tests: add 5929 test for http2

diff --git a/tests/bug-5929-02/http2_multiple_headers.pcap b/tests/bug-5929-02/http2_multiple_headers.pcap
new file mode 100644 (file)
index 0000000..e549d26
Binary files /dev/null and b/tests/bug-5929-02/http2_multiple_headers.pcap differ

diff --git a/tests/bug-5929-02/test.rules b/tests/bug-5929-02/test.rules
new file mode 100644 (file)
index 0000000..f717a01
--- /dev/null
+++ b/tests/bug-5929-02/test.rules
@@ -0,0 +1,4 @@
+alert http any any -> any any (flow:established,to_server; urilen:<70; http.uri; content:"dog/"; content:".exe"; distance:8; within:4; fast_pattern; sid:1;)
+alert http any any -> any any (flow:established,to_server; http.uri; bsize:<70; content:"dog/"; content:".exe"; distance:8; within:4; fast_pattern; sid:2;)
+alert http any any -> any any (flow:established,to_server; urilen:<70; http.uri; content:"dog/"; content:".exe"; distance:8; within:4; sid:3;)
+alert http any any -> any any (flow:established,to_server; http.uri; content:"dog/"; content:".exe"; distance:8; within:4; fast_pattern; sid:4;)

diff --git a/tests/bug-5929-02/test.yaml b/tests/bug-5929-02/test.yaml
new file mode 100644 (file)
index 0000000..2d563ac
--- /dev/null
+++ b/tests/bug-5929-02/test.yaml
@@ -0,0 +1,11 @@
+args:
+- --set app-layer.protocols.http2.enabled=true
+- --set app-layer.protocols.http2.http1-rules=true
+
+checks:
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 3
+