33 static int DetectTlsSerialTest01(
void)
40 "(msg:\"Testing tls.cert_serial\"; "
41 "tls.cert_serial; content:\"XX:XX:XX\"; sid:1;)");
63 static int DetectTlsSerialTest02(
void)
66 uint8_t client_hello[] = {
67 0x16, 0x03, 0x01, 0x00, 0xc8, 0x01, 0x00, 0x00,
68 0xc4, 0x03, 0x03, 0xd6, 0x08, 0x5a, 0xa2, 0x86,
69 0x5b, 0x85, 0xd4, 0x40, 0xab, 0xbe, 0xc0, 0xbc,
70 0x41, 0xf2, 0x26, 0xf0, 0xfe, 0x21, 0xee, 0x8b,
71 0x4c, 0x7e, 0x07, 0xc8, 0xec, 0xd2, 0x00, 0x46,
72 0x4c, 0xeb, 0xb7, 0x00, 0x00, 0x16, 0xc0, 0x2b,
73 0xc0, 0x2f, 0xc0, 0x0a, 0xc0, 0x09, 0xc0, 0x13,
74 0xc0, 0x14, 0x00, 0x33, 0x00, 0x39, 0x00, 0x2f,
75 0x00, 0x35, 0x00, 0x0a, 0x01, 0x00, 0x00, 0x85,
76 0x00, 0x00, 0x00, 0x12, 0x00, 0x10, 0x00, 0x00,
77 0x0d, 0x77, 0x77, 0x77, 0x2e, 0x67, 0x6f, 0x6f,
78 0x67, 0x6c, 0x65, 0x2e, 0x6e, 0x6f, 0xff, 0x01,
79 0x00, 0x01, 0x00, 0x00, 0x0a, 0x00, 0x08, 0x00,
80 0x06, 0x00, 0x17, 0x00, 0x18, 0x00, 0x19, 0x00,
81 0x0b, 0x00, 0x02, 0x01, 0x00, 0x00, 0x23, 0x00,
82 0x00, 0x33, 0x74, 0x00, 0x00, 0x00, 0x10, 0x00,
83 0x29, 0x00, 0x27, 0x05, 0x68, 0x32, 0x2d, 0x31,
84 0x36, 0x05, 0x68, 0x32, 0x2d, 0x31, 0x35, 0x05,
85 0x68, 0x32, 0x2d, 0x31, 0x34, 0x02, 0x68, 0x32,
86 0x08, 0x73, 0x70, 0x64, 0x79, 0x2f, 0x33, 0x2e,
87 0x31, 0x08, 0x68, 0x74, 0x74, 0x70, 0x2f, 0x31,
88 0x2e, 0x31, 0x00, 0x05, 0x00, 0x05, 0x01, 0x00,
89 0x00, 0x00, 0x00, 0x00, 0x0d, 0x00, 0x16, 0x00,
90 0x14, 0x04, 0x01, 0x05, 0x01, 0x06, 0x01, 0x02,
91 0x01, 0x04, 0x03, 0x05, 0x03, 0x06, 0x03, 0x02,
92 0x03, 0x04, 0x02, 0x02, 0x02
96 uint8_t server_hello[] = {
97 0x16, 0x03, 0x03, 0x00, 0x48, 0x02, 0x00, 0x00,
98 0x44, 0x03, 0x03, 0x57, 0x91, 0xb8, 0x63, 0xdd,
99 0xdb, 0xbb, 0x23, 0xcf, 0x0b, 0x43, 0x02, 0x1d,
100 0x46, 0x11, 0x27, 0x5c, 0x98, 0xcf, 0x67, 0xe1,
101 0x94, 0x3d, 0x62, 0x7d, 0x38, 0x48, 0x21, 0x23,
102 0xa5, 0x62, 0x31, 0x00, 0xc0, 0x2f, 0x00, 0x00,
103 0x1c, 0xff, 0x01, 0x00, 0x01, 0x00, 0x00, 0x00,
104 0x00, 0x00, 0x00, 0x23, 0x00, 0x00, 0x00, 0x10,
105 0x00, 0x05, 0x00, 0x03, 0x02, 0x68, 0x32, 0x00,
106 0x0b, 0x00, 0x02, 0x01, 0x00
110 uint8_t certificate[] = {
111 0x16, 0x03, 0x03, 0x04, 0x93, 0x0b, 0x00, 0x04,
