From: Philippe Antoine Date: Mon, 13 Jul 2020 08:00:11 +0000 (+0200) Subject: http: adds test with gap extending beyond body X-Git-Tag: suricata-6.0.4~239 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=bd9f9d1d0ca150d9c9d1e56486df1a406352bc1d;p=thirdparty%2Fsuricata-verify.git http: adds test with gap extending beyond body --- diff --git a/tests/http-gap-beyond-body/README.md b/tests/http-gap-beyond-body/README.md new file mode 100644 index 000000000..c75e1865e --- /dev/null +++ b/tests/http-gap-beyond-body/README.md @@ -0,0 +1,13 @@ +# Description + +Test http gap handling + +This test case contains a single simple gap in response body with defined content-length + +# PCAP + +The pcap comes from running +`python test/htptopcap.py toaddgap.txt` +With the attached toaddgap.txt from test http-gap-simple + +Then removing packet 9 diff --git a/tests/http-gap-beyond-body/input.pcap b/tests/http-gap-beyond-body/input.pcap new file mode 100644 index 000000000..ccdc64ff5 Binary files /dev/null and b/tests/http-gap-beyond-body/input.pcap differ diff --git a/tests/http-gap-beyond-body/test.yaml b/tests/http-gap-beyond-body/test.yaml new file mode 100644 index 000000000..5ec91f11d --- /dev/null +++ b/tests/http-gap-beyond-body/test.yaml @@ -0,0 +1,39 @@ +requires: + features: + - HAVE_LIBJANSSON + min-version: 6.0.0 + +# disables checksum verification +args: + - -k none + +checks: + + # Check that there is one file event with content range. + - filter: + count: 1 + match: + event_type: http + http.url: "/1" + http.status: 200 + - filter: + count: 1 + match: + event_type: http + http.url: "/2" +# response is not parsed in gap +# http.status: 200 + - filter: + count: 1 + match: + event_type: http + http.url: "/3" +# response is no longer parsed after gap +# http.status: 200 + - filter: + count: 1 + match: + event_type: fileinfo + fileinfo.size: 0 + fileinfo.state: "TRUNCATED" + fileinfo.gaps: true