From 95fe5437387de54ed5395db2828e7191606a7fa4 Mon Sep 17 00:00:00 2001 From: Philippe Antoine Date: Tue, 8 Oct 2024 21:42:43 +0200 Subject: [PATCH] template: use the keyword for the tx buffer Ticket: 3195 --- tests/app-layer-template/suricata.yaml | 3 +++ tests/app-layer-template/test.rules | 4 ++-- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/tests/app-layer-template/suricata.yaml b/tests/app-layer-template/suricata.yaml index 9ab153c7c..8e683fb49 100644 --- a/tests/app-layer-template/suricata.yaml +++ b/tests/app-layer-template/suricata.yaml @@ -11,6 +11,9 @@ outputs: app-layer: protocols: + # TODO remove once this string is out of main7 + template-rust: + enabled: yes template: enabled: yes detection-ports: diff --git a/tests/app-layer-template/test.rules b/tests/app-layer-template/test.rules index 0bec34b67..139a1328b 100644 --- a/tests/app-layer-template/test.rules +++ b/tests/app-layer-template/test.rules @@ -1,2 +1,2 @@ -alert template any any -> any any (msg:"TEST"; content:"Hello"; flow:established,to_server; sid:1; rev:1;) -alert template any any -> any any (msg:"TEST"; content:"Bye"; flow:established,to_client; sid:2; rev:1;) +alert template any any -> any any (msg:"TEST"; template.buffer; content:"Hello"; flow:established,to_server; sid:1; rev:1;) +alert template any any -> any any (msg:"TEST"; template.buffer; content:"Bye"; flow:established,to_client; sid:2; rev:1;)