From 87dbc81b259992a64481098512a4876dd8b1a6a2 Mon Sep 17 00:00:00 2001 From: Philippe Antoine Date: Thu, 21 Dec 2023 13:17:15 +0100 Subject: [PATCH] Adds test that we parse http not as 0.9 Ticket: 6643 --- tests/http-not09/README.md | 11 +++++++++++ tests/http-not09/input.pcap | Bin 0 -> 13762 bytes tests/http-not09/test.yaml | 9 +++++++++ 3 files changed, 20 insertions(+) create mode 100644 tests/http-not09/README.md create mode 100644 tests/http-not09/input.pcap create mode 100644 tests/http-not09/test.yaml diff --git a/tests/http-not09/README.md b/tests/http-not09/README.md new file mode 100644 index 000000000..dd731b818 --- /dev/null +++ b/tests/http-not09/README.md @@ -0,0 +1,11 @@ +# Test Description + +Test that we parse weird HTTP not as HTTP/0.9 + +## PCAP + +Crafted by running server `python3 -m http.server 8000` and a dummy client sending hardcoded data + +## Related issues + +https://redmine.openinfosecfoundation.org/issues/6643 diff --git a/tests/http-not09/input.pcap b/tests/http-not09/input.pcap new file mode 100644 index 0000000000000000000000000000000000000000..acc9a0e3921f39214b6761fd97d91b802058a4ea GIT binary patch literal 13762 zc-ozt&yU=;701_35EPqBn)Kj9fo!&ypv}za_m5z+abRzqp!tQ^KIF8Z$fp^_n$cK4 zcD)9i258ZsKrX%YS|C027WCX(|AGK5&>VW`r6|(>A?c$?jWlaNYTU){@Js6R-lHf| zBDtf#{q@g(xVrc3UjL)?XFvTl{QWo2@7+W#|E}WS$==>|`Fs7jy}e)V?Ol<7Uw`xR z^+&;%ccjf%SHJ)MI}h1s-~7jwXP$ZP%9S7N|Mp-1zSVlYs(ilk`MA%QuYdi`e;)qg zMf7|3s}~>l`MYQS(n!CZ&l&oR&{x#^^oV-iMZYh7_QJLQe)lRC>iS84($DKV_|bKH zN%|W4>FOl?yor7av@d!;_l)(qhJH@B>vQYm&cST|=jw9D@@SpaIUL{2O5k--UL53ERcEXDL0Xgtv!j_hyni&)UXnswNS`)sg2xaj@uSJ{ zBhQYH*ukQN^o_$Qmlc~JxMcO=@mBU|#*U9>NMAC!dHeJ>h5^JoNul$so*^a^1F~om zO-W?{v-wKJ-DnEV=k;=WvCNU}B!!mPj`adW!K>*7YfUZ}5vHd}ljQ=dt_6WH-ge>X z(mOovH3?T)4Vu-GLi4I-H8zJ96xP%Qj+tq-KysrE@Y2Jmobd(Bl*OQcFiR%YB1>x! z(=})7!{hBdWyGq*bbW!e5)=k2zL;{vlrUjX%`}IK0dp%WOu6Y5;~qFLQjHPng%GokJ&T2NS? z;Uh{p>?DO2%QY)OkD6i5V35h{rv-_v^mXnO4W`+AI&Yw=T6mK)8!R^PVg#IKtDeQo zIR5Dt|Ebv^mmQ+lX1H9ly03YgGaJbJYSTB2%8r;cNzXTl5pGK8*rtRrbjtXE#@r4D z6WBJHj7Ir%U|?wby3FK5yHnIi{NTfn-+BKQjzT3!f91M$hKT_wK|>{&u%066fwuKE!P(=hY%d@_?w_R^2VT^l?H+B@{}h4f#rIk9K@*~#haiz^2VTnNG!(uKm>ssScv+>e^up`@r zFbbnC=&rmmXb85SBtExn2!-$i4|^eY$-wn^8pgJ8nQzAoHrI4l-WW7;eb0-$G-Y@S zjt~ySwk2XO#vYU4FK|Ef!r1A8?#dg33UGaw#V$+Sz_pUpwzz}7M3mTp<2ni8g-V&V zxu(1F#-Jd0#yq}T?m0?uIiNmby?r&AR8fGyW~yAQCD1e&re*NwH2B#KM_cB#=R3QWQA9fmip zAd0}XA_uszL*~opv?Cl>Kq73g(b0}16)2M}s(bVxW5VT5-AvQ1rr?~_;7m%{h`pxZ zk}bOhY_E-QSL;4Q;q@A)GXwU?8s>_V$^^D|_f8o=b?fPr2`r1c(4>?m^g?qN2I#(OHcSmrSt+QjOi;Tm z+o=(->PeGNIbc<4fOHSbjXf+^6E`hrjJ5p?69dv;EjDtw66Gy1cq*Mi2{o+)orviY|2gwY!3rD=M2tWpwcYq>Vman0%)%2lNwgIih3 zgyT{`Io8SmIuqNPy75fGU2fc9TC;LGf4F6)%P8Ya$VqFPP)J^=e~oHEVFm9x=tffL zMZG9iGOQ8=c3<9k?~^y)`?>5P>I(Flf}4y_=JJu$DFb-ct(XQG8egrH*A;mpADz5) z^SzVl5@+%oNuW4jRWH$k#4un9OIX!a$8VQVhSj?J(!)klXrne|RBD3sMd-B&K4mMG zUsPFF@5joF#&R>~RFAizgUjWlld5h{sj6oNWYW$+lP1+{pEnrs;!NXG8NkIo&7m-0 zd8M(OY<(PS)EKMSxqJk)359eIZu3)HeQQrvrc(rX`{c&mkKVcSaof=c8OpEP7iufe zNeaa!V9T{B4LKd<7%{iQTqCB2i53*L#O1r1aBL)nmU72beo{cS=o6ACUpr9w#;T(HXh${-5W=uSr1)&OA{+j zcoe5rBEX5AfO8iF_zpULN{f-efk;Vodn>g zp^vNBFys)$+>QM{@U9jkfm5G34p@T6foIwH6NAI!Fvigm<4HJ4lt!*4!ane>7G&T$ z(-ZuSq|oJB%>uNbFq|DqNG1lP3))EvU3d4gwedc-wl|z@1j}x&&?y>hr_?GXA*Xle zjQG32R5pwf6xP&D*EF4^&qo3E%{