diff --git a/tests/transform-gunzip/test.rules b/tests/transform-gunzip/test.rules index 47a25785f..d619b64eb 100644 --- a/tests/transform-gunzip/test.rules +++ b/tests/transform-gunzip/test.rules @@ -1,5 +1,5 @@ alert http any any -> any any (msg:"from_base64"; http.uri; content:"gzb64?value="; fast_pattern; from_base64: offset 13 ; content:"|1f 8b|"; startswith; sid:1; rev:1;) alert http any any -> any any (msg:"from_base64 + gunzip"; http.uri; content:"gzb64?value="; fast_pattern; from_base64: offset 13 ; gunzip; content:"This is compressed then base64-encoded|0A|"; startswith; endswith; sid:2; rev:1;) -alert http any any -> any any (msg:"from_base64 + gunzip + limit"; http.uri; content:"gzb64?value="; fast_pattern; from_base64: offset 13 ; gunzip: max-size=8; content:"This is "; startswith; endswith; sid:3; rev:1;) +alert http any any -> any any (msg:"from_base64 + gunzip + limit"; http.uri; content:"gzb64?value="; fast_pattern; from_base64: offset 13 ; gunzip: max-size 8; content:"This is "; startswith; endswith; sid:3; rev:1;) # will not match as we limit the output size of gunzip -alert http any any -> any any (msg:"from_base64 + gunzip + limit"; http.uri; content:"gzb64?value="; fast_pattern; from_base64: offset 13 ; gunzip: max-size=8; content:"This is c"; sid:4; rev:1;) +alert http any any -> any any (msg:"from_base64 + gunzip + limit"; http.uri; content:"gzb64?value="; fast_pattern; from_base64: offset 13 ; gunzip: max-size 8; content:"This is c"; sid:4; rev:1;) diff --git a/tests/transform-gunzip/test.yaml b/tests/transform-gunzip/test.yaml index c836e85b7..c73fface8 100644 --- a/tests/transform-gunzip/test.yaml +++ b/tests/transform-gunzip/test.yaml @@ -1,5 +1,5 @@ requires: - min-version: 8.0.4 + min-version: 9 args: - -k none diff --git a/tests/transform-zlib-deflate/test.rules b/tests/transform-zlib-deflate/test.rules index 5b1f5ecc5..71b36195f 100644 --- a/tests/transform-zlib-deflate/test.rules +++ b/tests/transform-zlib-deflate/test.rules @@ -1,5 +1,5 @@ alert http any any -> any any (msg:"from_base64"; http.uri; content:"gzb64?value="; fast_pattern; from_base64: offset 13 ; content:"|78 9c|"; startswith; sid:1; rev:1;) alert http any any -> any any (msg:"from_base64 + zlib_deflate"; http.uri; content:"gzb64?value="; fast_pattern; from_base64: offset 13 ; zlib_deflate; content:"This is compressed then base64-encoded|0A|"; startswith; endswith; sid:2; rev:1;) -alert http any any -> any any (msg:"from_base64 + zlib_deflate + limit"; http.uri; content:"gzb64?value="; fast_pattern; from_base64: offset 13 ; zlib_deflate: max-size=8; content:"This is "; startswith; endswith; sid:3; rev:1;) +alert http any any -> any any (msg:"from_base64 + zlib_deflate + limit"; http.uri; content:"gzb64?value="; fast_pattern; from_base64: offset 13 ; zlib_deflate: max-size 8; content:"This is "; startswith; endswith; sid:3; rev:1;) # will not match as we limit the output size of zlib_deflate -alert http any any -> any any (msg:"from_base64 + zlib_deflate + limit"; http.uri; content:"gzb64?value="; fast_pattern; from_base64: offset 13 ; zlib_deflate: max-size=8; content:"This is c"; sid:4; rev:1;) +alert http any any -> any any (msg:"from_base64 + zlib_deflate + limit"; http.uri; content:"gzb64?value="; fast_pattern; from_base64: offset 13 ; zlib_deflate: max-size 8; content:"This is c"; sid:4; rev:1;) diff --git a/tests/transform-zlib-deflate/test.yaml b/tests/transform-zlib-deflate/test.yaml index c836e85b7..c73fface8 100644 --- a/tests/transform-zlib-deflate/test.yaml +++ b/tests/transform-zlib-deflate/test.yaml @@ -1,5 +1,5 @@ requires: - min-version: 8.0.4 + min-version: 9 args: - -k none