From: David Beckett <david.beckett@netronome.com>
Date: Wed, 16 Nov 2022 18:32:01 +0000 (+0000)
Subject: tests/http2: Add tests for HTTP/2 decompression bug
X-Git-Tag: suricata-6.0.10~43
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=8c8636779d7bab9dfcdd5892159ee3195b38f786;p=thirdparty%2Fsuricata-verify.git

tests/http2: Add tests for HTTP/2 decompression bug

7.0.0-beta1 hits anomaly, failed_decompression
---

diff --git a/tests/http2-compression-bug/README.md b/tests/http2-compression-bug/README.md
new file mode 100644
index 000000000..50f931c86
--- /dev/null
+++ b/tests/http2-compression-bug/README.md
@@ -0,0 +1 @@
+Chrome 107.0.5304.87 HTTP2 decrypted via Mira ETO
diff --git a/tests/http2-compression-bug/input.pcap b/tests/http2-compression-bug/input.pcap
new file mode 100644
index 000000000..5630354b3
Binary files /dev/null and b/tests/http2-compression-bug/input.pcap differ
diff --git a/tests/http2-compression-bug/test.yaml b/tests/http2-compression-bug/test.yaml
new file mode 100644
index 000000000..f2d94b73e
--- /dev/null
+++ b/tests/http2-compression-bug/test.yaml
@@ -0,0 +1,24 @@
+requires:
+  min-version: 7
+
+checks:
+- filter:
+    count: 7
+    match:
+      event_type: http
+- filter:
+    count: 9
+    match:
+      event_type: fileinfo
+- filter:
+    count: 0
+    match:
+      event_type: anomaly
+- filter:
+    count: 1
+    match:
+      event_type: flow
+- filter:
+    count: 1
+    match:
+      event_type: stats