112 0x8f, 0x00, 0x04, 0x8c, 0x00, 0x04, 0x89, 0x30,
113 0x82, 0x04, 0x85, 0x30, 0x82, 0x03, 0x6d, 0xa0,
114 0x03, 0x02, 0x01, 0x02, 0x02, 0x08, 0x5c, 0x19,
115 0xb7, 0xb1, 0x32, 0x3b, 0x1c, 0xa1, 0x30, 0x0d,
116 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d,
117 0x01, 0x01, 0x0b, 0x05, 0x00, 0x30, 0x49, 0x31,
118 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06,
119 0x13, 0x02, 0x55, 0x53, 0x31, 0x13, 0x30, 0x11,
120 0x06, 0x03, 0x55, 0x04, 0x0a, 0x13, 0x0a, 0x47,
121 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x20, 0x49, 0x6e,
122 0x63, 0x31, 0x25, 0x30, 0x23, 0x06, 0x03, 0x55,
123 0x04, 0x03, 0x13, 0x1c, 0x47, 0x6f, 0x6f, 0x67,
124 0x6c, 0x65, 0x20, 0x49, 0x6e, 0x74, 0x65, 0x72,
125 0x6e, 0x65, 0x74, 0x20, 0x41, 0x75, 0x74, 0x68,
126 0x6f, 0x72, 0x69, 0x74, 0x79, 0x20, 0x47, 0x32,
127 0x30, 0x1e, 0x17, 0x0d, 0x31, 0x36, 0x30, 0x37,
128 0x31, 0x33, 0x31, 0x33, 0x32, 0x34, 0x35, 0x32,
129 0x5a, 0x17, 0x0d, 0x31, 0x36, 0x31, 0x30, 0x30,
130 0x35, 0x31, 0x33, 0x31, 0x36, 0x30, 0x30, 0x5a,
131 0x30, 0x65, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03,
132 0x55, 0x04, 0x06, 0x13, 0x02, 0x55, 0x53, 0x31,
133 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x08,
134 0x0c, 0x0a, 0x43, 0x61, 0x6c, 0x69, 0x66, 0x6f,
135 0x72, 0x6e, 0x69, 0x61, 0x31, 0x16, 0x30, 0x14,
136 0x06, 0x03, 0x55, 0x04, 0x07, 0x0c, 0x0d, 0x4d,
137 0x6f, 0x75, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x20,
138 0x56, 0x69, 0x65, 0x77, 0x31, 0x13, 0x30, 0x11,
139 0x06, 0x03, 0x55, 0x04, 0x0a, 0x0c, 0x0a, 0x47,
140 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x20, 0x49, 0x6e,
141 0x63, 0x31, 0x14, 0x30, 0x12, 0x06, 0x03, 0x55,
142 0x04, 0x03, 0x0c, 0x0b, 0x2a, 0x2e, 0x67, 0x6f,
143 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x6e, 0x6f, 0x30,
144 0x82, 0x01, 0x22, 0x30, 0x0d, 0x06, 0x09, 0x2a,
145 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01,
146 0x05, 0x00, 0x03, 0x82, 0x01, 0x0f, 0x00, 0x30,
147 0x82, 0x01, 0x0a, 0x02, 0x82, 0x01, 0x01, 0x00,
148 0xa5, 0x0a, 0xb9, 0xb1, 0xca, 0x36, 0xd1, 0xae,
