Suricata

I could think of 2 ways to approach a feature like this:

1. as a transform, e.g. "decompress_gzip" or something. However this would only work for the start of the body, as we need a gzip header of the compressed data

2. a "config" directive, e.g. something like
config http1 any any -> any any (... config:force decompress_gzip, scope tx;)
However here we'd run into the problem that this rule may run too late and normal body processing may have already started.

I guess a 3rd way could be to just probe the body regardless of http headers, and try to decompress it if it appears to be gzip. I wonder if this could open the door to false negatives though. Insert a fake gzip header and confuse suri.