From: Philippe Antoine <contact@catenacyber.fr>
Date: Mon, 4 Mar 2019 16:27:57 +0000 (+0100)
Subject: Adds a testcase for HTTP multiple content-length
X-Git-Tag: suricata-6.0.4~382
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=c40762f0eb9151a6355ba5dc7050394bf5d3881f;p=thirdparty%2Fsuricata-verify.git

Adds a testcase for HTTP multiple content-length
---

diff --git a/tests/http-multiple-cl/README.md b/tests/http-multiple-cl/README.md
new file mode 100644
index 000000000..d00531bad
--- /dev/null
+++ b/tests/http-multiple-cl/README.md
@@ -0,0 +1,7 @@
+# Description
+
+Test HTTP parsing against multiple different content-length.
+
+# PCAP
+
+The pcap comes from running `python -m SimpleHTTPServer 8000` or `python3 -m http.server` as a server and the present dummy python script client.py
diff --git a/tests/http-multiple-cl/client.py b/tests/http-multiple-cl/client.py
new file mode 100644
index 000000000..5f2c3728a
--- /dev/null
+++ b/tests/http-multiple-cl/client.py
@@ -0,0 +1,20 @@
+import socket
+
+sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+sock.connect(("127.0.0.1", 8000))
+
+dummyContent = "bar=1&foo=2"
+badContent = "badbar=5&badfoo=6"
+badReq = "POST /bad.php HTTP/1.1\r\nHost: 127.0.0.1\r\nContent-Length:{:d}\r\n\r\n{}".format(
+    len(badContent), badContent)
+evilContent = "evilbar=3&evilfoo=4"
+evilReq = "POST /evil.php HTTP/1.1\r\nHost: 127.0.0.1\r\nContent-Length:{:d}\r\n\r\n{}".format(
+    len(evilContent)+len(badReq), evilContent)
+
+# This attempts request smuggling with different content-length values
+a = sock.send("POST /which.php HTTP/1.1\r\nHost: 127.0.0.1\r\nContent-Length:{:d}\r\nContent-Length:{:d}\r\n\r\n{}{}{}".format(
+    len(dummyContent), len(dummyContent)+len(evilReq), dummyContent, evilReq, badReq))
+data = sock.recv(10000)
+print("Received {}".format(data))
+
+sock.close()
diff --git a/tests/http-multiple-cl/input.pcap b/tests/http-multiple-cl/input.pcap
new file mode 100644
index 000000000..ef9a91410
Binary files /dev/null and b/tests/http-multiple-cl/input.pcap differ
diff --git a/tests/http-multiple-cl/test.rules b/tests/http-multiple-cl/test.rules
new file mode 100644
index 000000000..1b6d1cd5f
--- /dev/null
+++ b/tests/http-multiple-cl/test.rules
@@ -0,0 +1 @@
+alert http any any -> any any (msg:"SURICATA HTTP duplicate content length field in request"; flow:established,to_server; app-layer-event:http.duplicate_content_length_field_in_request; flowint:http.anomaly.count,+,1; classtype:protocol-command-decode; sid:2221034; rev:1;)
diff --git a/tests/http-multiple-cl/test.yaml b/tests/http-multiple-cl/test.yaml
new file mode 100644
index 000000000..91637f566
--- /dev/null
+++ b/tests/http-multiple-cl/test.yaml
@@ -0,0 +1,14 @@
+requires:
+  features:
+    - HAVE_LIBJANSSON
+
+# disables checksum verification
+args:
+  - -k none
+
+checks:
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 2221034