From: Philippe Antoine <contact@catenacyber.fr>
Date: Thu, 17 Dec 2020 13:19:25 +0000 (+0100)
Subject: http2: http.uri.raw keyword now works for HTTP2
X-Git-Tag: suricata-6.0.3~28
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=7d1f6d98bcdf3387f3c7f1295259ad58ffbffcfa;p=thirdparty%2Fsuricata.git

http2: http.uri.raw keyword now works for HTTP2

(cherry picked from commit 5d676c5998aeb33c529e8ee8efcaa2fdf10324ef)
---

diff --git a/src/detect-http-uri.c b/src/detect-http-uri.c
index d2bccf2bdf..ec26c10905 100644
--- a/src/detect-http-uri.c
+++ b/src/detect-http-uri.c
@@ -157,6 +157,13 @@ void DetectHttpUriRegister (void)
             PrefilterGenericMpmRegister, GetRawData, ALPROTO_HTTP,
             HTP_REQUEST_LINE);
 
+    // no difference between raw and decoded uri for HTTP2
+    DetectAppLayerInspectEngineRegister2("http_raw_uri", ALPROTO_HTTP2, SIG_FLAG_TOSERVER,
+            HTTP2StateDataClient, DetectEngineInspectBufferGeneric, GetData2);
+
+    DetectAppLayerMpmRegister2("http_raw_uri", SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister,
+            GetData2, ALPROTO_HTTP2, HTTP2StateDataClient);
+
     DetectBufferTypeSetDescriptionByName("http_raw_uri",
             "raw http uri");