suricata
detect-tls-cert-validity.c
Go to the documentation of this file.
1 /* Copyright (C) 2015-2019 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Mats Klepsland <mats.klepsland@gmail.com>
22  *
23  */
24 
25 #include "detect-engine-build.h"
26 #include "detect-engine-alert.h"
27 #include "app-layer-parser.h"
28 
29 /**
30  * \test This is a test for a valid value 1430000000.
31  *
32  * \retval 1 on success.
33  * \retval 0 on failure.
34  */
35 static int ValidityTestParse01 (void)
36 {
37  DetectTlsValidityData *dd = NULL;
38  dd = DetectTlsValidityParse("1430000000");
39  FAIL_IF_NULL(dd);
40  FAIL_IF_NOT(dd->epoch == 1430000000 && dd->mode == DETECT_TLS_VALIDITY_EQ);
41  DetectTlsValidityFree(NULL, dd);
42  PASS;
43 }
44 
45 /**
46  * \test This is a test for a valid value >1430000000.
47  *
48  * \retval 1 on success.
49  * \retval 0 on failure.
50  */
51 static int ValidityTestParse02 (void)
52 {
53  DetectTlsValidityData *dd = NULL;
54  dd = DetectTlsValidityParse(">1430000000");
55  FAIL_IF_NULL(dd);
56  FAIL_IF_NOT(dd->epoch == 1430000000 && dd->mode == DETECT_TLS_VALIDITY_GT);
57  DetectTlsValidityFree(NULL, dd);
58  PASS;
59 }
60 
61 /**
62  * \test This is a test for a valid value <1430000000.
63  *
64  * \retval 1 on success.
65  * \retval 0 on failure.
66  */
67 static int ValidityTestParse03 (void)
68 {
69  DetectTlsValidityData *dd = NULL;
70  dd = DetectTlsValidityParse("<1430000000");
71  FAIL_IF_NULL(dd);
72  FAIL_IF_NOT(dd->epoch == 1430000000 && dd->mode == DETECT_TLS_VALIDITY_LT);
73  DetectTlsValidityFree(NULL, dd);
74  PASS;
75 }
76 
77 /**
78  * \test This is a test for a valid value 1430000000<>1470000000.
79  *
80  * \retval 1 on success.
81  * \retval 0 on failure.
82  */
83 static int ValidityTestParse04 (void)
84 {
85  DetectTlsValidityData *dd = NULL;
86  dd = DetectTlsValidityParse("1430000000<>1470000000");
87  FAIL_IF_NULL(dd);
88  FAIL_IF_NOT(dd->epoch == 1430000000 && dd->epoch2 == 1470000000 &&
89  dd->mode == DETECT_TLS_VALIDITY_RA);
90  DetectTlsValidityFree(NULL, dd);
91  PASS;
92 }
93 
94 /**
95  * \test This is a test for a invalid value A.
96  *
97  * \retval 1 on success.
98  * \retval 0 on failure.
99  */
100 static int ValidityTestParse05 (void)
101 {
102  DetectTlsValidityData *dd = NULL;
103  dd = DetectTlsValidityParse("A");
104  FAIL_IF_NOT_NULL(dd);
105  PASS;
106 }
107 
108 /**
109  * \test This is a test for a invalid value >1430000000<>1470000000.
110  *
111  * \retval 1 on success.
112  * \retval 0 on failure.
113  */
114 static int ValidityTestParse06 (void)
115 {
116  DetectTlsValidityData *dd = NULL;
117  dd = DetectTlsValidityParse(">1430000000<>1470000000");
118  FAIL_IF_NOT_NULL(dd);
119  PASS;
120 }
121 
122 /**
123  * \test This is a test for a invalid value 1430000000<>.
124  *
125  * \retval 1 on success.
126  * \retval 0 on failure.
127  */
128 static int ValidityTestParse07 (void)
129 {
130  DetectTlsValidityData *dd = NULL;
131  dd = DetectTlsValidityParse("1430000000<>");
132  FAIL_IF_NOT_NULL(dd);
133  PASS;
134 }
135 
136 /**
137  * \test This is a test for a invalid value <>1430000000.
138  *
139  * \retval 1 on success.
140  * \retval 0 on failure.
141  */
142 static int ValidityTestParse08 (void)
143 {
144  DetectTlsValidityData *dd = NULL;
145  dd = DetectTlsValidityParse("<>1430000000");
146  FAIL_IF_NOT_NULL(dd);
147  PASS;
148 }
149 
150 /**
151  * \test This is a test for a invalid value "".
152  *
153  * \retval 1 on success.
154  * \retval 0 on failure.
155  */
156 static int ValidityTestParse09 (void)
157 {
158  DetectTlsValidityData *dd = NULL;
159  dd = DetectTlsValidityParse("");
160  FAIL_IF_NOT_NULL(dd);
161  PASS;
162 }
163 
164 /**
165  * \test This is a test for a invalid value " ".
166  *
167  * \retval 1 on success.
168  * \retval 0 on failure.
169  */
170 static int ValidityTestParse10 (void)
171 {
172  DetectTlsValidityData *dd = NULL;
173  dd = DetectTlsValidityParse(" ");
174  FAIL_IF_NOT_NULL(dd);
175  PASS;
176 }
177 
178 /**
179  * \test This is a test for a invalid value 1490000000<>1430000000.
180  *
181  * \retval 1 on success.
182  * \retval 0 on failure.
183  */
184 static int ValidityTestParse11 (void)
185 {
186  DetectTlsValidityData *dd = NULL;
187  dd = DetectTlsValidityParse("1490000000<>1430000000");
188  FAIL_IF_NOT_NULL(dd);
189  PASS;
190 }
191 
192 /**
193  * \test This is a test for a valid value 1430000000 <> 1490000000.
194  *
195  * \retval 1 on success.
196  * \retval 0 on failure.
197  */
198 static int ValidityTestParse12 (void)
199 {
200  DetectTlsValidityData *dd = NULL;
201  dd = DetectTlsValidityParse("1430000000 <> 1490000000");
202  FAIL_IF_NULL(dd);
203  FAIL_IF_NOT(dd->epoch == 1430000000 && dd->epoch2 == 1490000000 &&
204  dd->mode == DETECT_TLS_VALIDITY_RA);
205  DetectTlsValidityFree(NULL, dd);
206  PASS;
207 }
208 
209 /**
210  * \test This is a test for a valid value > 1430000000.
211  *
212  * \retval 1 on success.
213  * \retval 0 on failure.
214  */
215 static int ValidityTestParse13 (void)
216 {
217  DetectTlsValidityData *dd = NULL;
218  dd = DetectTlsValidityParse("> 1430000000 ");
219  FAIL_IF_NULL(dd);
220  FAIL_IF_NOT(dd->epoch == 1430000000 && dd->mode == DETECT_TLS_VALIDITY_GT);
221  DetectTlsValidityFree(NULL, dd);
222  PASS;
223 }
224 
225 /**
226  * \test This is a test for a valid value < 1490000000.
227  *
228  * \retval 1 on success.
229  * \retval 0 on failure.
230  */
231 static int ValidityTestParse14 (void)
232 {
233  DetectTlsValidityData *dd = NULL;
234  dd = DetectTlsValidityParse("< 1490000000 ");
235  FAIL_IF_NULL(dd);
236  FAIL_IF_NOT(dd->epoch == 1490000000 && dd->mode == DETECT_TLS_VALIDITY_LT);
237  DetectTlsValidityFree(NULL, dd);
238  PASS;
239 }
240 
241 /**
242  * \test This is a test for a valid value 1490000000.
243  *
244  * \retval 1 on success.
245  * \retval 0 on failure.
246  */
247 static int ValidityTestParse15 (void)
248 {
249  DetectTlsValidityData *dd = NULL;
250  dd = DetectTlsValidityParse(" 1490000000 ");
251  FAIL_IF_NULL(dd);
252  FAIL_IF_NOT(dd->epoch == 1490000000 && dd->mode == DETECT_TLS_VALIDITY_EQ);
253  DetectTlsValidityFree(NULL, dd);
254  PASS;
255 }
256 
257 /**
258  * \test This is a test for a valid value 2015-10.
259  *
260  * \retval 1 on success.
261  * \retval 0 on failure.
262  */
263 static int ValidityTestParse16 (void)
264 {
265  DetectTlsValidityData *dd = NULL;
266  dd = DetectTlsValidityParse("2015-10");
267  FAIL_IF_NULL(dd);
268  FAIL_IF_NOT(dd->epoch == 1443657600 && dd->mode == DETECT_TLS_VALIDITY_EQ);
269  DetectTlsValidityFree(NULL, dd);
270  PASS;
271 }
272 
273 /**
274  * \test This is a test for a valid value >2015-10-22.
275  *
276  * \retval 1 on success.
277  * \retval 0 on failure.
278  */
279 static int ValidityTestParse17 (void)
280 {
281  DetectTlsValidityData *dd = NULL;
282  dd = DetectTlsValidityParse(">2015-10-22");
283  FAIL_IF_NULL(dd);
284  FAIL_IF_NOT(dd->epoch == 1445472000 && dd->mode == DETECT_TLS_VALIDITY_GT);
285  DetectTlsValidityFree(NULL, dd);
286  PASS;
287 }
288 
289 /**
290  * \test This is a test for a valid value <2015-10-22 23.
291  *
292  * \retval 1 on success.
293  * \retval 0 on failure.
294  */
295 static int ValidityTestParse18 (void)
296 {
297  DetectTlsValidityData *dd = NULL;
298  dd = DetectTlsValidityParse("<2015-10-22 23");
299  FAIL_IF_NULL(dd);
300  FAIL_IF_NOT(dd->epoch == 1445554800 && dd->mode == DETECT_TLS_VALIDITY_LT);
301  DetectTlsValidityFree(NULL, dd);
302  PASS;
303 }
304 
305 /**
306  * \test This is a test for a valid value 2015-10-22 23:59.
307  *
308  * \retval 1 on success.
309  * \retval 0 on failure.
310  */
311 static int ValidityTestParse19 (void)
312 {
313  DetectTlsValidityData *dd = NULL;
314  dd = DetectTlsValidityParse("2015-10-22 23:59");
315  FAIL_IF_NULL(dd);
316  FAIL_IF_NOT(dd->epoch == 1445558340 && dd->mode == DETECT_TLS_VALIDITY_EQ);
317  DetectTlsValidityFree(NULL, dd);
318  PASS;
319 }
320 
321 /**
322  * \test This is a test for a valid value 2015-10-22 23:59:59.
323  *
324  * \retval 1 on success.
325  * \retval 0 on failure.
326  */
327 static int ValidityTestParse20 (void)
328 {
329  DetectTlsValidityData *dd = NULL;
330  dd = DetectTlsValidityParse("2015-10-22 23:59:59");
331  FAIL_IF_NULL(dd);
332  FAIL_IF_NOT(dd->epoch == 1445558399 && dd->mode == DETECT_TLS_VALIDITY_EQ);
333  DetectTlsValidityFree(NULL, dd);
334  PASS;
335 }
336 
337 /**
338  * \test This is a test for a valid value 2015-10-22T23.
339  *
340  * \retval 1 on success.
341  * \retval 0 on failure.
342  */
343 static int ValidityTestParse21 (void)
344 {
345  DetectTlsValidityData *dd = NULL;
346  dd = DetectTlsValidityParse("2015-10-22T23");
347  FAIL_IF_NULL(dd);
348  FAIL_IF_NOT(dd->epoch == 1445554800 && dd->mode == DETECT_TLS_VALIDITY_EQ);
349  DetectTlsValidityFree(NULL, dd);
350  PASS;
351 }
352 
353 /**
354  * \test This is a test for a valid value 2015-10-22T23:59.
355  *
356  * \retval 1 on success.
357  * \retval 0 on failure.
358  */
359 static int ValidityTestParse22 (void)
360 {
361  DetectTlsValidityData *dd = NULL;
362  dd = DetectTlsValidityParse("2015-10-22T23:59");
363  FAIL_IF_NULL(dd);
364  FAIL_IF_NOT(dd->epoch == 1445558340 && dd->mode == DETECT_TLS_VALIDITY_EQ);
365  DetectTlsValidityFree(NULL, dd);
366  PASS;
367 }
368 
369 /**
370  * \test This is a test for a valid value 2015-10-22T23:59:59.
371  *
372  * \retval 1 on success.
373  * \retval 0 on failure.
