Adds a test about filestore

That it does not store too many files
OISF · Jun 11, 2024 · a60b143 · a60b143
1 parent e8a1d72
commit a60b143
Show file tree

Hide file tree

Showing 5 changed files with 40 additions and 0 deletions.
diff --git a/tests/filestore-dont/README.md b/tests/filestore-dont/README.md
@@ -0,0 +1,11 @@
+# Description
+
+Test filestore does not store too much
+
+# Ticket
+
+https://redmine.openinfosecfoundation.org/issues/6390
+
+# PCAP
+
+The pcap was manually crafted to have HTTP/1 pipelining POST request  with multipart files when the first response is not over
diff --git a/tests/filestore-dont/input.pcap b/tests/filestore-dont/input.pcap
diff --git a/tests/filestore-dont/suricata.yaml b/tests/filestore-dont/suricata.yaml
@@ -0,0 +1,15 @@
+%YAML 1.1
+---
+
+outputs:
+  - eve-log:
+      enabled: yes
+      types:
+        - files
+        - alert
+        - http
+  - file-store:
+      version: 2
+      enabled: yes
+      force-filestore: no
+      stream-depth: 0
diff --git a/tests/filestore-dont/test.rules b/tests/filestore-dont/test.rules
@@ -0,0 +1 @@
+alert http any any -> any any (msg:"FILE HTTP filtore"; http.uri; content: "pipeline"; filestore:both,flow; sid:2; rev:1;)
diff --git a/tests/filestore-dont/test.yaml b/tests/filestore-dont/test.yaml
@@ -0,0 +1,13 @@
+requires:
+  min-version: 8
+
+args:
+- -k none
+
+checks:
+- filter:
+    count: 1
+    match:
+      event_type: fileinfo
+      fileinfo.sha256: eb076a2ec6ced9ee2e823e098446513cf5b2bb60fbcb04e6c85dc23dedaa414a
+      fileinfo.stored: false