suricata
detect-tls-cert-validity.c
Go to the documentation of this file.
1 /* Copyright (C) 2015-2019 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Mats Klepsland <mats.klepsland@gmail.com>
22  *
23  */
24 
25 #include "detect-engine-build.h"
26 #include "detect-engine-alert.h"
27 #include "app-layer-parser.h"
28 
29 /**
30  * \test This is a test for a valid value 1430000000.
31  *
32  * \retval 1 on success.
33  * \retval 0 on failure.
34  */
35 static int ValidityTestParse01 (void)
36 {
37  DetectTlsValidityData *dd = NULL;
38  dd = DetectTlsValidityParse("1430000000");
39  FAIL_IF_NULL(dd);
40  FAIL_IF_NOT(dd->epoch == 1430000000 && dd->mode == DETECT_TLS_VALIDITY_EQ);
41  DetectTlsValidityFree(NULL, dd);
42  PASS;
43 }
44 
45 /**
46  * \test This is a test for a valid value >1430000000.
47  *
48  * \retval 1 on success.
49  * \retval 0 on failure.
50  */
51 static int ValidityTestParse02 (void)
52 {
53  DetectTlsValidityData *dd = NULL;
54  dd = DetectTlsValidityParse(">1430000000");
55  FAIL_IF_NULL(dd);
56  FAIL_IF_NOT(dd->epoch == 1430000000 && dd->mode == DETECT_TLS_VALIDITY_GT);
57  DetectTlsValidityFree(NULL, dd);
58  PASS;
59 }
60 
61 /**
62  * \test This is a test for a valid value <1430000000.
63  *
64  * \retval 1 on success.
65  * \retval 0 on failure.
66  */
67 static int ValidityTestParse03 (void)
68 {
69  DetectTlsValidityData *dd = NULL;
70  dd = DetectTlsValidityParse("<1430000000");
71  FAIL_IF_NULL(dd);
72  FAIL_IF_NOT(dd->epoch == 1430000000 && dd->mode == DETECT_TLS_VALIDITY_LT);
73  DetectTlsValidityFree(NULL, dd);
74  PASS;
75 }
76 
77 /**
78  * \test This is a test for a valid value 1430000000<>1470000000.
79  *
80  * \retval 1 on success.
81  * \retval 0 on failure.
82  */
83 static int ValidityTestParse04 (void)
84 {
85  DetectTlsValidityData *dd = NULL;
86  dd = DetectTlsValidityParse("1430000000<>1470000000");
87  FAIL_IF_NULL(dd);
88  FAIL_IF_NOT(dd->epoch == 1430000000 && dd->epoch2 == 1470000000 &&
89  dd->mode == DETECT_TLS_VALIDITY_RA);
90  DetectTlsValidityFree(NULL, dd);
91  PASS;
92 }
93 
94 /**
95  * \test This is a test for a invalid value A.
96  *
97  * \retval 1 on success.
98  * \retval 0 on failure.
99  */
100 static int ValidityTestParse05 (void)
101 {
102  DetectTlsValidityData *dd = NULL;
103  dd = DetectTlsValidityParse("A");
104  FAIL_IF_NOT_NULL(dd);
105  PASS;
106 }
107 
108 /**
109  * \test This is a test for a invalid value >1430000000<>1470000000.
110  *
111  * \retval 1 on success.
112  * \retval 0 on failure.
113  */
114 static int ValidityTestParse06 (void)
115 {
116  DetectTlsValidityData *dd = NULL;
117  dd = DetectTlsValidityParse(">1430000000<>1470000000");
118  FAIL_IF_NOT_NULL(dd);
119  PASS;
120 }
121 
122 /**
123  * \test This is a test for a invalid value 1430000000<>.
124  *
125  * \retval 1 on success.
126  * \retval 0 on failure.
127  */
128 static int ValidityTestParse07 (void)
129 {
130  DetectTlsValidityData *dd = NULL;
131  dd = DetectTlsValidityParse("1430000000<>");
132  FAIL_IF_NOT_NULL(dd);
133  PASS;
134 }
135 
136 /**
137  * \test This is a test for a invalid value <>1430000000.
138  *
139  * \retval 1 on success.
140  * \retval 0 on failure.
141  */
142 static int ValidityTestParse08 (void)
143 {
144  DetectTlsValidityData *dd = NULL;
145  dd = DetectTlsValidityParse("<>1430000000");
146  FAIL_IF_NOT_NULL(dd);
147  PASS;
148 }
149 
150 /**
151  * \test This is a test for a invalid value "".
152  *
153  * \retval 1 on success.
154  * \retval 0 on failure.
155  */
156 static int ValidityTestParse09 (void)
157 {
158  DetectTlsValidityData *dd = NULL;
159  dd = DetectTlsValidityParse("");
160  FAIL_IF_NOT_NULL(dd);
161  PASS;
162 }
163 
164 /**
165  * \test This is a test for a invalid value " ".
166  *
167  * \retval 1 on success.
168  * \retval 0 on failure.
169  */
170 static int ValidityTestParse10 (void)
171 {
172  DetectTlsValidityData *dd = NULL;
173  dd = DetectTlsValidityParse(" ");
174  FAIL_IF_NOT_NULL(dd);
175  PASS;
176 }
177 
178 /**
179  * \test This is a test for a invalid value 1490000000<>1430000000.
180  *
181  * \retval 1 on success.
182  * \retval 0 on failure.
183  */
184 static int ValidityTestParse11 (void)
185 {
186  DetectTlsValidityData *dd = NULL;
187  dd = DetectTlsValidityParse("1490000000<>1430000000");
188  FAIL_IF_NOT_NULL(dd);
189  PASS;
190 }
191 
192 /**
193  * \test This is a test for a valid value 1430000000 <> 1490000000.
194  *
195  * \retval 1 on success.
196  * \retval 0 on failure.
197  */
198 static int ValidityTestParse12 (void)
199 {
200  DetectTlsValidityData *dd = NULL;
201  dd = DetectTlsValidityParse("1430000000 <> 1490000000");
202  FAIL_IF_NULL(dd);
203  FAIL_IF_NOT(dd->epoch == 1430000000 && dd->epoch2 == 1490000000 &&
204  dd->mode == DETECT_TLS_VALIDITY_RA);
205  DetectTlsValidityFree(NULL, dd);
206  PASS;
207 }
208 
209 /**
210  * \test This is a test for a valid value > 1430000000.
211  *
212  * \retval 1 on success.
213  * \retval 0 on failure.
214  */
215 static int ValidityTestParse13 (void)
216 {
217  DetectTlsValidityData *dd = NULL;
218  dd = DetectTlsValidityParse("> 1430000000 ");
219  FAIL_IF_NULL(dd);
220  FAIL_IF_NOT(dd->epoch == 1430000000 && dd->mode == DETECT_TLS_VALIDITY_GT);
221  DetectTlsValidityFree(NULL, dd);
222  PASS;
223 }
224 
225 /**
226  * \test This is a test for a valid value < 1490000000.
227  *
228  * \retval 1 on success.
229  * \retval 0 on failure.
230  */
231 static int ValidityTestParse14 (void)
232 {
233  DetectTlsValidityData *dd = NULL;
234  dd = DetectTlsValidityParse("< 1490000000 ");
235  FAIL_IF_NULL(dd);
236  FAIL_IF_NOT(dd->epoch == 1490000000 && dd->mode == DETECT_TLS_VALIDITY_LT);
237  DetectTlsValidityFree(NULL, dd);
238  PASS;
239 }
240 
241 /**
242  * \test This is a test for a valid value 1490000000.
243  *
244  * \retval 1 on success.
245  * \retval 0 on failure.
246  */
247 static int ValidityTestParse15 (void)
248 {
249  DetectTlsValidityData *dd = NULL;
250  dd = DetectTlsValidityParse(" 1490000000 ");
251  FAIL_IF_NULL(dd);
252  FAIL_IF_NOT(dd->epoch == 1490000000 && dd->mode == DETECT_TLS_VALIDITY_EQ);
253  DetectTlsValidityFree(NULL, dd);
254  PASS;
255 }
256 
257 /**
258  * \test This is a test for a valid value 2015-10.
259  *
260  * \retval 1 on success.
261  * \retval 0 on failure.
262  */
263 static int ValidityTestParse16 (void)
264 {
265  DetectTlsValidityData *dd = NULL;
266  dd = DetectTlsValidityParse("2015-10");
267  FAIL_IF_NULL(dd);
268  FAIL_IF_NOT(dd->epoch == 1443657600 && dd->mode == DETECT_TLS_VALIDITY_EQ);
269  DetectTlsValidityFree(NULL, dd);
270  PASS;
271 }
272 
273 /**
274  * \test This is a test for a valid value >2015-10-22.
275  *
276  * \retval 1 on success.
277  * \retval 0 on failure.
278  */
279 static int ValidityTestParse17 (void)
280 {
281  DetectTlsValidityData *dd = NULL;
282  dd = DetectTlsValidityParse(">2015-10-22");
283  FAIL_IF_NULL(dd);
284  FAIL_IF_NOT(dd->epoch == 1445472000 && dd->mode == DETECT_TLS_VALIDITY_GT);
285  DetectTlsValidityFree(NULL, dd);
286  PASS;
287 }
288 
289 /**
290  * \test This is a test for a valid value <2015-10-22 23.
291  *
292  * \retval 1 on success.
293  * \retval 0 on failure.
294  */
295 static int ValidityTestParse18 (void)
296 {
297  DetectTlsValidityData *dd = NULL;
298  dd = DetectTlsValidityParse("<2015-10-22 23");
299  FAIL_IF_NULL(dd);
300  FAIL_IF_NOT(dd->epoch == 1445554800 && dd->mode == DETECT_TLS_VALIDITY_LT);
301  DetectTlsValidityFree(NULL, dd);
302  PASS;
303 }
304 
305 /**
306  * \test This is a test for a valid value 2015-10-22 23:59.
307  *
308  * \retval 1 on success.
309  * \retval 0 on failure.
310  */
311 static int ValidityTestParse19 (void)
312 {
313  DetectTlsValidityData *dd = NULL;
314  dd = DetectTlsValidityParse("2015-10-22 23:59");
315  FAIL_IF_NULL(dd);
316  FAIL_IF_NOT(dd->epoch == 1445558340 && dd->mode == DETECT_TLS_VALIDITY_EQ);
317  DetectTlsValidityFree(NULL, dd);
318  PASS;
319 }
320 
321 /**
322  * \test This is a test for a valid value 2015-10-22 23:59:59.
323  *
324  * \retval 1 on success.
325  * \retval 0 on failure.
326  */
327 static int ValidityTestParse20 (void)
328 {
329  DetectTlsValidityData *dd = NULL;
330  dd = DetectTlsValidityParse("2015-10-22 23:59:59");
331  FAIL_IF_NULL(dd);
332  FAIL_IF_NOT(dd->epoch == 1445558399 && dd->mode == DETECT_TLS_VALIDITY_EQ);
333  DetectTlsValidityFree(NULL, dd);
334  PASS;
335 }
336 
337 /**
338  * \test This is a test for a valid value 2015-10-22T23.
339  *
340  * \retval 1 on success.
341  * \retval 0 on failure.
342  */
343 static int ValidityTestParse21 (void)
344 {
345  DetectTlsValidityData *dd = NULL;
346  dd = DetectTlsValidityParse("2015-10-22T23");
347  FAIL_IF_NULL(dd);
348  FAIL_IF_NOT(dd->epoch == 1445554800 && dd->mode == DETECT_TLS_VALIDITY_EQ);
349  DetectTlsValidityFree(NULL, dd);
350  PASS;
351 }
352 
353 /**
354  * \test This is a test for a valid value 2015-10-22T23:59.
355  *
356  * \retval 1 on success.
357  * \retval 0 on failure.
358  */
359 static int ValidityTestParse22 (void)
360 {
361  DetectTlsValidityData *dd = NULL;
362  dd = DetectTlsValidityParse("2015-10-22T23:59");
363  FAIL_IF_NULL(dd);
364  FAIL_IF_NOT(dd->epoch == 1445558340 && dd->mode == DETECT_TLS_VALIDITY_EQ);
365  DetectTlsValidityFree(NULL, dd);
366  PASS;
367 }
368 
369 /**
370  * \test This is a test for a valid value 2015-10-22T23:59:59.
