From 5e6060b8fdca1bc68bef824b51f60ce9a022617b Mon Sep 17 00:00:00 2001 From: Philippe Antoine Date: Tue, 5 Mar 2019 14:09:05 +0100 Subject: [PATCH] Adds a testcase for http invalid request line --- tests/http-request-invalid/README.md | 7 +++++++ tests/http-request-invalid/input.pcap | Bin 0 -> 54007 bytes tests/http-request-invalid/test.rules | 1 + tests/http-request-invalid/test.yaml | 15 +++++++++++++++ 4 files changed, 23 insertions(+) create mode 100644 tests/http-request-invalid/README.md create mode 100644 tests/http-request-invalid/input.pcap create mode 100644 tests/http-request-invalid/test.rules create mode 100644 tests/http-request-invalid/test.yaml diff --git a/tests/http-request-invalid/README.md b/tests/http-request-invalid/README.md new file mode 100644 index 000000000..6b145203f --- /dev/null +++ b/tests/http-request-invalid/README.md @@ -0,0 +1,7 @@ +# Description + +Test http invalid request. + +# PCAP + +The pcap comes from https://redmine.openinfosecfoundation.org/issues/2655 diff --git a/tests/http-request-invalid/input.pcap b/tests/http-request-invalid/input.pcap new file mode 100644 index 0000000000000000000000000000000000000000..fdf5dce580c39bc5f244a8ece71326399a191b1d GIT binary patch literal 54007 zc-rkqHwcFAj!KkyL%tpt?mw_yAx9Mb-6nsQAu&0-Ra$( z-0aLUGkd2K0#uN4VV5C>RQSVz7$giPF%T01F~o7OW4>a?K>`zOa0CWHtONwO06U?` zdp#dFGrK#dqYy4kUuo`kXS#p=`t|GAuix~q^wjt7y|rC9QJDWZQD}qT2fldsAN~B6 zHsKH8GhR!Db04|tG5CGmUvFM2j0(cQD>q*tT<|IRU;gBsg!?uNV>^%jLPCsN z+RbHeTq6kWCoZ|~#P+3$!#!{R9o}y{;e?YA`Ny}0kQt_fkH~_6$QuiYis-`FeVcE7 z>Px2pdghkjyOhlQ=RER5C;rnCME8&n0rEOPUDr(J?pOYb$^5SonKOXCZ0|DRVCU_O%IZ?E<@^h;47Z@-;;K{AZdXo-Vxn*7;$?v27ERL{fEy?h-3@RU;cF zC$nC(bxFf2Pyvi&(R+uJAh^om^_iR~6O(`(CAhbLQ%-KwU^QjeG+D|Y~dF>8^n zlO&rFGiwOk=S`Pw`j3$ z()2jJv`#JCf&u7AbR;yRtm=a$!#JlVTh^>$DuV^t>`0(Nyt*%BVqxR$zIqQD#1H-_ zV!X?C9)0O`FtH=2CLM$D3>Oil+uDRLoguI*ig?DJt1m~yJ8x@+*ztH6(X%L$%Vfy5 zO&y65&?lOYo+7y}vbJWzlWZT!^yj;B`D~V4xMi{o0=q|vQOlC0QvEiXx6gyL+MXqaVba@?6OS*+}SOxuB)qGBt_p~L`d5GIjs z4K{%R74r?N(1G7x8|SOpv`Qm-j6 z@Gw>|KHcd|S329z9!