tests: update gunzip / zlib_deflate syntax

tests/transform-gunzip/test.rules

@@ -1,5 +1,5 @@
 alert http any any -> any any (msg:"from_base64"; http.uri; content:"gzb64?value="; fast_pattern; from_base64: offset 13 ; content:"|1f 8b|"; startswith; sid:1; rev:1;)
 alert http any any -> any any (msg:"from_base64 + gunzip"; http.uri; content:"gzb64?value="; fast_pattern; from_base64: offset 13 ; gunzip; content:"This is compressed then base64-encoded|0A|"; startswith; endswith; sid:2; rev:1;)
-alert http any any -> any any (msg:"from_base64 + gunzip + limit"; http.uri; content:"gzb64?value="; fast_pattern; from_base64: offset 13 ; gunzip: max-size=8; content:"This is "; startswith; endswith; sid:3; rev:1;)
+alert http any any -> any any (msg:"from_base64 + gunzip + limit"; http.uri; content:"gzb64?value="; fast_pattern; from_base64: offset 13 ; gunzip: max-size 8; content:"This is "; startswith; endswith; sid:3; rev:1;)
 # will not match as we limit the output size of gunzip
-alert http any any -> any any (msg:"from_base64 + gunzip + limit"; http.uri; content:"gzb64?value="; fast_pattern; from_base64: offset 13 ; gunzip: max-size=8; content:"This is c"; sid:4; rev:1;)
+alert http any any -> any any (msg:"from_base64 + gunzip + limit"; http.uri; content:"gzb64?value="; fast_pattern; from_base64: offset 13 ; gunzip: max-size 8; content:"This is c"; sid:4; rev:1;)

tests/transform-gunzip/test.yaml

@@ -1,5 +1,5 @@
 requires:
-  min-version: 8.0.4
+  min-version: 9
 
 args:
   - -k none

tests/transform-zlib-deflate/test.rules

@@ -1,5 +1,5 @@
 alert http any any -> any any (msg:"from_base64"; http.uri; content:"gzb64?value="; fast_pattern; from_base64: offset 13 ; content:"|78 9c|"; startswith; sid:1; rev:1;)
 alert http any any -> any any (msg:"from_base64 + zlib_deflate"; http.uri; content:"gzb64?value="; fast_pattern; from_base64: offset 13 ; zlib_deflate; content:"This is compressed then base64-encoded|0A|"; startswith; endswith; sid:2; rev:1;)
-alert http any any -> any any (msg:"from_base64 + zlib_deflate + limit"; http.uri; content:"gzb64?value="; fast_pattern; from_base64: offset 13 ; zlib_deflate: max-size=8; content:"This is "; startswith; endswith; sid:3; rev:1;)
+alert http any any -> any any (msg:"from_base64 + zlib_deflate + limit"; http.uri; content:"gzb64?value="; fast_pattern; from_base64: offset 13 ; zlib_deflate: max-size 8; content:"This is "; startswith; endswith; sid:3; rev:1;)
 # will not match as we limit the output size of zlib_deflate
-alert http any any -> any any (msg:"from_base64 + zlib_deflate + limit"; http.uri; content:"gzb64?value="; fast_pattern; from_base64: offset 13 ; zlib_deflate: max-size=8; content:"This is c"; sid:4; rev:1;)
+alert http any any -> any any (msg:"from_base64 + zlib_deflate + limit"; http.uri; content:"gzb64?value="; fast_pattern; from_base64: offset 13 ; zlib_deflate: max-size 8; content:"This is c"; sid:4; rev:1;)

tests/transform-zlib-deflate/test.yaml

@@ -1,5 +1,5 @@
 requires:
-  min-version: 8.0.4
+  min-version: 9
 
 args:
   - -k none