371  *
372  * \retval 1 on success.
373  * \retval 0 on failure.
374  */
375 static int ValidityTestParse23 (void)
376 {
377  DetectTlsValidityData *dd = NULL;
378  dd = DetectTlsValidityParse("2015-10-22T23:59:59");
379  FAIL_IF_NULL(dd);
380  FAIL_IF_NOT(dd->epoch == 1445558399 && dd->mode == DETECT_TLS_VALIDITY_EQ);
381  DetectTlsValidityFree(NULL, dd);
382  PASS;
383 }
384 
385 /**
386  * \test This is a test for a valid value of 1970-01-01T00:00:00
387  * that is at epoch 0, within the range of acceptable
388  * values (1950-2049) as per RFC 5280. (https://tools.ietf.org/html/rfc5280#section-4.1.2.5.1)
389  *
390  * \retval 1 on success.
391  * \retval 0 on failure.
392  */
393 static int ValidityTestParse24(void)
394 {
395  DetectTlsValidityData *dd = NULL;
396  dd = DetectTlsValidityParse("1970-01-01T00:00:00");
397  FAIL_IF_NULL(dd);
398  FAIL_IF_NOT(dd->epoch == 0 && dd->mode == DETECT_TLS_VALIDITY_EQ);
399  DetectTlsValidityFree(NULL, dd);
400  PASS;
401 }
402 
403 /**
404  * \test This is a test for a valid value of 1965-10-22T23:59:59
405  * that is lower than epoch 0, but within the range of
406  * acceptable values (1950-2049) as per RFC 5280.
407  * (https://tools.ietf.org/html/rfc5280#section-4.1.2.5.1)
408  *
409  * \retval 1 on success.
410  * \retval 0 on failure.
411  */
412 static int ValidityTestParse25(void)
413 {
414  DetectTlsValidityData *dd = NULL;
415  dd = DetectTlsValidityParse("1969-12-31T23:59:59");
416  FAIL_IF_NULL(dd);
417  FAIL_IF_NOT(dd->epoch == -1 && dd->mode == DETECT_TLS_VALIDITY_EQ);
418  DetectTlsValidityFree(NULL, dd);
419  PASS;
420 }
421 
422 /**
423  * \test Test matching on validity dates in a certificate.
424  *
425  * \retval 1 on success.
426  * \retval 0 on failure.
427  */
428 static int ValidityTestDetect01(void)
429 {
430  /* client hello */
431  uint8_t client_hello[] = {
432  0x16, 0x03, 0x01, 0x00, 0xc8, 0x01, 0x00, 0x00,
433  0xc4, 0x03, 0x03, 0xd6, 0x08, 0x5a, 0xa2, 0x86,
434  0x5b, 0x85, 0xd4, 0x40, 0xab, 0xbe, 0xc0, 0xbc,
435  0x41, 0xf2, 0x26, 0xf0, 0xfe, 0x21, 0xee, 0x8b,
436  0x4c, 0x7e, 0x07, 0xc8, 0xec, 0xd2, 0x00, 0x46,
437  0x4c, 0xeb, 0xb7, 0x00, 0x00, 0x16, 0xc0, 0x2b,
438  0xc0, 0x2f, 0xc0, 0x0a, 0xc0, 0x09, 0xc0, 0x13,
439  0xc0, 0x14, 0x00, 0x33, 0x00, 0x39, 0x00, 0x2f,
440  0x00, 0x35, 0x00, 0x0a, 0x01, 0x00, 0x00, 0x85,
441  0x00, 0x00, 0x00, 0x12, 0x00, 0x10, 0x00, 0x00,
442  0x0d, 0x77, 0x77, 0x77, 0x2e, 0x67, 0x6f, 0x6f,
443  0x67, 0x6c, 0x65, 0x2e, 0x6e, 0x6f, 0xff, 0x01,
444  0x00, 0x01, 0x00, 0x00, 0x0a, 0x00, 0x08, 0x00,
445  0x06, 0x00, 0x17, 0x00, 0x18, 0x00, 0x19, 0x00,
446  0x0b, 0x00, 0x02, 0x01, 0x00, 0x00, 0x23, 0x00,
447  0x00, 0x33, 0x74, 0x00, 0x00, 0x00, 0x10, 0x00,
448  0x29, 0x00, 0x27, 0x05, 0x68, 0x32, 0x2d, 0x31,
449  0x36, 0x05, 0x68, 0x32, 0x2d, 0x31, 0x35, 0x05,
450  0x68, 0x32, 0x2d, 0x31, 0x34, 0x02, 0x68, 0x32,
451  0x08, 0x73, 0x70, 0x64, 0x79, 0x2f, 0x33, 0x2e,
452  0x31, 0x08, 0x68, 0x74, 0x74, 0x70, 0x2f, 0x31,
453  0x2e, 0x31, 0x00, 0x05, 0x00, 0x05, 0x01, 0x00,
454  0x00, 0x00, 0x00, 0x00, 0x0d, 0x00, 0x16, 0x00,
455  0x14, 0x04, 0x01, 0x05, 0x01, 0x06, 0x01, 0x02,
456  0x01, 0x04, 0x03, 0x05, 0x03, 0x06, 0x03, 0x02,
457  0x03, 0x04, 0x02, 0x02, 0x02
458  };
459 
460  /* server hello */
461  uint8_t server_hello[] = {
462  0x16, 0x03, 0x03, 0x00, 0x48, 0x02, 0x00, 0x00,
463  0x44, 0x03, 0x03, 0x57, 0x91, 0xb8, 0x63, 0xdd,
464  0xdb, 0xbb, 0x23, 0xcf, 0x0b, 0x43, 0x02, 0x1d,
465  0x46, 0x11, 0x27, 0x5c, 0x98, 0xcf, 0x67, 0xe1,
466  0x94, 0x3d, 0x62, 0x7d, 0x38, 0x48, 0x21, 0x23,
467  0xa5, 0x62, 0x31, 0x00, 0xc0, 0x2f, 0x00, 0x00,
468  0x1c, 0xff, 0x01, 0x00, 0x01, 0x00, 0x00, 0x00,
469  0x00, 0x00, 0x00, 0x23, 0x00, 0x00, 0x00, 0x10,
470  0x00, 0x05, 0x00, 0x03, 0x02, 0x68, 0x32, 0x00,
471  0x0b, 0x00, 0x02, 0x01, 0x00
472  };
473 
474  /* certificate */
475  uint8_t certificate[] = {
476  0x16, 0x03, 0x03, 0x04, 0x93, 0x0b, 0x00, 0x04,
477  0x8f, 0x00, 0x04, 0x8c, 0x00, 0x04, 0x89, 0x30,
478  0x82, 0x04, 0x85, 0x30, 0x82, 0x03, 0x6d, 0xa0,
479  0x03, 0x02, 0x01, 0x02, 0x02, 0x08, 0x5c, 0x19,
480  0xb7, 0xb1, 0x32, 0x3b, 0x1c, 0xa1, 0x30, 0x0d,
481  0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d,
482  0x01, 0x01, 0x0b, 0x05, 0x00, 0x30, 0x49, 0x31,
483  0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06,
484  0x13, 0x02, 0x55, 0x53, 0x31, 0x13, 0x30, 0x11,
485  0x06, 0x03, 0x55, 0x04, 0x0a, 0x13, 0x0a, 0x47,
486  0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x20, 0x49, 0x6e,
487  0x63, 0x31, 0x25, 0x30, 0x23, 0x06, 0x03, 0x55,
488  0x04, 0x03, 0x13, 0x1c, 0x47, 0x6f, 0x6f, 0x67,
489  0x6c, 0x65, 0x20, 0x49, 0x6e, 0x74, 0x65, 0x72,
490  0x6e, 0x65, 0x74, 0x20, 0x41, 0x75, 0x74, 0x68,
491  0x6f, 0x72, 0x69, 0x74, 0x79, 0x20, 0x47, 0x32,
492  0x30, 0x1e, 0x17, 0x0d, 0x31, 0x36, 0x30, 0x37,
493  0x31, 0x33, 0x31, 0x33, 0x32, 0x34, 0x35, 0x32,
494  0x5a, 0x17, 0x0d, 0x31, 0x36, 0x31, 0x30, 0x30,
495  0x35, 0x31, 0x33, 0x31, 0x36, 0x30, 0x30, 0x5a,
496  0x30, 0x65, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03,
497  0x55, 0x04, 0x06, 0x13, 0x02, 0x55, 0x53, 0x31,
498  0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x08,
499  0x0c, 0x0a, 0x43, 0x61, 0x6c, 0x69, 0x66, 0x6f,
500  0x72, 0x6e, 0x69, 0x61, 0x31, 0x16, 0x30, 0x14,
501  0x06, 0x03, 0x55, 0x04, 0x07, 0x0c, 0x0d, 0x4d,
502  0x6f, 0x75, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x20,
503  0x56, 0x69, 0x65, 0x77, 0x31, 0x13, 0x30, 0x11,
504  0x06, 0x03, 0x55, 0x04, 0x0a, 0x0c, 0x0a, 0x47,
505  0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x20, 0x49, 0x6e,
506  0x63, 0x31, 0x14, 0x30, 0x12, 0x06, 0x03, 0x55,
507  0x04, 0x03, 0x0c, 0x0b, 0x2a, 0x2e, 0x67, 0x6f,
508  0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x6e, 0x6f, 0x30,
509  0x82, 0x01, 0x22, 0x30, 0x0d, 0x06, 0x09, 0x2a,
510  0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01,
511  0x05, 0x00, 0x03, 0x82, 0x01, 0x0f, 0x00, 0x30,
512  0x82, 0x01, 0x0a, 0x02, 0x82, 0x01, 0x01, 0x00,
513  0xa5, 0x0a, 0xb9, 0xb1, 0xca, 0x36, 0xd1, 0xae,
514  0x22, 0x38, 0x07, 0x06, 0xc9, 0x1a, 0x56, 0x4f,
515  0xbb, 0xdf, 0xa8, 0x6d, 0xbd, 0xee, 0x76, 0x16,
516  0xbc, 0x53, 0x3c, 0x03, 0x6a, 0x5c, 0x94, 0x50,
517  0x87, 0x2f, 0x28, 0xb4, 0x4e, 0xd5, 0x9b, 0x8f,
518  0xfe, 0x02, 0xde, 0x2a, 0x83, 0x01, 0xf9, 0x45,
519  0x61, 0x0e, 0x66, 0x0e, 0x24, 0x22, 0xe2, 0x59,
520  0x66, 0x0d, 0xd3, 0xe9, 0x77, 0x8a, 0x7e, 0x42,
521  0xaa, 0x5a, 0xf9, 0x05, 0xbf, 0x30, 0xc7, 0x03,
522  0x2b, 0xdc, 0xa6, 0x9c, 0xe0, 0x9f, 0x0d, 0xf1,
523  0x28, 0x19, 0xf8, 0xf2, 0x02, 0xfa, 0xbd, 0x62,
524  0xa0, 0xf3, 0x02, 0x2b, 0xcd, 0xf7, 0x09, 0x04,
525  0x3b, 0x52, 0xd8, 0x65, 0x4b, 0x4a, 0x70, 0xe4,
526  0x57, 0xc9, 0x2e, 0x2a, 0xf6, 0x9c, 0x6e, 0xd8,
527  0xde, 0x01, 0x52, 0xc9, 0x6f, 0xe9, 0xef, 0x82,
528  0xbc, 0x0b, 0x95, 0xb2, 0xef, 0xcb, 0x91, 0xa6,
529  0x0b, 0x2d, 0x14, 0xc6, 0x00, 0xa9, 0x33, 0x86,
530  0x64, 0x00, 0xd4, 0x92, 0x19, 0x53, 0x3d, 0xfd,
531  0xcd, 0xc6, 0x1a, 0xf2, 0x0e, 0x67, 0xc2, 0x1d,
532  0x2c, 0xe0, 0xe8, 0x29, 0x97, 0x1c, 0xb6, 0xc4,
533  0xb2, 0x02, 0x0c, 0x83, 0xb8, 0x60, 0x61, 0xf5,
534  0x61, 0x2d, 0x73, 0x5e, 0x85, 0x4d, 0xbd, 0x0d,
535  0xe7, 0x1a, 0x37, 0x56, 0x8d, 0xe5, 0x50, 0x0c,
536  0xc9, 0x64, 0x4c, 0x11, 0xea, 0xf3, 0xcb, 0x26,
537  0x34, 0xbd, 0x02, 0xf5, 0xc1, 0xfb, 0xa2, 0xec,
538  0x27, 0xbb, 0x60, 0xbe, 0x0b, 0xf6, 0xe7, 0x3c,
539  0x2d, 0xc9, 0xe7, 0xb0, 0x30, 0x28, 0x17, 0x3d,
540  0x90, 0xf1, 0x63, 0x8e, 0x49, 0xf7, 0x15, 0x78,
541  0x21, 0xcc, 0x45, 0xe6, 0x86, 0xb2, 0xd8, 0xb0,
542  0x2e, 0x5a, 0xb0, 0x58, 0xd3, 0xb6, 0x11, 0x40,
543  0xae, 0x81, 0x1f, 0x6b, 0x7a, 0xaf, 0x40, 0x50,
544  0xf9, 0x2e, 0x81, 0x8b, 0xec, 0x26, 0x11, 0x3f,
545  0x02, 0x03, 0x01, 0x00, 0x01, 0xa3, 0x82, 0x01,
546  0x53, 0x30, 0x82, 0x01, 0x4f, 0x30, 0x1d, 0x06,
547  0x03, 0x55, 0x1d, 0x25, 0x04, 0x16, 0x30, 0x14,
548  0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07,
549  0x03, 0x01, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05,
550  0x05, 0x07, 0x03, 0x02, 0x30, 0x21, 0x06, 0x03,
551  0x55, 0x1d, 0x11, 0x04, 0x1a, 0x30, 0x18, 0x82,
552  0x0b, 0x2a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
553  0x65, 0x2e, 0x6e, 0x6f, 0x82, 0x09, 0x67, 0x6f,
554  0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x6e, 0x6f, 0x30,
555  0x68, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05,
556  0x07, 0x01, 0x01, 0x04, 0x5c, 0x30, 0x5a, 0x30,
557  0x2b, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05,
558  0x07, 0x30, 0x02, 0x86, 0x1f, 0x68, 0x74, 0x74,
559  0x70, 0x3a, 0x2f, 0x2f, 0x70, 0x6b, 0x69, 0x2e,
560  0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x63,
561  0x6f, 0x6d, 0x2f, 0x47, 0x49, 0x41, 0x47, 0x32,
562  0x2e, 0x63, 0x72, 0x74, 0x30, 0x2b, 0x06, 0x08,
563  0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x30, 0x01,
564  0x86, 0x1f, 0x68, 0x74, 0x74, 0x70, 0x3a, 0x2f,
565  0x2f, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x73,
566  0x31, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
567  0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6f, 0x63, 0x73,
568  0x70, 0x30, 0x1d, 0x06, 0x03, 0x55, 0x1d, 0x0e,
569  0x04, 0x16, 0x04, 0x14, 0xc6, 0x53, 0x87, 0x42,
570  0x2d, 0xc8, 0xee, 0x7a, 0x62, 0x1e, 0x83, 0xdb,
571  0x0d, 0xe2, 0x32, 0xeb, 0x8b, 0xaf, 0x69, 0x40,
572  0x30, 0x0c, 0x06, 0x03, 0x55, 0x1d, 0x13, 0x01,
573  0x01, 0xff, 0x04, 0x02, 0x30, 0x00, 0x30, 0x1f,
574  0x06, 0x03, 0x55, 0x1d, 0x23, 0x04, 0x18, 0x30,
575  0x16, 0x80, 0x14, 0x4a, 0xdd, 0x06, 0x16, 0x1b,
576  0xbc, 0xf6, 0x68, 0xb5, 0x76, 0xf5, 0x81, 0xb6,
577  0xbb, 0x62, 0x1a, 0xba, 0x5a, 0x81, 0x2f, 0x30,
578  0x21, 0x06, 0x03, 0x55, 0x1d, 0x20, 0x04, 0x1a,
579  0x30, 0x18, 0x30, 0x0c, 0x06, 0x0a, 0x2b, 0x06,
580  0x01, 0x04, 0x01, 0xd6, 0x79, 0x02, 0x05, 0x01,
581  0x30, 0x08, 0x06, 0x06, 0x67, 0x81, 0x0c, 0x01,
582  0x02, 0x02, 0x30, 0x30, 0x06, 0x03, 0x55, 0x1d,
583  0x1f, 0x04, 0x29, 0x30, 0x27, 0x30, 0x25, 0xa0,
584  0x23, 0xa0, 0x21, 0x86, 0x1f, 0x68, 0x74, 0x74,
585  0x70, 0x3a, 0x2f, 0x2f, 0x70, 0x6b, 0x69, 0x2e,
586  0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x63,
587  0x6f, 0x6d, 0x2f, 0x47, 0x49, 0x41, 0x47, 0x32,
588  0x2e, 0x63, 0x72, 0x6c, 0x30, 0x0d, 0x06, 0x09,
589  0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01,
590  0x0b, 0x05, 0x00, 0x03, 0x82, 0x01, 0x01, 0x00,
591  0x7b, 0x27, 0x00, 0x46, 0x8f, 0xfd, 0x5b, 0xff,
592  0xcb, 0x05, 0x9b, 0xf7, 0xf1, 0x68, 0xf6, 0x9a,
593  0x7b, 0xba, 0x53, 0xdf, 0x63, 0xed, 0x11, 0x94,
594  0x39, 0xf2, 0xd0, 0x20, 0xcd, 0xa3, 0xc4, 0x98,
595  0xa5, 0x10, 0x74, 0xe7, 0x10, 0x6d, 0x07, 0xf8,
596  0x33, 0x87, 0x05, 0x43, 0x0e, 0x64, 0x77, 0x09,
597  0x18, 0x4f, 0x38, 0x2e, 0x45, 0xae, 0xa8, 0x34,
598  0x3a, 0xa8, 0x33, 0xac, 0x9d, 0xdd, 0x25, 0x91,
599  0x59, 0x43, 0xbe, 0x0f, 0x87, 0x16, 0x2f, 0xb5,
600  0x27, 0xfd, 0xce, 0x2f, 0x35, 0x5d, 0x12, 0xa1,
601  0x66, 0xac, 0xf7, 0x95, 0x38, 0x0f, 0xe5, 0xb1,
602  0x18, 0x18, 0xe6, 0x80, 0x52, 0x31, 0x8a, 0x66,
603  0x02, 0x52, 0x1a, 0xa4, 0x32, 0x6a, 0x61, 0x05,
604  0xcf, 0x1d, 0xf9, 0x90, 0x73, 0xf0, 0xeb, 0x20,
605  0x31, 0x7b, 0x2e, 0xc0, 0xb0, 0xfb, 0x5c, 0xcc,
606  0xdc, 0x76, 0x55, 0x72, 0xaf, 0xb1, 0x05, 0xf4,
607  0xad, 0xf9, 0xd7, 0x73, 0x5c, 0x2c, 0xbf, 0x0d,
608  0x84, 0x18, 0x01, 0x1d, 0x4d, 0x08, 0xa9, 0x4e,
609  0x37, 0xb7, 0x58, 0xc4, 0x05, 0x0e, 0x65, 0x63,
610  0xd2, 0x88, 0x02, 0xf5, 0x82, 0x17, 0x08, 0xd5,
611  0x8f, 0x80, 0xc7, 0x82, 0x29, 0xbb, 0xe1, 0x04,
612  0xbe, 0xf6, 0xe1, 0x8c, 0xbc, 0x3a, 0xf8, 0xf9,
613  0x56, 0xda, 0xdc, 0x8e, 0xc6, 0xe6, 0x63, 0x98,
614  0x12, 0x08, 0x41, 0x2c, 0x9d, 0x7c, 0x82, 0x0d,
615  0x1e, 0xea, 0xba, 0xde, 0x32, 0x09, 0xda, 0x52,
616  0x24, 0x4f, 0xcc, 0xb6, 0x09, 0x33, 0x8b, 0x00,
617  0xf9, 0x83, 0xb3, 0xc6, 0xa4, 0x90, 0x49, 0x83,
618  0x2d, 0x36, 0xd9, 0x11, 0x78, 0xd0, 0x62, 0x9f,
619  0xc4, 0x8f, 0x84, 0xba, 0x7f, 0xaa, 0x04, 0xf1,
620  0xd9, 0xa4, 0xad, 0x5d, 0x63, 0xee, 0x72, 0xc6,
621  0x4d, 0xd1, 0x4b, 0x41, 0x8f, 0x40, 0x0f, 0x7d,
622  0xcd, 0xb8, 0x2e, 0x5b, 0x6e, 0x21, 0xc9, 0x3d
623  };
624 
625  Flow f;
626  SSLState *ssl_state = NULL;
627  TcpSession ssn;
628  Packet *p1 = NULL;
629  Packet *p2 = NULL;
630  Packet *p3 = NULL;
631  ThreadVars tv;
632  DetectEngineThreadCtx *det_ctx = NULL;
633  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
634 
635  memset(&tv, 0, sizeof(ThreadVars));
636  memset(&f, 0, sizeof(Flow));
637  memset(&ssn, 0, sizeof(TcpSession));
638 
639  p1 = UTHBuildPacketReal(client_hello, sizeof(client_hello), IPPROTO_TCP,
640  "192.168.1.5", "192.168.1.1", 51251, 443);
641  p2 = UTHBuildPacketReal(server_hello, sizeof(server_hello), IPPROTO_TCP,
642  "192.168.1.1", "192.168.1.5", 443, 51251);
643  p3 = UTHBuildPacketReal(certificate, sizeof(certificate), IPPROTO_TCP,
644  "192.168.1.1", "192.168.1.5", 443, 51251);
645 
646  FLOW_INITIALIZE(&f);
647  f.flags |= FLOW_IPV4;
648  f.proto = IPPROTO_TCP;
649  f.protomap = FlowGetProtoMapping(f.proto);
650  f.alproto = ALPROTO_TLS;
651 
652  p1->flow = &f;
653  p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
654  p1->flowflags |= FLOW_PKT_TOSERVER;
655  p1->flowflags |= FLOW_PKT_ESTABLISHED;
656  p1->pcap_cnt = 1;
657 
658  p2->flow = &f;
659  p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
660  p2->flowflags |= FLOW_PKT_TOCLIENT;
661  p2->flowflags |= FLOW_PKT_ESTABLISHED;
662  p2->pcap_cnt = 2;
663 
664  p3->flow = &f;
665  p3->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
666  p3->flowflags |= FLOW_PKT_TOCLIENT;
667  p3->flowflags |= FLOW_PKT_ESTABLISHED;
668  p3->pcap_cnt = 3;
669 
670  StreamTcpInitConfig(true);
671 
672  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
673  FAIL_IF_NULL(de_ctx);
674  de_ctx->flags |= DE_QUIET;
675 
676  Signature *s = DetectEngineAppendSig(de_ctx, "alert tls any any -> any any "
677  "(msg:\"Test tls_cert_notbefore\"; "
678  "tls_cert_notbefore:<2016-07-20; sid:1;)");
679  FAIL_IF_NULL(s);
680 
681  s = DetectEngineAppendSig(de_ctx, "alert tls any any -> any any "
682  "(msg:\"Test tls_cert_notafter\"; "
683  "tls_cert_notafter:>2016-09-01; sid:2;)");
684  FAIL_IF_NULL(s);
685 
686  SigGroupBuild(de_ctx);
687  DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
688 
689  int r = AppLayerParserParse(
690  NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, client_hello, sizeof(client_hello));
691  FAIL_IF(r != 0);
692 
693  ssl_state = f.alstate;
694  FAIL_IF_NULL(ssl_state);
695 
696  SigMatchSignatures(&tv, de_ctx, det_ctx, p1);
697  FAIL_IF(PacketAlertCheck(p1, 1));
698  FAIL_IF(PacketAlertCheck(p1, 2));
699 
700  r = AppLayerParserParse(
701  NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOCLIENT, server_hello, sizeof(server_hello));
702  FAIL_IF(r != 0);
703 
704  SigMatchSignatures(&tv, de_ctx, det_ctx, p2);
705  FAIL_IF(PacketAlertCheck(p2, 1));
706  FAIL_IF(PacketAlertCheck(p2, 2));
707 
708  r = AppLayerParserParse(
709  NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOCLIENT, certificate, sizeof(certificate));
710  FAIL_IF(r != 0);
711 
712  SigMatchSignatures(&tv, de_ctx, det_ctx, p3);
713  FAIL_IF_NOT(PacketAlertCheck(p3, 1));
714  FAIL_IF_NOT(PacketAlertCheck(p3, 2));
715 
716  UTHFreePacket(p1);
717  UTHFreePacket(p2);
718  UTHFreePacket(p3);
719  FLOW_DESTROY(&f);
720 
721  AppLayerParserThreadCtxFree(alp_tctx);
722  DetectEngineThreadCtxDeinit(&tv, det_ctx);
723  DetectEngineCtxFree(de_ctx);
724  StreamTcpFreeConfig(true);
725  StatsThreadCleanup(&tv);
726  PASS;
727 }
728 
729 /**
730  * \test Test matching on an expired certificate.
