http/gap: fix check for payload_length

Change to suricata.yaml illustrates bug 7213

There is not yet a valid http1.response frame for the second request
after the gap

diff --git a/tests/eve-payload-07-http-gap/suricata.yaml b/tests/eve-payload-07-http-gap/suricata.yaml
index 472f7d88b93b8ce59eec130600aada0e1d1af3a3..941508867631f2f8bf510e15fef4dec69cf91b1d 100644 (file)
--- a/tests/eve-payload-07-http-gap/suricata.yaml
+++ b/tests/eve-payload-07-http-gap/suricata.yaml
@@ -7,6 +7,9 @@ outputs:
       filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
       filename: eve.json
       types:
+        - frame:
+            # this should not affect detection (but it did)
+            enabled: yes
         - alert:
             payload: yes             # enable dumping payload in Base64
             payload-buffer-size: 4kb # max size of payload buffer to output in eve-log

diff --git a/tests/eve-payload-07-http-gap/test.yaml b/tests/eve-payload-07-http-gap/test.yaml
index 92d5e50f3ef7def5f9e28edd8b3756f96127d984..b469a94fcc432fd45536435b2855daee7885bf3c 100644 (file)
--- a/tests/eve-payload-07-http-gap/test.yaml
+++ b/tests/eve-payload-07-http-gap/test.yaml
@@ -40,13 +40,6 @@ checks:
       alert.signature_id: 2
       payload_printable: "HTTP/1.0 200 OK\r\nDate: Mon, 31 Aug 2009 20:25:50 GMT\r\nServer: Apache\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 12\r\n\r\n"
       payload_length: 136
-- filter:
-    count: 1
-    match:
-      event_type: alert
-      alert.signature_id: 3
-      payload_printable: "HTTP/1.0 200 OK\r\nDate: Mon, 31 Aug 2009 20:25:50 GMT\r\nServer: Apache\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 12\r\n\r\n[127 bytes missing]AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHTTP/1.0 200 OK\r\nServer: Apache\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 12\r\n\r\nHello People\r\n"
-      payload_length: 324
 - filter:
     count: 1
     match:
@@ -59,6 +52,7 @@ checks:
       event_type: alert
       alert.signature_id: 4
       payload_printable: "HTTP/1.0 200 OK\r\nDate: Mon, 31 Aug 2009 20:25:50 GMT\r\nServer: Apache\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 12\r\n\r\n[127 bytes missing]AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHTTP/1.0 200 OK\r\nServer: Apache\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 12\r\n\r\nHello People\r\n"
+      payload_length: 324
 - filter:
     count: 1
     match: