Http2.frametype not support detect RST_STREAM

gosudvtnews · October 11, 2023, 6:59am

Hello, suricata rules not support detect rst_stream
Ref: 6.28. HTTP2 Keywords — Suricata 6.0.0 documentation

vjulien · October 11, 2023, 7:18am

Try http2.frametype:rststream;

vjulien · October 11, 2023, 7:21am

See:

github.com

OISF/suricata/blob/master/rust/src/http2/parser.rs#L61


      
                  write!(f, "{:?}", self)
              }
          }
          
          impl std::str::FromStr for HTTP2FrameType {
              type Err = String;
          
              fn from_str(s: &str) -> Result<Self, Self::Err> {
                  let su = s.to_uppercase();
                  let su_slice: &str = &su;
                  match su_slice {
                      "DATA" => Ok(HTTP2FrameType::Data),
                      "HEADERS" => Ok(HTTP2FrameType::Headers),
                      "PRIORITY" => Ok(HTTP2FrameType::Priority),
                      "RSTSTREAM" => Ok(HTTP2FrameType::RstStream),
                      "SETTINGS" => Ok(HTTP2FrameType::Settings),
                      "PUSHPROMISE" => Ok(HTTP2FrameType::PushPromise),
                      "PING" => Ok(HTTP2FrameType::Ping),
                      "GOAWAY" => Ok(HTTP2FrameType::GoAway),
                      "WINDOWUPDATE" => Ok(HTTP2FrameType::WindowUpdate),
                      "CONTINUATION" => Ok(HTTP2FrameType::Continuation),

The match is case insensitive, so you can also write http2.frametype:RSTSTREAM; or http2.frametype:RstStream;,

gosudvtnews · October 11, 2023, 8:09am

Thanks you for the answer, i got it !!!

Topic		Replies	Views
Suricata v7 frame-support error Help	0	458	January 27, 2022
Suricata Rules HTTP Header not working Rules	3	390	October 31, 2023
Suricata can't search pattern in HTTP with content-type application/x-www-form-urlencoded Rules rules , suricata	1	167	December 1, 2023
Http/2 not working from lua detection or lua output scripts lua	7	267	October 27, 2023
Rule using http does not matching get request Rules	2	1028	January 18, 2022

Http2.frametype not support detect RST_STREAM

Related Topics