tests: add test for issue 7851

tests/bug-7851-01/README.md

@@ -0,0 +1,3 @@
+https://redmine.openinfosecfoundation.org/issues/7851
+
+PCAP generated based on the example traffic in the ticket.

tests/bug-7851-01/connect.fs

@@ -0,0 +1,3 @@
+flow default tcp 192.168.0.233:44123 > google.com:80 (tcp.initialize;);
+default > (content:"CONNECT / HTTP/1.1\x0d\x0aMp-Country: US\x0d\x0aMp-BuildVersion: 136\x0d\x0aMp-Roaming: 0\x0d\x0aMp-VersionRelease: 4.3\x0d\x0aMp-Operator: android\x0d\x0aMp-SdkId: 18\x0d\x0aMp-NetworkType: 3\x0d\x0a\x0d\x0a";);
+default < (content:"HTTP/1.1 200 OK\x0d\x0a\x0d\x0a";);

tests/bug-7851-01/test.rules

@@ -0,0 +1,6 @@
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"Suspicious short host value - pcre and bsize"; flow:established,to_server; http.host; bsize:<3; pcre:"/^.{1,2}$/"; classtype:bad-unknown; sid:1; rev:1;)
+
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"Suspicious short host value - bsize"; flow:established,to_server; http.host; bsize:<3; classtype:bad-unknown; sid:2; rev:1;)
+
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"Suspicious short host value - pcre"; flow:established,to_server; http.host; pcre:"/^.{1,2}$/"; classtype:bad-unknown; sid:3; rev:1;)
+

tests/bug-7851-01/test.yaml

@@ -0,0 +1,11 @@
+checks:
+  - filter:
+      count: 0
+      match:
+        event_type: alert
+  - filter:
+      count: 1
+      match:
+        event_type: http
+        http.http_method: CONNECT
+        http.url: /