From b542982a23821afc0e511d4a754ae667ea55e503 Mon Sep 17 00:00:00 2001
From: Victor Julien <victor@inliniac.net>
Date: Wed, 20 Mar 2024 08:17:06 +0100
Subject: [PATCH] tests: add bug 6875 test

---
 tests/bug-6875-01/README.md     |   3 +++
 tests/bug-6875-01/fuzz.pcap     | Bin 0 -> 385 bytes
 tests/bug-6875-01/suricata.yaml |   9 +++++++++
 tests/bug-6875-01/test.rules    |   1 +
 tests/bug-6875-01/test.yaml     |  10 ++++++++++
 5 files changed, 23 insertions(+)
 create mode 100644 tests/bug-6875-01/README.md
 create mode 100644 tests/bug-6875-01/fuzz.pcap
 create mode 100644 tests/bug-6875-01/suricata.yaml
 create mode 100644 tests/bug-6875-01/test.rules
 create mode 100644 tests/bug-6875-01/test.yaml

diff --git a/tests/bug-6875-01/README.md b/tests/bug-6875-01/README.md
new file mode 100644
index 000000000..c549c91e7
--- /dev/null
+++ b/tests/bug-6875-01/README.md
@@ -0,0 +1,3 @@
+PCAP
+====
+Pcap from https://redmine.openinfosecfoundation.org/issues/6875
diff --git a/tests/bug-6875-01/fuzz.pcap b/tests/bug-6875-01/fuzz.pcap
new file mode 100644
index 0000000000000000000000000000000000000000..345bac83d52e3b3c694d4c3c1dd7f818aa0875d0
GIT binary patch
literal 385
zc-p&ic+)~A1{MYw`2U}Qfe}cba()$gRhge*50DMQ91Q9U)n5R~`mNm@46Y0e>jcFd
z7#i3Z7!Ire=@W2Zgqy()GwUD3tV9q8VFes$GBC1A0O<@gabGCS3U<%`{~)(qSLJ7z
z1?10yxCQJAh>L)3>EZbTa!dHD11q@XfLNY!?}4I4Q<)6wC+y`4kYM=z&lzlB!oOf&
zCkF<IO9g;5gf*Fufk+o~GI%gZKs2KOMg~Nv8LII!cmX*ej2>!?Hi8ncP~(!%3{bGL
F0syVcK}!Gt

literal 0
Hc-jL100001

diff --git a/tests/bug-6875-01/suricata.yaml b/tests/bug-6875-01/suricata.yaml
new file mode 100644
index 000000000..b29df7888
--- /dev/null
+++ b/tests/bug-6875-01/suricata.yaml
@@ -0,0 +1,9 @@
+%YAML 1.1
+---
+
+outputs:
+  - eve-log:
+      enabled: yes
+      types:
+        - alert:
+            payload: yes
diff --git a/tests/bug-6875-01/test.rules b/tests/bug-6875-01/test.rules
new file mode 100644
index 000000000..742347ef6
--- /dev/null
+++ b/tests/bug-6875-01/test.rules
@@ -0,0 +1 @@
+alert ip any any -> any any (msg:"Flowbit set"; sid:1;)
diff --git a/tests/bug-6875-01/test.yaml b/tests/bug-6875-01/test.yaml
new file mode 100644
index 000000000..85c25abcf
--- /dev/null
+++ b/tests/bug-6875-01/test.yaml
@@ -0,0 +1,10 @@
+args:
+  - -k none
+
+checks:
+  - filter:
+      count: 1
+      match:
+        pcap_cnt: 1
+        alert.signature_id: 1
+        stream: 0
-- 
2.47.2