Suricata

This looks like it is caused by multiple issues. First, the "files" inspect engine is not registered for ALPROTO_HTTP2 (src/detect-filename.c). However, if this is done it still doesn't work. Since md5's are logged for these files, something else must be missing.

One thing to look at could be the hack SMB and NFS use before calling into Rust:

static AppLayerResult SMBTCPParseRequest(Flow *f, void *state,
        AppLayerParserState *pstate, const uint8_t *input, uint32_t input_len,
        void *local_data, const uint8_t flags)
{
    SCLogDebug("SMBTCPParseRequest");
    uint16_t file_flags = FileFlowToFlags(f, STREAM_TOSERVER);
    rs_smb_setfileflags(0, state, file_flags|FILE_USE_DETECT);
...

should trigger just a single alert in SV test http2-basic, yet it generates 23 alerts.

I get no alerts so far...

should trigger just a single alert in SV test http2-basic, yet it generates 23 alerts.

Ok without the fix for #4076 it generates 23 alerts
With the fix, it generates 0 alert

DetectFileHashMatch gets called, but only 3 times

eve.json shows that first "event_type": "fileinfo" has "tx_id": 3 and no http data
when first "event_type": "http" has "tx_id": 2,

Seems like the bug was that the file tracker was not using tx_id, but tx_id - 1

FILE_USE_DETECT seems also needed, but for the rule alert http2 any any -> any any (file.data; content:!"html"; startswith; sid:7; rev:1;)