diff --git a/tests/bug-7390/README.md b/tests/bug-7390/README.md new file mode 100644 index 000000000..3ee3c2f97 --- /dev/null +++ b/tests/bug-7390/README.md @@ -0,0 +1,9 @@ +# Test Description +This test demonstrates that that both rules trigger. Without the fix for 7390, the rule a +variable for distance would not trigger. + +## PCAP +None + +## Related issues +https://redmine.openinfosecfoundation.org/issues/7390 diff --git a/tests/bug-7390/input.pcap b/tests/bug-7390/input.pcap new file mode 100644 index 000000000..70d3c0de7 Binary files /dev/null and b/tests/bug-7390/input.pcap differ diff --git a/tests/bug-7390/test.rules b/tests/bug-7390/test.rules new file mode 100644 index 000000000..adedfb311 --- /dev/null +++ b/tests/bug-7390/test.rules @@ -0,0 +1,4 @@ +# This test uses a variable for distance +alert tcp any any -> any 8080 (msg:"TEST #1: distance using variable"; flow:to_server; content:"Authorization:"; content:"5f71ycy"; distance:0; byte_extract:1,0,option_len,string,relative; content:!"|38|"; distance:option_len; within:1; content:"|37|"; distance:-1; within:1; content:"|49|"; distance:option_len; within:1; sid:1;) +# This test uses a variable for distance +alert tcp any any -> any 8080 (msg:"TEST #2: distance using scalar value"; flow:to_server; content:"Authorization:"; content:"5f71ycy"; distance:0; byte_extract:1,0,option_len,string,relative; content:!"|38|"; distance:7; within:1; content:"|37|"; distance:-1; within:1; content:"|49|"; distance:option_len; within:1; sid:2;) diff --git a/tests/bug-7390/test.yaml b/tests/bug-7390/test.yaml new file mode 100644 index 000000000..d7faeb57e --- /dev/null +++ b/tests/bug-7390/test.yaml @@ -0,0 +1,17 @@ +requires: + min-version: 8 + +args: + - -k none + +checks: + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 1 + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 2