From: Philippe Antoine Date: Mon, 30 Jan 2023 08:41:03 +0000 (+0100) Subject: Adds test about http mime with truncated file X-Git-Tag: suricata-6.0.12 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=refs%2Fpull%2F1181%2Fhead;p=thirdparty%2Fsuricata-verify.git Adds test about http mime with truncated file due to request.body_limit configuration value --- diff --git a/tests/http-mime-truncated/README.md b/tests/http-mime-truncated/README.md new file mode 100644 index 000000000..4758eef00 --- /dev/null +++ b/tests/http-mime-truncated/README.md @@ -0,0 +1,7 @@ +# Description + +Test http mime truncated file + +# PCAP + +The pcap is an extract from SURI_TLPW1_files_sha256 diff --git a/tests/http-mime-truncated/input.pcap b/tests/http-mime-truncated/input.pcap new file mode 100644 index 000000000..37900bf76 Binary files /dev/null and b/tests/http-mime-truncated/input.pcap differ diff --git a/tests/http-mime-truncated/suricata.yaml b/tests/http-mime-truncated/suricata.yaml new file mode 100644 index 000000000..9261be0b2 --- /dev/null +++ b/tests/http-mime-truncated/suricata.yaml @@ -0,0 +1,16 @@ +%YAML 1.1 +--- + +outputs: + - eve-log: + enabled: yes + types: + - files: + force-hash: [sha256] + +app-layer: + protocols: + http: + libhtp: + default-config: + request-body-limit: 100kb diff --git a/tests/http-mime-truncated/test.yaml b/tests/http-mime-truncated/test.yaml new file mode 100644 index 000000000..4a3fa9e4c --- /dev/null +++ b/tests/http-mime-truncated/test.yaml @@ -0,0 +1,16 @@ +requires: + min-version: 7.0.0 + +# disables checksum verification +args: + - -k none + +checks: + + - filter: + count: 1 + match: + app_proto: http + fileinfo.sha256: "0adad78526c1b9c35f349a2cc7014c458aa87adcb9ec86f052fd8a9a80584e39" + fileinfo.state: TRUNCATED + fileinfo.size: 101422