requires:
  min-version: 8

pcap: ../../detect-itype-prefilter/icmpv4-ping.pcap

args:
  - --simulate-ips
  - -k none

checks:
  # Verify all 7 keywords produce the "has not been tested" warning
  - shell:
      args: grep "has not been tested for firewall rules" suricata.log | grep -c "icode"
      expect: "1"
  - shell:
      args: grep "has not been tested for firewall rules" suricata.log | grep -c "pcre"
      expect: "1"
  - shell:
      args: grep "has not been tested for firewall rules" suricata.log | grep -c "urilen"
      expect: "1"
  - shell:
      args: grep "has not been tested for firewall rules" suricata.log | grep -c "dns.opcode"
      expect: "1"
  - shell:
      args: grep "has not been tested for firewall rules" suricata.log | grep -c "tls.cert_chain_len"
      expect: "1"
  - shell:
      args: grep "has not been tested for firewall rules" suricata.log | grep -c "dataset"
      expect: "1"
  - shell:
      args: grep "has not been tested for firewall rules" suricata.log | grep -c "datarep"
      expect: "1"
