From da5e882a53b93db6633341ee50d1addd7ae53070 Mon Sep 17 00:00:00 2001
From: David Beckett <david.beckett@netronome.com>
Date: Wed, 16 Nov 2022 16:55:34 +0000
Subject: [PATCH] Add test for brotli content encoding

---
 tests/http-brotli-ce/README.md  |   2 ++
 tests/http-brotli-ce/input.pcap | Bin 0 -> 6744 bytes
 tests/http-brotli-ce/test.yaml  |  33 ++++++++++++++++++++++++++++++++
 3 files changed, 35 insertions(+)
 create mode 100644 tests/http-brotli-ce/README.md
 create mode 100644 tests/http-brotli-ce/input.pcap
 create mode 100644 tests/http-brotli-ce/test.yaml

diff --git a/tests/http-brotli-ce/README.md b/tests/http-brotli-ce/README.md
new file mode 100644
index 000000000..d5f136a5b
--- /dev/null
+++ b/tests/http-brotli-ce/README.md
@@ -0,0 +1,2 @@
+Chrome 107.0.5304.87 HTTPS decrypted via Mira ETO
+HTTP content encoding br (brotli)
diff --git a/tests/http-brotli-ce/input.pcap b/tests/http-brotli-ce/input.pcap
new file mode 100644
index 0000000000000000000000000000000000000000..3eb24d46e788a54d5854c93f2b4c32af9f97b310
GIT binary patch
literal 6744
zc-rk*3v?4z8ctu>jZ_6hSrMHL+LlA7nLOJh&bCR~rb(MNZPKPxBuppMWZKEhbY}7@
zc9)0ZDi1|D%Ib>PZe@Y8YEjq)#e=A@3Kh$%g<V+}mWQh#0u?zH_D)JEEiHIFd-fdH
zP0uu)|K9oTH*^30`@b{Yv$g%@cuAsU;FBnc1Hbns2l1`9#Y=49Z}B+0I9v0kR5E%>
z&#INll6;BefpJ`}BzIJAZQIz?b#2|N^L9*++msINS|Vbsh`;dF+-D?`_{5|)662Gl
z()N$<7UOXV2{(zzvJaB3AopSR;rAg+B)JmpsJpsFR1rOH(~jw9<}GUm=ufX0d+E~N
z&KR;+L_YBg<w_A9ASa8+dpeUOCID(0j<b3kALASt!ue@{-ZJ~PxSlvK;20<J-8EK3
z77>~3(UNZxB(Y;CV#0~pJ`r)@d&47My40ON7}1jNg5)?8U@1Z%<UE0KxIYJ{NP-qn
z+|Mxq0%ig<nd;*`9N8ZsA_9!jye~Dv^CT*yHlV2tDWFIyQ!Ai~RMv-6s1k`?L!)YC
zDj)RK6H(M?ZN!{WQ>j3z19n&&(Yf>JYHOX9h~`%)6{W1Hs=;mYg`q;1%OO`}DpI6{
z3@_-Ra5$XlV;CPrWCErsQZqx-1TK&at%vFff`u`P3=t{PD%cz&4(DM4riaW{r7~KU
zZ)Iz0Y{oK@rE$h&E+!n&aK5!(TUcx?tFx%_u*vMmVj7M4R?XCq9n9mi#F(`(D8_V-
zLNQjN%LXx9ol1;F<TQxYl}rWmERGNlVrYugN#Jk+A>e-4NeYA>q8XaFI%;RUu_%l)
z9Dnsd9wFW%5nzRAinM|!IN0a|H=&2@Oe0BAm|T;IK<QNqg#jui>0ktkWNSTI^%Tg+
zf=zQ1HASQ#*Ql~GRaz*$sL*9E&VVSgo`5U_Ue8Q{%&|R_E0C;AMErrASS`kpmoG_?
