From: Philippe Antoine Date: Tue, 1 Oct 2019 08:37:00 +0000 (+0200) Subject: Adds test for http post data decompression X-Git-Tag: suricata-6.0.4~159 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=63d12f253d02c17e8c0546a04aaac5067f4fa25e;p=thirdparty%2Fsuricata-verify.git Adds test for http post data decompression --- diff --git a/tests/http-post-data-decompression/README.md b/tests/http-post-data-decompression/README.md new file mode 100644 index 000000000..4f0c1de76 --- /dev/null +++ b/tests/http-post-data-decompression/README.md @@ -0,0 +1,7 @@ +# Description + +Test http request post data decompression + +# PCAP + +The pcap and rule come from https://redmine.openinfosecfoundation.org/issues/2510 diff --git a/tests/http-post-data-decompression/input.pcap b/tests/http-post-data-decompression/input.pcap new file mode 100644 index 000000000..22ac29677 Binary files /dev/null and b/tests/http-post-data-decompression/input.pcap differ diff --git a/tests/http-post-data-decompression/test.rules b/tests/http-post-data-decompression/test.rules new file mode 100644 index 000000000..6ca8c9f7e --- /dev/null +++ b/tests/http-post-data-decompression/test.rules @@ -0,0 +1 @@ +alert http any any -> any any (msg: "GZIPPED REQUEST"; flow: established, to_server; content: "name"; http_client_body; nocase; sid: 1; rev: 1; ) diff --git a/tests/http-post-data-decompression/test.yaml b/tests/http-post-data-decompression/test.yaml new file mode 100644 index 000000000..823312db7 --- /dev/null +++ b/tests/http-post-data-decompression/test.yaml @@ -0,0 +1,11 @@ +requires: + features: + - HAVE_LIBJANSSON + min-version: 7 + +checks: + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 1