tests: adds a test for http2 with userinfo in uri

Ticket: #6426

diff --git a/tests/http2-userinfo-authority/README.md b/tests/http2-userinfo-authority/README.md
new file mode 100644 (file)
index 0000000..2e8b70f
--- /dev/null
+++ b/tests/http2-userinfo-authority/README.md
@@ -0,0 +1,7 @@
+# Description
+
+Test http2 event for mismatch between authority and host
+
+# PCAP
+
+The pcap comes from https://redmine.openinfosecfoundation.org/issues/6425

diff --git a/tests/http2-userinfo-authority/http2_userinfo_in_authority_1.pcap b/tests/http2-userinfo-authority/http2_userinfo_in_authority_1.pcap
new file mode 100644 (file)
index 0000000..60800f8
Binary files /dev/null and b/tests/http2-userinfo-authority/http2_userinfo_in_authority_1.pcap differ

diff --git a/tests/http2-userinfo-authority/test.rules b/tests/http2-userinfo-authority/test.rules
new file mode 100644 (file)
index 0000000..0037515
--- /dev/null
+++ b/tests/http2-userinfo-authority/test.rules
@@ -0,0 +1,2 @@
+alert http2 any any -> any any (msg:"SURICATA HTTP2 authority host mismatch"; flow:established,to_server; http.request_header; content:":authority: "; startswith; content: "@"; pcre: /:authority: ([^:]*:[^@]*)@/,flow:http2_userinfo; sid:1; rev:1;)
+alert http2 any any -> any any (msg:"SURICATA HTTP2 authority host mismatch"; flow:established,to_server; app-layer-event:http2.userinfo_in_uri; sid:2; rev:1;)

diff --git a/tests/http2-userinfo-authority/test.yaml b/tests/http2-userinfo-authority/test.yaml
new file mode 100644 (file)
index 0000000..fb98495
--- /dev/null
+++ b/tests/http2-userinfo-authority/test.yaml
@@ -0,0 +1,18 @@
+requires:
+  min-version: 6.0.0
+
+# disables checksum verification
+args:
+  - -k none --set app-layer.protocols.http2.enabled=true
+
+checks:
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 1
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 2