OISF · catenacyber · Jul 13, 2026 · catenacyber · Jul 13, 2026 · jasonish
diff --git a/tests/lua/lua-http2lib-01/README.md b/tests/lua/lua-http2lib-01/README.md
@@ -0,0 +1,5 @@
+https://redmine.openinfosecfoundation.org/issues/6409
+
+Test lua HTTP/2 support
+
+Pcap with both HTTP1 and HTTP2 traffic
diff --git a/tests/lua/lua-http2lib-01/http-lua.rules b/tests/lua/lua-http2lib-01/http-lua.rules
@@ -0,0 +1,2 @@
+alert http2:stream:request_headers any any -> any any (msg: "Test HTTP2 Lua"; lua: http2.lua; sid:1;)
+alert http1:request_line any any -> any any (msg: "Test HTTP2 Lua"; lua: http2.lua; sid:2;)
diff --git a/tests/lua/lua-http2lib-01/http2.lua b/tests/lua/lua-http2lib-01/http2.lua
@@ -0,0 +1,19 @@
+-- simple http match on request_headers_raw module
+local http = require("suricata.http")
+
+function init (args)
+    return {}
+end
+
+function match(args)
+    local tx = http.get_tx()
+    uriraw, err = tx:request_uri_raw()
+
+    if #uriraw > 0 then
+        if uriraw:find("/toto") then
+            return 1
+        end
+    end
+
+    return 0
+end
diff --git a/tests/lua/lua-http2lib-01/input.pcap b/tests/lua/lua-http2lib-01/input.pcap
diff --git a/tests/lua/lua-http2lib-01/test.yaml b/tests/lua/lua-http2lib-01/test.yaml
@@ -0,0 +1,20 @@
+requires:
+  features:
+    - HAVE_LUA
+  min-version: 9
+
+args:
+  - --set security.lua.allow-rules=true
+  - --set default-rule-path=${TEST_DIR}
+  - -k none
+
+checks:
+  - filter:
+      count: 1
+      match:
+        alert.signature_id: 1
+  - filter:
+      count: 1
+      match:
+        alert.signature_id: 2
+
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,2 @@
		alert http2:stream:request_headers any any -> any any (msg: "Test HTTP2 Lua"; lua: http2.lua; sid:1;)
		alert http1:request_line any any -> any any (msg: "Test HTTP2 Lua"; lua: http2.lua; sid:2;)
catenacyber Jul 13, 2026 Copy link Copy Markdown Collaborator Author Choose a reason for hiding this comment The reason will be displayed to describe this comment to others. Learn more. @jasonish what would be the good way to run `lua: http2.lua;` whatever the HTTP protocol ? jasonish Jul 13, 2026 Copy link Copy Markdown Member Choose a reason for hiding this comment The reason will be displayed to describe this comment to others. Learn more. I'm not sure I know enough about how the `http` abstraction over `http1` and `http2` works to comment. I guess we need to decide if there should even be a common abstraction, or if Lua scripts should be specific enough to the version of http being processed. I guess for the command things, URLs, etc. a common abstraction would be ideal. Would/do existing scripts need to be updated to validate what version of http they are working against to avoid making a bad call? catenacyber Jul 14, 2026 Copy link Copy Markdown Collaborator Author Choose a reason for hiding this comment The reason will be displayed to describe this comment to others. Learn more. I guess we need to decide if there should even be a common abstraction Indeed, asked in the suricata draft PR ;-) I think there should be one Would/do existing scripts need to be updated to validate what version of http they are working against to avoid making a bad call? We can do multiple scenarios here : either make lua `http` work for http2, like we did `alert http` now works transparently for http2, and add functions that could check the http version later in script introduce a new `get_tx_whatever_the_http_version` function, and keep the `get_tx` for HTTP1 only, so current scripts remain http1 only, but it is is easy to upgrade them to do both HTTP versions