or at least some checks of it
alert http2 any any -> any any (http2.errorcode:INTERNAL_ERROR; sid:1;)
-alert http2 any any -> any any (http2.errorcode:!NO_ERROR; sid:2;)
+alert http2 any any -> any any (requires: version >= 9.0.0; http2.errorcode:!NO_ERROR; sid:2;)
# no match
alert http2 any any -> any any (http2.errorcode:HTTP_1_1_REQUIRED; sid:3;)
# new format
-alert http2 any any -> any any (http2.errorcode:HTTP11_REQUIRED; sid:4;)
+alert http2 any any -> any any (requires: version >= 9.0.0; http2.errorcode:HTTP11_REQUIRED; sid:4;)
requires:
- min-version: 9
+ min-version: 8.0.2
# disables checksum verification
args:
alert.signature_id: 1
http.http2.request.error_code: INTERNALERROR
- filter:
+ min-version: 9
count: 2
match:
event_type: alert