From: Philippe Antoine Date: Tue, 7 Nov 2023 16:22:14 +0000 (+0100) Subject: tests: adds a test for http2 with userinfo in uri X-Git-Tag: suricata-6.0.16~49 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=9fa1ab5a8dbd41333a9c6d7ad8e80d4cbc88b855;p=thirdparty%2Fsuricata-verify.git tests: adds a test for http2 with userinfo in uri Ticket: #6426 --- diff --git a/tests/http2-userinfo-authority/README.md b/tests/http2-userinfo-authority/README.md new file mode 100644 index 000000000..2e8b70f25 --- /dev/null +++ b/tests/http2-userinfo-authority/README.md @@ -0,0 +1,7 @@ +# Description + +Test http2 event for mismatch between authority and host + +# PCAP + +The pcap comes from https://redmine.openinfosecfoundation.org/issues/6425 diff --git a/tests/http2-userinfo-authority/http2_userinfo_in_authority_1.pcap b/tests/http2-userinfo-authority/http2_userinfo_in_authority_1.pcap new file mode 100644 index 000000000..60800f837 Binary files /dev/null and b/tests/http2-userinfo-authority/http2_userinfo_in_authority_1.pcap differ diff --git a/tests/http2-userinfo-authority/test.rules b/tests/http2-userinfo-authority/test.rules new file mode 100644 index 000000000..0037515fc --- /dev/null +++ b/tests/http2-userinfo-authority/test.rules @@ -0,0 +1,2 @@ +alert http2 any any -> any any (msg:"SURICATA HTTP2 authority host mismatch"; flow:established,to_server; http.request_header; content:":authority: "; startswith; content: "@"; pcre: /:authority: ([^:]*:[^@]*)@/,flow:http2_userinfo; sid:1; rev:1;) +alert http2 any any -> any any (msg:"SURICATA HTTP2 authority host mismatch"; flow:established,to_server; app-layer-event:http2.userinfo_in_uri; sid:2; rev:1;) diff --git a/tests/http2-userinfo-authority/test.yaml b/tests/http2-userinfo-authority/test.yaml new file mode 100644 index 000000000..fb9849550 --- /dev/null +++ b/tests/http2-userinfo-authority/test.yaml @@ -0,0 +1,18 @@ +requires: + min-version: 6.0.0 + +# disables checksum verification +args: + - -k none --set app-layer.protocols.http2.enabled=true + +checks: + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 1 + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 2