 {%- if http_max_message_size %}  max_message_size: {{ http_max_message_size }} {%- endif %}
+{%- if http_transaction_timeout %}  transaction_timeout: {{ http_transaction_timeout }} {%- endif %}
 
 - type: memcache
   ports: [{{ memcache_ports|default([11211])|join(", ") }}]

packetbeat/tests/system/packetbeat.py

@@ -29,7 +29,8 @@ def run_packetbeat(self, pcap,
                        output="packetbeat.log",
                        extra_args=[],
                        debug_selectors=[],
-                       exit_code=0):
+                       exit_code=0,
+                       real_time=False):
         """
         Executes packetbeat on an input pcap file.
         Waits for the process to finish before returning to
@@ -41,11 +42,13 @@ def run_packetbeat(self, pcap,
 
         args = [cmd]
 
+        if not real_time:
+            args.extend(["-t"])
+
         args.extend([
             "-e",
             "-I", os.path.join(self.beat_path + "/tests/system/pcaps", pcap),
             "-c", os.path.join(self.working_dir, config),
-            "-t",
             "-systemTest",
             "-test.coverprofile", os.path.join(self.working_dir, "coverage.cov"),
         ])

packetbeat/tests/system/test_0065_unmatched_http.py

@@ -0,0 +1,60 @@
+from packetbeat import BaseTest
+
+
+def check_event(event, expected):
+    for key in expected:
+        assert key in event, "key '{0}' not found in event".format(key)
+        assert event[key] == expected[key],\
+            "key '{0}' has value '{1}', expected '{2}'".format(key,
+                                                               event[key],
+                                                               expected[key])
+
+
+class Test(BaseTest):
+
+    def test_unmatched_response(self):
+        """
+        Unmatched response in stream
+        """
+
+        self.render_config_template(
+            http_ports=[8080],
+        )
+        self.run_packetbeat(pcap="http_unmatched.pcap",
+                            debug_selectors=["http", "httpdetailed"])
+        objs = self.read_output()
+
+        assert len(objs) == 2
+
+        check_event(objs[0], {
+            "type": "http",
+            "status": "Error",
+            "http.response.code": 404,
+            "notes": ["Unmatched response"]})
+
+        check_event(objs[1], {
+            "type": "http",
+            "http.response.code": 200,
+            "http.request.headers": {"content-length": 0},
+            "status": "OK"})
+
+    def test_unmatched_request(self):
+        """
+        Unmatched request due to timeout (15s)
+        """
+
+        self.render_config_template(
+            http_ports=[8080],
+            http_transaction_timeout="1s",
+        )
+        self.run_packetbeat(pcap="http_unmatched_timeout.pcap",
+                            debug_selectors=["http", "httpdetailed"],
+                            real_time=True)
+        objs = self.read_output()
+        print objs
+        assert len(objs) == 1
+        check_event(objs[0], {
+            "type": "http",
+            "status": "Error",
+            "query": "GET /something",
+            "notes": ["Unmatched request"]})