From d10112873925f0d3e46bd9bfdca0c7b97fd3711e Mon Sep 17 00:00:00 2001
From: Philippe Antoine <contact@catenacyber.fr>
Date: Fri, 17 Sep 2021 16:47:35 +0200
Subject: [PATCH] Adds test about HTTP2 disabled

---
 tests/http2-disabled/README.md     |   7 +++++++
 tests/http2-disabled/input.pcap    | Bin 0 -> 1617 bytes
 tests/http2-disabled/suricata.yaml |  20 ++++++++++++++++++++
 tests/http2-disabled/test.rules    |   1 +
 tests/http2-disabled/test.yaml     |  28 ++++++++++++++++++++++++++++
 5 files changed, 56 insertions(+)
 create mode 100644 tests/http2-disabled/README.md
 create mode 100644 tests/http2-disabled/input.pcap
 create mode 100644 tests/http2-disabled/suricata.yaml
 create mode 100644 tests/http2-disabled/test.rules
 create mode 100644 tests/http2-disabled/test.yaml

diff --git a/tests/http2-disabled/README.md b/tests/http2-disabled/README.md
new file mode 100644
index 000000000..19d06bcd0
--- /dev/null
+++ b/tests/http2-disabled/README.md
@@ -0,0 +1,7 @@
+# Description
+
+Test HTTP2 traffic after HTTP1 upgrade mechanism, with HTTP2 being disabled in Suricata
+
+# PCAP
+
+The pcap comes from https://wiki.wireshark.org/HTTP2
diff --git a/tests/http2-disabled/input.pcap b/tests/http2-disabled/input.pcap
new file mode 100644
index 0000000000000000000000000000000000000000..a77847ae7cb5de74582b4fa32ca7699f36d9e266
GIT binary patch
literal 1617
zc-p&ic+)~A1{MYcU}0bck_Yn&qE)7GF?<2CLAa~dVP25*q%zBW2OBvUTp1Xi^%OWT
zIIzvh<Kkps>Rwdc_GlYJz~U^!o+XB2nhg>RPlb3G7#JBjxLlsb=UmzIQQF-#L_xnO
zKPkVYSg)j_M8P8@BtYL#&ybhPBfq%BN+B;jqokz3NH4!AotG=LIJHREF+DX8D3M%R
zl%sF1XJ)8pz{};BoSa$!6x7n!;^lJA&&x|qF3HT#vr-5xNH0oEN!0<HYor^TT2hjk
zmtG7s3L;^pkYSVzv<pSnO2N_5*U{0@DcjL8$PofO!6YviFV`Vp7<{f~VORq6KL|s7
z4+#li7$`7IyS>(d!IUi`5#)bRI4}e}+6MCf;w&ROU>LmCafXD!l|7%rK;Z!Mvx1?4
zp+azZW=V1e&>0E=MfoN9$@w|OSiOYq1zs)&1|evSF#~Z5Fv<jgG%(r}7(i|=tz}_|
z0t!T7i#MO1B2c`|WkZcOBRinGyFu|LSOkl=#G@d02LyR4XhCAj2owXnT*1Du&^ZXS
zDHdo;EH<0`dy2s}F`?NM2Dhmc)g}yYIe^$qAOd9BW1wZ;K(;qF%WQi}z?KQ4Syl+Q
zEE(N01{Ow`(LaDjhXHvYj2_F39=F$lVmW*rS}b?NV%fJF9?KD+SY}{2!U*yRV@Kk&
zySedREMCqzr#KiZ9d;K^h{@1Oy0|~S-LqzC*9*y2In(ZE)=gnPl_9^Bg<;Qv$Q`%M
zSyT-(?(++G|BIGcC{x6l=Kbe?P)q+MuYP`BCNm?4{!d$y)q}1oU7k`Tc65zbeH+sQ
zhB=x0%i30DUYhmie@(m4R9~y$`1uaqpSEn{o3y6tQu3Al&bxd)Qrn&!o$T+>^J)7O
z#jH10UM@4f)_3vWnljJnpe(z3yu*Y~8~KC0gTnk*o!a=?vp>kbb;XMnmrgS<*ntZK
zMsSu)gk(uAE|<*W#GIV`aw`QcuHej))ZD}ZD+PUhq)e<|3=!6=$jwmzr<VV~Q1%BJ
z<&P}_9eYZ_5y*!YfmQGbOh=DE77lP?vH#D&2r_<u0}DejkY9|=_|%><aB=k#&G_~u
zhT`*q#=jNpMln8ufkA_j6_gb1AIdkebR<=0%6i1w1-ChNfCBo+&Ns8GI#jm>9A3Rc
z^k6VEus8xaVTwH`Jc(kI7PhxHfJ=+*sOd<2J}8-j(ox-ESUUQ$8srR=B)ZU_lVJ{!
zJqMf7eYZD(jZQ%`dIiwv9U!CU?tmM;9%8gTIEga%VoRc4pd>m8nnZsGOzt}(Y7jLu
nteT&f(XyTml;Yw`?;kyK_|QQH22OD5V9v`gQAo=#%}W6Q*3S+M

literal 0
Hc-jL100001

diff --git a/tests/http2-disabled/suricata.yaml b/tests/http2-disabled/suricata.yaml
new file mode 100644
index 000000000..e23f53682
--- /dev/null
+++ b/tests/http2-disabled/suricata.yaml
@@ -0,0 +1,20 @@
+%YAML 1.1
+---
+
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular
+      filename: eve.json
+      types:
+        - alert:
+            tagged-packets: yes
+        - http:
+            extended: yes
+        - http2
+        - files
+
+app-layer:
+  protocols:
+    http2:
+      enabled: no
diff --git a/tests/http2-disabled/test.rules b/tests/http2-disabled/test.rules
new file mode 100644
index 000000000..aa69184dc
--- /dev/null
+++ b/tests/http2-disabled/test.rules
@@ -0,0 +1 @@
+alert ip any any -> any any (content:"Sitemap"; sid:1; rev:1;)
diff --git a/tests/http2-disabled/test.yaml b/tests/http2-disabled/test.yaml
new file mode 100644
index 000000000..a6dd9ffe4
--- /dev/null
+++ b/tests/http2-disabled/test.yaml
@@ -0,0 +1,28 @@
+requires:
+  features:
+    - HAVE_LIBJANSSON
+  min-version: 6.0.0
+
+# disables checksum verification
+args:
+  - -k none --set stream.midstream=true
+
+checks:
+
+  # Check that there is one file event with content range.
+  - filter:
+      count: 1
+      match:
+        event_type: http
+        http.url: /robots.txt
+        http.status: 101
+  - filter:
+      count: 0
+      match:
+        event_type: http
+        http.http2.stream_id: 0
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 1
-- 
2.47.2