Lua http2 6409 v1

[catenacyber]

Link to ticket: https://redmine.openinfosecfoundation.org/issues/6409

Describe changes:

• lua : begin support for HTTP2

Provide values to any of the below to override the defaults.

SV_BRANCH=OISF/suricata-verify#3232

DRAFT :
First question is
Do we want to present the rule writer an unique http library for both http1 and http2 ? I think we do like local http = require("suricata.http")

Second question would then be how do we trigger a lua script for both http versions ?
See SV PR https://github.com/OISF/suricata-verify/pull/3232/changes#r3573799610

Now I have both

alert http2:stream:request_headers
alert http1:request_line

that works for either http2 or http1, but I do not have a way to express that I want to run my lua script for whatever http version

[jasonish]

Will

alert http2:stream:request_headers

ever be called for http1?

Will

alert http1:request_line

ever be called for http2?

[codecov]

Codecov Report

❌ Patch coverage is 47.50000% with 21 lines in your changes missing coverage. Please review.
✅ Project coverage is 82.98%. Comparing base (8455efd) to head (7d0afe0).

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #15871      +/-   ##
==========================================
- Coverage   83.03%   82.98%   -0.05%     
==========================================
  Files        1003     1003              
  Lines      276582   276617      +35     
==========================================
- Hits       229647   229538     -109     
- Misses      46935    47079     +144     

Flag	Coverage Δ
fuzzcorpus	61.50% <0.00%> (-0.07%)	⬇️
livemode	18.44% <0.00%> (-0.03%)	⬇️
netns	22.89% <0.00%> (-0.03%)	⬇️
pcap	45.35% <0.00%> (-0.11%)	⬇️
suricata-verify	67.00% <47.50%> (-0.08%)	⬇️
unittests	58.45% <0.00%> (-0.02%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[suricata-qa]

WARNING:

field	baseline	test	%
	SURI_TLPR1_stats_chk
.app_layer.flow.ftp_data	655	696	106.26%

Pipeline = 32570

[catenacyber]

Will

alert http2:stream:request_headers

ever be called for http1?

Will

alert http1:request_line

ever be called for http2?

No, see discussion on the SV PR

[catenacyber]

Status : waiting for a decision on

Do we want to present the rule writer an unique lua http library for both http1 and http2 ?

[jasonish]

Status : waiting for a decision on

Do we want to present the rule writer an unique lua http library for both http1 and http2 ?

I think we need to evaluate...

Whats common between the 2? Could the http lib serve http1 and whatever is common between http1 and http2? Then maybe add an http2 lib for the http2 specific?

Or maybe not a new lib, but an http2 object.. from the http, you could do some call get_http2 that returns you the http2 transaction? Just brainstorming ideas here, and hoping not to break the existing http lib.

[catenacyber]

Status : waiting for a decision on

Do we want to present the rule writer an unique lua http library for both http1 and http2 ?

Decision : do a unique lua http library for both http1 and http2, and have a mechanism in it to specify only http1 or only http2

[catenacyber]

Replaced by #16104