tests: add ticket 5929 test

diff --git a/tests/bug-5929-01/1e3b98e5dad2954.pcap b/tests/bug-5929-01/1e3b98e5dad2954.pcap
new file mode 100644 (file)
index 0000000..6ea9806
Binary files /dev/null and b/tests/bug-5929-01/1e3b98e5dad2954.pcap differ

diff --git a/tests/bug-5929-01/README.md b/tests/bug-5929-01/README.md
new file mode 100644 (file)
index 0000000..cd25c07
--- /dev/null
+++ b/tests/bug-5929-01/README.md
@@ -0,0 +1,4 @@
+PCAP
+====
+
+Pcap from https://redmine.openinfosecfoundation.org/issues/5929

diff --git a/tests/bug-5929-01/test.rules b/tests/bug-5929-01/test.rules
new file mode 100644 (file)
index 0000000..5bb4b84
--- /dev/null
+++ b/tests/bug-5929-01/test.rules
@@ -0,0 +1,4 @@
+alert http any any -> any any (flow:established,to_server; urilen:<70; http.uri; content:".php?"; content:"=01&"; distance:4; within:4; fast_pattern; sid:1;)
+alert http any any -> any any (flow:established,to_server; http.uri; bsize:<70; content:".php?"; content:"=01&"; distance:4; within:4; fast_pattern; sid:2;)
+alert http any any -> any any (flow:established,to_server; urilen:<70; http.uri; content:".php?"; content:"=01&"; distance:4; within:4; sid:3;)
+alert http any any -> any any (flow:established,to_server; http.uri; content:".php?"; content:"=01&"; distance:4; within:4; fast_pattern; sid:4;)

diff --git a/tests/bug-5929-01/test.yaml b/tests/bug-5929-01/test.yaml
new file mode 100644 (file)
index 0000000..1c96e4c
--- /dev/null
+++ b/tests/bug-5929-01/test.yaml
@@ -0,0 +1,24 @@
+args:
+- -k none
+
+checks:
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 1
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 2
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 3
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 4