z8gZOp1vno(9xqAz^pLNSWHTTyQA=S0kpb0kSLPIBv@eMHz<m%jT;a?hXhQ>vWa`8%
zVd_Z`FLhO;+AOt7rB-;dl%6cDM}epn2qK=S)!HmAVt^D5kIh&P5=5zl6$)6Pg%uhD
zWXw0CMy#GDEp`(Ug|P^$plxoq4Th^U1=VbERix3T3O3m4%_@b>n5EK|C@bn%U8R~8
zjAoVE0F_wtP>n)?+SR<)6y)n_D9%=uS81jwUqJ!vuPX8jPNR*g!>j9^Zf2TB87%XZ
zy0Y+WYq_h~-QW$|iyh8To{dqJhaGHXv00Pdz&MK<r|HUybk->C58A7#uu5f#I`}M`
zAFERql$cE_!DJ1Ukgf_-&}g9}*4khcQR=*T5nFu($pTwzC&HM+Y4UoBD8slN!C;=t
z7Orut>97xw&Z|U?2<J403mfZ8><va6Lt8M4b2ussI1BG|n*2(&uTs+}U|4C`Y6PDY
zX^M0okb$&ANs>pBB(Y<tWF>_*7l@MOt{Ng)E$Pr6izox@tbH=jCs(`1_Lm%_L=dR7
zC`AfN2yCaD@Mb^?EmXpUAaTDSg+{N@=@r?K#qLUxIylT1!1}Tp!~G!N^CK+D5xgFP
zLG_x&7!0aa;23IPRt6LZ@&e2eAyBtouuiO^1+j2lQ5LK!0DY0yVIhpiIg%9&5bnn~
zo)FLqR{@+2YDeHm98Bhb2C)n$z@V6d94SQgPyma-AVE=;LZi|m2r>ZOKL>U&6p4eW
zOidjS5t!$2C`~NZG(!!>6EK(rrSSw+n`Y=+{>ls-NTG=$ZGy$hMangnQX!kj(o&jm
z8n~d3k~d0Y0TKrRj)*biF;Q8;d64F@TA-ZZo(IlInj*o%kY5m3@XW+7z2WkeB9Fef
zT#oZ>W|$QG10pDf<i0R3$Gw91q&bG?;ZlzDku+S&5;Rbe{`&+J0P(&djG~w@%rb0{
z<qgo~l>`Qr0Vr9Dw7f6iV)W1~nU7<FtV|yp%8-Ev>j4i|rdMioAV-i489{qlhNJ~v
zrhjmjEXYw{?hOcES?~&VS<^#JSLDT9sE0&dG#A1ZM%V%5r<UOYHyDO1362M?V1#J}
zL5jM;6eDPPBMgb6O^q;SA_bb@`R}nVTuk!92=m;GTdPiynhN@gr4&rCg0>c<DF*Wn
zWN#h`GMy*;dLAYSU~&M&4Nxsf5g_LXR92fQL<HHuB?E#kD!7y2LIelIJ<N-ZvdZa%
z9ULR{w^2k47I0#!016-k($Q(O=a-gSE!L70X{^?2K~@c*;{G6APXLZa3RG7J2l=Z)
zWqP$*B{P6JMEeuPuY#4j5eCW-4Km`8T08R4uq!nLNqm^N0SciqwKfBUMe)=Cy-5I`
zF0nZfDtb#c_kC#l$_o!KtC>I{^C{zuw3}`@^yT?UZAqV2(sTH>3D0leI_=ZvcHoZf
zb*D!)A4yx5d2{z!-|P)l`wt!dcJ2zSL*2aoMP_qvzb2OgIW8T}MjCr~QIqeRIarfl
z{Aa%=UphBfldF!cwd_zVsa)_v+<@d40_4Ks;PuC!6ycRcL*T#ehi}&mh6l2dFo0_T
zke1<abqpfnu30k#_k2I@dSoyz(%+%x9ZQl>@sijv)TqYKn7BhUs$YLT*r@KY0O(#3
zc5(MGMit|uG%lx!uz=NgSm0|I{s+6op@t2QX(*_%pP+3U-je+Y9aVqsZCW_`I_}81
zNlfW2hliweZ#uNELCn2?;s);MvastRb#}Hg8#oQkP!EHFT_$l%OgniU&(PPHm@4?{
z3kFn|W_X&ct^I#f{4X@c?`3iab<TdAVuJPwem$gBBR`~_{>WP9xQ<bh_jXP1IdyEj
zeNKGFUNpCm(B*|D&FZ#nOT6b@e{tBez&5KouWVZMzK>gk?5E}&7t;C6Ty$5_ZuzMl
z-+pq>k;LuytdZ}|+;Av-fAZXkIntV(Ig6HLxjq_`IK#P9efIFSis#5fPky+9ocGSs
zreA+^(%kv*&YTPXn02Q4vyTwCYD(de1nj_)Kb=}SIXd}>5cGf6wc?R;C-zM_qJtMs