149 0x22, 0x38, 0x07, 0x06, 0xc9, 0x1a, 0x56, 0x4f,
150 0xbb, 0xdf, 0xa8, 0x6d, 0xbd, 0xee, 0x76, 0x16,
151 0xbc, 0x53, 0x3c, 0x03, 0x6a, 0x5c, 0x94, 0x50,
152 0x87, 0x2f, 0x28, 0xb4, 0x4e, 0xd5, 0x9b, 0x8f,
153 0xfe, 0x02, 0xde, 0x2a, 0x83, 0x01, 0xf9, 0x45,
154 0x61, 0x0e, 0x66, 0x0e, 0x24, 0x22, 0xe2, 0x59,
155 0x66, 0x0d, 0xd3, 0xe9, 0x77, 0x8a, 0x7e, 0x42,
156 0xaa, 0x5a, 0xf9, 0x05, 0xbf, 0x30, 0xc7, 0x03,
157 0x2b, 0xdc, 0xa6, 0x9c, 0xe0, 0x9f, 0x0d, 0xf1,
158 0x28, 0x19, 0xf8, 0xf2, 0x02, 0xfa, 0xbd, 0x62,
159 0xa0, 0xf3, 0x02, 0x2b, 0xcd, 0xf7, 0x09, 0x04,
160 0x3b, 0x52, 0xd8, 0x65, 0x4b, 0x4a, 0x70, 0xe4,
161 0x57, 0xc9, 0x2e, 0x2a, 0xf6, 0x9c, 0x6e, 0xd8,
162 0xde, 0x01, 0x52, 0xc9, 0x6f, 0xe9, 0xef, 0x82,
163 0xbc, 0x0b, 0x95, 0xb2, 0xef, 0xcb, 0x91, 0xa6,
164 0x0b, 0x2d, 0x14, 0xc6, 0x00, 0xa9, 0x33, 0x86,
165 0x64, 0x00, 0xd4, 0x92, 0x19, 0x53, 0x3d, 0xfd,
166 0xcd, 0xc6, 0x1a, 0xf2, 0x0e, 0x67, 0xc2, 0x1d,
167 0x2c, 0xe0, 0xe8, 0x29, 0x97, 0x1c, 0xb6, 0xc4,
168 0xb2, 0x02, 0x0c, 0x83, 0xb8, 0x60, 0x61, 0xf5,
169 0x61, 0x2d, 0x73, 0x5e, 0x85, 0x4d, 0xbd, 0x0d,
170 0xe7, 0x1a, 0x37, 0x56, 0x8d, 0xe5, 0x50, 0x0c,
171 0xc9, 0x64, 0x4c, 0x11, 0xea, 0xf3, 0xcb, 0x26,
172 0x34, 0xbd, 0x02, 0xf5, 0xc1, 0xfb, 0xa2, 0xec,
173 0x27, 0xbb, 0x60, 0xbe, 0x0b, 0xf6, 0xe7, 0x3c,
174 0x2d, 0xc9, 0xe7, 0xb0, 0x30, 0x28, 0x17, 0x3d,
175 0x90, 0xf1, 0x63, 0x8e, 0x49, 0xf7, 0x15, 0x78,
176 0x21, 0xcc, 0x45, 0xe6, 0x86, 0xb2, 0xd8, 0xb0,
177 0x2e, 0x5a, 0xb0, 0x58, 0xd3, 0xb6, 0x11, 0x40,
178 0xae, 0x81, 0x1f, 0x6b, 0x7a, 0xaf, 0x40, 0x50,
179 0xf9, 0x2e, 0x81, 0x8b, 0xec, 0x26, 0x11, 0x3f,
180 0x02, 0x03, 0x01, 0x00, 0x01, 0xa3, 0x82, 0x01,
181 0x53, 0x30, 0x82, 0x01, 0x4f, 0x30, 0x1d, 0x06,
182 0x03, 0x55, 0x1d, 0x25, 0x04, 0x16, 0x30, 0x14,
183 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07,
184 0x03, 0x01, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05,
185 0x05, 0x07, 0x03, 0x02, 0x30, 0x21, 0x06, 0x03,
186 0x55, 0x1d, 0x11, 0x04, 0x1a, 0x30, 0x18, 0x82,
187 0x0b, 0x2a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
188 0x65, 0x2e, 0x6e, 0x6f, 0x82, 0x09, 0x67, 0x6f,
