suricata
detect-tls-cert-validity.c
Go to the documentation of this file.
1 /* Copyright (C) 2015-2019 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Mats Klepsland <mats.klepsland@gmail.com>
22  *
23  */
24 
25 #include "detect-engine-build.h"
26 #include "detect-engine-alert.h"
27 #include "app-layer-parser.h"
28 
29 /**
30  * \test This is a test for a valid value 1430000000.
31  *
32  * \retval 1 on success.
33  * \retval 0 on failure.
34  */
35 static int ValidityTestParse01 (void)
36 {
37  DetectTlsValidityData *dd = NULL;
38  dd = DetectTlsValidityParse("1430000000");
39  FAIL_IF_NULL(dd);
40  FAIL_IF_NOT(dd->epoch == 1430000000 && dd->mode == DETECT_TLS_VALIDITY_EQ);
41  DetectTlsValidityFree(NULL, dd);
42  PASS;
43 }
44 
45 /**
46  * \test This is a test for a valid value >1430000000.
47  *
48  * \retval 1 on success.
49  * \retval 0 on failure.
50  */
51 static int ValidityTestParse02 (void)
52 {
53  DetectTlsValidityData *dd = NULL;
54  dd = DetectTlsValidityParse(">1430000000");
55  FAIL_IF_NULL(dd);
56  FAIL_IF_NOT(dd->epoch == 1430000000 && dd->mode == DETECT_TLS_VALIDITY_GT);
57  DetectTlsValidityFree(NULL, dd);
58  PASS;
59 }
60 
61 /**
62  * \test This is a test for a valid value <1430000000.
63  *
64  * \retval 1 on success.
65  * \retval 0 on failure.
66  */
67 static int ValidityTestParse03 (void)
68 {
69  DetectTlsValidityData *dd = NULL;
70  dd = DetectTlsValidityParse("<1430000000");
71  FAIL_IF_NULL(dd);
72  FAIL_IF_NOT(dd->epoch == 1430000000 && dd->mode == DETECT_TLS_VALIDITY_LT);
73  DetectTlsValidityFree(NULL, dd);
74  PASS;
75 }
76 
77 /**
78  * \test This is a test for a valid value 1430000000<>1470000000.
79  *
80  * \retval 1 on success.
81  * \retval 0 on failure.
82  */
83 static int ValidityTestParse04 (void)
84 {
85  DetectTlsValidityData *dd = NULL;
86  dd = DetectTlsValidityParse("1430000000<>1470000000");
87  FAIL_IF_NULL(dd);
88  FAIL_IF_NOT(dd->epoch == 1430000000 && dd->epoch2 == 1470000000 &&
89  dd->mode == DETECT_TLS_VALIDITY_RA);
90  DetectTlsValidityFree(NULL, dd);
91  PASS;
92 }
93 
94 /**
95  * \test This is a test for a invalid value A.
96  *
97  * \retval 1 on success.
98  * \retval 0 on failure.
99  */
100 static int ValidityTestParse05 (void)
101 {
102  DetectTlsValidityData *dd = NULL;
103  dd = DetectTlsValidityParse("A");
104  FAIL_IF_NOT_NULL(dd);
105  PASS;
106 }
107 
108 /**
109  * \test This is a test for a invalid value >1430000000<>1470000000.
110  *
111  * \retval 1 on success.
112  * \retval 0 on failure.
113  */
114 static int ValidityTestParse06 (void)
115 {
116  DetectTlsValidityData *dd = NULL;
117  dd = DetectTlsValidityParse(">1430000000<>1470000000");
118  FAIL_IF_NOT_NULL(dd);
119  PASS;
120 }
121 
122 /**
123  * \test This is a test for a invalid value 1430000000<>.
124  *
125  * \retval 1 on success.
126  * \retval 0 on failure.
127  */
128 static int ValidityTestParse07 (void)
129 {
130  DetectTlsValidityData *dd = NULL;
131  dd = DetectTlsValidityParse("1430000000<>");
132  FAIL_IF_NOT_NULL(dd);
133  PASS;
134 }
135 
136 /**
137  * \test This is a test for a invalid value <>1430000000.
138  *
139  * \retval 1 on success.
140  * \retval 0 on failure.
141  */
142 static int ValidityTestParse08 (void)
143 {
144  DetectTlsValidityData *dd = NULL;
145  dd = DetectTlsValidityParse("<>1430000000");
146  FAIL_IF_NOT_NULL(dd);
147  PASS;
148 }
149 
150 /**
151  * \test This is a test for a invalid value "".
152  *
153  * \retval 1 on success.
154  * \retval 0 on failure.
155  */
156 static int ValidityTestParse09 (void)
157 {
158  DetectTlsValidityData *dd = NULL;
159  dd = DetectTlsValidityParse("");
160  FAIL_IF_NOT_NULL(dd);
161  PASS;
162 }
163 
164 /**
165  * \test This is a test for a invalid value " ".
