From f99475e6aa87c071bcc7a4e15b8dfcbb058c5474 Mon Sep 17 00:00:00 2001
From: Philippe Antoine <contact@catenacyber.fr>
Date: Thu, 4 Apr 2019 20:55:51 +0200
Subject: [PATCH] Adds test case for http range logging

---
 tests/http-range/README.md  |   8 ++++++++
 tests/http-range/input.pcap | Bin 0 -> 2161 bytes
 tests/http-range/test.yaml  |  21 +++++++++++++++++++++
 3 files changed, 29 insertions(+)
 create mode 100644 tests/http-range/README.md
 create mode 100644 tests/http-range/input.pcap
 create mode 100644 tests/http-range/test.yaml

diff --git a/tests/http-range/README.md b/tests/http-range/README.md
new file mode 100644
index 000000000..a3d349f06
--- /dev/null
+++ b/tests/http-range/README.md
@@ -0,0 +1,8 @@
+# Description
+
+Test http content range logging.
+
+# PCAP
+
+The pcap comes from running 
+`curl http://i.imgur.com/z4d4kWk.jpg -i -H "Range: bytes=500-1000"`
diff --git a/tests/http-range/input.pcap b/tests/http-range/input.pcap
new file mode 100644
index 0000000000000000000000000000000000000000..dc92bd9639041ecf995a0154a95b07485043178d
GIT binary patch
literal 2161
zc-pm<eM}Q)9LJ9esHaubu`zMx31h=Tuf1z~lvbIPmkG$5wxXLly<Q)VgT8q^UI(TN
zCL4r>OtO*ah>8YZ=7Q+V!02?-jp>ZpAKijFvl(NU(Pc^&mTbw~^IVGx;<7FAa?j<S
zm-{^5-^=};(AlGVR75oK@QNm)&~y8$-VF;kkVFZ3$8C6j`Qczpi0fYP`|cS;9zkT`
zJ1e&G$1?|_$Szp_d1!<v)6UxP17;ji-M>FKkswsjF`q<Dn-&ulHG^CZ2F@#dRhZt=
zLlT9kk6V}<-b0};!*p}(mK&IicOc3_BU!J(XV4DUcF$k+)7c%E9-SPmnn7;2h5VR~
zcAAOFUm<cfqGnH}+Z54#dy?*Jh#nt|i(71HC5VXLtC)<5#=RubhiH9M5%)xhTc;!@
z#4YZ7VIpxwo&)F`O)gXQ+G<^uUjX?IN12|{F={g37m%$$)QKLUM$+*<kD6Q)fD&aB
zpchT>HIiFz*0ClXttM?e5B+E`RiCORS94wgT7k1chJj3$rYVM|(Hb?0<)6Cy&>@ex
z+SI=pyZTJqBv;34XKgGD#u1wA*<txedW~WNBA!FU*HPBsHklY*)X!n!$t_PJ9vzrS
z9Je1B=yXuVNwUbfL5|NWBcs)15f_lDVxLQ_5TVNo9F;X%KpViT(23SFX2393hPARr
zu%g(ZCi5JeU<FA`2G7!vaXO*JY;d|NEWFueab{GcSI~^b!djBlWIe@s8mWNnlQ;oV
zyqgOItibNDmE_u1=WZ&nsmX{0%F*CQz7;)aoxaKs1vSZYd?oq@%}YMF75HnMZjsjl
z4~L)v%rr8rF<l8jI7pNdo<Jl%YBHCT;kYFxVDn4Z5({85tfmYrONTA7;efJ617kEO
zQoN9tMW5FSsv-1KoLj7gYH}TAhf*zcQP~YBJrq^WI+0~e7Akvffi^P4y95JmHd?5h
z+!gqn96V|T`2`LwemoeW@<kb`WVFD5#~h*uO2{V+%bHBI(QIUNW`;4EGqmM)T3enM
zu`dvya>AaVY;L!&jw*(7rO$;xDATo|w9HXZT4H~~+EPgrL}V1oVZ{;&n<0Y=jz@uM
z01VFb@i;u1<X}9>^^7T<W!Q(SilA4JE0ODH2LAwqL$@>umv1IFeP7qTrt{dY>)Se2
zUEP`^XNNoIPha|7Y1e37`)A*FA6?(v8h>&mEo~?>VKq5>;h=oD|6|kp#DSQs)TlBt
z=uqvB#~oMm&*@8&!tWC%o<gVLBY2|zO3&zf_ID3n<Zno6b2g=1-`9HaO6M1EmM=ZD
zfM1lKNbYp@zPxu)R-$d>_R6pM*mErdZ7DZjxxD7^i*n0Y@6vaktN$%^^UOtUQb+S!
zZwzaa?^JJHcDIkKws~?F-s)O+yf^Qu+c9Nl$qrTCv6!mq$Axb`V6P9|sl9Z;{^gd@
z69@JE&))l^V?pM@LZz6aO4EeuR?}3q%iHf%YFEj`N+VKArAZ((r-KtKP4d`Fur)O)
zw<)x~?Z)zHwF51Q`<nB2tlxiX?8A0j$Ayev?3(k<#{+YO(Z6~QT`Srt^_*&__I0P6
z##-2W|NUUuScvop!MM49QlSUOz^_;jCSD!=-^6)w1a;|g;`8aV{;AgUiof2T<SzkH
mR|e-1n#^4f{MD#X5wYzN;=k6o5>YGBaY|61j%yqwF!gWKa<O^<

literal 0
Hc-jL100001

diff --git a/tests/http-range/test.yaml b/tests/http-range/test.yaml
new file mode 100644
index 000000000..dd667d4ef
--- /dev/null
+++ b/tests/http-range/test.yaml
@@ -0,0 +1,21 @@
+requires:
+  features:
+    - HAVE_LIBJANSSON
+
+# disables checksum verification
+args:
+  - -k none
+
+checks:
+
+  # Check that there is one file event with content range.
+  - filter:
+      count: 1
+      match:
+        event_type: fileinfo
+        http.content_range.raw: bytes 500-1000/146515
+        http.content_range.start: 500
+        http.content_range.end: 1000
+        http.content_range.size: 146515
+        fileinfo.start: 500
+        fileinfo.end: 1000
-- 
2.47.2