From: Victor Julien Date: Wed, 11 Dec 2019 10:05:03 +0000 (+0100) Subject: http: test for body inspection corner case X-Git-Tag: suricata-6.0.4~358 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=bf2fe025a5addc10a4fb90c3369c04d13e394693;p=thirdparty%2Fsuricata-verify.git http: test for body inspection corner case --- diff --git a/tests/http-body-inspect/http-aptget-ids-02-s2.pcap b/tests/http-body-inspect/http-aptget-ids-02-s2.pcap new file mode 100644 index 000000000..6907fbccd Binary files /dev/null and b/tests/http-body-inspect/http-aptget-ids-02-s2.pcap differ diff --git a/tests/http-body-inspect/test.rules b/tests/http-body-inspect/test.rules new file mode 100644 index 000000000..93c6adcce --- /dev/null +++ b/tests/http-body-inspect/test.rules @@ -0,0 +1 @@ +alert http any any -> any any (file_data; content:"|60 5c f3 f0 29 2b|"; sid:1;) diff --git a/tests/http-body-inspect/test.yaml b/tests/http-body-inspect/test.yaml new file mode 100644 index 000000000..390088186 --- /dev/null +++ b/tests/http-body-inspect/test.yaml @@ -0,0 +1,18 @@ +requires: + features: + - HAVE_LIBJANSSON + +args: +- --set app-layer.protocols.http.libhtp.default-config.response-body-limit=1mb + +checks: + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 1 + tx_id: 0 + - filter: + count: 1 + match: + event_type: http