From 24a222ca22ba30413e68fc288fd7ced12a995a81 Mon Sep 17 00:00:00 2001 From: Philippe Antoine Date: Fri, 3 Sep 2021 11:09:57 +0200 Subject: [PATCH] Adds http2 range test --- tests/http2-range/README.md | 14 ++++++++++++++ tests/http2-range/http2-range.pcap | Bin 0 -> 10775 bytes tests/http2-range/server.go | 25 +++++++++++++++++++++++++ tests/http2-range/test.yaml | 21 +++++++++++++++++++++ 4 files changed, 60 insertions(+) create mode 100644 tests/http2-range/README.md create mode 100644 tests/http2-range/http2-range.pcap create mode 100644 tests/http2-range/server.go create mode 100644 tests/http2-range/test.yaml diff --git a/tests/http2-range/README.md b/tests/http2-range/README.md new file mode 100644 index 0000000..3ea272e --- /dev/null +++ b/tests/http2-range/README.md @@ -0,0 +1,14 @@ +# Description + +Test http2 file extraction over multiple transactions with range header. +# PCAP + +The pcap comes from running dummy HTTP1 and HTTP2 server with `go run server.go` with an eicar.txt file in the current directory containing the eicar file +and in parallel as client(s) : +``` +curl -H 'Range: bytes=0-10' --http2 127.0.0.1:8080/eicar +curl -H 'Range: bytes=10-20' 127.0.0.1:8080/eicar +curl -H 'Range: bytes=20-30' --http2 127.0.0.1:8080/eicar +curl -H 'Range: bytes=30-40' 127.0.0.1:8080/eicar +curl -H 'Range: bytes=40-68' --http2 127.0.0.1:8080/eicar +``` diff --git a/tests/http2-range/http2-range.pcap b/tests/http2-range/http2-range.pcap new file mode 100644 index 0000000000000000000000000000000000000000..0f149a6ca7a4265bdd07a1fec35e5db6e1d2dbea GIT binary patch literal 10775 zc-qyOdrVvR6~})D5`o7f&O?K(2{(@>fyH1G+W`Xw$Kl~BP{%e&uxS?8xWowp0*=}=L_%6{oT!cGp|ceU#`<->Zh}hUyV`Ic;;;eX5qvK z!#(p)W&+nXz4Afk#fA1ykSj8mfLRW#@;K9?qSFT4to{}Gi}$y}i-JDnAt$RMHAm2v zg)EvQYC?_;IQQWGdvVTZN%iCdXHl-Fq0YyZh9jY1FW2bvxl7F@<{W)vcVE=bnag&R znBbq;UT!Kk<>*`b!o5aEN4N{Fg^u-hmhLFAS@7+SP$=93FBX>;=jff?U0vZ&G}7H= z=URF?dV}rZZ83D2(Ho9NBV8SRfZ{LMxkF_k*iLrU&N&=S4u@ms5r@O$;J;k4?>Tx; zu&V>^dg|F|xUbq|G=r)fJ*Hxhwv>JWDZQbT(!=&Ve1B{Soad5q@`2MW=ZJaa%qBDE z{Z1qrIs|cX?%wWbcc{CwPccV{IpM?lzMZ+^z5q#X2*R} zjz^1II8?USCT(F&+#(}0wnNPl(IND@ow;n>s9mjWZfWCe1I~3N&TVa+3N_BAsyxyP z_qWD5ElD}~z;Vergyak7v5c$`PUS9HPFCn@p?9y~Po=zywLo95fX$Ao6{xE!_2~+N zk4l2AlHgmsVBvI09)G&~w236DZj_y;Meu=ax_W5A zUacI1GAG2q;R8RA4J>CuHOB%+&MB=NgEHqe_PCtD%2CVD4GT#BvhTzVjd8HYkmy&z#qnAXj8stqk$mL&OYEw5q=4rSCZ<%v2H)Gu&JMK(5HV(aI1nud^Ar1$0|P4)T!muU4k~qqYKM(Hv0| za`OCy{Fm@c;C!A`54P8vay?&R*I#BbZkKxZ7QdF9R;;Ak2%Xb$KVh-`aSmnsMb1OA z{V3<>e%6w!SP7C2(vLh{ayR`Xwe6=ll7jEyox>~TJRCA9D_1vvW>N9Hm?F!n_AJltCeF= z=6u2)R~xWatL10xB*XYOS~y|6w0A~r{Hx#megi%JeSDH>{2M(ppE(2ES*7uBn8jXb9q+%>I-a@V4sFV|gfHyJI` zgjS;|?0xI$PYOD0#}Jddj&mq?Epon8cO8rR|HNJUhgfTN-}*E2SyOb=rEB)7AtrY{ ziVQL7qPrH8?sRyJUZ10Rm&1d|!`h@>pxXy6?JcbwgEHs0L#*|gbpco#)avtZS~&(~ z&Zq2gZ2;CqwftC4=u)@WvBHU>-_NX8Yp;{V=NIYr`aA;@VjP>8^V)&CMyb6v{d&rd zT#-2e%#`u+I@bWVl5UI0L0;@*l7S;=t3(#f5j7#_FThFZu4z4#yB76)h26EqWVDrw zZRD1=oXUPlN9S~ZzmCOS$2pX{7C8^mU5EOaOKt%q4bqQ1U2;DFPD*!8b0~K$a+100 zmw}(sUGw~ZOMIuCpTb?g($9RtgSd^_37-W{N|zp!I-4y?wI)hUaOpqOByLvrcP?7o zYuY#kYMi^kVXz=^4rM_^4wJji8(=Na*#g+?oLYf?eL%S(T5`^6ph4~nS$vBkl7dbLvp#kRln*r#Cg!-#Q zC~__V=PcZRHqMz$%E63{$~lCz$!-4#+Wv2({jo~(U)9ShlKK7__S4ufG3Q%HcNQUw zmB{%eaE`$JN8+3g<)D4*q@V+dL9gX~zh{@x(d={Wb$MF6Mqi!RXRLSau3NvU@mr0> z`Uid!@CR)n?4i$%4&jkOjU0nAr)iM2j(mH7wNb5(j%wu?lsTj9acu;aM=3x511)%> A)Bpeg literal 0 Hc-jL100001 diff --git a/tests/http2-range/server.go b/tests/http2-range/server.go new file mode 100644 index 0000000..1abcb6a --- /dev/null +++ b/tests/http2-range/server.go @@ -0,0 +1,25 @@ +package main + +import ( + "fmt" + "golang.org/x/net/http2" + "golang.org/x/net/http2/h2c" + "net/http" +) + +func main() { + h2s := &http2.Server{} + + handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + http.ServeFile(w, r, "eicar.txt") + }) + + server := &http.Server{ + Addr: "0.0.0.0:8080", + Handler: h2c.NewHandler(handler, h2s), + } + + fmt.Printf("Listening [0.0.0.0:8080]...\n") + err := server.ListenAndServe() + fmt.Printf("lol %s", err) +} diff --git a/tests/http2-range/test.yaml b/tests/http2-range/test.yaml new file mode 100644 index 0000000..a3b204d --- /dev/null +++ b/tests/http2-range/test.yaml @@ -0,0 +1,21 @@ +requires: + features: + - HAVE_LIBJANSSON + min-version: 7.0.0 + +# disables checksum verification +args: + - -k none --set app-layer.protocols.http2.enabled=true + +checks: + + # Check that there is one file event with total length. + - filter: + count: 1 + match: + event_type: fileinfo + fileinfo.size: 69 + - filter: + count: 0 + match: + event_type: anomaly -- 2.47.3