374  */
375 static int ValidityTestParse23 (void)
376 {
377  DetectTlsValidityData *dd = NULL;
378  dd = DetectTlsValidityParse("2015-10-22T23:59:59");
379  FAIL_IF_NULL(dd);
380  FAIL_IF_NOT(dd->epoch == 1445558399 && dd->mode == DETECT_TLS_VALIDITY_EQ);
381  DetectTlsValidityFree(NULL, dd);
382  PASS;
383 }
384 
385 /**
386  * \test This is a test for a valid value of 1970-01-01T00:00:00
387  * that is at epoch 0, within the range of acceptable
388  * values (1950-2049) as per RFC 5280. (https://tools.ietf.org/html/rfc5280#section-4.1.2.5.1)
389  *
390  * \retval 1 on success.
391  * \retval 0 on failure.
392  */
393 static int ValidityTestParse24(void)
394 {
395  DetectTlsValidityData *dd = NULL;
396  dd = DetectTlsValidityParse("1970-01-01T00:00:00");
397  FAIL_IF_NULL(dd);
398  FAIL_IF_NOT(dd->epoch == 0 && dd->mode == DETECT_TLS_VALIDITY_EQ);
399  DetectTlsValidityFree(NULL, dd);
400  PASS;
401 }
402 
403 /**
404  * \test This is a test for a valid value of 1965-10-22T23:59:59
405  * that is lower than epoch 0, but within the range of
406  * acceptable values (1950-2049) as per RFC 5280.
407  * (https://tools.ietf.org/html/rfc5280#section-4.1.2.5.1)
408  *
409  * \retval 1 on success.
410  * \retval 0 on failure.
411  */
412 static int ValidityTestParse25(void)
413 {
414  DetectTlsValidityData *dd = NULL;
415  dd = DetectTlsValidityParse("1969-12-31T23:59:59");
416  FAIL_IF_NULL(dd);
417  FAIL_IF_NOT(dd->epoch == -1 && dd->mode == DETECT_TLS_VALIDITY_EQ);
418  DetectTlsValidityFree(NULL, dd);
419  PASS;
420 }
421 
422 /**
423 
424  * \test This is a test for a valid value <2015.
425  *
426  * \retval 1 on success.
427  * \retval 0 on failure.
428  */
429 static int ValidityTestParse26(void)
430 {
431  DetectTlsValidityData *dd = NULL;
432  dd = DetectTlsValidityParse("<2015");
433  FAIL_IF_NULL(dd);
434  FAIL_IF_NOT(dd->epoch == 1422748800 && dd->mode == DETECT_TLS_VALIDITY_LT);
435  DetectTlsValidityFree(NULL, dd);
436  PASS;
437 }
438 
439 /**
440 
441  * \test This is a test for a valid value >2020.
442  *
443  * \retval 1 on success.
444  * \retval 0 on failure.
445  */
446 static int ValidityTestParse27(void)
447 {
448  DetectTlsValidityData *dd = NULL;
449  dd = DetectTlsValidityParse(">2020");
450  FAIL_IF_NULL(dd);
451  FAIL_IF_NOT(dd->epoch == 1580515200 && dd->mode == DETECT_TLS_VALIDITY_GT);
452  DetectTlsValidityFree(NULL, dd);
453  PASS;
454 }
455 
456 /**
457  * \test Test matching on validity dates in a certificate.
458  *
459  * \retval 1 on success.
460  * \retval 0 on failure.
461  */
462 static int ValidityTestDetect01(void)
463 {
464  /* client hello */
465  uint8_t client_hello[] = {
466  0x16, 0x03, 0x01, 0x00, 0xc8, 0x01, 0x00, 0x00,
467  0xc4, 0x03, 0x03, 0xd6, 0x08, 0x5a, 0xa2, 0x86,
468  0x5b, 0x85, 0xd4, 0x40, 0xab, 0xbe, 0xc0, 0xbc,
469  0x41, 0xf2, 0x26, 0xf0, 0xfe, 0x21, 0xee, 0x8b,
470  0x4c, 0x7e, 0x07, 0xc8, 0xec, 0xd2, 0x00, 0x46,
471  0x4c, 0xeb, 0xb7, 0x00, 0x00, 0x16, 0xc0, 0x2b,
472  0xc0, 0x2f, 0xc0, 0x0a, 0xc0, 0x09, 0xc0, 0x13,
473  0xc0, 0x14, 0x00, 0x33, 0x00, 0x39, 0x00, 0x2f,
474  0x00, 0x35, 0x00, 0x0a, 0x01, 0x00, 0x00, 0x85,
475  0x00, 0x00, 0x00, 0x12, 0x00, 0x10, 0x00, 0x00,
476  0x0d, 0x77, 0x77, 0x77, 0x2e, 0x67, 0x6f, 0x6f,
477  0x67, 0x6c, 0x65, 0x2e, 0x6e, 0x6f, 0xff, 0x01,
478  0x00, 0x01, 0x00, 0x00, 0x0a, 0x00, 0x08, 0x00,
479  0x06, 0x00, 0x17, 0x00, 0x18, 0x00, 0x19, 0x00,
480  0x0b, 0x00, 0x02, 0x01, 0x00, 0x00, 0x23, 0x00,
481  0x00, 0x33, 0x74, 0x00, 0x00, 0x00, 0x10, 0x00,
482  0x29, 0x00, 0x27, 0x05, 0x68, 0x32, 0x2d, 0x31,
483  0x36, 0x05, 0x68, 0x32, 0x2d, 0x31, 0x35, 0x05,
484  0x68, 0x32, 0x2d, 0x31, 0x34, 0x02, 0x68, 0x32,
485  0x08, 0x73, 0x70, 0x64, 0x79, 0x2f, 0x33, 0x2e,
486  0x31, 0x08, 0x68, 0x74, 0x74, 0x70, 0x2f, 0x31,
487  0x2e, 0x31, 0x00, 0x05, 0x00, 0x05, 0x01, 0x00,
488  0x00, 0x00, 0x00, 0x00, 0x0d, 0x00, 0x16, 0x00,
489  0x14, 0x04, 0x01, 0x05, 0x01, 0x06, 0x01, 0x02,
490  0x01, 0x04, 0x03, 0x05, 0x03, 0x06, 0x03, 0x02,
491  0x03, 0x04, 0x02, 0x02, 0x02
492  };
493 
494  /* server hello */
495  uint8_t server_hello[] = {
496  0x16, 0x03, 0x03, 0x00, 0x48, 0x02, 0x00, 0x00,
497  0x44, 0x03, 0x03, 0x57, 0x91, 0xb8, 0x63, 0xdd,
498  0xdb, 0xbb, 0x23, 0xcf, 0x0b, 0x43, 0x02, 0x1d,
499  0x46, 0x11, 0x27, 0x5c, 0x98, 0xcf, 0x67, 0xe1,
500  0x94, 0x3d, 0x62, 0x7d, 0x38, 0x48, 0x21, 0x23,
501  0xa5, 0x62, 0x31, 0x00, 0xc0, 0x2f, 0x00, 0x00,
502  0x1c, 0xff, 0x01, 0x00, 0x01, 0x00, 0x00, 0x00,
503  0x00, 0x00, 0x00, 0x23, 0x00, 0x00, 0x00, 0x10,
504  0x00, 0x05, 0x00, 0x03, 0x02, 0x68, 0x32, 0x00,
505  0x0b, 0x00, 0x02, 0x01, 0x00
506  };
507 
508  /* certificate */
509  uint8_t certificate[] = {
510  0x16, 0x03, 0x03, 0x04, 0x93, 0x0b, 0x00, 0x04,
511  0x8f, 0x00, 0x04, 0x8c, 0x00, 0x04, 0x89, 0x30,
512  0x82, 0x04, 0x85, 0x30, 0x82, 0x03, 0x6d, 0xa0,
513  0x03, 0x02, 0x01, 0x02, 0x02, 0x08, 0x5c, 0x19,
514  0xb7, 0xb1, 0x32, 0x3b, 0x1c, 0xa1, 0x30, 0x0d,
515  0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d,
516  0x01, 0x01, 0x0b, 0x05, 0x00, 0x30, 0x49, 0x31,
517  0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06,
518  0x13, 0x02, 0x55, 0x53, 0x31, 0x13, 0x30, 0x11,
519  0x06, 0x03, 0x55, 0x04, 0x0a, 0x13, 0x0a, 0x47,
520  0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x20, 0x49, 0x6e,
521  0x63, 0x31, 0x25, 0x30, 0x23, 0x06, 0x03, 0x55,
522  0x04, 0x03, 0x13, 0x1c, 0x47, 0x6f, 0x6f, 0x67,
523  0x6c, 0x65, 0x20, 0x49, 0x6e, 0x74, 0x65, 0x72,
524  0x6e, 0x65, 0x74, 0x20, 0x41, 0x75, 0x74, 0x68,
525  0x6f, 0x72, 0x69, 0x74, 0x79, 0x20, 0x47, 0x32,
526  0x30, 0x1e, 0x17, 0x0d, 0x31, 0x36, 0x30, 0x37,
527  0x31, 0x33, 0x31, 0x33, 0x32, 0x34, 0x35, 0x32,
528  0x5a, 0x17, 0x0d, 0x31, 0x36, 0x31, 0x30, 0x30,
529  0x35, 0x31, 0x33, 0x31, 0x36, 0x30, 0x30, 0x5a,
530  0x30, 0x65, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03,
531  0x55, 0x04, 0x06, 0x13, 0x02, 0x55, 0x53, 0x31,
532  0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x08,
533  0x0c, 0x0a, 0x43, 0x61, 0x6c, 0x69, 0x66, 0x6f,
534  0x72, 0x6e, 0x69, 0x61, 0x31, 0x16, 0x30, 0x14,
535  0x06, 0x03, 0x55, 0x04, 0x07, 0x0c, 0x0d, 0x4d,
536  0x6f, 0x75, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x20,
537  0x56, 0x69, 0x65, 0x77, 0x31, 0x13, 0x30, 0x11,
538  0x06, 0x03, 0x55, 0x04, 0x0a, 0x0c, 0x0a, 0x47,
539  0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x20, 0x49, 0x6e,
540  0x63, 0x31, 0x14, 0x30, 0x12, 0x06, 0x03, 0x55,
541  0x04, 0x03, 0x0c, 0x0b, 0x2a, 0x2e, 0x67, 0x6f,
542  0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x6e, 0x6f, 0x30,
543  0x82, 0x01, 0x22, 0x30, 0x0d, 0x06, 0x09, 0x2a,
544  0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01,
545  0x05, 0x00, 0x03, 0x82, 0x01, 0x0f, 0x00, 0x30,
546  0x82, 0x01, 0x0a, 0x02, 0x82, 0x01, 0x01, 0x00,
547  0xa5, 0x0a, 0xb9, 0xb1, 0xca, 0x36, 0xd1, 0xae,
548  0x22, 0x38, 0x07, 0x06, 0xc9, 0x1a, 0x56, 0x4f,
549  0xbb, 0xdf, 0xa8, 0x6d, 0xbd, 0xee, 0x76, 0x16,
550  0xbc, 0x53, 0x3c, 0x03, 0x6a, 0x5c, 0x94, 0x50,
551  0x87, 0x2f, 0x28, 0xb4, 0x4e, 0xd5, 0x9b, 0x8f,
552  0xfe, 0x02, 0xde, 0x2a, 0x83, 0x01, 0xf9, 0x45,
553  0x61, 0x0e, 0x66, 0x0e, 0x24, 0x22, 0xe2, 0x59,
554  0x66, 0x0d, 0xd3, 0xe9, 0x77, 0x8a, 0x7e, 0x42,
555  0xaa, 0x5a, 0xf9, 0x05, 0xbf, 0x30, 0xc7, 0x03,
556  0x2b, 0xdc, 0xa6, 0x9c, 0xe0, 0x9f, 0x0d, 0xf1,
557  0x28, 0x19, 0xf8, 0xf2, 0x02, 0xfa, 0xbd, 0x62,
558  0xa0, 0xf3, 0x02, 0x2b, 0xcd, 0xf7, 0x09, 0x04,
559  0x3b, 0x52, 0xd8, 0x65, 0x4b, 0x4a, 0x70, 0xe4,
560  0x57, 0xc9, 0x2e, 0x2a, 0xf6, 0x9c, 0x6e, 0xd8,
561  0xde, 0x01, 0x52, 0xc9, 0x6f, 0xe9, 0xef, 0x82,
562  0xbc, 0x0b, 0x95, 0xb2, 0xef, 0xcb, 0x91, 0xa6,
563  0x0b, 0x2d, 0x14, 0xc6, 0x00, 0xa9, 0x33, 0x86,
564  0x64, 0x00, 0xd4, 0x92, 0x19, 0x53, 0x3d, 0xfd,
565  0xcd, 0xc6, 0x1a, 0xf2, 0x0e, 0x67, 0xc2, 0x1d,
566  0x2c, 0xe0, 0xe8, 0x29, 0x97, 0x1c, 0xb6, 0xc4,
567  0xb2, 0x02, 0x0c, 0x83, 0xb8, 0x60, 0x61, 0xf5,
568  0x61, 0x2d, 0x73, 0x5e, 0x85, 0x4d, 0xbd, 0x0d,
569  0xe7, 0x1a, 0x37, 0x56, 0x8d, 0xe5, 0x50, 0x0c,
570  0xc9, 0x64, 0x4c, 0x11, 0xea, 0xf3, 0xcb, 0x26,
571  0x34, 0xbd, 0x02, 0xf5, 0xc1, 0xfb, 0xa2, 0xec,
572  0x27, 0xbb, 0x60, 0xbe, 0x0b, 0xf6, 0xe7, 0x3c,