^lu2sUm(>zZ8Gi=Z+`~LrqfJ}3YC>1 zR&}6CZJE_g!+cR^29rTOCrQ!yHkkAkzJ?SlvT0F!aQo!?bYGH4E|RU<8Xa=1E$7M( z-73j-%_d{ajcl|D%)Du9KynH@6)k&Cqr`^x+-8cFl_XWFsPbUaDw>q)Ona-zWvoI~ zHbF;ulBw+qUTfGx=(yv2nmoNc0lx}{GM94f4!~#o6gR56dYvxN?>TZhjpk_Nav9svE z%Fvl2XqlS6l!`hdR%KP6s)6D>K@G?Fz#UWYs4y!W7)7;enhdSmazUf6ShK2vlddn5 z@q6OvEnP5d+oB8xHYFNXXR@$#vihdBMnYr;ix}E_4T1yIe%l+6SV4#W7Y93)l3@c zW1p*;zNXH+&wbJt5+&?vvJqF~`V$4*9aWk-A+HMyP5VF}9Zb~*y%vw5o1sqno_B%K zck0%)RO^SD8aG(kXaio|kS`3ad%doC^~RZ3-)R5vx?IE#JezCj$RdkhZpASzeqoWP zOo){(YbDq4NG{vGKCXJ%q;sw7_pk5o>g)CEizUr~&YpOn-TBy*B3Vno~z(VEZBKF_&$qg=HVQDJHjBkle zh9opK8%-^K>V*5+qDY{pam7L%Z59g-kE|cIyt&^av~rs6R%ktEhbj1eg>|%!|@XtrnVoB9lFAcqON>ejYmD-$0E{2A!ic!}TSUrYJTGQkrbt<8G4@iX}vQjgO zn3`$^KVaKK(u{0kUW{ds0?G0L2_CK@1zIvp%92g0UdQHPu$`f#*l{!1nV@zCq*`zm zG&e6-c`~#hLl|XNWeqLLbW8;MObbr`WnF>&f_|<|rgdW$#*k^$RW)d*0h-O3lv~C$ z3g9~CqQl{7wpa(7)omzH*X0>m)zHrnr4G6@8h~*@hKVHWMcULF5EvT-S3p2dmTK8n ziqv3pY&m*_xW#Y%T#LvG?Bk)3i9tf629IH8huuhX7vekl1}EbDI9{>t&d_Zzm@_J! zJ#K!*nR(EA&k1~}uYvZcTx|}LVzy(|G?@resxMN=Q&pk{$g>SOSgt0Iw%n`X*q?X0}0@U{xTd6ARby-UeIe&4T zC8{$w(CN6nN`p|$&$RHpAdqYYJS21Q=n-9S6P+vzt!2@{(q!;HHtRif(=)}O5@J^) zG*21Tu4%@sm5-CggkWEy_WXDz_CQ?ge!(3`DY3^b{CNy`YldlC?tS=PH54liJ_nqN z;upjRt3?Pslu+H(^VRS}L$yd5^g>o#p-`_(8tPYFYgDuUP*Yn!bQhnX0+=Cqu?9NX z@L*fj4V$ zP>lvKKgs~np zmI+y(!XCiz)|I#`&=LY2*)xl_zL+%HRB~r(=Jw>(L2Axj}w%9y| z`Dj&yGuhD*e)>q1o@H2u|SleNxQk)$gONwBq4&k9K zDqh6ytc{@1K-^lioivFUJ5+_CVNe7*R0fUvJ2Zk2uCwOC=5SVp;8Zu9#2!oFFrgNR zmYS+#p-~Qg4+iq?UVpKvhCs3bwsodq*e#O{-sY2xLn-T+8eTBV(0tFgZqCz9%Gja51F1Ak2$^gUmGHzh2 z!32ge#$qT>K9G$z&NPlj5nL^pkB`gt@bY>=4(y?g^fOK1S{R75q4f=m!a zt+eV8B(m+kBa>y$xH(8n5mx0nHmh+`Lp*6yjP+UTEi)agWxxA#K5%dw-mn1;PnyU+ zzI9%~n}EKJ1w{bOG-O&`2Y#_pZ@|MXM^&D7)2qg;9tw6r%R0V0@X$m*NAG9K8q>%I z9_yG zk`2Zz<{(o9iWH~812j~h_Xv1!6dMx5r$-&pq|aGkBSq@jadL?6f_VY@YCr@GS8n#! z%S-H=zJg_#U$acMRwTQZM_j~j6du+oPb36tnW~^1sj5QFQ^Jv5{#TZ-%%r~f7*U^T&y0psys*e4^!U^QlM=m*#Y22f0~9F9-g+{%(Rk2NN3 z9#Ho#Yx`=mq|K!p6LE<97~-Q%5j%s3@BY$5T)8O`cZmKA>=6Ag!fBufR6sqtw^KOs zQoEl9x&cuUv3FCfjQg34k3?iV3aEb)?)AGz5cOF=oVxYo82-!ihY@l5G9PiPFm_$# z$)7dlzx1B^oX3AbK_T#-x8_P8R5{PbH(7snMDdtuMRmjn7a$Q3#DdqJ+qGlvk}L;f`&x7Nb$ zZ!