http2: check for http_response_line exact content

Ticket: 6547
OISF · Dec 12, 2023 · 9158a56 · 9158a56
1 parent bddba8f
commit 9158a56
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 0 deletions.
diff --git a/tests/http2-keywords2/test.rules b/tests/http2-keywords2/test.rules
@@ -17,3 +17,4 @@ alert http2 any any -> any any (http.response_body; content:"not found"; sid:36;
 alert http2 any any -> any any (http_request_line; content:"GET /humans.txt HTTP/2"; sid:37;)
 alert http2 any any -> any any (http.stat_msg; content:!"OK"; sid:38;)
 alert http2 any any -> any any (http.stat_msg; bsize:0; sid:39;)
+alert http2 any any -> any any (http_response_line; content:"HTTP/2 200|0d 0a|"; startswith; endswith; sid:40;)
diff --git a/tests/http2-keywords2/test.yaml b/tests/http2-keywords2/test.yaml
@@ -85,3 +85,10 @@ checks:
       match:
         event_type: alert
         alert.signature_id: 39
+  - filter:
+      # to remove when backport is merged
+      min-version: 8.0.0
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 40