573  0x2d, 0xc9, 0xe7, 0xb0, 0x30, 0x28, 0x17, 0x3d,
574  0x90, 0xf1, 0x63, 0x8e, 0x49, 0xf7, 0x15, 0x78,
575  0x21, 0xcc, 0x45, 0xe6, 0x86, 0xb2, 0xd8, 0xb0,
576  0x2e, 0x5a, 0xb0, 0x58, 0xd3, 0xb6, 0x11, 0x40,
577  0xae, 0x81, 0x1f, 0x6b, 0x7a, 0xaf, 0x40, 0x50,
578  0xf9, 0x2e, 0x81, 0x8b, 0xec, 0x26, 0x11, 0x3f,
579  0x02, 0x03, 0x01, 0x00, 0x01, 0xa3, 0x82, 0x01,
580  0x53, 0x30, 0x82, 0x01, 0x4f, 0x30, 0x1d, 0x06,
581  0x03, 0x55, 0x1d, 0x25, 0x04, 0x16, 0x30, 0x14,
582  0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07,
583  0x03, 0x01, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05,
584  0x05, 0x07, 0x03, 0x02, 0x30, 0x21, 0x06, 0x03,
585  0x55, 0x1d, 0x11, 0x04, 0x1a, 0x30, 0x18, 0x82,
586  0x0b, 0x2a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
587  0x65, 0x2e, 0x6e, 0x6f, 0x82, 0x09, 0x67, 0x6f,
588  0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x6e, 0x6f, 0x30,
589  0x68, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05,
590  0x07, 0x01, 0x01, 0x04, 0x5c, 0x30, 0x5a, 0x30,
591  0x2b, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05,
592  0x07, 0x30, 0x02, 0x86, 0x1f, 0x68, 0x74, 0x74,
593  0x70, 0x3a, 0x2f, 0x2f, 0x70, 0x6b, 0x69, 0x2e,
594  0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x63,
595  0x6f, 0x6d, 0x2f, 0x47, 0x49, 0x41, 0x47, 0x32,
596  0x2e, 0x63, 0x72, 0x74, 0x30, 0x2b, 0x06, 0x08,
597  0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x30, 0x01,
598  0x86, 0x1f, 0x68, 0x74, 0x74, 0x70, 0x3a, 0x2f,
599  0x2f, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x73,
600  0x31, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
601  0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6f, 0x63, 0x73,
602  0x70, 0x30, 0x1d, 0x06, 0x03, 0x55, 0x1d, 0x0e,
603  0x04, 0x16, 0x04, 0x14, 0xc6, 0x53, 0x87, 0x42,
604  0x2d, 0xc8, 0xee, 0x7a, 0x62, 0x1e, 0x83, 0xdb,
605  0x0d, 0xe2, 0x32, 0xeb, 0x8b, 0xaf, 0x69, 0x40,
606  0x30, 0x0c, 0x06, 0x03, 0x55, 0x1d, 0x13, 0x01,
607  0x01, 0xff, 0x04, 0x02, 0x30, 0x00, 0x30, 0x1f,
608  0x06, 0x03, 0x55, 0x1d, 0x23, 0x04, 0x18, 0x30,
609  0x16, 0x80, 0x14, 0x4a, 0xdd, 0x06, 0x16, 0x1b,
610  0xbc, 0xf6, 0x68, 0xb5, 0x76, 0xf5, 0x81, 0xb6,
611  0xbb, 0x62, 0x1a, 0xba, 0x5a, 0x81, 0x2f, 0x30,
612  0x21, 0x06, 0x03, 0x55, 0x1d, 0x20, 0x04, 0x1a,
613  0x30, 0x18, 0x30, 0x0c, 0x06, 0x0a, 0x2b, 0x06,
614  0x01, 0x04, 0x01, 0xd6, 0x79, 0x02, 0x05, 0x01,
615  0x30, 0x08, 0x06, 0x06, 0x67, 0x81, 0x0c, 0x01,
616  0x02, 0x02, 0x30, 0x30, 0x06, 0x03, 0x55, 0x1d,
617  0x1f, 0x04, 0x29, 0x30, 0x27, 0x30, 0x25, 0xa0,
618  0x23, 0xa0, 0x21, 0x86, 0x1f, 0x68, 0x74, 0x74,
619  0x70, 0x3a, 0x2f, 0x2f, 0x70, 0x6b, 0x69, 0x2e,
620  0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x63,
621  0x6f, 0x6d, 0x2f, 0x47, 0x49, 0x41, 0x47, 0x32,
622  0x2e, 0x63, 0x72, 0x6c, 0x30, 0x0d, 0x06, 0x09,
623  0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01,
624  0x0b, 0x05, 0x00, 0x03, 0x82, 0x01, 0x01, 0x00,
625  0x7b, 0x27, 0x00, 0x46, 0x8f, 0xfd, 0x5b, 0xff,
626  0xcb, 0x05, 0x9b, 0xf7, 0xf1, 0x68, 0xf6, 0x9a,
627  0x7b, 0xba, 0x53, 0xdf, 0x63, 0xed, 0x11, 0x94,
628  0x39, 0xf2, 0xd0, 0x20, 0xcd, 0xa3, 0xc4, 0x98,
629  0xa5, 0x10, 0x74, 0xe7, 0x10, 0x6d, 0x07, 0xf8,
630  0x33, 0x87, 0x05, 0x43, 0x0e, 0x64, 0x77, 0x09,
631  0x18, 0x4f, 0x38, 0x2e, 0x45, 0xae, 0xa8, 0x34,
632  0x3a, 0xa8, 0x33, 0xac, 0x9d, 0xdd, 0x25, 0x91,
633  0x59, 0x43, 0xbe, 0x0f, 0x87, 0x16, 0x2f, 0xb5,
634  0x27, 0xfd, 0xce, 0x2f, 0x35, 0x5d, 0x12, 0xa1,
635  0x66, 0xac, 0xf7, 0x95, 0x38, 0x0f, 0xe5, 0xb1,
636  0x18, 0x18, 0xe6, 0x80, 0x52, 0x31, 0x8a, 0x66,
637  0x02, 0x52, 0x1a, 0xa4, 0x32, 0x6a, 0x61, 0x05,
638  0xcf, 0x1d, 0xf9, 0x90, 0x73, 0xf0, 0xeb, 0x20,
639  0x31, 0x7b, 0x2e, 0xc0, 0xb0, 0xfb, 0x5c, 0xcc,
640  0xdc, 0x76, 0x55, 0x72, 0xaf, 0xb1, 0x05, 0xf4,
641  0xad, 0xf9, 0xd7, 0x73, 0x5c, 0x2c, 0xbf, 0x0d,
642  0x84, 0x18, 0x01, 0x1d, 0x4d, 0x08, 0xa9, 0x4e,
643  0x37, 0xb7, 0x58, 0xc4, 0x05, 0x0e, 0x65, 0x63,
644  0xd2, 0x88, 0x02, 0xf5, 0x82, 0x17, 0x08, 0xd5,
645  0x8f, 0x80, 0xc7, 0x82, 0x29, 0xbb, 0xe1, 0x04,
646  0xbe, 0xf6, 0xe1, 0x8c, 0xbc, 0x3a, 0xf8, 0xf9,
647  0x56, 0xda, 0xdc, 0x8e, 0xc6, 0xe6, 0x63, 0x98,
648  0x12, 0x08, 0x41, 0x2c, 0x9d, 0x7c, 0x82, 0x0d,
649  0x1e, 0xea, 0xba, 0xde, 0x32, 0x09, 0xda, 0x52,
650  0x24, 0x4f, 0xcc, 0xb6, 0x09, 0x33, 0x8b, 0x00,
651  0xf9, 0x83, 0xb3, 0xc6, 0xa4, 0x90, 0x49, 0x83,
652  0x2d, 0x36, 0xd9, 0x11, 0x78, 0xd0, 0x62, 0x9f,
653  0xc4, 0x8f, 0x84, 0xba, 0x7f, 0xaa, 0x04, 0xf1,
654  0xd9, 0xa4, 0xad, 0x5d, 0x63, 0xee, 0x72, 0xc6,
655  0x4d, 0xd1, 0x4b, 0x41, 0x8f, 0x40, 0x0f, 0x7d,
656  0xcd, 0xb8, 0x2e, 0x5b, 0x6e, 0x21, 0xc9, 0x3d
657  };
658 
659  Flow f;
660  SSLState *ssl_state = NULL;
661  TcpSession ssn;
662  Packet *p1 = NULL;
663  Packet *p2 = NULL;
664  Packet *p3 = NULL;
665  ThreadVars tv;
666  DetectEngineThreadCtx *det_ctx = NULL;
667  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
668 
669  memset(&tv, 0, sizeof(ThreadVars));
670  StatsThreadInit(&tv.stats);
671  memset(&f, 0, sizeof(Flow));
672  memset(&ssn, 0, sizeof(TcpSession));
673 
674  p1 = UTHBuildPacketReal(client_hello, sizeof(client_hello), IPPROTO_TCP,
675  "192.168.1.5", "192.168.1.1", 51251, 443);
676  p2 = UTHBuildPacketReal(server_hello, sizeof(server_hello), IPPROTO_TCP,
677  "192.168.1.1", "192.168.1.5", 443, 51251);
678  p3 = UTHBuildPacketReal(certificate, sizeof(certificate), IPPROTO_TCP,
679  "192.168.1.1", "192.168.1.5", 443, 51251);
680 
681  FLOW_INITIALIZE(&f);
682  f.flags |= FLOW_IPV4;
683  f.proto = IPPROTO_TCP;
684  f.protomap = FlowGetProtoMapping(f.proto);
685  f.alproto = ALPROTO_TLS;
686 
687  p1->flow = &f;
688  p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
689  p1->flowflags |= FLOW_PKT_TOSERVER;
690  p1->flowflags |= FLOW_PKT_ESTABLISHED;
691  PcapPacketCntSet(p1, 1);
692 
693  p2->flow = &f;
694  p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
695  p2->flowflags |= FLOW_PKT_TOCLIENT;
696  p2->flowflags |= FLOW_PKT_ESTABLISHED;
697  PcapPacketCntSet(p2, 2);
698 
699  p3->flow = &f;
700  p3->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
701  p3->flowflags |= FLOW_PKT_TOCLIENT;
702  p3->flowflags |= FLOW_PKT_ESTABLISHED;
703  PcapPacketCntSet(p3, 3);
704 
705  StreamTcpInitConfig(true);
706 
707  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
708  FAIL_IF_NULL(de_ctx);
709  de_ctx->flags |= DE_QUIET;
710 
711  Signature *s = DetectEngineAppendSig(de_ctx, "alert tls any any -> any any "
712  "(msg:\"Test tls_cert_notbefore\"; "
713  "tls_cert_notbefore:<2016-07-20; sid:1;)");
714  FAIL_IF_NULL(s);
715 
716  s = DetectEngineAppendSig(de_ctx, "alert tls any any -> any any "
717  "(msg:\"Test tls_cert_notafter\"; "
718  "tls_cert_notafter:>2016-09-01; sid:2;)");
719  FAIL_IF_NULL(s);
720 
721  SigGroupBuild(de_ctx);
722  DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
723 
724  int r = AppLayerParserParse(
725  NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, client_hello, sizeof(client_hello));
726  FAIL_IF(r != 0);
727 
728  ssl_state = f.alstate;
729  FAIL_IF_NULL(ssl_state);
730 
731  SigMatchSignatures(&tv, de_ctx, det_ctx, p1);
732  FAIL_IF(PacketAlertCheck(p1, 1));
733  FAIL_IF(PacketAlertCheck(p1, 2));
734 
735  r = AppLayerParserParse(
736  NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOCLIENT, server_hello, sizeof(server_hello));
737  FAIL_IF(r != 0);
738 
739  SigMatchSignatures(&tv, de_ctx, det_ctx, p2);
740  FAIL_IF(PacketAlertCheck(p2, 1));
741  FAIL_IF(PacketAlertCheck(p2, 2));
742 
743  r = AppLayerParserParse(
744  NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOCLIENT, certificate, sizeof(certificate));
745  FAIL_IF(r != 0);
746 
747  SigMatchSignatures(&tv, de_ctx, det_ctx, p3);
748  FAIL_IF_NOT(PacketAlertCheck(p3, 1));
749  FAIL_IF_NOT(PacketAlertCheck(p3, 2));
750 
751  UTHFreePacket(p1);
752  UTHFreePacket(p2);
753  UTHFreePacket(p3);
754  FLOW_DESTROY(&f);
755 
756  AppLayerParserThreadCtxFree(alp_tctx);
757  DetectEngineThreadCtxDeinit(&tv, det_ctx);
758  DetectEngineCtxFree(de_ctx);
759  StreamTcpFreeConfig(true);
760  StatsThreadCleanup(&tv.stats);
761  PASS;
762 }
763 
764 /**
765  * \test Test matching on an expired certificate.