731  *
732  * Traffic from expired.badssl.com
733  *
734  * \retval 1 on success.
735  * \retval 0 on failure.
736  */
737 static int ExpiredTestDetect01(void)
738 {
739  /* client hello */
740  uint8_t client_hello[] = {
741  0x16, 0x03, 0x03, 0x00, 0x5a, 0x01, 0x00, 0x00,
742  0x56, 0x03, 0x03, 0x62, 0x87, 0xa4, 0x11, 0x3e,
743  0x11, 0x32, 0x7d, 0xbc, 0x5b, 0x63, 0xb7, 0xaf,
744  0x55, 0x8d, 0x46, 0x5b, 0x8f, 0xac, 0x50, 0x02,
745  0x90, 0xe3, 0x55, 0x03, 0xfe, 0xad, 0xa6, 0x92,
746  0x56, 0x75, 0xf9, 0x00, 0x00, 0x08, 0x00, 0x35,
747  0x00, 0x2f, 0x00, 0x0a, 0x00, 0xff, 0x01, 0x00,
748  0x00, 0x25, 0x00, 0x00, 0x00, 0x17, 0x00, 0x15,
749  0x00, 0x00, 0x12, 0x65, 0x78, 0x70, 0x69, 0x72,
750  0x65, 0x64, 0x2e, 0x62, 0x61, 0x64, 0x73, 0x73,
751  0x6c, 0x2e, 0x63, 0x6f, 0x6d, 0x00, 0x0d, 0x00,
752  0x06, 0x00, 0x04, 0x04, 0x01, 0x02, 0x01
753  };
754 
755  /* server hello */
756  uint8_t server_hello[] = {
757  0x16, 0x03, 0x03, 0x00, 0x55, 0x02, 0x00, 0x00,
758  0x51, 0x03, 0x03, 0x22, 0xa1, 0xd8, 0xd0, 0x3c,
759  0x8d, 0x32, 0x7e, 0x4f, 0x60, 0x27, 0xf6, 0x0c,
760  0x99, 0x7a, 0x8e, 0x6e, 0x52, 0xa5, 0xf4, 0x20,
761  0x2e, 0xa1, 0xa4, 0x0b, 0xd5, 0x80, 0x9b, 0xec,
762  0xbd, 0x2c, 0x6c, 0x20, 0x7a, 0x9b, 0xcc, 0x6b,
763  0xbf, 0x3d, 0xfc, 0x7c, 0x31, 0x78, 0x65, 0x1e,
764  0xcc, 0x41, 0x0b, 0x8b, 0x3d, 0x4e, 0xde, 0x45,
765  0xe5, 0x20, 0xf5, 0xbd, 0x8e, 0x99, 0xce, 0xc2,
766  0xad, 0x88, 0x08, 0x27, 0x00, 0x2f, 0x00, 0x00,
767  0x09, 0x00, 0x00, 0x00, 0x00, 0xff, 0x01, 0x00,
768  0x01, 0x00
769  };
770 
771  /* certificate */
772  uint8_t certificate[] = {
773  0x16, 0x03, 0x03, 0x05, 0x59, 0x0b, 0x00, 0x05,
774  0x55, 0x00, 0x05, 0x52, 0x00, 0x05, 0x4f, 0x30,
775  0x82, 0x05, 0x4b, 0x30, 0x82, 0x04, 0x33, 0xa0,
776  0x03, 0x02, 0x01, 0x02, 0x02, 0x10, 0x4a, 0xe7,
777  0x95, 0x49, 0xfa, 0x9a, 0xbe, 0x3f, 0x10, 0x0f,
778  0x17, 0xa4, 0x78, 0xe1, 0x69, 0x09, 0x30, 0x0d,
779  0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d,
780  0x01, 0x01, 0x0b, 0x05, 0x00, 0x30, 0x81, 0x90,
781  0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04,
782  0x06, 0x13, 0x02, 0x47, 0x42, 0x31, 0x1b, 0x30,
783  0x19, 0x06, 0x03, 0x55, 0x04, 0x08, 0x13, 0x12,
784  0x47, 0x72, 0x65, 0x61, 0x74, 0x65, 0x72, 0x20,
785  0x4d, 0x61, 0x6e, 0x63, 0x68, 0x65, 0x73, 0x74,
786  0x65, 0x72, 0x31, 0x10, 0x30, 0x0e, 0x06, 0x03,
787  0x55, 0x04, 0x07, 0x13, 0x07, 0x53, 0x61, 0x6c,
788  0x66, 0x6f, 0x72, 0x64, 0x31, 0x1a, 0x30, 0x18,
789  0x06, 0x03, 0x55, 0x04, 0x0a, 0x13, 0x11, 0x43,
790  0x4f, 0x4d, 0x4f, 0x44, 0x4f, 0x20, 0x43, 0x41,
791  0x20, 0x4c, 0x69, 0x6d, 0x69, 0x74, 0x65, 0x64,
792  0x31, 0x36, 0x30, 0x34, 0x06, 0x03, 0x55, 0x04,
793  0x03, 0x13, 0x2d, 0x43, 0x4f, 0x4d, 0x4f, 0x44,
794  0x4f, 0x20, 0x52, 0x53, 0x41, 0x20, 0x44, 0x6f,
795  0x6d, 0x61, 0x69, 0x6e, 0x20, 0x56, 0x61, 0x6c,
796  0x69, 0x64, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x20,
797  0x53, 0x65, 0x63, 0x75, 0x72, 0x65, 0x20, 0x53,
798  0x65, 0x72, 0x76, 0x65, 0x72, 0x20, 0x43, 0x41,
799  0x30, 0x1e, 0x17, 0x0d, 0x31, 0x35, 0x30, 0x34,
800  0x30, 0x39, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30,
801  0x5a, 0x17, 0x0d, 0x31, 0x35, 0x30, 0x34, 0x31,
802  0x32, 0x32, 0x33, 0x35, 0x39, 0x35, 0x39, 0x5a,
803  0x30, 0x59, 0x31, 0x21, 0x30, 0x1f, 0x06, 0x03,
804  0x55, 0x04, 0x0b, 0x13, 0x18, 0x44, 0x6f, 0x6d,
805  0x61, 0x69, 0x6e, 0x20, 0x43, 0x6f, 0x6e, 0x74,
806  0x72, 0x6f, 0x6c, 0x20, 0x56, 0x61, 0x6c, 0x69,
807  0x64, 0x61, 0x74, 0x65, 0x64, 0x31, 0x1d, 0x30,
808  0x1b, 0x06, 0x03, 0x55, 0x04, 0x0b, 0x13, 0x14,
809  0x50, 0x6f, 0x73, 0x69, 0x74, 0x69, 0x76, 0x65,
810  0x53, 0x53, 0x4c, 0x20, 0x57, 0x69, 0x6c, 0x64,
811  0x63, 0x61, 0x72, 0x64, 0x31, 0x15, 0x30, 0x13,
812  0x06, 0x03, 0x55, 0x04, 0x03, 0x14, 0x0c, 0x2a,
813  0x2e, 0x62, 0x61, 0x64, 0x73, 0x73, 0x6c, 0x2e,
814  0x63, 0x6f, 0x6d, 0x30, 0x82, 0x01, 0x22, 0x30,
815  0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7,
816  0x0d, 0x01, 0x01, 0x01, 0x05, 0x00, 0x03, 0x82,
817  0x01, 0x0f, 0x00, 0x30, 0x82, 0x01, 0x0a, 0x02,
818  0x82, 0x01, 0x01, 0x00, 0xc2, 0x04, 0xec, 0xf8,
819  0x8c, 0xee, 0x04, 0xc2, 0xb3, 0xd8, 0x50, 0xd5,
820  0x70, 0x58, 0xcc, 0x93, 0x18, 0xeb, 0x5c, 0xa8,
821  0x68, 0x49, 0xb0, 0x22, 0xb5, 0xf9, 0x95, 0x9e,
822  0xb1, 0x2b, 0x2c, 0x76, 0x3e, 0x6c, 0xc0, 0x4b,
823  0x60, 0x4c, 0x4c, 0xea, 0xb2, 0xb4, 0xc0, 0x0f,
824  0x80, 0xb6, 0xb0, 0xf9, 0x72, 0xc9, 0x86, 0x02,
825  0xf9, 0x5c, 0x41, 0x5d, 0x13, 0x2b, 0x7f, 0x71,
826  0xc4, 0x4b, 0xbc, 0xe9, 0x94, 0x2e, 0x50, 0x37,
827  0xa6, 0x67, 0x1c, 0x61, 0x8c, 0xf6, 0x41, 0x42,
828  0xc5, 0x46, 0xd3, 0x16, 0x87, 0x27, 0x9f, 0x74,
829  0xeb, 0x0a, 0x9d, 0x11, 0x52, 0x26, 0x21, 0x73,
830  0x6c, 0x84, 0x4c, 0x79, 0x55, 0xe4, 0xd1, 0x6b,
831  0xe8, 0x06, 0x3d, 0x48, 0x15, 0x52, 0xad, 0xb3,
832  0x28, 0xdb, 0xaa, 0xff, 0x6e, 0xff, 0x60, 0x95,
833  0x4a, 0x77, 0x6b, 0x39, 0xf1, 0x24, 0xd1, 0x31,
834  0xb6, 0xdd, 0x4d, 0xc0, 0xc4, 0xfc, 0x53, 0xb9,
835  0x6d, 0x42, 0xad, 0xb5, 0x7c, 0xfe, 0xae, 0xf5,
836  0x15, 0xd2, 0x33, 0x48, 0xe7, 0x22, 0x71, 0xc7,
837  0xc2, 0x14, 0x7a, 0x6c, 0x28, 0xea, 0x37, 0x4a,
838  0xdf, 0xea, 0x6c, 0xb5, 0x72, 0xb4, 0x7e, 0x5a,
839  0xa2, 0x16, 0xdc, 0x69, 0xb1, 0x57, 0x44, 0xdb,
840  0x0a, 0x12, 0xab, 0xde, 0xc3, 0x0f, 0x47, 0x74,
841  0x5c, 0x41, 0x22, 0xe1, 0x9a, 0xf9, 0x1b, 0x93,
842  0xe6, 0xad, 0x22, 0x06, 0x29, 0x2e, 0xb1, 0xba,
843  0x49, 0x1c, 0x0c, 0x27, 0x9e, 0xa3, 0xfb, 0x8b,
844  0xf7, 0x40, 0x72, 0x00, 0xac, 0x92, 0x08, 0xd9,
845  0x8c, 0x57, 0x84, 0x53, 0x81, 0x05, 0xcb, 0xe6,
846  0xfe, 0x6b, 0x54, 0x98, 0x40, 0x27, 0x85, 0xc7,
847  0x10, 0xbb, 0x73, 0x70, 0xef, 0x69, 0x18, 0x41,
848  0x07, 0x45, 0x55, 0x7c, 0xf9, 0x64, 0x3f, 0x3d,
849  0x2c, 0xc3, 0xa9, 0x7c, 0xeb, 0x93, 0x1a, 0x4c,
850  0x86, 0xd1, 0xca, 0x85, 0x02, 0x03, 0x01, 0x00,
851  0x01, 0xa3, 0x82, 0x01, 0xd5, 0x30, 0x82, 0x01,
852  0xd1, 0x30, 0x1f, 0x06, 0x03, 0x55, 0x1d, 0x23,
853  0x04, 0x18, 0x30, 0x16, 0x80, 0x14, 0x90, 0xaf,
854  0x6a, 0x3a, 0x94, 0x5a, 0x0b, 0xd8, 0x90, 0xea,
855  0x12, 0x56, 0x73, 0xdf, 0x43, 0xb4, 0x3a, 0x28,
856  0xda, 0xe7, 0x30, 0x1d, 0x06, 0x03, 0x55, 0x1d,
857  0x0e, 0x04, 0x16, 0x04, 0x14, 0x9d, 0xee, 0xc1,
858  0x7b, 0x81, 0x0b, 0x3a, 0x47, 0x69, 0x71, 0x18,
859  0x7d, 0x11, 0x37, 0x93, 0xbc, 0xa5, 0x1b, 0x3f,
860  0xfb, 0x30, 0x0e, 0x06, 0x03, 0x55, 0x1d, 0x0f,
861  0x01, 0x01, 0xff, 0x04, 0x04, 0x03, 0x02, 0x05,
862  0xa0, 0x30, 0x0c, 0x06, 0x03, 0x55, 0x1d, 0x13,
863  0x01, 0x01, 0xff, 0x04, 0x02, 0x30, 0x00, 0x30,
864  0x1d, 0x06, 0x03, 0x55, 0x1d, 0x25, 0x04, 0x16,
865  0x30, 0x14, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05,
866  0x05, 0x07, 0x03, 0x01, 0x06, 0x08, 0x2b, 0x06,
867  0x01, 0x05, 0x05, 0x07, 0x03, 0x02, 0x30, 0x4f,
868  0x06, 0x03, 0x55, 0x1d, 0x20, 0x04, 0x48, 0x30,
869  0x46, 0x30, 0x3a, 0x06, 0x0b, 0x2b, 0x06, 0x01,
870  0x04, 0x01, 0xb2, 0x31, 0x01, 0x02, 0x02, 0x07,
871  0x30, 0x2b, 0x30, 0x29, 0x06, 0x08, 0x2b, 0x06,
872  0x01, 0x05, 0x05, 0x07, 0x02, 0x01, 0x16, 0x1d,
873  0x68, 0x74, 0x74, 0x70, 0x73, 0x3a, 0x2f, 0x2f,
874  0x73, 0x65, 0x63, 0x75, 0x72, 0x65, 0x2e, 0x63,
