tests: add bug 6875 test

diff --git a/tests/bug-6875-01/README.md b/tests/bug-6875-01/README.md
new file mode 100644 (file)
index 0000000..c549c91
--- /dev/null
+++ b/tests/bug-6875-01/README.md
@@ -0,0 +1,3 @@
+PCAP
+====
+Pcap from https://redmine.openinfosecfoundation.org/issues/6875

diff --git a/tests/bug-6875-01/fuzz.pcap b/tests/bug-6875-01/fuzz.pcap
new file mode 100644 (file)
index 0000000..345bac8
Binary files /dev/null and b/tests/bug-6875-01/fuzz.pcap differ

diff --git a/tests/bug-6875-01/suricata.yaml b/tests/bug-6875-01/suricata.yaml
new file mode 100644 (file)
index 0000000..b29df78
--- /dev/null
+++ b/tests/bug-6875-01/suricata.yaml
@@ -0,0 +1,9 @@
+%YAML 1.1
+---
+
+outputs:
+  - eve-log:
+      enabled: yes
+      types:
+        - alert:
+            payload: yes

diff --git a/tests/bug-6875-01/test.rules b/tests/bug-6875-01/test.rules
new file mode 100644 (file)
index 0000000..742347e
--- /dev/null
+++ b/tests/bug-6875-01/test.rules
@@ -0,0 +1 @@
+alert ip any any -> any any (msg:"Flowbit set"; sid:1;)

diff --git a/tests/bug-6875-01/test.yaml b/tests/bug-6875-01/test.yaml
new file mode 100644 (file)
index 0000000..85c25ab
--- /dev/null
+++ b/tests/bug-6875-01/test.yaml
@@ -0,0 +1,10 @@
+args:
+  - -k none
+
+checks:
+  - filter:
+      count: 1
+      match:
+        pcap_cnt: 1
+        alert.signature_id: 1
+        stream: 0