From 924102e47e206068cc2659d50895ef8a8fb4822e Mon Sep 17 00:00:00 2001
From: Jeff Lucovsky <jlucovsky@oisf.net>
Date: Tue, 17 Dec 2024 09:18:49 -0500
Subject: [PATCH] test/bug-7390 Add test cases relating to 7390

Issue: 7390

Insure that both rules trigger alerts; the rules are equivalent with one
using a distance variable and the other a hard-coded value.
---
 tests/bug-7390/README.md  |   9 +++++++++
 tests/bug-7390/input.pcap | Bin 0 -> 1418 bytes
 tests/bug-7390/test.rules |   4 ++++
 tests/bug-7390/test.yaml  |  17 +++++++++++++++++
 4 files changed, 30 insertions(+)
 create mode 100644 tests/bug-7390/README.md
 create mode 100644 tests/bug-7390/input.pcap
 create mode 100644 tests/bug-7390/test.rules
 create mode 100644 tests/bug-7390/test.yaml

diff --git a/tests/bug-7390/README.md b/tests/bug-7390/README.md
new file mode 100644
index 000000000..aa03697c3
--- /dev/null
+++ b/tests/bug-7390/README.md
@@ -0,0 +1,9 @@
+# Test Description
+This test demonstrates that that both rules trigger. Without the fix for 7390, the rule a
+variable for distance would not trigger.
+
+## PCAP
+Using pcap from the redmine issue
+
+## Related issues
+https://redmine.openinfosecfoundation.org/issues/7390
diff --git a/tests/bug-7390/input.pcap b/tests/bug-7390/input.pcap
new file mode 100644
index 0000000000000000000000000000000000000000..70d3c0de7b09d941280a1834196b439529fd178f
GIT binary patch
literal 1418
zc-no_PiWIn90%}ZtD6J@IuP`<M-M96rb*haH7f3}U8<{Vt+NU`v-CB6TTHSvY1fJ%
zqTm!{f}r3<L70LU|D3(ds~$u_MLY<C&Ohv;2L<uHly0uh6_SR$UqAf%zQ6Zk?!m1V
z%114Id=!oEPYMC8{V78w@iV!o4aXR<-MjnNQUesVYg+H7y4x~a?{%ELaIfQB?d$W-
znTvB1$4K$bmY)mk4T@^<t$E~YS<Bp>iO0!%y0x{P$U?L1tNV4CqPnR)ZEvp<mFS%_
zU!T8!e2wVGZ+85?Fgmg%pMN*oO7w<2{*0k|G1|LQ&yneqUeBSXo{wYw%9(ZakIS97
zN4nlGksIPAyd~sn7U|Q|1`&rptSD}ze{5!#i;00O2q_i{xt3-tc^Fb%+lGb%2D91W
zkiZEnGia6^2?#Nf6XKi@#$Tc+#rZhTGKWgg4)$ocUIJFtDVj#mhLbKVIi--uiBa<N
z9#w^w6C5y9Gmi{S0$L4O0g#6UU2$MzT>{%e+gPU0Gz_RZ$TTD{0ihLCbW|oqF2-$C
zQ|e2wnk<ebRCE9(<wG@DNFli-8=0uuCwIvcR&Jy(xr4(+?vcZSE{~f?9Zc$KI8&BU
z1?6)oUDbD3M{)7c!3sK>D^_sLRH`;KHPoMurn2cuA<b!t{Ue#l+}_MsRpry^Ozv>6
zX+;Y$p{iD6ZZ!clai1I)`iJER%diZI=5}+~e~(dQ;UgKN&kvi%=*q=8eHMrPYcy4l
z2FKzf@epy(3x?W)gWf{_E7F@5J`r*L>5Ae;`qzo@qPT{LjZA^a^WeZfmN^LRGPEUN
zXvmntD`Jc!){k?MK(^=x03QP>vyAJ-2!59Ms1)HrVkqk+<>1_d*{X$$70c3*>ZKDJ
zFPX+ppcWOo1fAWkQwYYF%J)M<bBYq^;{P8u%bfD#wn})xFZo4|=lI|lbQCTe^#}Z8
zF4FU(DDRhqE+OD|Oh?g2y_bF|+!Z}dwr%F+s;AEMPF-;M8PR9oKfYeZL43dTZSjmq
zWb24{_tmPR<%xk6#r0VHvMBCsh&``Y9hP}-Sne;6_Ieqscd+>Pu(T1Ch><s|_BiSF
TxV@>zJ6NrF|9XB|k8OVdDg&%k

literal 0
Hc-jL100001

diff --git a/tests/bug-7390/test.rules b/tests/bug-7390/test.rules
new file mode 100644
index 000000000..adedfb311
--- /dev/null
+++ b/tests/bug-7390/test.rules
@@ -0,0 +1,4 @@
+# This test uses a variable for distance
+alert tcp any any -> any 8080 (msg:"TEST #1: distance using variable"; flow:to_server; content:"Authorization:"; content:"5f71ycy"; distance:0; byte_extract:1,0,option_len,string,relative; content:!"|38|"; distance:option_len; within:1; content:"|37|"; distance:-1; within:1; content:"|49|"; distance:option_len; within:1; sid:1;)
+# This test uses a variable for distance
+alert tcp any any -> any 8080 (msg:"TEST #2: distance using scalar value"; flow:to_server; content:"Authorization:"; content:"5f71ycy"; distance:0; byte_extract:1,0,option_len,string,relative; content:!"|38|"; distance:7; within:1; content:"|37|"; distance:-1; within:1; content:"|49|"; distance:option_len; within:1; sid:2;)
diff --git a/tests/bug-7390/test.yaml b/tests/bug-7390/test.yaml
new file mode 100644
index 000000000..d7faeb57e
--- /dev/null
+++ b/tests/bug-7390/test.yaml
@@ -0,0 +1,17 @@
+requires:
+  min-version: 8
+
+args:
+  - -k none
+
+checks:
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 1
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 2
-- 
2.47.2