166  *
167  * \retval 1 on success.
168  * \retval 0 on failure.
169  */
170 static int ValidityTestParse10 (void)
171 {
172  DetectTlsValidityData *dd = NULL;
173  dd = DetectTlsValidityParse(" ");
174  FAIL_IF_NOT_NULL(dd);
175  PASS;
176 }
177 
178 /**
179  * \test This is a test for a invalid value 1490000000<>1430000000.
180  *
181  * \retval 1 on success.
182  * \retval 0 on failure.
183  */
184 static int ValidityTestParse11 (void)
185 {
186  DetectTlsValidityData *dd = NULL;
187  dd = DetectTlsValidityParse("1490000000<>1430000000");
188  FAIL_IF_NOT_NULL(dd);
189  PASS;
190 }
191 
192 /**
193  * \test This is a test for a valid value 1430000000 <> 1490000000.
194  *
195  * \retval 1 on success.
196  * \retval 0 on failure.
197  */
198 static int ValidityTestParse12 (void)
199 {
200  DetectTlsValidityData *dd = NULL;
201  dd = DetectTlsValidityParse("1430000000 <> 1490000000");
202  FAIL_IF_NULL(dd);
203  FAIL_IF_NOT(dd->epoch == 1430000000 && dd->epoch2 == 1490000000 &&
204  dd->mode == DETECT_TLS_VALIDITY_RA);
205  DetectTlsValidityFree(NULL, dd);
206  PASS;
207 }
208 
209 /**
210  * \test This is a test for a valid value > 1430000000.
211  *
212  * \retval 1 on success.
213  * \retval 0 on failure.
214  */
215 static int ValidityTestParse13 (void)
216 {
217  DetectTlsValidityData *dd = NULL;
218  dd = DetectTlsValidityParse("> 1430000000 ");
219  FAIL_IF_NULL(dd);
220  FAIL_IF_NOT(dd->epoch == 1430000000 && dd->mode == DETECT_TLS_VALIDITY_GT);
221  DetectTlsValidityFree(NULL, dd);
222  PASS;
223 }
224 
225 /**
226  * \test This is a test for a valid value < 1490000000.
227  *
228  * \retval 1 on success.
229  * \retval 0 on failure.
230  */
231 static int ValidityTestParse14 (void)
232 {
233  DetectTlsValidityData *dd = NULL;
234  dd = DetectTlsValidityParse("< 1490000000 ");
235  FAIL_IF_NULL(dd);
236  FAIL_IF_NOT(dd->epoch == 1490000000 && dd->mode == DETECT_TLS_VALIDITY_LT);
237  DetectTlsValidityFree(NULL, dd);
238  PASS;
239 }
240 
241 /**
242  * \test This is a test for a valid value 1490000000.
243  *
244  * \retval 1 on success.
245  * \retval 0 on failure.
246  */
247 static int ValidityTestParse15 (void)
248 {
249  DetectTlsValidityData *dd = NULL;
250  dd = DetectTlsValidityParse(" 1490000000 ");
251  FAIL_IF_NULL(dd);
252  FAIL_IF_NOT(dd->epoch == 1490000000 && dd->mode == DETECT_TLS_VALIDITY_EQ);
253  DetectTlsValidityFree(NULL, dd);
254  PASS;
255 }
256 
257 /**
258  * \test This is a test for a valid value 2015-10.
259  *
260  * \retval 1 on success.
261  * \retval 0 on failure.
262  */
263 static int ValidityTestParse16 (void)
264 {
265  DetectTlsValidityData *dd = NULL;
266  dd = DetectTlsValidityParse("2015-10");
267  FAIL_IF_NULL(dd);
268  FAIL_IF_NOT(dd->epoch == 1443657600 && dd->mode == DETECT_TLS_VALIDITY_EQ);
269  DetectTlsValidityFree(NULL, dd);
270  PASS;
271 }
272 
273 /**
274  * \test This is a test for a valid value >2015-10-22.
275  *
276  * \retval 1 on success.
277  * \retval 0 on failure.
278  */
279 static int ValidityTestParse17 (void)
280 {
281  DetectTlsValidityData *dd = NULL;
282  dd = DetectTlsValidityParse(">2015-10-22");
283  FAIL_IF_NULL(dd);
284  FAIL_IF_NOT(dd->epoch == 1445472000 && dd->mode == DETECT_TLS_VALIDITY_GT);
285  DetectTlsValidityFree(NULL, dd);
286  PASS;
287 }
288 
289 /**
290  * \test This is a test for a valid value <2015-10-22 23.
291  *
292  * \retval 1 on success.
293  * \retval 0 on failure.
