Adds test about HTTP2 disabled

diff --git a/tests/http2-disabled/README.md b/tests/http2-disabled/README.md
new file mode 100644 (file)
index 0000000..19d06bc
--- /dev/null
+++ b/tests/http2-disabled/README.md
@@ -0,0 +1,7 @@
+# Description
+
+Test HTTP2 traffic after HTTP1 upgrade mechanism, with HTTP2 being disabled in Suricata
+
+# PCAP
+
+The pcap comes from https://wiki.wireshark.org/HTTP2

diff --git a/tests/http2-disabled/input.pcap b/tests/http2-disabled/input.pcap
new file mode 100644 (file)
index 0000000..a77847a
Binary files /dev/null and b/tests/http2-disabled/input.pcap differ

diff --git a/tests/http2-disabled/suricata.yaml b/tests/http2-disabled/suricata.yaml
new file mode 100644 (file)
index 0000000..e23f536
--- /dev/null
+++ b/tests/http2-disabled/suricata.yaml
@@ -0,0 +1,20 @@
+%YAML 1.1
+---
+
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular
+      filename: eve.json
+      types:
+        - alert:
+            tagged-packets: yes
+        - http:
+            extended: yes
+        - http2
+        - files
+
+app-layer:
+  protocols:
+    http2:
+      enabled: no

diff --git a/tests/http2-disabled/test.rules b/tests/http2-disabled/test.rules
new file mode 100644 (file)
index 0000000..aa69184
--- /dev/null
+++ b/tests/http2-disabled/test.rules
@@ -0,0 +1 @@
+alert ip any any -> any any (content:"Sitemap"; sid:1; rev:1;)

diff --git a/tests/http2-disabled/test.yaml b/tests/http2-disabled/test.yaml
new file mode 100644 (file)
index 0000000..a6dd9ff
--- /dev/null
+++ b/tests/http2-disabled/test.yaml
@@ -0,0 +1,28 @@
+requires:
+  features:
+    - HAVE_LIBJANSSON
+  min-version: 6.0.0
+
+# disables checksum verification
+args:
+  - -k none --set stream.midstream=true
+
+checks:
+
+  # Check that there is one file event with content range.
+  - filter:
+      count: 1
+      match:
+        event_type: http
+        http.url: /robots.txt
+        http.status: 101
+  - filter:
+      count: 0
+      match:
+        event_type: http
+        http.http2.stream_id: 0
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 1