875  0x6f, 0x6d, 0x6f, 0x64, 0x6f, 0x2e, 0x63, 0x6f,
876  0x6d, 0x2f, 0x43, 0x50, 0x53, 0x30, 0x08, 0x06,
877  0x06, 0x67, 0x81, 0x0c, 0x01, 0x02, 0x01, 0x30,
878  0x54, 0x06, 0x03, 0x55, 0x1d, 0x1f, 0x04, 0x4d,
879  0x30, 0x4b, 0x30, 0x49, 0xa0, 0x47, 0xa0, 0x45,
880  0x86, 0x43, 0x68, 0x74, 0x74, 0x70, 0x3a, 0x2f,
881  0x2f, 0x63, 0x72, 0x6c, 0x2e, 0x63, 0x6f, 0x6d,
882  0x6f, 0x64, 0x6f, 0x63, 0x61, 0x2e, 0x63, 0x6f,
883  0x6d, 0x2f, 0x43, 0x4f, 0x4d, 0x4f, 0x44, 0x4f,
884  0x52, 0x53, 0x41, 0x44, 0x6f, 0x6d, 0x61, 0x69,
885  0x6e, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74,
886  0x69, 0x6f, 0x6e, 0x53, 0x65, 0x63, 0x75, 0x72,
887  0x65, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x43,
888  0x41, 0x2e, 0x63, 0x72, 0x6c, 0x30, 0x81, 0x85,
889  0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07,
890  0x01, 0x01, 0x04, 0x79, 0x30, 0x77, 0x30, 0x4f,
891  0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07,
892  0x30, 0x02, 0x86, 0x43, 0x68, 0x74, 0x74, 0x70,
893  0x3a, 0x2f, 0x2f, 0x63, 0x72, 0x74, 0x2e, 0x63,
894  0x6f, 0x6d, 0x6f, 0x64, 0x6f, 0x63, 0x61, 0x2e,
895  0x63, 0x6f, 0x6d, 0x2f, 0x43, 0x4f, 0x4d, 0x4f,
896  0x44, 0x4f, 0x52, 0x53, 0x41, 0x44, 0x6f, 0x6d,
897  0x61, 0x69, 0x6e, 0x56, 0x61, 0x6c, 0x69, 0x64,
898  0x61, 0x74, 0x69, 0x6f, 0x6e, 0x53, 0x65, 0x63,
899  0x75, 0x72, 0x65, 0x53, 0x65, 0x72, 0x76, 0x65,
900  0x72, 0x43, 0x41, 0x2e, 0x63, 0x72, 0x74, 0x30,
901  0x24, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05,
902  0x07, 0x30, 0x01, 0x86, 0x18, 0x68, 0x74, 0x74,
903  0x70, 0x3a, 0x2f, 0x2f, 0x6f, 0x63, 0x73, 0x70,
904  0x2e, 0x63, 0x6f, 0x6d, 0x6f, 0x64, 0x6f, 0x63,
905  0x61, 0x2e, 0x63, 0x6f, 0x6d, 0x30, 0x23, 0x06,
906  0x03, 0x55, 0x1d, 0x11, 0x04, 0x1c, 0x30, 0x1a,
907  0x82, 0x0c, 0x2a, 0x2e, 0x62, 0x61, 0x64, 0x73,
908  0x73, 0x6c, 0x2e, 0x63, 0x6f, 0x6d, 0x82, 0x0a,
909  0x62, 0x61, 0x64, 0x73, 0x73, 0x6c, 0x2e, 0x63,
910  0x6f, 0x6d, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86,
911  0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0b, 0x05,
912  0x00, 0x03, 0x82, 0x01, 0x01, 0x00, 0x6a, 0x7a,
913  0xf1, 0xda, 0xff, 0x03, 0x07, 0x72, 0x78, 0xc5,
914  0x66, 0xa1, 0x4f, 0x46, 0x43, 0x0e, 0x5f, 0x14,
915  0x21, 0x8c, 0x75, 0x1a, 0xeb, 0x36, 0xe0, 0x1f,
916  0xa4, 0x10, 0x15, 0xec, 0xda, 0x33, 0x25, 0x7c,
917  0x3b, 0xb5, 0x0a, 0xc7, 0x01, 0x38, 0x3d, 0x27,
918  0xfd, 0x58, 0xd9, 0xcc, 0xea, 0x2d, 0x69, 0x39,
919  0x7c, 0xbe, 0x97, 0xef, 0x0b, 0xd6, 0x0b, 0x58,
920  0xe7, 0x8c, 0x7f, 0xbf, 0xb3, 0x4c, 0x1d, 0xf3,
921  0xb7, 0x90, 0x80, 0xa6, 0x36, 0x7c, 0x14, 0x5b,
922  0xec, 0x07, 0x2d, 0x02, 0x3e, 0x1b, 0x5b, 0x63,
923  0x5b, 0x15, 0xab, 0x00, 0xfa, 0x1f, 0x3b, 0x19,
924  0x2d, 0xdf, 0xe2, 0x23, 0x10, 0x11, 0x07, 0x7e,
925  0x72, 0x7f, 0xe2, 0xbf, 0xb7, 0x00, 0x1b, 0x98,
926  0x2f, 0x2c, 0x3f, 0xce, 0x85, 0x9a, 0x27, 0x8c,
927  0x10, 0x22, 0x08, 0x41, 0x2b, 0x8a, 0x3e, 0x82,
928  0x4e, 0xfc, 0xdd, 0x21, 0xc6, 0x56, 0x74, 0x70,
929  0xa4, 0x34, 0xf2, 0xb1, 0x40, 0x9e, 0x2b, 0x58,
930  0xa2, 0x59, 0x0f, 0x1d, 0x48, 0xef, 0xeb, 0x11,
931  0x3e, 0xc1, 0x4a, 0x9e, 0xbc, 0x65, 0x55, 0x6d,
932  0xc6, 0xa3, 0xef, 0xd5, 0xd4, 0x96, 0xcd, 0xf1,
933  0xae, 0x27, 0xf7, 0xa4, 0x57, 0x14, 0x3c, 0x94,
934  0x41, 0x05, 0x7a, 0x8b, 0xa1, 0x37, 0x47, 0xd7,
935  0xf5, 0x7d, 0xdc, 0xfa, 0xce, 0x6f, 0x31, 0xa2,
936  0xb0, 0x8c, 0xea, 0xcc, 0x12, 0x9b, 0x22, 0xf1,
937  0x34, 0x70, 0xcf, 0x7d, 0x75, 0x4a, 0x8b, 0x68,
938  0x29, 0x0c, 0x1e, 0xe9, 0x96, 0xa8, 0xcf, 0xb0,
939  0x12, 0x1f, 0x5c, 0x2a, 0xee, 0x67, 0x2f, 0x7f,
940  0xbd, 0x73, 0xf3, 0x5a, 0x01, 0x22, 0x0c, 0x70,
941  0xfa, 0xcd, 0x45, 0xef, 0x78, 0x5c, 0xce, 0x0d,
942  0xfa, 0x4e, 0xe1, 0xef, 0xce, 0x65, 0x9f, 0x47,
943  0x0c, 0x4f, 0xbb, 0x36, 0x44, 0x68, 0x56, 0x5c,
944  0x56, 0x59, 0xad, 0xaa, 0x8a, 0xbc,
945  };
946 
947  Flow f;
948  SSLState *ssl_state = NULL;
949  TcpSession ssn;
950  Packet *p1 = NULL;
951  Packet *p2 = NULL;
952  Packet *p3 = NULL;
953  ThreadVars tv;
954  DetectEngineThreadCtx *det_ctx = NULL;
955  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
956 
957  memset(&tv, 0, sizeof(ThreadVars));
958  memset(&f, 0, sizeof(Flow));
959  memset(&ssn, 0, sizeof(TcpSession));
960 
961  p1 = UTHBuildPacketReal(client_hello, sizeof(client_hello), IPPROTO_TCP,
962  "192.168.1.5", "192.168.1.1", 51251, 443);
963  p2 = UTHBuildPacketReal(server_hello, sizeof(server_hello), IPPROTO_TCP,
964  "192.168.1.1", "192.168.1.5", 443, 51251);
965  p3 = UTHBuildPacketReal(certificate, sizeof(certificate), IPPROTO_TCP,
966  "192.168.1.1", "192.168.1.5", 443, 51251);
967 
968  FLOW_INITIALIZE(&f);
969  f.flags |= FLOW_IPV4;
970  f.proto = IPPROTO_TCP;
971  f.protomap = FlowGetProtoMapping(f.proto);
972  f.alproto = ALPROTO_TLS;
973 
974  p1->flow = &f;
975  p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
976  p1->flowflags |= FLOW_PKT_TOSERVER;
977  p1->flowflags |= FLOW_PKT_ESTABLISHED;
978  p1->pcap_cnt = 1;
979 
980  p2->flow = &f;
981  p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
982  p2->flowflags |= FLOW_PKT_TOCLIENT;
983  p2->flowflags |= FLOW_PKT_ESTABLISHED;
984  p2->pcap_cnt = 2;
985 
986  p3->flow = &f;
987  p3->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
988  p3->flowflags |= FLOW_PKT_TOCLIENT;
989  p3->flowflags |= FLOW_PKT_ESTABLISHED;
990  p3->pcap_cnt = 3;
991 
992  f.lastts = SCTIME_FROM_SECS(1474978656L); /* 2016-09-27 */
993 
994  StreamTcpInitConfig(true);
995 
996  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
997  FAIL_IF_NULL(de_ctx);
998 
999  de_ctx->flags |= DE_QUIET;
1000 
1001  Signature *s = DetectEngineAppendSig(de_ctx, "alert tls any any -> any any "
1002  "(msg:\"Test tls_cert_expired\"; "
1003  "tls_cert_expired; sid:1;)");
1004  FAIL_IF_NULL(s);
1005 
1006  SigGroupBuild(de_ctx);
1007  DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
1008 
1009  int r = AppLayerParserParse(
1010  NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, client_hello, sizeof(client_hello));
1011  FAIL_IF(r != 0);
1012 
1013  ssl_state = f.alstate;
1014  FAIL_IF_NULL(ssl_state);
1015 
1016  SigMatchSignatures(&tv, de_ctx, det_ctx, p1);
1017  FAIL_IF(PacketAlertCheck(p1, 1));
1018 
1019  r = AppLayerParserParse(
1020  NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOCLIENT, server_hello, sizeof(server_hello));
1021  FAIL_IF(r != 0);
1022 
1023  SigMatchSignatures(&tv, de_ctx, det_ctx, p2);
1024  FAIL_IF(PacketAlertCheck(p2, 1));
1025 
1026  r = AppLayerParserParse(
1027  NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOCLIENT, certificate, sizeof(certificate));
1028  FAIL_IF(r != 0);
1029 
1030  SigMatchSignatures(&tv, de_ctx, det_ctx, p3);
1031  FAIL_IF_NOT(PacketAlertCheck(p3, 1));
1032 
1033  UTHFreePacket(p1);
1034  UTHFreePacket(p2);
1035  UTHFreePacket(p3);
1036  FLOW_DESTROY(&f);
1037 
1038  AppLayerParserThreadCtxFree(alp_tctx);
1039  DetectEngineThreadCtxDeinit(&tv, det_ctx);
1040  DetectEngineCtxFree(de_ctx);
1041  StreamTcpFreeConfig(true);
1042  StatsThreadCleanup(&tv);
1043  PASS;
1044 }
1045 
1046 /**
1047  * \test Test matching on a valid TLS certificate.