294  */
295 static int ValidityTestParse18 (void)
296 {
297  DetectTlsValidityData *dd = NULL;
298  dd = DetectTlsValidityParse("<2015-10-22 23");
299  FAIL_IF_NULL(dd);
300  FAIL_IF_NOT(dd->epoch == 1445554800 && dd->mode == DETECT_TLS_VALIDITY_LT);
301  DetectTlsValidityFree(NULL, dd);
302  PASS;
303 }
304 
305 /**
306  * \test This is a test for a valid value 2015-10-22 23:59.
307  *
308  * \retval 1 on success.
309  * \retval 0 on failure.
310  */
311 static int ValidityTestParse19 (void)
312 {
313  DetectTlsValidityData *dd = NULL;
314  dd = DetectTlsValidityParse("2015-10-22 23:59");
315  FAIL_IF_NULL(dd);
316  FAIL_IF_NOT(dd->epoch == 1445558340 && dd->mode == DETECT_TLS_VALIDITY_EQ);
317  DetectTlsValidityFree(NULL, dd);
318  PASS;
319 }
320 
321 /**
322  * \test This is a test for a valid value 2015-10-22 23:59:59.
323  *
324  * \retval 1 on success.
325  * \retval 0 on failure.
326  */
327 static int ValidityTestParse20 (void)
328 {
329  DetectTlsValidityData *dd = NULL;
330  dd = DetectTlsValidityParse("2015-10-22 23:59:59");
331  FAIL_IF_NULL(dd);
332  FAIL_IF_NOT(dd->epoch == 1445558399 && dd->mode == DETECT_TLS_VALIDITY_EQ);
333  DetectTlsValidityFree(NULL, dd);
334  PASS;
335 }
336 
337 /**
338  * \test This is a test for a valid value 2015-10-22T23.
339  *
340  * \retval 1 on success.
341  * \retval 0 on failure.
342  */
343 static int ValidityTestParse21 (void)
344 {
345  DetectTlsValidityData *dd = NULL;
346  dd = DetectTlsValidityParse("2015-10-22T23");
347  FAIL_IF_NULL(dd);
348  FAIL_IF_NOT(dd->epoch == 1445554800 && dd->mode == DETECT_TLS_VALIDITY_EQ);
349  DetectTlsValidityFree(NULL, dd);
350  PASS;
351 }
352 
353 /**
354  * \test This is a test for a valid value 2015-10-22T23:59.
355  *
356  * \retval 1 on success.
357  * \retval 0 on failure.
358  */
359 static int ValidityTestParse22 (void)
360 {
361  DetectTlsValidityData *dd = NULL;
362  dd = DetectTlsValidityParse("2015-10-22T23:59");
363  FAIL_IF_NULL(dd);
364  FAIL_IF_NOT(dd->epoch == 1445558340 && dd->mode == DETECT_TLS_VALIDITY_EQ);
365  DetectTlsValidityFree(NULL, dd);
366  PASS;
367 }
368 
369 /**
370  * \test This is a test for a valid value 2015-10-22T23:59:59.
371  *
372  * \retval 1 on success.
373  * \retval 0 on failure.
374  */
375 static int ValidityTestParse23 (void)
376 {
377  DetectTlsValidityData *dd = NULL;
378  dd = DetectTlsValidityParse("2015-10-22T23:59:59");
379  FAIL_IF_NULL(dd);
380  FAIL_IF_NOT(dd->epoch == 1445558399 && dd->mode == DETECT_TLS_VALIDITY_EQ);
381  DetectTlsValidityFree(NULL, dd);
382  PASS;
383 }
384 
385 /**
386  * \test This is a test for a valid value of 1970-01-01T00:00:00
387  * that is at epoch 0, within the range of acceptable
388  * values (1950-2049) as per RFC 5280. (https://tools.ietf.org/html/rfc5280#section-4.1.2.5.1)
389  *
390  * \retval 1 on success.
391  * \retval 0 on failure.
392  */
393 static int ValidityTestParse24(void)
394 {
395  DetectTlsValidityData *dd = NULL;
396  dd = DetectTlsValidityParse("1970-01-01T00:00:00");
397  FAIL_IF_NULL(dd);
398  FAIL_IF_NOT(dd->epoch == 0 && dd->mode == DETECT_TLS_VALIDITY_EQ);
399  DetectTlsValidityFree(NULL, dd);
400  PASS;
401 }
402 
403 /**
404  * \test This is a test for a valid value of 1965-10-22T23:59:59
405  * that is lower than epoch 0, but within the range of
406  * acceptable values (1950-2049) as per RFC 5280.
407  * (https://tools.ietf.org/html/rfc5280#section-4.1.2.5.1)
408  *
409  * \retval 1 on success.
410  * \retval 0 on failure.
