test/bug-7390 Add test cases relating to 7390

Issue: 7390

Insure that both rules trigger alerts; the rules are equivalent with one
using a distance variable and the other a hard-coded value.

diff --git a/tests/bug-7390/README.md b/tests/bug-7390/README.md
new file mode 100644 (file)
index 0000000..aa03697
--- /dev/null
+++ b/tests/bug-7390/README.md
@@ -0,0 +1,9 @@
+# Test Description
+This test demonstrates that that both rules trigger. Without the fix for 7390, the rule a
+variable for distance would not trigger.
+
+## PCAP
+Using pcap from the redmine issue
+
+## Related issues
+https://redmine.openinfosecfoundation.org/issues/7390

diff --git a/tests/bug-7390/input.pcap b/tests/bug-7390/input.pcap
new file mode 100644 (file)
index 0000000..70d3c0d
Binary files /dev/null and b/tests/bug-7390/input.pcap differ

diff --git a/tests/bug-7390/test.rules b/tests/bug-7390/test.rules
new file mode 100644 (file)
index 0000000..adedfb3
--- /dev/null
+++ b/tests/bug-7390/test.rules
@@ -0,0 +1,4 @@
+# This test uses a variable for distance
+alert tcp any any -> any 8080 (msg:"TEST #1: distance using variable"; flow:to_server; content:"Authorization:"; content:"5f71ycy"; distance:0; byte_extract:1,0,option_len,string,relative; content:!"|38|"; distance:option_len; within:1; content:"|37|"; distance:-1; within:1; content:"|49|"; distance:option_len; within:1; sid:1;)
+# This test uses a variable for distance
+alert tcp any any -> any 8080 (msg:"TEST #2: distance using scalar value"; flow:to_server; content:"Authorization:"; content:"5f71ycy"; distance:0; byte_extract:1,0,option_len,string,relative; content:!"|38|"; distance:7; within:1; content:"|37|"; distance:-1; within:1; content:"|49|"; distance:option_len; within:1; sid:2;)

diff --git a/tests/bug-7390/test.yaml b/tests/bug-7390/test.yaml
new file mode 100644 (file)
index 0000000..d7faeb5
--- /dev/null
+++ b/tests/bug-7390/test.yaml
@@ -0,0 +1,17 @@
+requires:
+  min-version: 8
+
+args:
+  - -k none
+
+checks:
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 1
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 2