tests: adds a test for http2 with userinfo in uri

Ticket: #6426
OISF · Nov 16, 2023 · 9fa1ab5 · 9fa1ab5
1 parent 91882fc
commit 9fa1ab5
Show file tree

Hide file tree

Showing 4 changed files with 27 additions and 0 deletions.
diff --git a/tests/http2-userinfo-authority/README.md b/tests/http2-userinfo-authority/README.md
@@ -0,0 +1,7 @@
+# Description
+
+Test http2 event for mismatch between authority and host
+
+# PCAP
+
+The pcap comes from https://redmine.openinfosecfoundation.org/issues/6425
diff --git a/tests/http2-userinfo-authority/http2_userinfo_in_authority_1.pcap b/tests/http2-userinfo-authority/http2_userinfo_in_authority_1.pcap
diff --git a/tests/http2-userinfo-authority/test.rules b/tests/http2-userinfo-authority/test.rules
@@ -0,0 +1,2 @@
+alert http2 any any -> any any (msg:"SURICATA HTTP2 authority host mismatch"; flow:established,to_server; http.request_header; content:":authority: "; startswith; content: "@"; pcre: /:authority: ([^:]*:[^@]*)@/,flow:http2_userinfo; sid:1; rev:1;)
+alert http2 any any -> any any (msg:"SURICATA HTTP2 authority host mismatch"; flow:established,to_server; app-layer-event:http2.userinfo_in_uri; sid:2; rev:1;)
diff --git a/tests/http2-userinfo-authority/test.yaml b/tests/http2-userinfo-authority/test.yaml
@@ -0,0 +1,18 @@
+requires:
+  min-version: 6.0.0
+
+# disables checksum verification
+args:
+  - -k none --set app-layer.protocols.http2.enabled=true
+
+checks:
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 1
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 2
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,2 @@
		alert http2 any any -> any any (msg:"SURICATA HTTP2 authority host mismatch"; flow:established,to_server; http.request_header; content:":authority: "; startswith; content: "@"; pcre: /:authority: ([^:]:[^@])@/,flow:http2_userinfo; sid:1; rev:1;)
		alert http2 any any -> any any (msg:"SURICATA HTTP2 authority host mismatch"; flow:established,to_server; app-layer-event:http2.userinfo_in_uri; sid:2; rev:1;)