189 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x6e, 0x6f, 0x30,
190 0x68, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05,
191 0x07, 0x01, 0x01, 0x04, 0x5c, 0x30, 0x5a, 0x30,
192 0x2b, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05,
193 0x07, 0x30, 0x02, 0x86, 0x1f, 0x68, 0x74, 0x74,
194 0x70, 0x3a, 0x2f, 0x2f, 0x70, 0x6b, 0x69, 0x2e,
195 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x63,
196 0x6f, 0x6d, 0x2f, 0x47, 0x49, 0x41, 0x47, 0x32,
197 0x2e, 0x63, 0x72, 0x74, 0x30, 0x2b, 0x06, 0x08,
198 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x30, 0x01,
199 0x86, 0x1f, 0x68, 0x74, 0x74, 0x70, 0x3a, 0x2f,
200 0x2f, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x73,
201 0x31, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
202 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6f, 0x63, 0x73,
203 0x70, 0x30, 0x1d, 0x06, 0x03, 0x55, 0x1d, 0x0e,
204 0x04, 0x16, 0x04, 0x14, 0xc6, 0x53, 0x87, 0x42,
205 0x2d, 0xc8, 0xee, 0x7a, 0x62, 0x1e, 0x83, 0xdb,
206 0x0d, 0xe2, 0x32, 0xeb, 0x8b, 0xaf, 0x69, 0x40,
207 0x30, 0x0c, 0x06, 0x03, 0x55, 0x1d, 0x13, 0x01,
208 0x01, 0xff, 0x04, 0x02, 0x30, 0x00, 0x30, 0x1f,
209 0x06, 0x03, 0x55, 0x1d, 0x23, 0x04, 0x18, 0x30,
210 0x16, 0x80, 0x14, 0x4a, 0xdd, 0x06, 0x16, 0x1b,
211 0xbc, 0xf6, 0x68, 0xb5, 0x76, 0xf5, 0x81, 0xb6,
212 0xbb, 0x62, 0x1a, 0xba, 0x5a, 0x81, 0x2f, 0x30,
213 0x21, 0x06, 0x03, 0x55, 0x1d, 0x20, 0x04, 0x1a,
214 0x30, 0x18, 0x30, 0x0c, 0x06, 0x0a, 0x2b, 0x06,
215 0x01, 0x04, 0x01, 0xd6, 0x79, 0x02, 0x05, 0x01,
216 0x30, 0x08, 0x06, 0x06, 0x67, 0x81, 0x0c, 0x01,
217 0x02, 0x02, 0x30, 0x30, 0x06, 0x03, 0x55, 0x1d,
218 0x1f, 0x04, 0x29, 0x30, 0x27, 0x30, 0x25, 0xa0,
219 0x23, 0xa0, 0x21, 0x86, 0x1f, 0x68, 0x74, 0x74,
220 0x70, 0x3a, 0x2f, 0x2f, 0x70, 0x6b, 0x69, 0x2e,
221 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x63,
222 0x6f, 0x6d, 0x2f, 0x47, 0x49, 0x41, 0x47, 0x32,
223 0x2e, 0x63, 0x72, 0x6c, 0x30, 0x0d, 0x06, 0x09,
224 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01,
225 0x0b, 0x05, 0x00, 0x03, 0x82, 0x01, 0x01, 0x00,
226 0x7b, 0x27, 0x00, 0x46, 0x8f, 0xfd, 0x5b, 0xff,