1048  *
1049  * \retval 1 on success.
1050  * \retval 0 on failure.
1051  */
1052 static int ValidTestDetect01(void)
1053 {
1054  /* client hello */
1055  uint8_t client_hello[] = {
1056  0x16, 0x03, 0x01, 0x00, 0xc8, 0x01, 0x00, 0x00,
1057  0xc4, 0x03, 0x03, 0xd6, 0x08, 0x5a, 0xa2, 0x86,
1058  0x5b, 0x85, 0xd4, 0x40, 0xab, 0xbe, 0xc0, 0xbc,
1059  0x41, 0xf2, 0x26, 0xf0, 0xfe, 0x21, 0xee, 0x8b,
1060  0x4c, 0x7e, 0x07, 0xc8, 0xec, 0xd2, 0x00, 0x46,
1061  0x4c, 0xeb, 0xb7, 0x00, 0x00, 0x16, 0xc0, 0x2b,
1062  0xc0, 0x2f, 0xc0, 0x0a, 0xc0, 0x09, 0xc0, 0x13,
1063  0xc0, 0x14, 0x00, 0x33, 0x00, 0x39, 0x00, 0x2f,
1064  0x00, 0x35, 0x00, 0x0a, 0x01, 0x00, 0x00, 0x85,
1065  0x00, 0x00, 0x00, 0x12, 0x00, 0x10, 0x00, 0x00,
1066  0x0d, 0x77, 0x77, 0x77, 0x2e, 0x67, 0x6f, 0x6f,
1067  0x67, 0x6c, 0x65, 0x2e, 0x6e, 0x6f, 0xff, 0x01,
1068  0x00, 0x01, 0x00, 0x00, 0x0a, 0x00, 0x08, 0x00,
1069  0x06, 0x00, 0x17, 0x00, 0x18, 0x00, 0x19, 0x00,
1070  0x0b, 0x00, 0x02, 0x01, 0x00, 0x00, 0x23, 0x00,
1071  0x00, 0x33, 0x74, 0x00, 0x00, 0x00, 0x10, 0x00,
1072  0x29, 0x00, 0x27, 0x05, 0x68, 0x32, 0x2d, 0x31,
1073  0x36, 0x05, 0x68, 0x32, 0x2d, 0x31, 0x35, 0x05,
1074  0x68, 0x32, 0x2d, 0x31, 0x34, 0x02, 0x68, 0x32,
1075  0x08, 0x73, 0x70, 0x64, 0x79, 0x2f, 0x33, 0x2e,
1076  0x31, 0x08, 0x68, 0x74, 0x74, 0x70, 0x2f, 0x31,
1077  0x2e, 0x31, 0x00, 0x05, 0x00, 0x05, 0x01, 0x00,
1078  0x00, 0x00, 0x00, 0x00, 0x0d, 0x00, 0x16, 0x00,
1079  0x14, 0x04, 0x01, 0x05, 0x01, 0x06, 0x01, 0x02,
1080  0x01, 0x04, 0x03, 0x05, 0x03, 0x06, 0x03, 0x02,
1081  0x03, 0x04, 0x02, 0x02, 0x02
1082  };
1083 
1084  /* server hello */
1085  uint8_t server_hello[] = {
1086  0x16, 0x03, 0x03, 0x00, 0x48, 0x02, 0x00, 0x00,
1087  0x44, 0x03, 0x03, 0x57, 0x91, 0xb8, 0x63, 0xdd,
1088  0xdb, 0xbb, 0x23, 0xcf, 0x0b, 0x43, 0x02, 0x1d,
1089  0x46, 0x11, 0x27, 0x5c, 0x98, 0xcf, 0x67, 0xe1,
1090  0x94, 0x3d, 0x62, 0x7d, 0x38, 0x48, 0x21, 0x23,
1091  0xa5, 0x62, 0x31, 0x00, 0xc0, 0x2f, 0x00, 0x00,
1092  0x1c, 0xff, 0x01, 0x00, 0x01, 0x00, 0x00, 0x00,
1093  0x00, 0x00, 0x00, 0x23, 0x00, 0x00, 0x00, 0x10,
1094  0x00, 0x05, 0x00, 0x03, 0x02, 0x68, 0x32, 0x00,
1095  0x0b, 0x00, 0x02, 0x01, 0x00
1096  };
1097 
1098  /* certificate */
1099  uint8_t certificate[] = {
1100  0x16, 0x03, 0x03, 0x04, 0x93, 0x0b, 0x00, 0x04,
1101  0x8f, 0x00, 0x04, 0x8c, 0x00, 0x04, 0x89, 0x30,
1102  0x82, 0x04, 0x85, 0x30, 0x82, 0x03, 0x6d, 0xa0,
1103  0x03, 0x02, 0x01, 0x02, 0x02, 0x08, 0x5c, 0x19,
1104  0xb7, 0xb1, 0x32, 0x3b, 0x1c, 0xa1, 0x30, 0x0d,
1105  0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d,
1106  0x01, 0x01, 0x0b, 0x05, 0x00, 0x30, 0x49, 0x31,
1107  0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06,
1108  0x13, 0x02, 0x55, 0x53, 0x31, 0x13, 0x30, 0x11,
1109  0x06, 0x03, 0x55, 0x04, 0x0a, 0x13, 0x0a, 0x47,
1110  0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x20, 0x49, 0x6e,
1111  0x63, 0x31, 0x25, 0x30, 0x23, 0x06, 0x03, 0x55,
1112  0x04, 0x03, 0x13, 0x1c, 0x47, 0x6f, 0x6f, 0x67,
1113  0x6c, 0x65, 0x20, 0x49, 0x6e, 0x74, 0x65, 0x72,
1114  0x6e, 0x65, 0x74, 0x20, 0x41, 0x75, 0x74, 0x68,
1115  0x6f, 0x72, 0x69, 0x74, 0x79, 0x20, 0x47, 0x32,
1116  0x30, 0x1e, 0x17, 0x0d, 0x31, 0x36, 0x30, 0x37,
1117  0x31, 0x33, 0x31, 0x33, 0x32, 0x34, 0x35, 0x32,
1118  0x5a, 0x17, 0x0d, 0x31, 0x36, 0x31, 0x30, 0x30,
1119  0x35, 0x31, 0x33, 0x31, 0x36, 0x30, 0x30, 0x5a,
1120  0x30, 0x65, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03,
1121  0x55, 0x04, 0x06, 0x13, 0x02, 0x55, 0x53, 0x31,
1122  0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x08,
1123  0x0c, 0x0a, 0x43, 0x61, 0x6c, 0x69, 0x66, 0x6f,
1124  0x72, 0x6e, 0x69, 0x61, 0x31, 0x16, 0x30, 0x14,
1125  0x06, 0x03, 0x55, 0x04, 0x07, 0x0c, 0x0d, 0x4d,
1126  0x6f, 0x75, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x20,
1127  0x56, 0x69, 0x65, 0x77, 0x31, 0x13, 0x30, 0x11,
1128  0x06, 0x03, 0x55, 0x04, 0x0a, 0x0c, 0x0a, 0x47,
1129  0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x20, 0x49, 0x6e,
1130  0x63, 0x31, 0x14, 0x30, 0x12, 0x06, 0x03, 0x55,
1131  0x04, 0x03, 0x0c, 0x0b, 0x2a, 0x2e, 0x67, 0x6f,
1132  0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x6e, 0x6f, 0x30,
1133  0x82, 0x01, 0x22, 0x30, 0x0d, 0x06, 0x09, 0x2a,
1134  0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01,
1135  0x05, 0x00, 0x03, 0x82, 0x01, 0x0f, 0x00, 0x30,
1136  0x82, 0x01, 0x0a, 0x02, 0x82, 0x01, 0x01, 0x00,
1137  0xa5, 0x0a, 0xb9, 0xb1, 0xca, 0x36, 0xd1, 0xae,
1138  0x22, 0x38, 0x07, 0x06, 0xc9, 0x1a, 0x56, 0x4f,
1139  0xbb, 0xdf, 0xa8, 0x6d, 0xbd, 0xee, 0x76, 0x16,
1140  0xbc, 0x53, 0x3c, 0x03, 0x6a, 0x5c, 0x94, 0x50,
1141  0x87, 0x2f, 0x28, 0xb4, 0x4e, 0xd5, 0x9b, 0x8f,
1142  0xfe, 0x02, 0xde, 0x2a, 0x83, 0x01, 0xf9, 0x45,
1143  0x61, 0x0e, 0x66, 0x0e, 0x24, 0x22, 0xe2, 0x59,
1144  0x66, 0x0d, 0xd3, 0xe9, 0x77, 0x8a, 0x7e, 0x42,
1145  0xaa, 0x5a, 0xf9, 0x05, 0xbf, 0x30, 0xc7, 0x03,
1146  0x2b, 0xdc, 0xa6, 0x9c, 0xe0, 0x9f, 0x0d, 0xf1,
1147  0x28, 0x19, 0xf8, 0xf2, 0x02, 0xfa, 0xbd, 0x62,
1148  0xa0, 0xf3, 0x02, 0x2b, 0xcd, 0xf7, 0x09, 0x04,
1149  0x3b, 0x52, 0xd8, 0x65, 0x4b, 0x4a, 0x70, 0xe4,
1150  0x57, 0xc9, 0x2e, 0x2a, 0xf6, 0x9c, 0x6e, 0xd8,
1151  0xde, 0x01, 0x52, 0xc9, 0x6f, 0xe9, 0xef, 0x82,
1152  0xbc, 0x0b, 0x95, 0xb2, 0xef, 0xcb, 0x91, 0xa6,
1153  0x0b, 0x2d, 0x14, 0xc6, 0x00, 0xa9, 0x33, 0x86,
1154  0x64, 0x00, 0xd4, 0x92, 0x19, 0x53, 0x3d, 0xfd,
1155  0xcd, 0xc6, 0x1a, 0xf2, 0x0e, 0x67, 0xc2, 0x1d,
1156  0x2c, 0xe0, 0xe8, 0x29, 0x97, 0x1c, 0xb6, 0xc4,
1157  0xb2, 0x02, 0x0c, 0x83, 0xb8, 0x60, 0x61, 0xf5,
1158  0x61, 0x2d, 0x73, 0x5e, 0x85, 0x4d, 0xbd, 0x0d,
1159  0xe7, 0x1a, 0x37, 0x56, 0x8d, 0xe5, 0x50, 0x0c,
1160  0xc9, 0x64, 0x4c, 0x11, 0xea, 0xf3, 0xcb, 0x26,
1161  0x34, 0xbd, 0x02, 0xf5, 0xc1, 0xfb, 0xa2, 0xec,
1162  0x27, 0xbb, 0x60, 0xbe, 0x0b, 0xf6, 0xe7, 0x3c,
1163  0x2d, 0xc9, 0xe7, 0xb0, 0x30, 0x28, 0x17, 0x3d,
1164  0x90, 0xf1, 0x63, 0x8e, 0x49, 0xf7, 0x15, 0x78,
1165  0x21, 0xcc, 0x45, 0xe6, 0x86, 0xb2, 0xd8, 0xb0,
1166  0x2e, 0x5a, 0xb0, 0x58, 0xd3, 0xb6, 0x11, 0x40,
1167  0xae, 0x81, 0x1f, 0x6b, 0x7a, 0xaf, 0x40, 0x50,
1168  0xf9, 0x2e, 0x81, 0x8b, 0xec, 0x26, 0x11, 0x3f,
1169  0x02, 0x03, 0x01, 0x00, 0x01, 0xa3, 0x82, 0x01,
1170  0x53, 0x30, 0x82, 0x01, 0x4f, 0x30, 0x1d, 0x06,
1171  0x03, 0x55, 0x1d, 0x25, 0x04, 0x16, 0x30, 0x14,
1172  0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07,
1173  0x03, 0x01, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05,
1174  0x05, 0x07, 0x03, 0x02, 0x30, 0x21, 0x06, 0x03,
1175  0x55, 0x1d, 0x11, 0x04, 0x1a, 0x30, 0x18, 0x82,
1176  0x0b, 0x2a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
1177  0x65, 0x2e, 0x6e, 0x6f, 0x82, 0x09, 0x67, 0x6f,
1178  0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x6e, 0x6f, 0x30,
1179  0x68, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05,
1180  0x07, 0x01, 0x01, 0x04, 0x5c, 0x30, 0x5a, 0x30,
1181  0x2b, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05,
