Adds test about http mime with truncated file

due to request.body_limit configuration value

diff --git a/tests/http-mime-truncated/README.md b/tests/http-mime-truncated/README.md
new file mode 100644 (file)
index 0000000..4758eef
--- /dev/null
+++ b/tests/http-mime-truncated/README.md
@@ -0,0 +1,7 @@
+# Description
+
+Test http mime truncated file
+
+# PCAP
+
+The pcap is an extract from SURI_TLPW1_files_sha256

diff --git a/tests/http-mime-truncated/input.pcap b/tests/http-mime-truncated/input.pcap
new file mode 100644 (file)
index 0000000..37900bf
Binary files /dev/null and b/tests/http-mime-truncated/input.pcap differ

diff --git a/tests/http-mime-truncated/suricata.yaml b/tests/http-mime-truncated/suricata.yaml
new file mode 100644 (file)
index 0000000..9261be0
--- /dev/null
+++ b/tests/http-mime-truncated/suricata.yaml
@@ -0,0 +1,16 @@
+%YAML 1.1
+---
+
+outputs:
+  - eve-log:
+      enabled: yes
+      types:
+        - files:
+            force-hash: [sha256]
+
+app-layer:
+  protocols:
+    http:
+      libhtp:
+         default-config:
+           request-body-limit: 100kb

diff --git a/tests/http-mime-truncated/test.yaml b/tests/http-mime-truncated/test.yaml
new file mode 100644 (file)
index 0000000..4a3fa9e
--- /dev/null
+++ b/tests/http-mime-truncated/test.yaml
@@ -0,0 +1,16 @@
+requires:
+  min-version: 7.0.0
+
+# disables checksum verification
+args:
+  - -k none
+
+checks:
+
+  - filter:
+      count: 1
+      match:
+        app_proto: http
+        fileinfo.sha256: "0adad78526c1b9c35f349a2cc7014c458aa87adcb9ec86f052fd8a9a80584e39"
+        fileinfo.state: TRUNCATED
+        fileinfo.size: 101422