227 0xcb, 0x05, 0x9b, 0xf7, 0xf1, 0x68, 0xf6, 0x9a,
228 0x7b, 0xba, 0x53, 0xdf, 0x63, 0xed, 0x11, 0x94,
229 0x39, 0xf2, 0xd0, 0x20, 0xcd, 0xa3, 0xc4, 0x98,
230 0xa5, 0x10, 0x74, 0xe7, 0x10, 0x6d, 0x07, 0xf8,
231 0x33, 0x87, 0x05, 0x43, 0x0e, 0x64, 0x77, 0x09,
232 0x18, 0x4f, 0x38, 0x2e, 0x45, 0xae, 0xa8, 0x34,
233 0x3a, 0xa8, 0x33, 0xac, 0x9d, 0xdd, 0x25, 0x91,
234 0x59, 0x43, 0xbe, 0x0f, 0x87, 0x16, 0x2f, 0xb5,
235 0x27, 0xfd, 0xce, 0x2f, 0x35, 0x5d, 0x12, 0xa1,
236 0x66, 0xac, 0xf7, 0x95, 0x38, 0x0f, 0xe5, 0xb1,
237 0x18, 0x18, 0xe6, 0x80, 0x52, 0x31, 0x8a, 0x66,
238 0x02, 0x52, 0x1a, 0xa4, 0x32, 0x6a, 0x61, 0x05,
239 0xcf, 0x1d, 0xf9, 0x90, 0x73, 0xf0, 0xeb, 0x20,
240 0x31, 0x7b, 0x2e, 0xc0, 0xb0, 0xfb, 0x5c, 0xcc,
241 0xdc, 0x76, 0x55, 0x72, 0xaf, 0xb1, 0x05, 0xf4,
242 0xad, 0xf9, 0xd7, 0x73, 0x5c, 0x2c, 0xbf, 0x0d,
243 0x84, 0x18, 0x01, 0x1d, 0x4d, 0x08, 0xa9, 0x4e,
244 0x37, 0xb7, 0x58, 0xc4, 0x05, 0x0e, 0x65, 0x63,
245 0xd2, 0x88, 0x02, 0xf5, 0x82, 0x17, 0x08, 0xd5,
246 0x8f, 0x80, 0xc7, 0x82, 0x29, 0xbb, 0xe1, 0x04,
247 0xbe, 0xf6, 0xe1, 0x8c, 0xbc, 0x3a, 0xf8, 0xf9,
248 0x56, 0xda, 0xdc, 0x8e, 0xc6, 0xe6, 0x63, 0x98,
249 0x12, 0x08, 0x41, 0x2c, 0x9d, 0x7c, 0x82, 0x0d,
250 0x1e, 0xea, 0xba, 0xde, 0x32, 0x09, 0xda, 0x52,
251 0x24, 0x4f, 0xcc, 0xb6, 0x09, 0x33, 0x8b, 0x00,
252 0xf9, 0x83, 0xb3, 0xc6, 0xa4, 0x90, 0x49, 0x83,
253 0x2d, 0x36, 0xd9, 0x11, 0x78, 0xd0, 0x62, 0x9f,
254 0xc4, 0x8f, 0x84, 0xba, 0x7f, 0xaa, 0x04, 0xf1,
255 0xd9, 0xa4, 0xad, 0x5d, 0x63, 0xee, 0x72, 0xc6,
256 0x4d, 0xd1, 0x4b, 0x41, 0x8f, 0x40, 0x0f, 0x7d,
257 0xcd, 0xb8, 0x2e, 0x5b, 0x6e, 0x21, 0xc9, 0x3d
271 memset(&f, 0,
sizeof(
Flow));
275 "192.168.1.5",
"192.168.1.1", 51251, 443);
277 "192.168.1.1",
"192.168.1.5", 443, 51251);
279 "192.168.1.1",
"192.168.1.5", 443, 51251);
283 f.
proto = IPPROTO_TCP;
314 "(msg:\"Test tls.cert_serial\"; "
316 "content:\"5C:19:B7:B1:32:3B:1C:A1\"; "
324 STREAM_TOSERVER, client_hello,
325 sizeof(client_hello));
337 server_hello,
sizeof(server_hello));
346 certificate,
sizeof(certificate));
372 static void DetectTlsSerialRegisterTests(
void)