From 6a713133a471d0a8422bb4404befce7f542bc5d8 Mon Sep 17 00:00:00 2001
From: Philippe Antoine <contact@catenacyber.fr>
Date: Mon, 5 Jul 2021 10:59:27 +0200
Subject: [PATCH] Adds test about http2 deflate decompression

---
 tests/http2-deflate/README.md          |   8 ++++++
 tests/http2-deflate/http2_deflate.pcap | Bin 0 -> 2719 bytes
 tests/http2-deflate/server.go          |  33 +++++++++++++++++++++++++
 tests/http2-deflate/test.yaml          |  22 +++++++++++++++++
 4 files changed, 63 insertions(+)
 create mode 100644 tests/http2-deflate/README.md
 create mode 100644 tests/http2-deflate/http2_deflate.pcap
 create mode 100644 tests/http2-deflate/server.go
 create mode 100644 tests/http2-deflate/test.yaml

diff --git a/tests/http2-deflate/README.md b/tests/http2-deflate/README.md
new file mode 100644
index 000000000..a053e457c
--- /dev/null
+++ b/tests/http2-deflate/README.md
@@ -0,0 +1,8 @@
+# Description
+
+Test http2 deflate decompression
+
+# PCAP
+
+The pcap comes from running dummy HTTP2 server with `go run server.go`
+and client `curl -H 'Accept-Encoding: deflate' --http2 127.0.0.1:8080/`
diff --git a/tests/http2-deflate/http2_deflate.pcap b/tests/http2-deflate/http2_deflate.pcap
new file mode 100644
index 0000000000000000000000000000000000000000..f765f6dcdc0b9dfa2e20d4136ea7cb6bea0c2b07
GIT binary patch
literal 2719
zc-ocKZ%7ki90%~{wka|kO$!?I$IBNXL$}?UIR@fR8!9Rdr;=fmZP#WUJKIi#eBmf0
zeW8pfebbxXNX#kfi(V-7CJ1^{i~Q5Opy)+N83aa!uHUoUZf@M>-L^-@o_jve_xU}~
zog1%KpQ(@rWnaSgE3ZG_&^{;7CHRh;3YrTcC;m7~5gJE`z-@P`D*9;t+(SHOS(Qv4
z*x*`C(?>$BE+L3A?UUo(v6QM3%sv@rRdjbMxU)75?&NZ%w252B^n+;!%bqoD1#(V;
zI}_1U+Xpr9;~@(>AsJ3O+YGh}IcwnT!}$HI^QUMY132GvomN*5X(roxdfaBpMCr6`
zT$p!|l(oTRfj8x_TkIB{wl~a#>S#X`gg);`h&4Bu>TM?IpuJvZ7=ARGjXG@$7Ys69
zeuxV?$lhUpXwb*hrf6%OhvE65pg#<h(BU8hRxeDK)9WB<x{Idi<~uaqO$)E~)ZffZ
zb*`Y7^TD+a(#PCl2YE)P)oF1twiFe$x(kZ>UaF|qVg$ZE)zZ#bQO5udm+NH8Nm3Sy
z^o$Pi-T*`<-64+Wyc`>rELDDKgk_Dz<es_eE{L=V%i5G$))qK!81K$Hokbl3IL=(h
z-Q7+ag|lMCo3GP)x-vPxfbRj<ll3nb@EOr>$@LMcOg|vh(0oYaL}@K``~8F|Tmqe$
zf-W#cM4X~Ne+o@mYKEpHA~5<ZCi~cI;_Oi0gj9WN78E%VaNbEd7G=(KA?HDyK>aYj
zKkM`sbqwINi_U^jEJJ!fN{~LiD}PZb(i2X2dh3N<c^a2}K&N4{JqWyUC@`LA0Xy5^
zz;>ou+G#B67{H-&9sK+!GRNgdTy`b*0G)+kZ>56y7mq%6IgSCG`ut$&V~36j$L{{3
z?5fQMch=Pq?t@e~X6fjv3E|e&Vz^>e8(UHoth`XL-^&CVh4G_VCtM&{xfskZI&mS`
zMFJl{V)E)lbTwg{yB<9=lDMfm-`IJ2%GlS;)_faKU9b$!Chom_tiH{>n9vX<&c?g*
zOT<?y@CnB_xuR$}9eMv1aEv&1Y~Zjkp3ORe0?X+Tmot#-AaoYtIuqyw+DW!CEX&oB
z=2|kq^TQ634~;O;nM}fN;2RBzThgj*4dZ!_1aS?EN}UR6=go@T8*6<Wthu}!OLYDz
Tbt<HtQ>(JqH3wEisy_b#9E!I}

literal 0
Hc-jL100001

diff --git a/tests/http2-deflate/server.go b/tests/http2-deflate/server.go
new file mode 100644
index 000000000..b409b8287
--- /dev/null
+++ b/tests/http2-deflate/server.go
@@ -0,0 +1,33 @@
+package main
+
+import (
+	"compress/flate"
+	"fmt"
+	"golang.org/x/net/http2"
+	"golang.org/x/net/http2/h2c"
+	"net/http"
+)
+
+func main() {
+	h2s := &http2.Server{}
+
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		h := w.Header()
+		h["content-encoding"] = []string{"deflate"}
+		fw, err := flate.NewWriter(w, 1)
+		if err != nil {
+			fmt.Fprintf(w, "FAIL %s, %v, http: %v", err, r.URL.Path, r.TLS == nil)
+		}
+		fmt.Fprintf(fw, "Hello, %v, http: %v", r.URL.Path, r.TLS == nil)
+		fw.Flush()
+	})
+
+	server := &http.Server{
+		Addr:    "0.0.0.0:8080",
+		Handler: h2c.NewHandler(handler, h2s),
+	}
+
+	fmt.Printf("Listening [0.0.0.0:8080]...\n")
+	err := server.ListenAndServe()
+	fmt.Printf("lol %s", err)
+}
diff --git a/tests/http2-deflate/test.yaml b/tests/http2-deflate/test.yaml
new file mode 100644
index 000000000..b7895b75d
--- /dev/null
+++ b/tests/http2-deflate/test.yaml
@@ -0,0 +1,22 @@
+requires:
+  features:
+    - HAVE_LIBJANSSON
+  min-version: 6.0.0
+
+# disables checksum verification
+args:
+  - -k none --set app-layer.protocols.http2.enabled=true
+
+checks:
+
+  # Check that there is one file event with decompressed length.
+  - filter:
+      count: 1
+      match:
+        event_type: fileinfo
+        http2.length: 30
+        fileinfo.size: 20
+  - filter:
+      count: 0
+      match:
+        event_type: anomaly
-- 
2.47.2