From: Philippe Antoine Date: Fri, 17 Sep 2021 14:47:35 +0000 (+0200) Subject: Adds test about HTTP2 disabled X-Git-Tag: suricata-6.0.4~13 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=d10112873925f0d3e46bd9bfdca0c7b97fd3711e;p=thirdparty%2Fsuricata-verify.git Adds test about HTTP2 disabled --- diff --git a/tests/http2-disabled/README.md b/tests/http2-disabled/README.md new file mode 100644 index 000000000..19d06bcd0 --- /dev/null +++ b/tests/http2-disabled/README.md @@ -0,0 +1,7 @@ +# Description + +Test HTTP2 traffic after HTTP1 upgrade mechanism, with HTTP2 being disabled in Suricata + +# PCAP + +The pcap comes from https://wiki.wireshark.org/HTTP2 diff --git a/tests/http2-disabled/input.pcap b/tests/http2-disabled/input.pcap new file mode 100644 index 000000000..a77847ae7 Binary files /dev/null and b/tests/http2-disabled/input.pcap differ diff --git a/tests/http2-disabled/suricata.yaml b/tests/http2-disabled/suricata.yaml new file mode 100644 index 000000000..e23f53682 --- /dev/null +++ b/tests/http2-disabled/suricata.yaml @@ -0,0 +1,20 @@ +%YAML 1.1 +--- + +outputs: + - eve-log: + enabled: yes + filetype: regular + filename: eve.json + types: + - alert: + tagged-packets: yes + - http: + extended: yes + - http2 + - files + +app-layer: + protocols: + http2: + enabled: no diff --git a/tests/http2-disabled/test.rules b/tests/http2-disabled/test.rules new file mode 100644 index 000000000..aa69184dc --- /dev/null +++ b/tests/http2-disabled/test.rules @@ -0,0 +1 @@ +alert ip any any -> any any (content:"Sitemap"; sid:1; rev:1;) diff --git a/tests/http2-disabled/test.yaml b/tests/http2-disabled/test.yaml new file mode 100644 index 000000000..a6dd9ffe4 --- /dev/null +++ b/tests/http2-disabled/test.yaml @@ -0,0 +1,28 @@ +requires: + features: + - HAVE_LIBJANSSON + min-version: 6.0.0 + +# disables checksum verification +args: + - -k none --set stream.midstream=true + +checks: + + # Check that there is one file event with content range. + - filter: + count: 1 + match: + event_type: http + http.url: /robots.txt + http.status: 101 + - filter: + count: 0 + match: + event_type: http + http.http2.stream_id: 0 + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 1