From: Jeff Lucovsky <jlucovsky@oisf.net>
Date: Tue, 17 Dec 2024 14:18:49 +0000 (-0500)
Subject: test/bug-7390 Add test cases relating to 7390
X-Git-Tag: suricata-7.0.11~41
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=924102e47e206068cc2659d50895ef8a8fb4822e;p=thirdparty%2Fsuricata-verify.git

test/bug-7390 Add test cases relating to 7390

Issue: 7390

Insure that both rules trigger alerts; the rules are equivalent with one
using a distance variable and the other a hard-coded value.
---

diff --git a/tests/bug-7390/README.md b/tests/bug-7390/README.md
new file mode 100644
index 000000000..aa03697c3
--- /dev/null
+++ b/tests/bug-7390/README.md
@@ -0,0 +1,9 @@
+# Test Description
+This test demonstrates that that both rules trigger. Without the fix for 7390, the rule a
+variable for distance would not trigger.
+
+## PCAP
+Using pcap from the redmine issue
+
+## Related issues
+https://redmine.openinfosecfoundation.org/issues/7390
diff --git a/tests/bug-7390/input.pcap b/tests/bug-7390/input.pcap
new file mode 100644
index 000000000..70d3c0de7
Binary files /dev/null and b/tests/bug-7390/input.pcap differ
diff --git a/tests/bug-7390/test.rules b/tests/bug-7390/test.rules
new file mode 100644
index 000000000..adedfb311
--- /dev/null
+++ b/tests/bug-7390/test.rules
@@ -0,0 +1,4 @@
+# This test uses a variable for distance
+alert tcp any any -> any 8080 (msg:"TEST #1: distance using variable"; flow:to_server; content:"Authorization:"; content:"5f71ycy"; distance:0; byte_extract:1,0,option_len,string,relative; content:!"|38|"; distance:option_len; within:1; content:"|37|"; distance:-1; within:1; content:"|49|"; distance:option_len; within:1; sid:1;)
+# This test uses a variable for distance
+alert tcp any any -> any 8080 (msg:"TEST #2: distance using scalar value"; flow:to_server; content:"Authorization:"; content:"5f71ycy"; distance:0; byte_extract:1,0,option_len,string,relative; content:!"|38|"; distance:7; within:1; content:"|37|"; distance:-1; within:1; content:"|49|"; distance:option_len; within:1; sid:2;)
diff --git a/tests/bug-7390/test.yaml b/tests/bug-7390/test.yaml
new file mode 100644
index 000000000..d7faeb57e
--- /dev/null
+++ b/tests/bug-7390/test.yaml
@@ -0,0 +1,17 @@
+requires:
+  min-version: 8
+
+args:
+  - -k none
+
+checks:
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 1
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 2