detect/datasets: adds test for unset operation

[catenacyber]

Ticket

Redmine ticket: https://redmine.openinfosecfoundation.org/issues/7195

Suricata feature was merged for OISF/suricata#11815 and in 7 also with OISF/suricata#11833

[catenacyber]

This fails because datasets do not seem well fit for load + save with 2 different paths and SV using input and output

Suricata patch could be

diff --git a/src/detect-dataset.c b/src/detect-dataset.c
index ae23925f2c..587088240c 100644
--- a/src/detect-dataset.c
+++ b/src/detect-dataset.c
@@ -409,9 +409,15 @@ int DetectDatasetSetup (DetectEngineCtx *de_ctx, Signature *s, const char *rawst
         if (SetupSavePath(de_ctx, save, sizeof(save)) != 0)
             return -1;
         strlcpy(load, save, sizeof(load));
+    } else if (strlen(save) != 0 && strlen(load) != 0 &&
+               strcmp(save, load) != 0) {
+        if (SetupLoadPath(de_ctx, load, sizeof(load)) != 0)
+            return -1;
+        if (SetupSavePath(de_ctx, save, sizeof(save)) != 0)
+            return -1;
     }

[catenacyber]

New version in #2070

[inashivb]

This fails because datasets do not seem well fit for load + save with 2 different paths and SV using input and output

If such a setting is allowed, perhaps we should get your Suricata patch below in too.

Suricata patch could be

diff --git a/src/detect-dataset.c b/src/detect-dataset.c
index ae23925f2c..587088240c 100644
--- a/src/detect-dataset.c
+++ b/src/detect-dataset.c
@@ -409,9 +409,15 @@ int DetectDatasetSetup (DetectEngineCtx *de_ctx, Signature *s, const char *rawst
         if (SetupSavePath(de_ctx, save, sizeof(save)) != 0)
             return -1;
         strlcpy(load, save, sizeof(load));
+    } else if (strlen(save) != 0 && strlen(load) != 0 &&
+               strcmp(save, load) != 0) {
+        if (SetupLoadPath(de_ctx, load, sizeof(load)) != 0)
+            return -1;
+        if (SetupSavePath(de_ctx, save, sizeof(save)) != 0)
+            return -1;
     }

[catenacyber]

If such a setting is allowed, perhaps we should get your Suricata patch below in too.

Maybe, you know better the expected behavior of datasets I guess...
Would you create a ticket ?