tests: add tests for stream-async

[jufajardini]

In investigating whether would backport an exception policy for stream-async to main 7.0.x.

Wondering if we should have tests with different pcaps. While I settled here for picking a single pcap and splitting the traffic to create an async scenario, resulting in the tests seen here, with no alerts or app proto seen in stream-async-6063-cli-02, some other cases (using async pcaps present in our tests, already) showed scenarios where Suri was able to generate alerts and other events against async traffic, even with stream.async-oneside=false

I added the flow events to the tests in case those would show any difference with async true or false, but didn't notice anything.

Related to
Task #6063

Ticket

Redmine ticket:
https://redmine.openinfosecfoundation.org/issues/6063

[victorjulien]

I think this is a great start. In general the async logic is under cooked, and it's unclear how the various protocols and features work with async. I wonder if we should just have a stream-async subdir and then have per protocol tests.

It would probably also be a good goal to then document the per protocol behavior/support in https://docs.suricata.io/en/latest/protocols/protocols.html

[jufajardini]

I think this is a great start. In general the async logic is under cooked, and it's unclear how the various protocols and features work with async. I wonder if we should just have a stream-async subdir and then have per protocol tests.

It would probably also be a good goal to then document the per protocol behavior/support in https://docs.suricata.io/en/latest/protocols/protocols.html

Agreeing to both things

I think this is a great start. In general the async logic is under cooked, and it's unclear how the various protocols and features work with async. I wonder if we should just have a stream-async subdir and then have per protocol tests.

It would probably also be a good goal to then document the per protocol behavior/support in https://docs.suricata.io/en/latest/protocols/protocols.html

Added: https://redmine.openinfosecfoundation.org/issues/8011

[jufajardini]

Added tests that show the difference with stream.async-oneside=false to compare with tests

• alert-testmyids-async
• bug-2491-02
  Moved all tests to stream-async/http since all of them are for http, so far.

[victorjulien]

Great stuff.

[catenacyber]

Is this still a draft ?

Should it be labelled tests pass ?

[victorjulien]

Would be great to get this part already going in.