Suricata gzip unpacker bypass
Suricata gzip unpacker may be easily bypassed by nested gzip/identity compressions.
I know there is option "response-body-decompress-layer-limit" set to 2 by default, but it is incredebly easy to bypass. Snort IDS does all layers decompression (sorry for comparison).
HTTP/1.1 200 OK
Content-Encoding: identity, identity, gzip, identity, gzip, gzip
alert http any any -> any any (msg: "RESPONSE UNGZIPPED"; flow: established, from_server; content: "Hi"; http_server_body; nocase; sid: 1; rev: 1; )
alert http any any -> any any (msg: "FROM_SERVER |1F 8B|"; flow: established, from_server; content: "|1F 8B|"; http_server_body; nocase; sid: 2; rev: 1; )
Expectation: alert sid 1
Reality: alert sid 2