OISF · catenacyber · Aug 1, 2024
diff --git a/tests/detect-flowvar/README.md b/tests/detect-flowvar/README.md
@@ -0,0 +1,12 @@
+Test
+====
+
+Test flow variable functionality
+
+https://redmine.openinfosecfoundation.org/issues/7197
+
+PCAP
+====
+
+Pcap crafted with some http server and some python client that delays or not the writing of the headers
+
diff --git a/tests/detect-flowvar/input.pcap b/tests/detect-flowvar/input.pcap
diff --git a/tests/detect-flowvar/test.rules b/tests/detect-flowvar/test.rules
@@ -0,0 +1 @@
+alert http any any -> any any ( sid: 1; http.uri; content: "param"; fast_pattern; pcre: "/param=(.*)/,flow:paramval"; http.request_header; content: "Header1";)
diff --git a/tests/detect-flowvar/test.yaml b/tests/detect-flowvar/test.yaml
@@ -0,0 +1,20 @@
+requires:
+ min-version: 8
+
+args:
+- -k none
+
+checks:
+- filter:
+ # we should get twice the extracted flowvar
+ count: 2
+ match:
+ event_type: alert
+ alert.signature_id: 1
+ metadata.flowvars[0].paramval: value
+- filter:
+ # we have twice the same data in 2 flows, rule matches twice and it is ok
+ count: 2
+ match:
+ event_type: alert
+ alert.signature_id: 1