766  *
767  * Traffic from expired.badssl.com
768  *
769  * \retval 1 on success.
770  * \retval 0 on failure.
771  */
772 static int ExpiredTestDetect01(void)
773 {
774  /* client hello */
775  uint8_t client_hello[] = {
776  0x16, 0x03, 0x03, 0x00, 0x5a, 0x01, 0x00, 0x00,
777  0x56, 0x03, 0x03, 0x62, 0x87, 0xa4, 0x11, 0x3e,
778  0x11, 0x32, 0x7d, 0xbc, 0x5b, 0x63, 0xb7, 0xaf,
779  0x55, 0x8d, 0x46, 0x5b, 0x8f, 0xac, 0x50, 0x02,
780  0x90, 0xe3, 0x55, 0x03, 0xfe, 0xad, 0xa6, 0x92,
781  0x56, 0x75, 0xf9, 0x00, 0x00, 0x08, 0x00, 0x35,
782  0x00, 0x2f, 0x00, 0x0a, 0x00, 0xff, 0x01, 0x00,
783  0x00, 0x25, 0x00, 0x00, 0x00, 0x17, 0x00, 0x15,
784  0x00, 0x00, 0x12, 0x65, 0x78, 0x70, 0x69, 0x72,
785  0x65, 0x64, 0x2e, 0x62, 0x61, 0x64, 0x73, 0x73,
786  0x6c, 0x2e, 0x63, 0x6f, 0x6d, 0x00, 0x0d, 0x00,
787  0x06, 0x00, 0x04, 0x04, 0x01, 0x02, 0x01
788  };
789 
790  /* server hello */
791  uint8_t server_hello[] = {
792  0x16, 0x03, 0x03, 0x00, 0x55, 0x02, 0x00, 0x00,
793  0x51, 0x03, 0x03, 0x22, 0xa1, 0xd8, 0xd0, 0x3c,
794  0x8d, 0x32, 0x7e, 0x4f, 0x60, 0x27, 0xf6, 0x0c,
795  0x99, 0x7a, 0x8e, 0x6e, 0x52, 0xa5, 0xf4, 0x20,
796  0x2e, 0xa1, 0xa4, 0x0b, 0xd5, 0x80, 0x9b, 0xec,
797  0xbd, 0x2c, 0x6c, 0x20, 0x7a, 0x9b, 0xcc, 0x6b,
798  0xbf, 0x3d, 0xfc, 0x7c, 0x31, 0x78, 0x65, 0x1e,
799  0xcc, 0x41, 0x0b, 0x8b, 0x3d, 0x4e, 0xde, 0x45,
800  0xe5, 0x20, 0xf5, 0xbd, 0x8e, 0x99, 0xce, 0xc2,
801  0xad, 0x88, 0x08, 0x27, 0x00, 0x2f, 0x00, 0x00,
802  0x09, 0x00, 0x00, 0x00, 0x00, 0xff, 0x01, 0x00,
803  0x01, 0x00
804  };
805 
806  /* certificate */
807  uint8_t certificate[] = {
808  0x16, 0x03, 0x03, 0x05, 0x59, 0x0b, 0x00, 0x05,
809  0x55, 0x00, 0x05, 0x52, 0x00, 0x05, 0x4f, 0x30,
810  0x82, 0x05, 0x4b, 0x30, 0x82, 0x04, 0x33, 0xa0,
811  0x03, 0x02, 0x01, 0x02, 0x02, 0x10, 0x4a, 0xe7,
812  0x95, 0x49, 0xfa, 0x9a, 0xbe, 0x3f, 0x10, 0x0f,
813  0x17, 0xa4, 0x78, 0xe1, 0x69, 0x09, 0x30, 0x0d,
814  0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d,
815  0x01, 0x01, 0x0b, 0x05, 0x00, 0x30, 0x81, 0x90,
816  0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04,
817  0x06, 0x13, 0x02, 0x47, 0x42, 0x31, 0x1b, 0x30,
818  0x19, 0x06, 0x03, 0x55, 0x04, 0x08, 0x13, 0x12,
819  0x47, 0x72, 0x65, 0x61, 0x74, 0x65, 0x72, 0x20,
820  0x4d, 0x61, 0x6e, 0x63, 0x68, 0x65, 0x73, 0x74,
821  0x65, 0x72, 0x31, 0x10, 0x30, 0x0e, 0x06, 0x03,
822  0x55, 0x04, 0x07, 0x13, 0x07, 0x53, 0x61, 0x6c,
823  0x66, 0x6f, 0x72, 0x64, 0x31, 0x1a, 0x30, 0x18,
824  0x06, 0x03, 0x55, 0x04, 0x0a, 0x13, 0x11, 0x43,
825  0x4f, 0x4d, 0x4f, 0x44, 0x4f, 0x20, 0x43, 0x41,
826  0x20, 0x4c, 0x69, 0x6d, 0x69, 0x74, 0x65, 0x64,
827  0x31, 0x36, 0x30, 0x34, 0x06, 0x03, 0x55, 0x04,
828  0x03, 0x13, 0x2d, 0x43, 0x4f, 0x4d, 0x4f, 0x44,
829  0x4f, 0x20, 0x52, 0x53, 0x41, 0x20, 0x44, 0x6f,
830  0x6d, 0x61, 0x69, 0x6e, 0x20, 0x56, 0x61, 0x6c,
831  0x69, 0x64, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x20,
832  0x53, 0x65, 0x63, 0x75, 0x72, 0x65, 0x20, 0x53,
833  0x65, 0x72, 0x76, 0x65, 0x72, 0x20, 0x43, 0x41,
834  0x30, 0x1e, 0x17, 0x0d, 0x31, 0x35, 0x30, 0x34,
835  0x30, 0x39, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30,
836  0x5a, 0x17, 0x0d, 0x31, 0x35, 0x30, 0x34, 0x31,
837  0x32, 0x32, 0x33, 0x35, 0x39, 0x35, 0x39, 0x5a,
838  0x30, 0x59, 0x31, 0x21, 0x30, 0x1f, 0x06, 0x03,
839  0x55, 0x04, 0x0b, 0x13, 0x18, 0x44, 0x6f, 0x6d,
840  0x61, 0x69, 0x6e, 0x20, 0x43, 0x6f, 0x6e, 0x74,
841  0x72, 0x6f, 0x6c, 0x20, 0x56, 0x61, 0x6c, 0x69,
842  0x64, 0x61, 0x74, 0x65, 0x64, 0x31, 0x1d, 0x30,
843  0x1b, 0x06, 0x03, 0x55, 0x04, 0x0b, 0x13, 0x14,
844  0x50, 0x6f, 0x73, 0x69, 0x74, 0x69, 0x76, 0x65,
845  0x53, 0x53, 0x4c, 0x20, 0x57, 0x69, 0x6c, 0x64,
846  0x63, 0x61, 0x72, 0x64, 0x31, 0x15, 0x30, 0x13,
847  0x06, 0x03, 0x55, 0x04, 0x03, 0x14, 0x0c, 0x2a,
848  0x2e, 0x62, 0x61, 0x64, 0x73, 0x73, 0x6c, 0x2e,
849  0x63, 0x6f, 0x6d, 0x30, 0x82, 0x01, 0x22, 0x30,
850  0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7,
851  0x0d, 0x01, 0x01, 0x01, 0x05, 0x00, 0x03, 0x82,
852  0x01, 0x0f, 0x00, 0x30, 0x82, 0x01, 0x0a, 0x02,
853  0x82, 0x01, 0x01, 0x00, 0xc2, 0x04, 0xec, 0xf8,
854  0x8c, 0xee, 0x04, 0xc2, 0xb3, 0xd8, 0x50, 0xd5,
855  0x70, 0x58, 0xcc, 0x93, 0x18, 0xeb, 0x5c, 0xa8,
856  0x68, 0x49, 0xb0, 0x22, 0xb5, 0xf9, 0x95, 0x9e,
857  0xb1, 0x2b, 0x2c, 0x76, 0x3e, 0x6c, 0xc0, 0x4b,
858  0x60, 0x4c, 0x4c, 0xea, 0xb2, 0xb4, 0xc0, 0x0f,
859  0x80, 0xb6, 0xb0, 0xf9, 0x72, 0xc9, 0x86, 0x02,
860  0xf9, 0x5c, 0x41, 0x5d, 0x13, 0x2b, 0x7f, 0x71,
861  0xc4, 0x4b, 0xbc, 0xe9, 0x94, 0x2e, 0x50, 0x37,
862  0xa6, 0x67, 0x1c, 0x61, 0x8c, 0xf6, 0x41, 0x42,
863  0xc5, 0x46, 0xd3, 0x16, 0x87, 0x27, 0x9f, 0x74,
864  0xeb, 0x0a, 0x9d, 0x11, 0x52, 0x26, 0x21, 0x73,
865  0x6c, 0x84, 0x4c, 0x79, 0x55, 0xe4, 0xd1, 0x6b,
866  0xe8, 0x06, 0x3d, 0x48, 0x15, 0x52, 0xad, 0xb3,
867  0x28, 0xdb, 0xaa, 0xff, 0x6e, 0xff, 0x60, 0x95,
868  0x4a, 0x77, 0x6b, 0x39, 0xf1, 0x24, 0xd1, 0x31,
869  0xb6, 0xdd, 0x4d, 0xc0, 0xc4, 0xfc, 0x53, 0xb9,
870  0x6d, 0x42, 0xad, 0xb5, 0x7c, 0xfe, 0xae, 0xf5,
871  0x15, 0xd2, 0x33, 0x48, 0xe7, 0x22, 0x71, 0xc7,
872  0xc2, 0x14, 0x7a, 0x6c, 0x28, 0xea, 0x37, 0x4a,
873  0xdf, 0xea, 0x6c, 0xb5, 0x72, 0xb4, 0x7e, 0x5a,
874  0xa2, 0x16, 0xdc, 0x69, 0xb1, 0x57, 0x44, 0xdb,
875  0x0a, 0x12, 0xab, 0xde, 0xc3, 0x0f, 0x47, 0x74,
876  0x5c, 0x41, 0x22, 0xe1, 0x9a, 0xf9, 0x1b, 0x93,
877  0xe6, 0xad, 0x22, 0x06, 0x29, 0x2e, 0xb1, 0xba,
878  0x49, 0x1c, 0x0c, 0x27, 0x9e, 0xa3, 0xfb, 0x8b,
879  0xf7, 0x40, 0x72, 0x00, 0xac, 0x92, 0x08, 0xd9,
880  0x8c, 0x57, 0x84, 0x53, 0x81, 0x05, 0xcb, 0xe6,
881  0xfe, 0x6b, 0x54, 0x98, 0x40, 0x27, 0x85, 0xc7,
882  0x10, 0xbb, 0x73, 0x70, 0xef, 0x69, 0x18, 0x41,
883  0x07, 0x45, 0x55, 0x7c, 0xf9, 0x64, 0x3f, 0x3d,
884  0x2c, 0xc3, 0xa9, 0x7c, 0xeb, 0x93, 0x1a, 0x4c,
885  0x86, 0xd1, 0xca, 0x85, 0x02, 0x03, 0x01, 0x00,
886  0x01, 0xa3, 0x82, 0x01, 0xd5, 0x30, 0x82, 0x01,
887  0xd1, 0x30, 0x1f, 0x06, 0x03, 0x55, 0x1d, 0x23,
888  0x04, 0x18, 0x30, 0x16, 0x80, 0x14, 0x90, 0xaf,
889  0x6a, 0x3a, 0x94, 0x5a, 0x0b, 0xd8, 0x90, 0xea,
890  0x12, 0x56, 0x73, 0xdf, 0x43, 0xb4, 0x3a, 0x28,
891  0xda, 0xe7, 0x30, 0x1d, 0x06, 0x03, 0x55, 0x1d,
892  0x0e, 0x04, 0x16, 0x04, 0x14, 0x9d, 0xee, 0xc1,
893  0x7b, 0x81, 0x0b, 0x3a, 0x47, 0x69, 0x71, 0x18,
894  0x7d, 0x11, 0x37, 0x93, 0xbc, 0xa5, 0x1b, 0x3f,
895  0xfb, 0x30, 0x0e, 0x06, 0x03, 0x55, 0x1d, 0x0f,
896  0x01, 0x01, 0xff, 0x04, 0x04, 0x03, 0x02, 0x05,
897  0xa0, 0x30, 0x0c, 0x06, 0x03, 0x55, 0x1d, 0x13,
898  0x01, 0x01, 0xff, 0x04, 0x02, 0x30, 0x00, 0x30,
899  0x1d, 0x06, 0x03, 0x55, 0x1d, 0x25, 0x04, 0x16,
900  0x30, 0x14, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05,
901  0x05, 0x07, 0x03, 0x01, 0x06, 0x08, 0x2b, 0x06,
902  0x01, 0x05, 0x05, 0x07, 0x03, 0x02, 0x30, 0x4f,
903  0x06, 0x03, 0x55, 0x1d, 0x20, 0x04, 0x48, 0x30,
904  0x46, 0x30, 0x3a, 0x06, 0x0b, 0x2b, 0x06, 0x01,
905  0x04, 0x01, 0xb2, 0x31, 0x01, 0x02, 0x02, 0x07,
906  0x30, 0x2b, 0x30, 0x29, 0x06, 0x08, 0x2b, 0x06,
907  0x01, 0x05, 0x05, 0x07, 0x02, 0x01, 0x16, 0x1d,
908  0x68, 0x74, 0x74, 0x70, 0x73, 0x3a, 0x2f, 0x2f,
909  0x73, 0x65, 0x63, 0x75, 0x72, 0x65, 0x2e, 0x63,
910  0x6f, 0x6d, 0x6f, 0x64, 0x6f, 0x2e, 0x63, 0x6f,
