doc/http2: explicit behavior for some http keywords

HTTP/2 does not define a way to carry the version or reason phrase
that is included in an HTTP/1.1 status line.

Ticket: 6548
pull/12862/head
Philippe Antoine 2 years ago committed by Victor Julien
parent 91389a40ce
commit 879a733c12

@ -796,6 +796,9 @@ http.stat_msg
The ``http.stat_msg`` keyword is used to match on the HTTP status message
that can be present in an HTTP response.
For HTTP/2, an empty buffer is returned by Suricata.
See rfc 7540 section 8.1.2.4. about Response Pseudo-Header Fields.
It is possible to use any of the :doc:`payload-keywords` with the
``http.stat_msg`` keyword.
@ -1216,6 +1219,9 @@ http.protocol
The ``http.protocol`` keyword is used to match on the protocol field that is
contained in HTTP requests and responses.
For HTTP/2, the constant string "HTTP/2" is used.
See rfc 7540 section 8.1.2.4. about Response Pseudo-Header Fields.
It is possible to use any of the :doc:`payload-keywords` with the
``http.protocol`` keyword.

Loading…
Cancel
Save