diff --git a/tests/filestore-dont/README.md b/tests/filestore-dont/README.md new file mode 100644 index 000000000..b1dd64828 --- /dev/null +++ b/tests/filestore-dont/README.md @@ -0,0 +1,11 @@ +# Description + +Test filestore does not store too much + +# Ticket + +https://redmine.openinfosecfoundation.org/issues/6390 + +# PCAP + +The pcap was manually crafted to have HTTP/1 pipelining POST request with multipart files when the first response is not over diff --git a/tests/filestore-dont/input.pcap b/tests/filestore-dont/input.pcap new file mode 100644 index 000000000..5e67b0727 Binary files /dev/null and b/tests/filestore-dont/input.pcap differ diff --git a/tests/filestore-dont/suricata.yaml b/tests/filestore-dont/suricata.yaml new file mode 100644 index 000000000..f168a4151 --- /dev/null +++ b/tests/filestore-dont/suricata.yaml @@ -0,0 +1,15 @@ +%YAML 1.1 +--- + +outputs: + - eve-log: + enabled: yes + types: + - files + - alert + - http + - file-store: + version: 2 + enabled: yes + force-filestore: no + stream-depth: 0 diff --git a/tests/filestore-dont/test.rules b/tests/filestore-dont/test.rules new file mode 100644 index 000000000..cce790919 --- /dev/null +++ b/tests/filestore-dont/test.rules @@ -0,0 +1 @@ +alert http any any -> any any (msg:"FILE HTTP filtore"; http.uri; content: "pipeline"; filestore:both,flow; sid:2; rev:1;) diff --git a/tests/filestore-dont/test.yaml b/tests/filestore-dont/test.yaml new file mode 100644 index 000000000..6530edebb --- /dev/null +++ b/tests/filestore-dont/test.yaml @@ -0,0 +1,13 @@ +requires: + min-version: 8 + +args: +- -k none + +checks: +- filter: + count: 1 + match: + event_type: fileinfo + fileinfo.sha256: eb076a2ec6ced9ee2e823e098446513cf5b2bb60fbcb04e6c85dc23dedaa414a + fileinfo.stored: false