911  0x6d, 0x2f, 0x43, 0x50, 0x53, 0x30, 0x08, 0x06,
912  0x06, 0x67, 0x81, 0x0c, 0x01, 0x02, 0x01, 0x30,
913  0x54, 0x06, 0x03, 0x55, 0x1d, 0x1f, 0x04, 0x4d,
914  0x30, 0x4b, 0x30, 0x49, 0xa0, 0x47, 0xa0, 0x45,
915  0x86, 0x43, 0x68, 0x74, 0x74, 0x70, 0x3a, 0x2f,
916  0x2f, 0x63, 0x72, 0x6c, 0x2e, 0x63, 0x6f, 0x6d,
917  0x6f, 0x64, 0x6f, 0x63, 0x61, 0x2e, 0x63, 0x6f,
918  0x6d, 0x2f, 0x43, 0x4f, 0x4d, 0x4f, 0x44, 0x4f,
919  0x52, 0x53, 0x41, 0x44, 0x6f, 0x6d, 0x61, 0x69,
920  0x6e, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74,
921  0x69, 0x6f, 0x6e, 0x53, 0x65, 0x63, 0x75, 0x72,
922  0x65, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x43,
923  0x41, 0x2e, 0x63, 0x72, 0x6c, 0x30, 0x81, 0x85,
924  0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07,
925  0x01, 0x01, 0x04, 0x79, 0x30, 0x77, 0x30, 0x4f,
926  0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07,
927  0x30, 0x02, 0x86, 0x43, 0x68, 0x74, 0x74, 0x70,
928  0x3a, 0x2f, 0x2f, 0x63, 0x72, 0x74, 0x2e, 0x63,
929  0x6f, 0x6d, 0x6f, 0x64, 0x6f, 0x63, 0x61, 0x2e,
930  0x63, 0x6f, 0x6d, 0x2f, 0x43, 0x4f, 0x4d, 0x4f,
931  0x44, 0x4f, 0x52, 0x53, 0x41, 0x44, 0x6f, 0x6d,
932  0x61, 0x69, 0x6e, 0x56, 0x61, 0x6c, 0x69, 0x64,
933  0x61, 0x74, 0x69, 0x6f, 0x6e, 0x53, 0x65, 0x63,
934  0x75, 0x72, 0x65, 0x53, 0x65, 0x72, 0x76, 0x65,
935  0x72, 0x43, 0x41, 0x2e, 0x63, 0x72, 0x74, 0x30,
936  0x24, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05,
937  0x07, 0x30, 0x01, 0x86, 0x18, 0x68, 0x74, 0x74,
938  0x70, 0x3a, 0x2f, 0x2f, 0x6f, 0x63, 0x73, 0x70,
939  0x2e, 0x63, 0x6f, 0x6d, 0x6f, 0x64, 0x6f, 0x63,
940  0x61, 0x2e, 0x63, 0x6f, 0x6d, 0x30, 0x23, 0x06,
941  0x03, 0x55, 0x1d, 0x11, 0x04, 0x1c, 0x30, 0x1a,
942  0x82, 0x0c, 0x2a, 0x2e, 0x62, 0x61, 0x64, 0x73,
943  0x73, 0x6c, 0x2e, 0x63, 0x6f, 0x6d, 0x82, 0x0a,
944  0x62, 0x61, 0x64, 0x73, 0x73, 0x6c, 0x2e, 0x63,
945  0x6f, 0x6d, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86,
946  0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0b, 0x05,
947  0x00, 0x03, 0x82, 0x01, 0x01, 0x00, 0x6a, 0x7a,
948  0xf1, 0xda, 0xff, 0x03, 0x07, 0x72, 0x78, 0xc5,
949  0x66, 0xa1, 0x4f, 0x46, 0x43, 0x0e, 0x5f, 0x14,
950  0x21, 0x8c, 0x75, 0x1a, 0xeb, 0x36, 0xe0, 0x1f,
951  0xa4, 0x10, 0x15, 0xec, 0xda, 0x33, 0x25, 0x7c,
952  0x3b, 0xb5, 0x0a, 0xc7, 0x01, 0x38, 0x3d, 0x27,
953  0xfd, 0x58, 0xd9, 0xcc, 0xea, 0x2d, 0x69, 0x39,
954  0x7c, 0xbe, 0x97, 0xef, 0x0b, 0xd6, 0x0b, 0x58,
955  0xe7, 0x8c, 0x7f, 0xbf, 0xb3, 0x4c, 0x1d, 0xf3,
956  0xb7, 0x90, 0x80, 0xa6, 0x36, 0x7c, 0x14, 0x5b,
957  0xec, 0x07, 0x2d, 0x02, 0x3e, 0x1b, 0x5b, 0x63,
958  0x5b, 0x15, 0xab, 0x00, 0xfa, 0x1f, 0x3b, 0x19,
959  0x2d, 0xdf, 0xe2, 0x23, 0x10, 0x11, 0x07, 0x7e,
960  0x72, 0x7f, 0xe2, 0xbf, 0xb7, 0x00, 0x1b, 0x98,
961  0x2f, 0x2c, 0x3f, 0xce, 0x85, 0x9a, 0x27, 0x8c,
962  0x10, 0x22, 0x08, 0x41, 0x2b, 0x8a, 0x3e, 0x82,
963  0x4e, 0xfc, 0xdd, 0x21, 0xc6, 0x56, 0x74, 0x70,
964  0xa4, 0x34, 0xf2, 0xb1, 0x40, 0x9e, 0x2b, 0x58,
965  0xa2, 0x59, 0x0f, 0x1d, 0x48, 0xef, 0xeb, 0x11,
966  0x3e, 0xc1, 0x4a, 0x9e, 0xbc, 0x65, 0x55, 0x6d,
967  0xc6, 0xa3, 0xef, 0xd5, 0xd4, 0x96, 0xcd, 0xf1,
968  0xae, 0x27, 0xf7, 0xa4, 0x57, 0x14, 0x3c, 0x94,
969  0x41, 0x05, 0x7a, 0x8b, 0xa1, 0x37, 0x47, 0xd7,
970  0xf5, 0x7d, 0xdc, 0xfa, 0xce, 0x6f, 0x31, 0xa2,
971  0xb0, 0x8c, 0xea, 0xcc, 0x12, 0x9b, 0x22, 0xf1,
972  0x34, 0x70, 0xcf, 0x7d, 0x75, 0x4a, 0x8b, 0x68,
973  0x29, 0x0c, 0x1e, 0xe9, 0x96, 0xa8, 0xcf, 0xb0,
974  0x12, 0x1f, 0x5c, 0x2a, 0xee, 0x67, 0x2f, 0x7f,
975  0xbd, 0x73, 0xf3, 0x5a, 0x01, 0x22, 0x0c, 0x70,
976  0xfa, 0xcd, 0x45, 0xef, 0x78, 0x5c, 0xce, 0x0d,
977  0xfa, 0x4e, 0xe1, 0xef, 0xce, 0x65, 0x9f, 0x47,
978  0x0c, 0x4f, 0xbb, 0x36, 0x44, 0x68, 0x56, 0x5c,
979  0x56, 0x59, 0xad, 0xaa, 0x8a, 0xbc,
980  };
981 
982  Flow f;
983  SSLState *ssl_state = NULL;
984  TcpSession ssn;
985  Packet *p1 = NULL;
986  Packet *p2 = NULL;
987  Packet *p3 = NULL;
988  ThreadVars tv;
989  DetectEngineThreadCtx *det_ctx = NULL;
990  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
991 
992  memset(&tv, 0, sizeof(ThreadVars));
993  StatsThreadInit(&tv.stats);
994  memset(&f, 0, sizeof(Flow));
995  memset(&ssn, 0, sizeof(TcpSession));
996 
997  p1 = UTHBuildPacketReal(client_hello, sizeof(client_hello), IPPROTO_TCP,
998  "192.168.1.5", "192.168.1.1", 51251, 443);
999  p2 = UTHBuildPacketReal(server_hello, sizeof(server_hello), IPPROTO_TCP,
1000  "192.168.1.1", "192.168.1.5", 443, 51251);
1001  p3 = UTHBuildPacketReal(certificate, sizeof(certificate), IPPROTO_TCP,
1002  "192.168.1.1", "192.168.1.5", 443, 51251);
1003 
1004  FLOW_INITIALIZE(&f);
1005  f.flags |= FLOW_IPV4;
1006  f.proto = IPPROTO_TCP;
1007  f.protomap = FlowGetProtoMapping(f.proto);
1008  f.alproto = ALPROTO_TLS;
1009 
1010  p1->flow = &f;
1011  p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
1012  p1->flowflags |= FLOW_PKT_TOSERVER;
1013  p1->flowflags |= FLOW_PKT_ESTABLISHED;
1014  PcapPacketCntSet(p1, 1);
1015 
1016  p2->flow = &f;
1017  p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
1018  p2->flowflags |= FLOW_PKT_TOCLIENT;
1019  p2->flowflags |= FLOW_PKT_ESTABLISHED;
1020  PcapPacketCntSet(p2, 2);
1021 
1022  p3->flow = &f;
1023  p3->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
1024  p3->flowflags |= FLOW_PKT_TOCLIENT;
1025  p3->flowflags |= FLOW_PKT_ESTABLISHED;
1026  PcapPacketCntSet(p3, 3);
1027 
1028  f.lastts = SCTIME_FROM_SECS(1474978656L); /* 2016-09-27 */
1029 
1030  StreamTcpInitConfig(true);
1031 
1032  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
1033  FAIL_IF_NULL(de_ctx);
1034 
1035  de_ctx->flags |= DE_QUIET;
1036 
1037  Signature *s = DetectEngineAppendSig(de_ctx, "alert tls any any -> any any "
1038  "(msg:\"Test tls_cert_expired\"; "
1039  "tls_cert_expired; sid:1;)");
1040  FAIL_IF_NULL(s);
1041 
1042  SigGroupBuild(de_ctx);
1043  DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
1044 
1045  int r = AppLayerParserParse(
1046  NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, client_hello, sizeof(client_hello));
1047  FAIL_IF(r != 0);
1048 
1049  ssl_state = f.alstate;
1050  FAIL_IF_NULL(ssl_state);
1051 
1052  SigMatchSignatures(&tv, de_ctx, det_ctx, p1);
1053  FAIL_IF(PacketAlertCheck(p1, 1));
1054 
1055  r = AppLayerParserParse(
1056  NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOCLIENT, server_hello, sizeof(server_hello));
1057  FAIL_IF(r != 0);
1058 
1059  SigMatchSignatures(&tv, de_ctx, det_ctx, p2);
1060  FAIL_IF(PacketAlertCheck(p2, 1));
1061 
1062  r = AppLayerParserParse(
1063  NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOCLIENT, certificate, sizeof(certificate));
1064  FAIL_IF(r != 0);
1065 
1066  SigMatchSignatures(&tv, de_ctx, det_ctx, p3);
1067  FAIL_IF_NOT(PacketAlertCheck(p3, 1));
1068 
1069  UTHFreePacket(p1);
1070  UTHFreePacket(p2);
1071  UTHFreePacket(p3);
1072  FLOW_DESTROY(&f);
1073 
1074  AppLayerParserThreadCtxFree(alp_tctx);
1075  DetectEngineThreadCtxDeinit(&tv, det_ctx);
1076  DetectEngineCtxFree(de_ctx);
1077  StreamTcpFreeConfig(true);
1078  StatsThreadCleanup(&tv.stats);
1079  PASS;
1080 }
1081 
1082 /**
1083  * \test Test matching on a valid TLS certificate.
