Adds a test about filestore

That it does not store too many files
OISF · Dec 7, 2023 · 549fbbd · 549fbbd
1 parent 0a31d52
commit 549fbbd
Show file tree

Hide file tree

Showing 5 changed files with 40 additions and 0 deletions.
diff --git a/tests/filestore-dont/README.md b/tests/filestore-dont/README.md
@@ -0,0 +1,12 @@
+# Description
+
+Test filestore does not store too much
+
+# Ticket
+
+https://redmine.openinfosecfoundation.org/issues/6388
+https://redmine.openinfosecfoundation.org/issues/6390
+
+# PCAP
+
+The pcap was manually crafted to have HTTP/1 pipelining POST request  with multipart files when the first response is not over
diff --git a/tests/filestore-dont/input.pcap b/tests/filestore-dont/input.pcap
diff --git a/tests/filestore-dont/suricata.yaml b/tests/filestore-dont/suricata.yaml
@@ -0,0 +1,15 @@
+%YAML 1.1
+---
+
+outputs:
+  - eve-log:
+      enabled: yes
+      types:
+        - files
+        - alert
+        - http
+  - file-store:
+      version: 2
+      enabled: yes
+      force-filestore: no
+      stream-depth: 0
diff --git a/tests/filestore-dont/test.rules b/tests/filestore-dont/test.rules
@@ -0,0 +1 @@
+alert http any any -> any any (msg:"FILE HTTP filtore"; http.uri; content: "pipeline"; filestore:both,flow; sid:2; rev:1;)
diff --git a/tests/filestore-dont/test.yaml b/tests/filestore-dont/test.yaml
@@ -0,0 +1,12 @@
+requires:
+  min-version: 8
+  features:
+    - HAVE_NSS
+
+args:
+- -k none
+
+checks:
+  - shell:
+        # if there is this file hash, it must have the full 2048 bytes content
+        args: not test -e output//filestore/eb/eb076a2ec6ced9ee2e823e098446513cf5b2bb60fbcb04e6c85dc23dedaa414a || ( wc -c output//filestore/eb/eb076a2ec6ced9ee2e823e098446513cf5b2bb60fbcb04e6c85dc23dedaa414a | grep 2048 )
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		alert http any any -> any any (msg:"FILE HTTP filtore"; http.uri; content: "pipeline"; filestore:both,flow; sid:2; rev:1;)