From 5df23b65c26995cc2e623b034a77db93643350f5 Mon Sep 17 00:00:00 2001
From: Philippe Antoine <pantoine@oisf.net>
Date: Thu, 23 Jul 2026 09:28:04 +0200
Subject: [PATCH] tests/http2: add test for content-encoding case insensitivity

Ticket: 8760
---
 tests/http2-deflate-case/README.md  |  10 +++++++++
 tests/http2-deflate-case/input.pcap | Bin 0 -> 2605 bytes
 tests/http2-deflate-case/server.go  |  33 ++++++++++++++++++++++++++++
 tests/http2-deflate-case/test.yaml  |  20 +++++++++++++++++
 4 files changed, 63 insertions(+)
 create mode 100644 tests/http2-deflate-case/README.md
 create mode 100644 tests/http2-deflate-case/input.pcap
 create mode 100644 tests/http2-deflate-case/server.go
 create mode 100644 tests/http2-deflate-case/test.yaml

diff --git a/tests/http2-deflate-case/README.md b/tests/http2-deflate-case/README.md
new file mode 100644
index 000000000..78e3edcef
--- /dev/null
+++ b/tests/http2-deflate-case/README.md
@@ -0,0 +1,10 @@
+# Description
+
+Test http2 content-encoding case insensitivity
+
+https://redmine.openinfosecfoundation.org/issues/8760
+
+# PCAP
+
+The pcap comes from running dummy HTTP2 server with `go run server.go`
+and client `curl --compressed -H 'Accept-Encoding: deflate' --http2 127.0.0.1:8080/` and seeing the decompressed output
diff --git a/tests/http2-deflate-case/input.pcap b/tests/http2-deflate-case/input.pcap
new file mode 100644
index 0000000000000000000000000000000000000000..42560ffbe0e85c9b9309d6c44a01b5f6c36ff18d
GIT binary patch
literal 2605
zc-obeOH30{6o&5<M4YBr&_x$2L!yRYOFIR%HbI$cV<A2Y1;s}~>U5-NogwWIh%PW1
zeC*ixN=OVlmr7h~j9V6(xDX!*jV7WsNa99~)N`iO8K<_Toz9(3=HBz&|NQr!`|A1h
zl!;Ul{mQ)a&%);(Ettsxc*kaf<|m{b@AfJ}#t5OX{hq3yh)%!9A>^SconC2$v6cH?
zQxz3e6je>%TX{LBP)!-;_T=i!`ib9D+Z@5;!1X_@`=9xvYF7<%v&?p2dVuB8nXLtM
z`hnYb*=kFzG{Q$!AM%hBEP<nH>qFMRoUA6~#DMb$;{WKJpGEc9fb-3$=b*obaWa9P
zo}iO$W-W9;O2}S@b?<I=!H@NNTppK&?o9}B2R9&y(8mwQV@^*q+tLgj9M20w@Uh9+
zWTE#<qA2k4pd@;k-l2hbI3m~;wA&F9WO+~=NB}C+;bo$39;P$&dKr#8%yFFWJjZn@
zH^+70gUin3@Qb_@fw5jDBAktdWx+yQXf)$$S*Fg>VCrH%Q;&Z%<9Ma1oJ&PHHsDA`
zPS#F_b+JrnWKia#AejlqC0XL7SR$`gxz=RTl0KHY=jLdTbRW|Cns3j20nRAIkLnz`
zD8~kzsF4%w?qHfSd&P~5Z=pkn@kvOXTG$oPB2d|sItvzLweq)jj8Le9d@6aF?t_+2
z$mesuW%8xWM1Xif=Y)%LY{2Q&IM&R0u~pT*hFDegzep9aQtg<570)RAz7Coq{zR(e
z#pr~IXL1%}9w$c5IB+<K=X6e6Q4TH!YviD{RQ3d&OqJ~F3_wFUuA&?B3TMfTu}V`p
zTu~0Xx>MuSB1c<tvOeS5^is*Lg#bL8<Jtm(ku$Tjx@)SqSxp>k5Vv4(ZK*tA$wI;|
zem9d5h#%28i2}lsny`UfVY?{YjMR;j<4;bvTDJ91Y#x4b#<IQb(59PB$9%EI#nYx1
zSNQgawx^xzZn@w3u8_%K&ASb|O>gc#mQcp^@8zV^)lev%JHY9O_<o&pDt|g%4O%)!
zbJN+P90C;CNWP{6LM$fP8K<3z%JPtxk>kTyx9K!a_n<u4fkLwDm(8Rb;=6Uuk)j+d
zDxbzlB8QOLwdCI`5gnEz(uk<+mmSL`E4`r1P-{?{%qn#(ms+h|0c7P=YaOzX(^4Ks
wEW{Cj(*f}vI>%p>gA2aL$RVU!b51L;YXG*xyIlu27BEc2m>^WZ$|geo0<}esm;e9(

literal 0
Hc-jL100001

diff --git a/tests/http2-deflate-case/server.go b/tests/http2-deflate-case/server.go
new file mode 100644
index 000000000..96cf2ff40
--- /dev/null
+++ b/tests/http2-deflate-case/server.go
@@ -0,0 +1,33 @@
+package main
+
+import (
+	"compress/flate"
+	"fmt"
+	"golang.org/x/net/http2"
+	"golang.org/x/net/http2/h2c"
+	"net/http"
+)
+
+func main() {
+	h2s := &http2.Server{}
+
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		h := w.Header()
+		h["content-encoding"] = []string{"DeFlate"}
+		fw, err := flate.NewWriter(w, 1)
+		if err != nil {
+			fmt.Fprintf(w, "FAIL %s, %v, http: %v", err, r.URL.Path, r.TLS == nil)
+		}
+		fmt.Fprintf(fw, "Hello, %v, http: %v", r.URL.Path, r.TLS == nil)
+		fw.Flush()
+	})
+
+	server := &http.Server{
+		Addr:    "0.0.0.0:8080",
+		Handler: h2c.NewHandler(handler, h2s),
+	}
+
+	fmt.Printf("Listening [0.0.0.0:8080]...\n")
+	err := server.ListenAndServe()
+	fmt.Printf("lol %s", err)
+}
diff --git a/tests/http2-deflate-case/test.yaml b/tests/http2-deflate-case/test.yaml
new file mode 100644
index 000000000..082cdd53f
--- /dev/null
+++ b/tests/http2-deflate-case/test.yaml
@@ -0,0 +1,20 @@
+requires:
+  min-version: 9
+
+args:
+  - -k none
+
+checks:
+
+  # Check that there is one file event with decompressed length.
+  - filter:
+      count: 1
+      match:
+        event_type: fileinfo
+        http.length: 30
+        http.version: "2"
+        fileinfo.size: 20
+  - filter:
+      count: 0
+      match:
+        event_type: anomaly
-- 
2.47.3