1084  *
1085  * \retval 1 on success.
1086  * \retval 0 on failure.
1087  */
1088 static int ValidTestDetect01(void)
1089 {
1090  /* client hello */
1091  uint8_t client_hello[] = {
1092  0x16, 0x03, 0x01, 0x00, 0xc8, 0x01, 0x00, 0x00,
1093  0xc4, 0x03, 0x03, 0xd6, 0x08, 0x5a, 0xa2, 0x86,
1094  0x5b, 0x85, 0xd4, 0x40, 0xab, 0xbe, 0xc0, 0xbc,
1095  0x41, 0xf2, 0x26, 0xf0, 0xfe, 0x21, 0xee, 0x8b,
1096  0x4c, 0x7e, 0x07, 0xc8, 0xec, 0xd2, 0x00, 0x46,
1097  0x4c, 0xeb, 0xb7, 0x00, 0x00, 0x16, 0xc0, 0x2b,
1098  0xc0, 0x2f, 0xc0, 0x0a, 0xc0, 0x09, 0xc0, 0x13,
1099  0xc0, 0x14, 0x00, 0x33, 0x00, 0x39, 0x00, 0x2f,
1100  0x00, 0x35, 0x00, 0x0a, 0x01, 0x00, 0x00, 0x85,
1101  0x00, 0x00, 0x00, 0x12, 0x00, 0x10, 0x00, 0x00,
1102  0x0d, 0x77, 0x77, 0x77, 0x2e, 0x67, 0x6f, 0x6f,
1103  0x67, 0x6c, 0x65, 0x2e, 0x6e, 0x6f, 0xff, 0x01,
1104  0x00, 0x01, 0x00, 0x00, 0x0a, 0x00, 0x08, 0x00,
1105  0x06, 0x00, 0x17, 0x00, 0x18, 0x00, 0x19, 0x00,
1106  0x0b, 0x00, 0x02, 0x01, 0x00, 0x00, 0x23, 0x00,
1107  0x00, 0x33, 0x74, 0x00, 0x00, 0x00, 0x10, 0x00,
1108  0x29, 0x00, 0x27, 0x05, 0x68, 0x32, 0x2d, 0x31,
1109  0x36, 0x05, 0x68, 0x32, 0x2d, 0x31, 0x35, 0x05,
1110  0x68, 0x32, 0x2d, 0x31, 0x34, 0x02, 0x68, 0x32,
1111  0x08, 0x73, 0x70, 0x64, 0x79, 0x2f, 0x33, 0x2e,
1112  0x31, 0x08, 0x68, 0x74, 0x74, 0x70, 0x2f, 0x31,
1113  0x2e, 0x31, 0x00, 0x05, 0x00, 0x05, 0x01, 0x00,
1114  0x00, 0x00, 0x00, 0x00, 0x0d, 0x00, 0x16, 0x00,
1115  0x14, 0x04, 0x01, 0x05, 0x01, 0x06, 0x01, 0x02,
1116  0x01, 0x04, 0x03, 0x05, 0x03, 0x06, 0x03, 0x02,
1117  0x03, 0x04, 0x02, 0x02, 0x02
1118  };
1119 
1120  /* server hello */
1121  uint8_t server_hello[] = {
1122  0x16, 0x03, 0x03, 0x00, 0x48, 0x02, 0x00, 0x00,
1123  0x44, 0x03, 0x03, 0x57, 0x91, 0xb8, 0x63, 0xdd,
1124  0xdb, 0xbb, 0x23, 0xcf, 0x0b, 0x43, 0x02, 0x1d,
1125  0x46, 0x11, 0x27, 0x5c, 0x98, 0xcf, 0x67, 0xe1,
1126  0x94, 0x3d, 0x62, 0x7d, 0x38, 0x48, 0x21, 0x23,
1127  0xa5, 0x62, 0x31, 0x00, 0xc0, 0x2f, 0x00, 0x00,
1128  0x1c, 0xff, 0x01, 0x00, 0x01, 0x00, 0x00, 0x00,
1129  0x00, 0x00, 0x00, 0x23, 0x00, 0x00, 0x00, 0x10,
1130  0x00, 0x05, 0x00, 0x03, 0x02, 0x68, 0x32, 0x00,
1131  0x0b, 0x00, 0x02, 0x01, 0x00
1132  };
1133 
1134  /* certificate */
1135  uint8_t certificate[] = {
1136  0x16, 0x03, 0x03, 0x04, 0x93, 0x0b, 0x00, 0x04,
1137  0x8f, 0x00, 0x04, 0x8c, 0x00, 0x04, 0x89, 0x30,
1138  0x82, 0x04, 0x85, 0x30, 0x82, 0x03, 0x6d, 0xa0,
1139  0x03, 0x02, 0x01, 0x02, 0x02, 0x08, 0x5c, 0x19,
1140  0xb7, 0xb1, 0x32, 0x3b, 0x1c, 0xa1, 0x30, 0x0d,
1141  0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d,
1142  0x01, 0x01, 0x0b, 0x05, 0x00, 0x30, 0x49, 0x31,
1143  0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06,
1144  0x13, 0x02, 0x55, 0x53, 0x31, 0x13, 0x30, 0x11,
1145  0x06, 0x03, 0x55, 0x04, 0x0a, 0x13, 0x0a, 0x47,
1146  0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x20, 0x49, 0x6e,
1147  0x63, 0x31, 0x25, 0x30, 0x23, 0x06, 0x03, 0x55,
1148  0x04, 0x03, 0x13, 0x1c, 0x47, 0x6f, 0x6f, 0x67,
1149  0x6c, 0x65, 0x20, 0x49, 0x6e, 0x74, 0x65, 0x72,
1150  0x6e, 0x65, 0x74, 0x20, 0x41, 0x75, 0x74, 0x68,
1151  0x6f, 0x72, 0x69, 0x74, 0x79, 0x20, 0x47, 0x32,
1152  0x30, 0x1e, 0x17, 0x0d, 0x31, 0x36, 0x30, 0x37,
1153  0x31, 0x33, 0x31, 0x33, 0x32, 0x34, 0x35, 0x32,
1154  0x5a, 0x17, 0x0d, 0x31, 0x36, 0x31, 0x30, 0x30,
1155  0x35, 0x31, 0x33, 0x31, 0x36, 0x30, 0x30, 0x5a,
1156  0x30, 0x65, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03,
1157  0x55, 0x04, 0x06, 0x13, 0x02, 0x55, 0x53, 0x31,
1158  0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x08,
1159  0x0c, 0x0a, 0x43, 0x61, 0x6c, 0x69, 0x66, 0x6f,
1160  0x72, 0x6e, 0x69, 0x61, 0x31, 0x16, 0x30, 0x14,
1161  0x06, 0x03, 0x55, 0x04, 0x07, 0x0c, 0x0d, 0x4d,
1162  0x6f, 0x75, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x20,
1163  0x56, 0x69, 0x65, 0x77, 0x31, 0x13, 0x30, 0x11,
1164  0x06, 0x03, 0x55, 0x04, 0x0a, 0x0c, 0x0a, 0x47,
1165  0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x20, 0x49, 0x6e,
1166  0x63, 0x31, 0x14, 0x30, 0x12, 0x06, 0x03, 0x55,
1167  0x04, 0x03, 0x0c, 0x0b, 0x2a, 0x2e, 0x67, 0x6f,
1168  0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x6e, 0x6f, 0x30,
1169  0x82, 0x01, 0x22, 0x30, 0x0d, 0x06, 0x09, 0x2a,
1170  0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01,
1171  0x05, 0x00, 0x03, 0x82, 0x01, 0x0f, 0x00, 0x30,
1172  0x82, 0x01, 0x0a, 0x02, 0x82, 0x01, 0x01, 0x00,
1173  0xa5, 0x0a, 0xb9, 0xb1, 0xca, 0x36, 0xd1, 0xae,
1174  0x22, 0x38, 0x07, 0x06, 0xc9, 0x1a, 0x56, 0x4f,
1175  0xbb, 0xdf, 0xa8, 0x6d, 0xbd, 0xee, 0x76, 0x16,
1176  0xbc, 0x53, 0x3c, 0x03, 0x6a, 0x5c, 0x94, 0x50,
1177  0x87, 0x2f, 0x28, 0xb4, 0x4e, 0xd5, 0x9b, 0x8f,
1178  0xfe, 0x02, 0xde, 0x2a, 0x83, 0x01, 0xf9, 0x45,
1179  0x61, 0x0e, 0x66, 0x0e, 0x24, 0x22, 0xe2, 0x59,
1180  0x66, 0x0d, 0xd3, 0xe9, 0x77, 0x8a, 0x7e, 0x42,
1181  0xaa, 0x5a, 0xf9, 0x05, 0xbf, 0x30, 0xc7, 0x03,
1182  0x2b, 0xdc, 0xa6, 0x9c, 0xe0, 0x9f, 0x0d, 0xf1,
1183  0x28, 0x19, 0xf8, 0xf2, 0x02, 0xfa, 0xbd, 0x62,
1184  0xa0, 0xf3, 0x02, 0x2b, 0xcd, 0xf7, 0x09, 0x04,
1185  0x3b, 0x52, 0xd8, 0x65, 0x4b, 0x4a, 0x70, 0xe4,
1186  0x57, 0xc9, 0x2e, 0x2a, 0xf6, 0x9c, 0x6e, 0xd8,
1187  0xde, 0x01, 0x52, 0xc9, 0x6f, 0xe9, 0xef, 0x82,
1188  0xbc, 0x0b, 0x95, 0xb2, 0xef, 0xcb, 0x91, 0xa6,
1189  0x0b, 0x2d, 0x14, 0xc6, 0x00, 0xa9, 0x33, 0x86,
1190  0x64, 0x00, 0xd4, 0x92, 0x19, 0x53, 0x3d, 0xfd,
1191  0xcd, 0xc6, 0x1a, 0xf2, 0x0e, 0x67, 0xc2, 0x1d,
1192  0x2c, 0xe0, 0xe8, 0x29, 0x97, 0x1c, 0xb6, 0xc4,
1193  0xb2, 0x02, 0x0c, 0x83, 0xb8, 0x60, 0x61, 0xf5,
1194  0x61, 0x2d, 0x73, 0x5e, 0x85, 0x4d, 0xbd, 0x0d,
1195  0xe7, 0x1a, 0x37, 0x56, 0x8d, 0xe5, 0x50, 0x0c,
1196  0xc9, 0x64, 0x4c, 0x11, 0xea, 0xf3, 0xcb, 0x26,
1197  0x34, 0xbd, 0x02, 0xf5, 0xc1, 0xfb, 0xa2, 0xec,
1198  0x27, 0xbb, 0x60, 0xbe, 0x0b, 0xf6, 0xe7, 0x3c,
1199  0x2d, 0xc9, 0xe7, 0xb0, 0x30, 0x28, 0x17, 0x3d,
1200  0x90, 0xf1, 0x63, 0x8e, 0x49, 0xf7, 0x15, 0x78,
1201  0x21, 0xcc, 0x45, 0xe6, 0x86, 0xb2, 0xd8, 0xb0,
1202  0x2e, 0x5a, 0xb0, 0x58, 0xd3, 0xb6, 0x11, 0x40,
1203  0xae, 0x81, 0x1f, 0x6b, 0x7a, 0xaf, 0x40, 0x50,
1204  0xf9, 0x2e, 0x81, 0x8b, 0xec, 0x26, 0x11, 0x3f,
1205  0x02, 0x03, 0x01, 0x00, 0x01, 0xa3, 0x82, 0x01,
1206  0x53, 0x30, 0x82, 0x01, 0x4f, 0x30, 0x1d, 0x06,
1207  0x03, 0x55, 0x1d, 0x25, 0x04, 0x16, 0x30, 0x14,
1208  0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07,
1209  0x03, 0x01, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05,
1210  0x05, 0x07, 0x03, 0x02, 0x30, 0x21, 0x06, 0x03,
1211  0x55, 0x1d, 0x11, 0x04, 0x1a, 0x30, 0x18, 0x82,
1212  0x0b, 0x2a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
1213  0x65, 0x2e, 0x6e, 0x6f, 0x82, 0x09, 0x67, 0x6f,
1214  0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x6e, 0x6f, 0x30,
1215  0x68, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05,
1216  0x07, 0x01, 0x01, 0x04, 0x5c, 0x30, 0x5a, 0x30,
1217  0x2b, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05,
1218  0x07, 0x30, 0x02, 0x86, 0x1f, 0x68, 0x74, 0x74,
