http2: anomaly event on continuation frame without preceding headers

Ticket: 9217

rules/http2-events.rules

@@ -28,3 +28,4 @@ alert http2 any any -> any any (msg:"SURICATA HTTP2 data on stream zero"; flow:e
 # alert http2 any any -> any any (msg:"SURICATA HTTP2 too many frames"; flow:established; app-layer-event:http2.too_many_frames; classtype:protocol-command-decode; sid:2290019; rev:1;)
 alert http2 any any -> any any (msg:"SURICATA HTTP2 compression bomb"; flow:established; app-layer-event:http2.compression_bomb; classtype:protocol-command-decode; sid:2290020; rev:1;)
 alert http2 any any -> any any (msg:"SURICATA HTTP2 headers table overflow"; flow:established; app-layer-event:http2.header_table_overflow; classtype:protocol-command-decode; sid:2290021; rev:1;)
+alert http2 any any -> any any (msg:"SURICATA HTTP2 continuation without headers"; flow:established; app-layer-event:http2.continuation_without_headers; classtype:protocol-command-decode; sid:2290022; rev:1;)

rust/src/http2/http2.rs

@@ -711,6 +711,7 @@ pub enum HTTP2Event {
     DataStreamZero,
     TooManyFrames,
     CompressionBomb,
+    ContinuationWithoutHeaders,
 }
 
 pub struct HTTP2DynTable {
@@ -1261,7 +1262,10 @@ impl HTTP2State {
                         };
                         return (HTTP2FrameTypeData::CONTINUATION(hs), events);
                     }
-                } // else try to parse anyways
+                } else {
+                    events.push(HTTP2Event::ContinuationWithoutHeaders);
+                }
+                // else try to parse anyways
                 let input_reass = if head.stream_id == buf.stream_id {
                     &buf.data
                 } else {