z?%Gb?n>=BoY}Judn?8IfWGW^ux~Jx^YTIYr*kQ%Y2`Nwi+&(JeJ$^7v`u+zIeoM{C
zcQ))js5s<115J5rd_`bs!ifue4WXlf<`<rS``PA+_o&LJSI_Nv<(&3hKEusapXpfo
zK+6}EEn~)YjwR-2FC@N_oO`Tu?yFNZ=RIvFS9hu(cRYG`>n)gZ`RNl)r!(ZL9gog=
zr)6#VyNNC9ow#w2rB3(D&4<o7Ut98B*QqI=r!5HI^>$}n^UeF)|4`C$=c47&(ydD^
z&#zBE`+Jw&^mS$OEf;pL{A7VIXS2aFX~W-Ndo#4|<y*I}#k;A${V_RZ0YbVC=Pa5r
z;nsz0^|E&BUkm2nKQk}6cA|fq;jyqMujgN_x?g>B_RQyZKKNLc@#W5oFEwh~-Jb5=
z)L-?y(e%<<?#W{-n~pxwQFLp{{4LeTeitq)xg&MspI`4B|HbOo<FBl1YwNwkSz#IF
z`S{tHtLlQ!{MH?s+Pv$%V@r3c_VZ<BTh>qZwT>Z`6MnYl_RL&lRqn-8ub<c5{zQ9O
zS@18CIBMbJ<8M0sr9qV)*EK=%n~N*W2bRt`|ADB<$fD7b*+7nG4`(yDExn>9SG5k-
z<d&R%O<tZhSd+VEMP?q{dRyw8+{)H*M+5b*Z!Ef*b-D%rq`fbC+wavj_m)cD)@(m0
ziKy6cT-Vx+htuBQfA_2T$kC1oxJ2ah(5BIn<-nUPAI_gV_1$98pN#1l>`(SJ08ULJ
zA2l|NKLHNFqeRp>1c@qqe#JBo=Cs+0HNLVMJHk4BdA?K}^P*%b=|vSfM5Rz8npDQe
zasf2Rrs4vs(5A8+7*wiN|1n?l(|i&2KjmolgKX{IoghI$ri#bV>WP<s85OH%DmA2f
zn$n@Jonp2szZ%ies6pd{F88%z-^BQZ0CkOh8L2m4zoqKFM@#)d4b@2i4{_bCC;Hw@
zp#>Z%QUlqJ!`DzVKrANsQMm!~G69UF(W@%X0L5M*5#Srp5NiwVE3F?{Gd}>5>A<m3
z*ZHr+nq*P>h_1oX*R}J^yw=F<F_$i#EF3I-B4S*#^a|oN;;wd<i|M&-@!<4qjR4e+
j7@}oxdWwhzS0P@@(XJIaZe2ZuV+TNuiV5G3*w69b2hP*k

literal 0
Hc-jL100001

diff --git a/tests/http-brotli-ce/test.yaml b/tests/http-brotli-ce/test.yaml
new file mode 100644
index 000000000..1bfd70da9
--- /dev/null
+++ b/tests/http-brotli-ce/test.yaml
@@ -0,0 +1,33 @@
+requires:
+  min-version: 8
+
+checks:
+- filter:
+    count: 3
+    match:
+      # 2 RESPONSE_HEADER_REPETITION for Accept-CH and 1 RESPONSE_BODY_UNEXPECTED
+      event_type: anomaly
+- filter:
+    count: 3
+    match:
+      event_type: http
+- filter:
+    count: 2
+    match:
+      event_type: fileinfo
+- filter:
+    count: 1
+    match:
+      event_type: fileinfo
+      fileinfo.filename: f.txt
+      # compressed size is 95
+      fileinfo.size: 121
+- filter:
+    count: 1
+    match:
+      event_type: fileinfo
+      fileinfo.size: 1743
+- filter:
+    count: 1
+    match:
+      event_type: flow
-- 
2.47.2