1219  0x70, 0x3a, 0x2f, 0x2f, 0x70, 0x6b, 0x69, 0x2e,
1220  0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x63,
1221  0x6f, 0x6d, 0x2f, 0x47, 0x49, 0x41, 0x47, 0x32,
1222  0x2e, 0x63, 0x72, 0x74, 0x30, 0x2b, 0x06, 0x08,
1223  0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x30, 0x01,
1224  0x86, 0x1f, 0x68, 0x74, 0x74, 0x70, 0x3a, 0x2f,
1225  0x2f, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x73,
1226  0x31, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
1227  0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6f, 0x63, 0x73,
1228  0x70, 0x30, 0x1d, 0x06, 0x03, 0x55, 0x1d, 0x0e,
1229  0x04, 0x16, 0x04, 0x14, 0xc6, 0x53, 0x87, 0x42,
1230  0x2d, 0xc8, 0xee, 0x7a, 0x62, 0x1e, 0x83, 0xdb,
1231  0x0d, 0xe2, 0x32, 0xeb, 0x8b, 0xaf, 0x69, 0x40,
1232  0x30, 0x0c, 0x06, 0x03, 0x55, 0x1d, 0x13, 0x01,
1233  0x01, 0xff, 0x04, 0x02, 0x30, 0x00, 0x30, 0x1f,
1234  0x06, 0x03, 0x55, 0x1d, 0x23, 0x04, 0x18, 0x30,
1235  0x16, 0x80, 0x14, 0x4a, 0xdd, 0x06, 0x16, 0x1b,
1236  0xbc, 0xf6, 0x68, 0xb5, 0x76, 0xf5, 0x81, 0xb6,
1237  0xbb, 0x62, 0x1a, 0xba, 0x5a, 0x81, 0x2f, 0x30,
1238  0x21, 0x06, 0x03, 0x55, 0x1d, 0x20, 0x04, 0x1a,
1239  0x30, 0x18, 0x30, 0x0c, 0x06, 0x0a, 0x2b, 0x06,
1240  0x01, 0x04, 0x01, 0xd6, 0x79, 0x02, 0x05, 0x01,
1241  0x30, 0x08, 0x06, 0x06, 0x67, 0x81, 0x0c, 0x01,
1242  0x02, 0x02, 0x30, 0x30, 0x06, 0x03, 0x55, 0x1d,
1243  0x1f, 0x04, 0x29, 0x30, 0x27, 0x30, 0x25, 0xa0,
1244  0x23, 0xa0, 0x21, 0x86, 0x1f, 0x68, 0x74, 0x74,
1245  0x70, 0x3a, 0x2f, 0x2f, 0x70, 0x6b, 0x69, 0x2e,
1246  0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x63,
1247  0x6f, 0x6d, 0x2f, 0x47, 0x49, 0x41, 0x47, 0x32,
1248  0x2e, 0x63, 0x72, 0x6c, 0x30, 0x0d, 0x06, 0x09,
1249  0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01,
1250  0x0b, 0x05, 0x00, 0x03, 0x82, 0x01, 0x01, 0x00,
1251  0x7b, 0x27, 0x00, 0x46, 0x8f, 0xfd, 0x5b, 0xff,
1252  0xcb, 0x05, 0x9b, 0xf7, 0xf1, 0x68, 0xf6, 0x9a,
1253  0x7b, 0xba, 0x53, 0xdf, 0x63, 0xed, 0x11, 0x94,
1254  0x39, 0xf2, 0xd0, 0x20, 0xcd, 0xa3, 0xc4, 0x98,
1255  0xa5, 0x10, 0x74, 0xe7, 0x10, 0x6d, 0x07, 0xf8,
1256  0x33, 0x87, 0x05, 0x43, 0x0e, 0x64, 0x77, 0x09,
1257  0x18, 0x4f, 0x38, 0x2e, 0x45, 0xae, 0xa8, 0x34,
1258  0x3a, 0xa8, 0x33, 0xac, 0x9d, 0xdd, 0x25, 0x91,
1259  0x59, 0x43, 0xbe, 0x0f, 0x87, 0x16, 0x2f, 0xb5,
1260  0x27, 0xfd, 0xce, 0x2f, 0x35, 0x5d, 0x12, 0xa1,
1261  0x66, 0xac, 0xf7, 0x95, 0x38, 0x0f, 0xe5, 0xb1,
1262  0x18, 0x18, 0xe6, 0x80, 0x52, 0x31, 0x8a, 0x66,
1263  0x02, 0x52, 0x1a, 0xa4, 0x32, 0x6a, 0x61, 0x05,
1264  0xcf, 0x1d, 0xf9, 0x90, 0x73, 0xf0, 0xeb, 0x20,
1265  0x31, 0x7b, 0x2e, 0xc0, 0xb0, 0xfb, 0x5c, 0xcc,
1266  0xdc, 0x76, 0x55, 0x72, 0xaf, 0xb1, 0x05, 0xf4,
1267  0xad, 0xf9, 0xd7, 0x73, 0x5c, 0x2c, 0xbf, 0x0d,
1268  0x84, 0x18, 0x01, 0x1d, 0x4d, 0x08, 0xa9, 0x4e,
1269  0x37, 0xb7, 0x58, 0xc4, 0x05, 0x0e, 0x65, 0x63,
1270  0xd2, 0x88, 0x02, 0xf5, 0x82, 0x17, 0x08, 0xd5,
1271  0x8f, 0x80, 0xc7, 0x82, 0x29, 0xbb, 0xe1, 0x04,
1272  0xbe, 0xf6, 0xe1, 0x8c, 0xbc, 0x3a, 0xf8, 0xf9,
1273  0x56, 0xda, 0xdc, 0x8e, 0xc6, 0xe6, 0x63, 0x98,
1274  0x12, 0x08, 0x41, 0x2c, 0x9d, 0x7c, 0x82, 0x0d,
1275  0x1e, 0xea, 0xba, 0xde, 0x32, 0x09, 0xda, 0x52,
1276  0x24, 0x4f, 0xcc, 0xb6, 0x09, 0x33, 0x8b, 0x00,
1277  0xf9, 0x83, 0xb3, 0xc6, 0xa4, 0x90, 0x49, 0x83,
1278  0x2d, 0x36, 0xd9, 0x11, 0x78, 0xd0, 0x62, 0x9f,
1279  0xc4, 0x8f, 0x84, 0xba, 0x7f, 0xaa, 0x04, 0xf1,
1280  0xd9, 0xa4, 0xad, 0x5d, 0x63, 0xee, 0x72, 0xc6,
1281  0x4d, 0xd1, 0x4b, 0x41, 0x8f, 0x40, 0x0f, 0x7d,
1282  0xcd, 0xb8, 0x2e, 0x5b, 0x6e, 0x21, 0xc9, 0x3d
1283  };
1284 
1285  Flow f;
1286  SSLState *ssl_state = NULL;
1287  TcpSession ssn;
1288  Packet *p1 = NULL;
1289  Packet *p2 = NULL;
1290  Packet *p3 = NULL;
1291  ThreadVars tv;
1292  DetectEngineThreadCtx *det_ctx = NULL;
1293  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
1294 
1295  memset(&tv, 0, sizeof(ThreadVars));
1296  StatsThreadInit(&tv.stats);
1297  memset(&f, 0, sizeof(Flow));
1298  memset(&ssn, 0, sizeof(TcpSession));
1299 
1300  p1 = UTHBuildPacketReal(client_hello, sizeof(client_hello), IPPROTO_TCP,
1301  "192.168.1.5", "192.168.1.1", 51251, 443);
1302  p2 = UTHBuildPacketReal(server_hello, sizeof(server_hello), IPPROTO_TCP,
1303  "192.168.1.1", "192.168.1.5", 443, 51251);
1304  p3 = UTHBuildPacketReal(certificate, sizeof(certificate), IPPROTO_TCP,
1305  "192.168.1.1", "192.168.1.5", 443, 51251);
1306 
1307  FLOW_INITIALIZE(&f);
1308  f.flags |= FLOW_IPV4;
1309  f.proto = IPPROTO_TCP;
1310  f.protomap = FlowGetProtoMapping(f.proto);
1311  f.alproto = ALPROTO_TLS;
1312 
1313  p1->flow = &f;
1314  p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
1315  p1->flowflags |= FLOW_PKT_TOSERVER;
1316  p1->flowflags |= FLOW_PKT_ESTABLISHED;
1317  PcapPacketCntSet(p1, 1);
1318 
1319  p2->flow = &f;
1320  p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
1321  p2->flowflags |= FLOW_PKT_TOCLIENT;
1322  p2->flowflags |= FLOW_PKT_ESTABLISHED;
1323  PcapPacketCntSet(p2, 2);
1324 
1325  p3->flow = &f;
1326  p3->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
1327  p3->flowflags |= FLOW_PKT_TOCLIENT;
1328  p3->flowflags |= FLOW_PKT_ESTABLISHED;
1329  PcapPacketCntSet(p3, 3);
1330 
1331  f.lastts = SCTIME_FROM_SECS(1474978656L); /* 2016-09-27 */
1332 
1333  StreamTcpInitConfig(true);
1334 
1335  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
1336  FAIL_IF_NULL(de_ctx);
1337 
1338  de_ctx->flags |= DE_QUIET;
1339 
1340  Signature *s = DetectEngineAppendSig(de_ctx, "alert tls any any -> any any "
1341  "(msg:\"Test tls_cert_valid\"; "
1342  "tls_cert_valid; sid:1;)");
1343  FAIL_IF_NULL(s);
1344 
1345  SigGroupBuild(de_ctx);
1346  DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
1347 
1348  int r = AppLayerParserParse(
1349  NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, client_hello, sizeof(client_hello));
1350  FAIL_IF(r != 0);
1351 
1352  ssl_state = f.alstate;
1353  FAIL_IF_NULL(ssl_state);
1354 
1355  SigMatchSignatures(&tv, de_ctx, det_ctx, p1);
1356  FAIL_IF(PacketAlertCheck(p1, 1));
1357 
1358  r = AppLayerParserParse(
1359  NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOCLIENT, server_hello, sizeof(server_hello));
1360  FAIL_IF(r != 0);
1361 
1362  SigMatchSignatures(&tv, de_ctx, det_ctx, p2);
1363  FAIL_IF(PacketAlertCheck(p2, 1));
1364 
1365  r = AppLayerParserParse(
1366  NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOCLIENT, certificate, sizeof(certificate));
1367  FAIL_IF(r != 0);
1368 
1369  SigMatchSignatures(&tv, de_ctx, det_ctx, p3);
1370  FAIL_IF_NOT(PacketAlertCheck(p3, 1));
1371 
1372  UTHFreePacket(p1);
1373  UTHFreePacket(p2);
1374  UTHFreePacket(p3);
1375  FLOW_DESTROY(&f);
1376 
1377  AppLayerParserThreadCtxFree(alp_tctx);
1378  DetectEngineThreadCtxDeinit(&tv, det_ctx);
1379  DetectEngineCtxFree(de_ctx);
1380  StreamTcpFreeConfig(true);
1381  StatsThreadCleanup(&tv.stats);
1382  PASS;
1383 }
1384 
1385 /**
1386  * \brief Register unit tests for tls_cert_notbefore.