1182  0x07, 0x30, 0x02, 0x86, 0x1f, 0x68, 0x74, 0x74,
1183  0x70, 0x3a, 0x2f, 0x2f, 0x70, 0x6b, 0x69, 0x2e,
1184  0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x63,
1185  0x6f, 0x6d, 0x2f, 0x47, 0x49, 0x41, 0x47, 0x32,
1186  0x2e, 0x63, 0x72, 0x74, 0x30, 0x2b, 0x06, 0x08,
1187  0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x30, 0x01,
1188  0x86, 0x1f, 0x68, 0x74, 0x74, 0x70, 0x3a, 0x2f,
1189  0x2f, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x73,
1190  0x31, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
1191  0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6f, 0x63, 0x73,
1192  0x70, 0x30, 0x1d, 0x06, 0x03, 0x55, 0x1d, 0x0e,
1193  0x04, 0x16, 0x04, 0x14, 0xc6, 0x53, 0x87, 0x42,
1194  0x2d, 0xc8, 0xee, 0x7a, 0x62, 0x1e, 0x83, 0xdb,
1195  0x0d, 0xe2, 0x32, 0xeb, 0x8b, 0xaf, 0x69, 0x40,
1196  0x30, 0x0c, 0x06, 0x03, 0x55, 0x1d, 0x13, 0x01,
1197  0x01, 0xff, 0x04, 0x02, 0x30, 0x00, 0x30, 0x1f,
1198  0x06, 0x03, 0x55, 0x1d, 0x23, 0x04, 0x18, 0x30,
1199  0x16, 0x80, 0x14, 0x4a, 0xdd, 0x06, 0x16, 0x1b,
1200  0xbc, 0xf6, 0x68, 0xb5, 0x76, 0xf5, 0x81, 0xb6,
1201  0xbb, 0x62, 0x1a, 0xba, 0x5a, 0x81, 0x2f, 0x30,
1202  0x21, 0x06, 0x03, 0x55, 0x1d, 0x20, 0x04, 0x1a,
1203  0x30, 0x18, 0x30, 0x0c, 0x06, 0x0a, 0x2b, 0x06,
1204  0x01, 0x04, 0x01, 0xd6, 0x79, 0x02, 0x05, 0x01,
1205  0x30, 0x08, 0x06, 0x06, 0x67, 0x81, 0x0c, 0x01,
1206  0x02, 0x02, 0x30, 0x30, 0x06, 0x03, 0x55, 0x1d,
1207  0x1f, 0x04, 0x29, 0x30, 0x27, 0x30, 0x25, 0xa0,
1208  0x23, 0xa0, 0x21, 0x86, 0x1f, 0x68, 0x74, 0x74,
1209  0x70, 0x3a, 0x2f, 0x2f, 0x70, 0x6b, 0x69, 0x2e,
1210  0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x63,
1211  0x6f, 0x6d, 0x2f, 0x47, 0x49, 0x41, 0x47, 0x32,
1212  0x2e, 0x63, 0x72, 0x6c, 0x30, 0x0d, 0x06, 0x09,
1213  0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01,
1214  0x0b, 0x05, 0x00, 0x03, 0x82, 0x01, 0x01, 0x00,
1215  0x7b, 0x27, 0x00, 0x46, 0x8f, 0xfd, 0x5b, 0xff,
1216  0xcb, 0x05, 0x9b, 0xf7, 0xf1, 0x68, 0xf6, 0x9a,
1217  0x7b, 0xba, 0x53, 0xdf, 0x63, 0xed, 0x11, 0x94,
1218  0x39, 0xf2, 0xd0, 0x20, 0xcd, 0xa3, 0xc4, 0x98,
1219  0xa5, 0x10, 0x74, 0xe7, 0x10, 0x6d, 0x07, 0xf8,
1220  0x33, 0x87, 0x05, 0x43, 0x0e, 0x64, 0x77, 0x09,
1221  0x18, 0x4f, 0x38, 0x2e, 0x45, 0xae, 0xa8, 0x34,
1222  0x3a, 0xa8, 0x33, 0xac, 0x9d, 0xdd, 0x25, 0x91,
1223  0x59, 0x43, 0xbe, 0x0f, 0x87, 0x16, 0x2f, 0xb5,
1224  0x27, 0xfd, 0xce, 0x2f, 0x35, 0x5d, 0x12, 0xa1,
1225  0x66, 0xac, 0xf7, 0x95, 0x38, 0x0f, 0xe5, 0xb1,
1226  0x18, 0x18, 0xe6, 0x80, 0x52, 0x31, 0x8a, 0x66,
1227  0x02, 0x52, 0x1a, 0xa4, 0x32, 0x6a, 0x61, 0x05,
1228  0xcf, 0x1d, 0xf9, 0x90, 0x73, 0xf0, 0xeb, 0x20,
1229  0x31, 0x7b, 0x2e, 0xc0, 0xb0, 0xfb, 0x5c, 0xcc,
1230  0xdc, 0x76, 0x55, 0x72, 0xaf, 0xb1, 0x05, 0xf4,
1231  0xad, 0xf9, 0xd7, 0x73, 0x5c, 0x2c, 0xbf, 0x0d,
1232  0x84, 0x18, 0x01, 0x1d, 0x4d, 0x08, 0xa9, 0x4e,
1233  0x37, 0xb7, 0x58, 0xc4, 0x05, 0x0e, 0x65, 0x63,
1234  0xd2, 0x88, 0x02, 0xf5, 0x82, 0x17, 0x08, 0xd5,
1235  0x8f, 0x80, 0xc7, 0x82, 0x29, 0xbb, 0xe1, 0x04,
1236  0xbe, 0xf6, 0xe1, 0x8c, 0xbc, 0x3a, 0xf8, 0xf9,
1237  0x56, 0xda, 0xdc, 0x8e, 0xc6, 0xe6, 0x63, 0x98,
1238  0x12, 0x08, 0x41, 0x2c, 0x9d, 0x7c, 0x82, 0x0d,
1239  0x1e, 0xea, 0xba, 0xde, 0x32, 0x09, 0xda, 0x52,
1240  0x24, 0x4f, 0xcc, 0xb6, 0x09, 0x33, 0x8b, 0x00,
1241  0xf9, 0x83, 0xb3, 0xc6, 0xa4, 0x90, 0x49, 0x83,
1242  0x2d, 0x36, 0xd9, 0x11, 0x78, 0xd0, 0x62, 0x9f,
1243  0xc4, 0x8f, 0x84, 0xba, 0x7f, 0xaa, 0x04, 0xf1,
1244  0xd9, 0xa4, 0xad, 0x5d, 0x63, 0xee, 0x72, 0xc6,
1245  0x4d, 0xd1, 0x4b, 0x41, 0x8f, 0x40, 0x0f, 0x7d,
1246  0xcd, 0xb8, 0x2e, 0x5b, 0x6e, 0x21, 0xc9, 0x3d
1247  };
1248 
1249  Flow f;
1250  SSLState *ssl_state = NULL;
1251  TcpSession ssn;
1252  Packet *p1 = NULL;
1253  Packet *p2 = NULL;
1254  Packet *p3 = NULL;
1255  ThreadVars tv;
1256  DetectEngineThreadCtx *det_ctx = NULL;
1257  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
1258 
1259  memset(&tv, 0, sizeof(ThreadVars));
1260  memset(&f, 0, sizeof(Flow));
1261  memset(&ssn, 0, sizeof(TcpSession));
1262 
1263  p1 = UTHBuildPacketReal(client_hello, sizeof(client_hello), IPPROTO_TCP,
1264  "192.168.1.5", "192.168.1.1", 51251, 443);
1265  p2 = UTHBuildPacketReal(server_hello, sizeof(server_hello), IPPROTO_TCP,
1266  "192.168.1.1", "192.168.1.5", 443, 51251);
1267  p3 = UTHBuildPacketReal(certificate, sizeof(certificate), IPPROTO_TCP,
1268  "192.168.1.1", "192.168.1.5", 443, 51251);
1269 
1270  FLOW_INITIALIZE(&f);
1271  f.flags |= FLOW_IPV4;
1272  f.proto = IPPROTO_TCP;
1273  f.protomap = FlowGetProtoMapping(f.proto);
1274  f.alproto = ALPROTO_TLS;
1275 
1276  p1->flow = &f;
1277  p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
1278  p1->flowflags |= FLOW_PKT_TOSERVER;
1279  p1->flowflags |= FLOW_PKT_ESTABLISHED;
1280  p1->pcap_cnt = 1;
1281 
1282  p2->flow = &f;
1283  p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
1284  p2->flowflags |= FLOW_PKT_TOCLIENT;
1285  p2->flowflags |= FLOW_PKT_ESTABLISHED;
1286  p2->pcap_cnt = 2;
1287 
1288  p3->flow = &f;
1289  p3->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
1290  p3->flowflags |= FLOW_PKT_TOCLIENT;
1291  p3->flowflags |= FLOW_PKT_ESTABLISHED;
1292  p3->pcap_cnt = 3;
1293 
1294  f.lastts = SCTIME_FROM_SECS(1474978656L); /* 2016-09-27 */
1295 
1296  StreamTcpInitConfig(true);
1297 
1298  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
1299  FAIL_IF_NULL(de_ctx);
1300 
1301  de_ctx->flags |= DE_QUIET;
1302 
1303  Signature *s = DetectEngineAppendSig(de_ctx, "alert tls any any -> any any "
1304  "(msg:\"Test tls_cert_valid\"; "
1305  "tls_cert_valid; sid:1;)");
1306  FAIL_IF_NULL(s);
1307 
1308  SigGroupBuild(de_ctx);
1309  DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
1310 
1311  int r = AppLayerParserParse(
1312  NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, client_hello, sizeof(client_hello));
1313  FAIL_IF(r != 0);
1314 
1315  ssl_state = f.alstate;
1316  FAIL_IF_NULL(ssl_state);
1317 
1318  SigMatchSignatures(&tv, de_ctx, det_ctx, p1);
1319  FAIL_IF(PacketAlertCheck(p1, 1));
1320 
1321  r = AppLayerParserParse(
1322  NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOCLIENT, server_hello, sizeof(server_hello));
1323  FAIL_IF(r != 0);
1324 
1325  SigMatchSignatures(&tv, de_ctx, det_ctx, p2);
1326  FAIL_IF(PacketAlertCheck(p2, 1));
1327 
1328  r = AppLayerParserParse(
1329  NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOCLIENT, certificate, sizeof(certificate));
1330  FAIL_IF(r != 0);
1331 
1332  SigMatchSignatures(&tv, de_ctx, det_ctx, p3);
1333  FAIL_IF_NOT(PacketAlertCheck(p3, 1));
1334 
1335  UTHFreePacket(p1);
1336  UTHFreePacket(p2);
1337  UTHFreePacket(p3);
1338  FLOW_DESTROY(&f);
1339 
1340  AppLayerParserThreadCtxFree(alp_tctx);
1341  DetectEngineThreadCtxDeinit(&tv, det_ctx);
1342  DetectEngineCtxFree(de_ctx);
1343  StreamTcpFreeConfig(true);
1344  StatsThreadCleanup(&tv);
1345  PASS;
1346 }
1347 
1348 /**
1349  * \brief Register unit tests for tls_cert_notbefore.
