test: adds test for lua http2 library - #3232
Conversation
Ticket: 6409
| @@ -0,0 +1,2 @@ | |||
| alert http2:stream:request_headers any any -> any any (msg: "Test HTTP2 Lua"; lua: http2.lua; sid:1;) | |||
| alert http1:request_line any any -> any any (msg: "Test HTTP2 Lua"; lua: http2.lua; sid:2;) | |||
There was a problem hiding this comment.
@jasonish what would be the good way to run lua: http2.lua; whatever the HTTP protocol ?
There was a problem hiding this comment.
I'm not sure I know enough about how the http abstraction over http1 and http2 works to comment. I guess we need to decide if there should even be a common abstraction, or if Lua scripts should be specific enough to the version of http being processed. I guess for the command things, URLs, etc. a common abstraction would be ideal.
Would/do existing scripts need to be updated to validate what version of http they are working against to avoid making a bad call?
There was a problem hiding this comment.
I guess we need to decide if there should even be a common abstraction
Indeed, asked in the suricata draft PR ;-)
I think there should be one
Would/do existing scripts need to be updated to validate what version of http they are working against to avoid making a bad call?
We can do multiple scenarios here :
- either make lua
httpwork for http2, like we didalert httpnow works transparently for http2, and add functions that could check the http version later in script - introduce a new
get_tx_whatever_the_http_versionfunction, and keep theget_txfor HTTP1 only, so current scripts remain http1 only, but it is is easy to upgrade them to do both HTTP versions
| @@ -0,0 +1,19 @@ | |||
| -- simple http match on request_headers_raw module | |||
| local http = require("suricata.http") | |||
There was a problem hiding this comment.
I think we will want for lua what we have for rules in suricata : something like :
httpmeans http whatever versionhttp1only http1http2only http2
Should I add a function a bit like LuaFlowAppLayerProto to get the HTTP version of the flow alproto ?
There was a problem hiding this comment.
I think that makes sense. Right now suricata.http is specifically http1 right? Not sure we'd want to break that, even on a major version upgrade.
There was a problem hiding this comment.
I think we want to break/extend this for 9...
|
Replaced by #3315 |
2 participants
Ticket
Redmine ticket: https://redmine.openinfosecfoundation.org/issues/6409
Suricata PR still a draft with some questions here