1387  */
1388 void TlsNotBeforeRegisterTests(void)
1389 {
1390  UtRegisterTest("ValidityTestParse01", ValidityTestParse01);
1391  UtRegisterTest("ValidityTestParse03", ValidityTestParse03);
1392  UtRegisterTest("ValidityTestParse05", ValidityTestParse05);
1393  UtRegisterTest("ValidityTestParse07", ValidityTestParse07);
1394  UtRegisterTest("ValidityTestParse09", ValidityTestParse09);
1395  UtRegisterTest("ValidityTestParse11", ValidityTestParse11);
1396  UtRegisterTest("ValidityTestParse13", ValidityTestParse13);
1397  UtRegisterTest("ValidityTestParse15", ValidityTestParse15);
1398  UtRegisterTest("ValidityTestParse17", ValidityTestParse17);
1399  UtRegisterTest("ValidityTestParse19", ValidityTestParse19);
1400  UtRegisterTest("ValidityTestParse21", ValidityTestParse21);
1401  UtRegisterTest("ValidityTestParse23", ValidityTestParse23);
1402  UtRegisterTest("ValidityTestParse24", ValidityTestParse24);
1403  UtRegisterTest("ValidityTestParse25", ValidityTestParse25);
1404  UtRegisterTest("ValidityTestParse26", ValidityTestParse26);
1405  UtRegisterTest("ValidityTestParse27", ValidityTestParse27);
1406  UtRegisterTest("ValidityTestDetect01", ValidityTestDetect01);
1407 }
1408 
1409 /**
1410  * \brief Register unit tests for tls_cert_notafter.
1411  */
1412 void TlsNotAfterRegisterTests(void)
1413 {
1414  UtRegisterTest("ValidityTestParse02", ValidityTestParse02);
1415  UtRegisterTest("ValidityTestParse04", ValidityTestParse04);
1416  UtRegisterTest("ValidityTestParse06", ValidityTestParse06);
1417  UtRegisterTest("ValidityTestParse08", ValidityTestParse08);
1418  UtRegisterTest("ValidityTestParse10", ValidityTestParse10);
1419  UtRegisterTest("ValidityTestParse12", ValidityTestParse12);
1420  UtRegisterTest("ValidityTestParse14", ValidityTestParse14);
1421  UtRegisterTest("ValidityTestParse16", ValidityTestParse16);
1422  UtRegisterTest("ValidityTestParse18", ValidityTestParse18);
1423  UtRegisterTest("ValidityTestParse20", ValidityTestParse20);
1424  UtRegisterTest("ValidityTestParse22", ValidityTestParse22);
1425 }
1426 
1427 /**
1428  * \brief Register unit tests for tls_cert_expired
1429  */
1430 void TlsExpiredRegisterTests(void)
1431 {
1432  UtRegisterTest("ExpiredTestDetect01", ExpiredTestDetect01);
1433 }
1434 
1435 /**
1436  * \brief Register unit tests for tls_cert_valid
1437  */
1438 void TlsValidRegisterTests(void)
1439 {
1440  UtRegisterTest("ValidTestDetect01", ValidTestDetect01);
1441 }
SSLState_
SSLv[2.0|3.[0|1|2|3]] state structure.
Definition: app-layer-ssl.h:236
FAIL_IF_NULL
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
Definition: util-unittest.h:89
PKT_HAS_FLOW
#define PKT_HAS_FLOW
Definition: decode.h:1267
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
ALPROTO_TLS
@ ALPROTO_TLS
Definition: app-layer-protos.h:39
DETECT_TLS_VALIDITY_EQ
#define DETECT_TLS_VALIDITY_EQ
Definition: detect-tls-cert-validity.h:27
TlsNotBeforeRegisterTests
void TlsNotBeforeRegisterTests(void)
Register unit tests for tls_cert_notbefore.
Definition: detect-tls-cert-validity.c:1388
Flow_::proto
uint8_t proto
Definition: flow.h:369
TlsNotAfterRegisterTests
void TlsNotAfterRegisterTests(void)
Register unit tests for tls_cert_notafter.
Definition: detect-tls-cert-validity.c:1412
PacketAlertCheck
int PacketAlertCheck(Packet *p, uint32_t sid)
Check if a certain sid alerted, this is used in the test functions.
Definition: detect-engine-alert.c:142
Packet_::flags
uint32_t flags
Definition: decode.h:544
Flow_
Flow data structure.
Definition: flow.h:347
Flow_::protomap
uint8_t protomap
Definition: flow.h:436
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:933
DetectEngineCtxFree
void DetectEngineCtxFree(DetectEngineCtx *)
Free a DetectEngineCtx::
Definition: detect-engine.c:2684
PcapPacketCntSet
void PcapPacketCntSet(Packet *p, uint64_t pcap_cnt)
Definition: decode.c:1112
DETECT_TLS_VALIDITY_RA
#define DETECT_TLS_VALIDITY_RA
Definition: detect-tls-cert-validity.h:30
AppLayerParserThreadCtxFree
void AppLayerParserThreadCtxFree(AppLayerParserThreadCtx *tctx)
Destroys the app layer parser thread context obtained using AppLayerParserThreadCtxAlloc().
Definition: app-layer-parser.c:324
FLOW_PKT_TOSERVER
#define FLOW_PKT_TOSERVER
Definition: flow.h:224
DE_QUIET
#define DE_QUIET
Definition: detect.h:329
SigMatchSignatures
void SigMatchSignatures(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p)
wrapper for old tests
Definition: detect.c:2420
DetectEngineAppendSig
Signature * DetectEngineAppendSig(DetectEngineCtx *, const char *)
Parse and append a Signature into the Detection Engine Context signature list.
Definition: detect-parse.c:3446
Packet_::flowflags
uint8_t flowflags
Definition: decode.h:532
UTHBuildPacketReal
Packet * UTHBuildPacketReal(uint8_t *payload, uint16_t payload_len, uint8_t ipproto, const char *src, const char *dst, uint16_t sport, uint16_t dport)
UTHBuildPacketReal is a function that create tcp/udp packets for unittests specifying ip and port sou...
Definition: util-unittest-helper.c:260
FLOW_IPV4
#define FLOW_IPV4
Definition: flow.h:99
FAIL_IF_NOT
#define FAIL_IF_NOT(expr)
Fail a test if expression evaluates to false.
Definition: util-unittest.h:82
SCTIME_FROM_SECS
#define SCTIME_FROM_SECS(s)
Definition: util-time.h:69
StreamTcpInitConfig
void StreamTcpInitConfig(bool)
To initialize the stream global configuration data.
Definition: stream-tcp.c:496
FLOW_INITIALIZE
#define FLOW_INITIALIZE(f)
Definition: flow-util.h:38
FAIL_IF_NOT_NULL
#define FAIL_IF_NOT_NULL(expr)
Fail a test if expression evaluates to non-NULL.
Definition: util-unittest.h:96
PASS
#define PASS
Pass the test.
Definition: util-unittest.h:105
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:19
DetectEngineThreadCtx_
Definition: detect.h:1245
Flow_::lastts
SCTime_t lastts
Definition: flow.h:401
alp_tctx
AppLayerParserThreadCtx * alp_tctx
Definition: fuzz_applayerparserparse.c:24
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:58
DetectTlsValidityData_
Definition: detect-tls-cert-validity.h:41
DetectEngineThreadCtxInit
TmEcode DetectEngineThreadCtxInit(ThreadVars *tv, void *initdata, void **data)
initialize thread specific detection engine context
Definition: detect-engine.c:3414
DetectTlsValidityData_::mode
uint8_t mode
Definition: detect-tls-cert-validity.h:44
app-layer-parser.h
FlowGetProtoMapping
uint8_t FlowGetProtoMapping(uint8_t proto)
Function to map the protocol to the defined FLOW_PROTO_* enumeration.
Definition: flow-util.c:99
Packet_
Definition: decode.h:501
detect-engine-build.h
detect-engine-alert.h
FLOW_PKT_TOCLIENT
#define FLOW_PKT_TOCLIENT
Definition: flow.h:225
SigGroupBuild
int SigGroupBuild(DetectEngineCtx *de_ctx)
Convert the signature list into the runtime match structure.
Definition: detect-engine-build.c:2194
StatsThreadInit
void StatsThreadInit(StatsThreadContext *stats)
Definition: counters.c:1333
AppLayerParserThreadCtxAlloc
AppLayerParserThreadCtx * AppLayerParserThreadCtxAlloc(void)
Gets a new app layer protocol's parser thread context.
Definition: app-layer-parser.c:297
Packet_::flow
struct Flow_ * flow
Definition: decode.h:546
FAIL_IF
#define FAIL_IF(expr)
Fail a test if expression evaluates to true.
Definition: util-unittest.h:71
StreamTcpFreeConfig
void StreamTcpFreeConfig(bool quiet)
Definition: stream-tcp.c:867
DETECT_TLS_VALIDITY_LT
#define DETECT_TLS_VALIDITY_LT
Definition: detect-tls-cert-validity.h:28
AppLayerParserParse
int AppLayerParserParse(ThreadVars *tv, AppLayerParserThreadCtx *alp_tctx, Flow *f, AppProto alproto, uint8_t flags, const uint8_t *input, uint32_t input_len)
Definition: app-layer-parser.c:1284
DetectEngineThreadCtxDeinit
TmEcode DetectEngineThreadCtxDeinit(ThreadVars *tv, void *data)
Definition: detect-engine.c:3651
DetectTlsValidityData_::epoch2
time_t epoch2
Definition: detect-tls-cert-validity.h:43
DETECT_TLS_VALIDITY_GT
#define DETECT_TLS_VALIDITY_GT
Definition: detect-tls-cert-validity.h:29
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:33
UTHFreePacket
void UTHFreePacket(Packet *p)
UTHFreePacket: function to release the allocated data from UTHBuildPacket and the packet itself.
Definition: util-unittest-helper.c:473
Flow_::alstate
void * alstate
Definition: flow.h:470
TlsValidRegisterTests
void TlsValidRegisterTests(void)
Register unit tests for tls_cert_valid.
Definition: detect-tls-cert-validity.c:1438
Flow_::flags
uint32_t flags
Definition: flow.h:412
DetectTlsValidityData_::epoch
time_t epoch
Definition: detect-tls-cert-validity.h:42
Signature_
Signature container.
Definition: detect.h:668
FLOW_PKT_ESTABLISHED
#define FLOW_PKT_ESTABLISHED
Definition: flow.h:226
DetectEngineCtxInit
DetectEngineCtx * DetectEngineCtxInit(void)
Definition: detect-engine.c:2645
DetectEngineCtx_::flags
uint8_t flags
Definition: detect.h:935
AppLayerParserThreadCtx_
Definition: app-layer-parser.c:60
TcpSession_
Definition: stream-tcp-private.h:283
Flow_::alproto
AppProto alproto
application level protocol
Definition: flow.h:441
ThreadVars_::stats
StatsThreadContext stats
Definition: threadvars.h:121
StatsThreadCleanup
void StatsThreadCleanup(StatsThreadContext *stats)
Definition: counters.c:1429
FLOW_DESTROY
#define FLOW_DESTROY(f)
Definition: flow-util.h:119
TlsExpiredRegisterTests
void TlsExpiredRegisterTests(void)
Register unit tests for tls_cert_expired.
Definition: detect-tls-cert-validity.c:1430
PKT_STREAM_EST
#define PKT_STREAM_EST
Definition: decode.h:1263