1350  */
1351 void TlsNotBeforeRegisterTests(void)
1352 {
1353  UtRegisterTest("ValidityTestParse01", ValidityTestParse01);
1354  UtRegisterTest("ValidityTestParse03", ValidityTestParse03);
1355  UtRegisterTest("ValidityTestParse05", ValidityTestParse05);
1356  UtRegisterTest("ValidityTestParse07", ValidityTestParse07);
1357  UtRegisterTest("ValidityTestParse09", ValidityTestParse09);
1358  UtRegisterTest("ValidityTestParse11", ValidityTestParse11);
1359  UtRegisterTest("ValidityTestParse13", ValidityTestParse13);
1360  UtRegisterTest("ValidityTestParse15", ValidityTestParse15);
1361  UtRegisterTest("ValidityTestParse17", ValidityTestParse17);
1362  UtRegisterTest("ValidityTestParse19", ValidityTestParse19);
1363  UtRegisterTest("ValidityTestParse21", ValidityTestParse21);
1364  UtRegisterTest("ValidityTestParse23", ValidityTestParse23);
1365  UtRegisterTest("ValidityTestParse24", ValidityTestParse24);
1366  UtRegisterTest("ValidityTestParse25", ValidityTestParse25);
1367  UtRegisterTest("ValidityTestDetect01", ValidityTestDetect01);
1368 }
1369 
1370 /**
1371  * \brief Register unit tests for tls_cert_notafter.
1372  */
1373 void TlsNotAfterRegisterTests(void)
1374 {
1375  UtRegisterTest("ValidityTestParse02", ValidityTestParse02);
1376  UtRegisterTest("ValidityTestParse04", ValidityTestParse04);
1377  UtRegisterTest("ValidityTestParse06", ValidityTestParse06);
1378  UtRegisterTest("ValidityTestParse08", ValidityTestParse08);
1379  UtRegisterTest("ValidityTestParse10", ValidityTestParse10);
1380  UtRegisterTest("ValidityTestParse12", ValidityTestParse12);
1381  UtRegisterTest("ValidityTestParse14", ValidityTestParse14);
1382  UtRegisterTest("ValidityTestParse16", ValidityTestParse16);
1383  UtRegisterTest("ValidityTestParse18", ValidityTestParse18);
1384  UtRegisterTest("ValidityTestParse20", ValidityTestParse20);
1385  UtRegisterTest("ValidityTestParse22", ValidityTestParse22);
1386 }
1387 
1388 /**
1389  * \brief Register unit tests for tls_cert_expired
1390  */
1391 void TlsExpiredRegisterTests(void)
1392 {
1393  UtRegisterTest("ExpiredTestDetect01", ExpiredTestDetect01);
1394 }
1395 
1396 /**
1397  * \brief Register unit tests for tls_cert_valid
1398  */
1399 void TlsValidRegisterTests(void)
1400 {
1401  UtRegisterTest("ValidTestDetect01", ValidTestDetect01);
1402 }
SSLState_
SSLv[2.0|3.[0|1|2|3]] state structure.
Definition: app-layer-ssl.h:227
FAIL_IF_NULL
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
Definition: util-unittest.h:89
PKT_HAS_FLOW
#define PKT_HAS_FLOW
Definition: decode.h:1268
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
ALPROTO_TLS
@ ALPROTO_TLS
Definition: app-layer-protos.h:39
DETECT_TLS_VALIDITY_EQ
#define DETECT_TLS_VALIDITY_EQ
Definition: detect-tls-cert-validity.h:27
Packet_::pcap_cnt
uint64_t pcap_cnt
Definition: decode.h:626
TlsNotBeforeRegisterTests
void TlsNotBeforeRegisterTests(void)
Register unit tests for tls_cert_notbefore.
Definition: detect-tls-cert-validity.c:1351
Flow_::proto
uint8_t proto
Definition: flow.h:370
TlsNotAfterRegisterTests
void TlsNotAfterRegisterTests(void)
Register unit tests for tls_cert_notafter.
Definition: detect-tls-cert-validity.c:1373
PacketAlertCheck
int PacketAlertCheck(Packet *p, uint32_t sid)
Check if a certain sid alerted, this is used in the test functions.
Definition: detect-engine-alert.c:142
Packet_::flags
uint32_t flags
Definition: decode.h:544
Flow_
Flow data structure.
Definition: flow.h:348
Flow_::protomap
uint8_t protomap
Definition: flow.h:437
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:932
DetectEngineCtxFree
void DetectEngineCtxFree(DetectEngineCtx *)
Free a DetectEngineCtx::
Definition: detect-engine.c:2634
DETECT_TLS_VALIDITY_RA
#define DETECT_TLS_VALIDITY_RA
Definition: detect-tls-cert-validity.h:30
AppLayerParserThreadCtxFree
void AppLayerParserThreadCtxFree(AppLayerParserThreadCtx *tctx)
Destroys the app layer parser thread context obtained using AppLayerParserThreadCtxAlloc().
Definition: app-layer-parser.c:324
FLOW_PKT_TOSERVER
#define FLOW_PKT_TOSERVER
Definition: flow.h:225
DE_QUIET
#define DE_QUIET
Definition: detect.h:330
SigMatchSignatures
void SigMatchSignatures(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p)
wrapper for old tests
Definition: detect.c:2416
DetectEngineAppendSig
Signature * DetectEngineAppendSig(DetectEngineCtx *, const char *)
Parse and append a Signature into the Detection Engine Context signature list.
Definition: detect-parse.c:3439
Packet_::flowflags
uint8_t flowflags
Definition: decode.h:532
UTHBuildPacketReal
Packet * UTHBuildPacketReal(uint8_t *payload, uint16_t payload_len, uint8_t ipproto, const char *src, const char *dst, uint16_t sport, uint16_t dport)
UTHBuildPacketReal is a function that create tcp/udp packets for unittests specifying ip and port sou...
Definition: util-unittest-helper.c:260
FLOW_IPV4
#define FLOW_IPV4
Definition: flow.h:100
FAIL_IF_NOT
#define FAIL_IF_NOT(expr)
Fail a test if expression evaluates to false.
Definition: util-unittest.h:82
SCTIME_FROM_SECS
#define SCTIME_FROM_SECS(s)
Definition: util-time.h:69
StreamTcpInitConfig
void StreamTcpInitConfig(bool)
To initialize the stream global configuration data.
Definition: stream-tcp.c:488
FLOW_INITIALIZE
#define FLOW_INITIALIZE(f)
Definition: flow-util.h:38
FAIL_IF_NOT_NULL
#define FAIL_IF_NOT_NULL(expr)
Fail a test if expression evaluates to non-NULL.
Definition: util-unittest.h:96
PASS
#define PASS
Pass the test.
Definition: util-unittest.h:105
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:18
DetectEngineThreadCtx_
Definition: detect.h:1244
Flow_::lastts
SCTime_t lastts
Definition: flow.h:402
alp_tctx
AppLayerParserThreadCtx * alp_tctx
Definition: fuzz_applayerparserparse.c:23
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:58
DetectTlsValidityData_
Definition: detect-tls-cert-validity.h:41
DetectEngineThreadCtxInit
TmEcode DetectEngineThreadCtxInit(ThreadVars *tv, void *initdata, void **data)
initialize thread specific detection engine context
Definition: detect-engine.c:3364
DetectTlsValidityData_::mode
uint8_t mode
Definition: detect-tls-cert-validity.h:44
app-layer-parser.h
FlowGetProtoMapping
uint8_t FlowGetProtoMapping(uint8_t proto)
Function to map the protocol to the defined FLOW_PROTO_* enumeration.
Definition: flow-util.c:99
Packet_
Definition: decode.h:501
detect-engine-build.h
detect-engine-alert.h
FLOW_PKT_TOCLIENT
#define FLOW_PKT_TOCLIENT
Definition: flow.h:226
SigGroupBuild
int SigGroupBuild(DetectEngineCtx *de_ctx)
Convert the signature list into the runtime match structure.
Definition: detect-engine-build.c:2194
AppLayerParserThreadCtxAlloc
AppLayerParserThreadCtx * AppLayerParserThreadCtxAlloc(void)
Gets a new app layer protocol's parser thread context.
Definition: app-layer-parser.c:297
Packet_::flow
struct Flow_ * flow
Definition: decode.h:546
FAIL_IF
#define FAIL_IF(expr)
Fail a test if expression evaluates to true.
Definition: util-unittest.h:71
StreamTcpFreeConfig
void StreamTcpFreeConfig(bool quiet)
Definition: stream-tcp.c:859
DETECT_TLS_VALIDITY_LT
#define DETECT_TLS_VALIDITY_LT
Definition: detect-tls-cert-validity.h:28
AppLayerParserParse
int AppLayerParserParse(ThreadVars *tv, AppLayerParserThreadCtx *alp_tctx, Flow *f, AppProto alproto, uint8_t flags, const uint8_t *input, uint32_t input_len)
Definition: app-layer-parser.c:1291
DetectEngineThreadCtxDeinit
TmEcode DetectEngineThreadCtxDeinit(ThreadVars *tv, void *data)
Definition: detect-engine.c:3596
DetectTlsValidityData_::epoch2
time_t epoch2
Definition: detect-tls-cert-validity.h:43
DETECT_TLS_VALIDITY_GT
#define DETECT_TLS_VALIDITY_GT
Definition: detect-tls-cert-validity.h:29
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:32
UTHFreePacket
void UTHFreePacket(Packet *p)
UTHFreePacket: function to release the allocated data from UTHBuildPacket and the packet itself.
Definition: util-unittest-helper.c:473
Flow_::alstate
void * alstate
Definition: flow.h:471
TlsValidRegisterTests
void TlsValidRegisterTests(void)
Register unit tests for tls_cert_valid.
Definition: detect-tls-cert-validity.c:1399
Flow_::flags
uint32_t flags
Definition: flow.h:413
DetectTlsValidityData_::epoch
time_t epoch
Definition: detect-tls-cert-validity.h:42
Signature_
Signature container.
Definition: detect.h:668
FLOW_PKT_ESTABLISHED
#define FLOW_PKT_ESTABLISHED
Definition: flow.h:227
DetectEngineCtxInit
DetectEngineCtx * DetectEngineCtxInit(void)
Definition: detect-engine.c:2595
DetectEngineCtx_::flags
uint8_t flags
Definition: detect.h:934
AppLayerParserThreadCtx_
Definition: app-layer-parser.c:60
TcpSession_
Definition: stream-tcp-private.h:283
Flow_::alproto
AppProto alproto
application level protocol
Definition: flow.h:442
StatsThreadCleanup
void StatsThreadCleanup(ThreadVars *tv)
Definition: counters.c:1324
FLOW_DESTROY
#define FLOW_DESTROY(f)
Definition: flow-util.h:119
TlsExpiredRegisterTests
void TlsExpiredRegisterTests(void)
Register unit tests for tls_cert_expired.
Definition: detect-tls-cert-validity.c:1391
PKT_STREAM_EST
#define PKT_STREAM_EST
Definition: decode.h:1264