(#`6Os8GK))i)6}jYWL`K9v{?$_9wKjoW4P22!yYE88A1!N&h+L6W7?E>Dj_3cC z@*xsQKtde-1HW1tGf!Xa$I&lmB9?l^;Jx$!5=rho&6}r=l_FyG?WHk9k{9!c*#DEJ zh#?}$GcO?G;)o<&=W!wlCz5a?2`7?pA_*swa3TpOl5ipkCz5a?2`7?pA_*swa3TpO zl5ipkCz5a?2`7?pA_*swa3TpOl5ipkCz5a?2`7?pA_*swa3TpOl5ipkCz5a?2`7?p zA_*swa3TpOl5ipkCz5a?2`7^L&JjuQsP^8sW61<}Gcv(L;iLcbzzcg`dnQb&xMVpV z*G9zE?<^Hov*I69sb_3zs2G2?o5WPlNI8gZ2yo>fk#hi zcV)8SGuTB9R>YRaujfw#tCo@O>+9)Hv-9@zC$ibO>%fWZjiZz6og>-oNlwhLL)h+7 z>LK@RvU{31(r5qNuzR4vJbY1Nm3N$b{4 zxQ6K2AsS8QomexxhneAnjb?cCK`_H_H8aDZcVbx$BaGFsB5a07A7p0ODIB@#*{~TR zqPX(YaWeiblkwY4WPE6EXGq43C*$GOpN^Apl*za}BI84VdJvfxS3Ty-_!6SN4Tujv z`WfLr01dA;;gT!g|4l+TR}k76;u9DDJKXJ@xd+hNUVs1n-#q&2Nt$r~`Oj`iPmHb| zAKpM#2e~@iCMNN}FXTJJq^KN9?eZHQuZ(pg||ecB?IB)dI$O`rIy6-wl*;i)O&yLkHxq!w(tGIzUI8GYkb}oBA=gLvN+z>c-sxT zCjfmv^0xMWG059`QATtRc`G2dwx3OmW%b@aMr7U(=#ydI)-}r!84<4s#P75T>}ud` z-Lr`~@Bh1?DdOqE%WwW~7?Ja~7Qx&45NTN5j!A3ck{D;O<0c%;H+~c`yvcp?OxvBkebY-*s}T7^jMHsu-t=ajF=nigBtKr;2f^7^jMHsu-t= zajF=nigBtKr;2^zsA8C6p_$mE4dcJO_wB}{%^i1zsbcdh5q0ubQ#hT%_m>K>pgoj1M%C@%k`T?3$IHj9*(9E8{nqj1Na- zydF?Li(HP*ANn#D5S8U%e;7*@dy-Mb?*4dF#omQ}e)h@OejZ@`yzArL&tId>9gOYg MLDtW2e!Tnn|9dvQJ^%m! literal 0 Hc-jL100001 diff --git a/tests/http-request-invalid/test.rules b/tests/http-request-invalid/test.rules new file mode 100644 index 000000000..03a06775e --- /dev/null +++ b/tests/http-request-invalid/test.rules @@ -0,0 +1 @@ +alert http any any -> any any (msg:"test"; flow:established,to_server; content:"login=foo&password=bar"; http_client_body; app-layer-event:http.request_body_unexpected; sid:1; rev:1;) diff --git a/tests/http-request-invalid/test.yaml b/tests/http-request-invalid/test.yaml new file mode 100644 index 000000000..e2e2f7d61 --- /dev/null +++ b/tests/http-request-invalid/test.yaml @@ -0,0 +1,15 @@ +requires: + features: + - HAVE_LIBJANSSON + min-version: 4.1.0 + +# disables checksum verification +args: + - -k none + +checks: + - filter: + count: 2 + match: + event_type: alert + alert.signature_id: 1 -- 2.47.2