From: Philippe Antoine Date: Tue, 16 Apr 2024 20:55:38 +0000 (+0200) Subject: http: adds test about decompression X-Git-Tag: suricata-6.0.20~59 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=288e4033f5d58f285260ebcfde388f3bd74e22ac;p=thirdparty%2Fsuricata-verify.git http: adds test about decompression Ticket: 6959 --- diff --git a/tests/http-encoding-gzip-uncompressed/README.md b/tests/http-encoding-gzip-uncompressed/README.md new file mode 100644 index 000000000..f5db8febe --- /dev/null +++ b/tests/http-encoding-gzip-uncompressed/README.md @@ -0,0 +1,12 @@ +# Test Description + +Test that we do not wrongly decompress if we have encoding gzip but clear text + +## PCAP + +From https://redmine.openinfosecfoundation.org/issues/6959 + + +## Related issues + +https://redmine.openinfosecfoundation.org/issues/6959 diff --git a/tests/http-encoding-gzip-uncompressed/input.pcap b/tests/http-encoding-gzip-uncompressed/input.pcap new file mode 100644 index 000000000..dd66e9b6d Binary files /dev/null and b/tests/http-encoding-gzip-uncompressed/input.pcap differ diff --git a/tests/http-encoding-gzip-uncompressed/test.rules b/tests/http-encoding-gzip-uncompressed/test.rules new file mode 100644 index 000000000..8cda46105 --- /dev/null +++ b/tests/http-encoding-gzip-uncompressed/test.rules @@ -0,0 +1 @@ +alert http $HOME_NET any -> $EXTERNAL_NET 8100 (msg:"ET MOBILE_MALWARE Android Dropper Checkin Activity (POST)"; flow:established,to_server; http.request_body; content:"|22|sdk_version|22 3a|"; content:"|22|app_package|22 3a 22|"; distance:0; content:"|22|app_version|22 3a 22|"; distance:0; content:"|22|device_id|22 3a 22|"; distance:0; classtype:trojan-activity; sid:2038629; rev:1;) diff --git a/tests/http-encoding-gzip-uncompressed/test.yaml b/tests/http-encoding-gzip-uncompressed/test.yaml new file mode 100644 index 000000000..4b5bb4bc8 --- /dev/null +++ b/tests/http-encoding-gzip-uncompressed/test.yaml @@ -0,0 +1,9 @@ +args: + - -k none + +checks: + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 2038629