411  */
412 static int ValidityTestParse25(void)
413 {
414  DetectTlsValidityData *dd = NULL;
415  dd = DetectTlsValidityParse("1969-12-31T23:59:59");
416  FAIL_IF_NULL(dd);
417  FAIL_IF_NOT(dd->epoch == -1 && dd->mode == DETECT_TLS_VALIDITY_EQ);
418  DetectTlsValidityFree(NULL, dd);
419  PASS;
420 }
421 
422 /**
423  * \test Test matching on validity dates in a certificate.
424  *
425  * \retval 1 on success.
426  * \retval 0 on failure.
427  */
428 static int ValidityTestDetect01(void)
429 {
430  /* client hello */
431  uint8_t client_hello[] = {
432  0x16, 0x03, 0x01, 0x00, 0xc8, 0x01, 0x00, 0x00,
433  0xc4, 0x03, 0x03, 0xd6, 0x08, 0x5a, 0xa2, 0x86,
434  0x5b, 0x85, 0xd4, 0x40, 0xab, 0xbe, 0xc0, 0xbc,
435  0x41, 0xf2, 0x26, 0xf0, 0xfe, 0x21, 0xee, 0x8b,
436  0x4c, 0x7e, 0x07, 0xc8, 0xec, 0xd2, 0x00, 0x46,
437  0x4c, 0xeb, 0xb7, 0x00, 0x00, 0x16, 0xc0, 0x2b,
438  0xc0, 0x2f, 0xc0, 0x0a, 0xc0, 0x09, 0xc0, 0x13,
439  0xc0, 0x14, 0x00, 0x33, 0x00, 0x39, 0x00, 0x2f,
440  0x00, 0x35, 0x00, 0x0a, 0x01, 0x00, 0x00, 0x85,
441  0x00, 0x00, 0x00, 0x12, 0x00, 0x10, 0x00, 0x00,
442  0x0d, 0x77, 0x77, 0x77, 0x2e, 0x67, 0x6f, 0x6f,
443  0x67, 0x6c, 0x65, 0x2e, 0x6e, 0x6f, 0xff, 0x01,
444  0x00, 0x01, 0x00, 0x00, 0x0a, 0x00, 0x08, 0x00,
445  0x06, 0x00, 0x17, 0x00, 0x18, 0x00, 0x19, 0x00,
446  0x0b, 0x00, 0x02, 0x01, 0x00, 0x00, 0x23, 0x00,
447  0x00, 0x33, 0x74, 0x00, 0x00, 0x00, 0x10, 0x00,
448  0x29, 0x00, 0x27, 0x05, 0x68, 0x32, 0x2d, 0x31,
449  0x36, 0x05, 0x68, 0x32, 0x2d, 0x31, 0x35, 0x05,
450  0x68, 0x32, 0x2d, 0x31, 0x34, 0x02, 0x68, 0x32,
451  0x08, 0x73, 0x70, 0x64, 0x79, 0x2f, 0x33, 0x2e,
452  0x31, 0x08, 0x68, 0x74, 0x74, 0x70, 0x2f, 0x31,
453  0x2e, 0x31, 0x00, 0x05, 0x00, 0x05, 0x01, 0x00,
454  0x00, 0x00, 0x00, 0x00, 0x0d, 0x00, 0x16, 0x00,
455  0x14, 0x04, 0x01, 0x05, 0x01, 0x06, 0x01, 0x02,
456  0x01, 0x04, 0x03, 0x05, 0x03, 0x06, 0x03, 0x02,
457  0x03, 0x04, 0x02, 0x02, 0x02
458  };
459 
460  /* server hello */
461  uint8_t server_hello[] = {
462  0x16, 0x03, 0x03, 0x00, 0x48, 0x02, 0x00, 0x00,
463  0x44, 0x03, 0x03, 0x57, 0x91, 0xb8, 0x63, 0xdd,
464  0xdb, 0xbb, 0x23, 0xcf, 0x0b, 0x43, 0x02, 0x1d,
465  0x46, 0x11, 0x27, 0x5c, 0x98, 0xcf, 0x67, 0xe1,
466  0x94, 0x3d, 0x62, 0x7d, 0x38, 0x48, 0x21, 0x23,
467  0xa5, 0x62, 0x31, 0x00, 0xc0, 0x2f, 0x00, 0x00,
468  0x1c, 0xff, 0x01, 0x00, 0x01, 0x00, 0x00, 0x00,
469  0x00, 0x00, 0x00, 0x23, 0x00, 0x00, 0x00, 0x10,
470  0x00, 0x05, 0x00, 0x03, 0x02, 0x68, 0x32, 0x00,
471  0x0b, 0x00, 0x02, 0x01, 0x00
472  };
473 
474  /* certificate */
475  uint8_t certificate[] = {
476  0x16, 0x03, 0x03, 0x04, 0x93, 0x0b, 0x00, 0x04,
477  0x8f, 0x00, 0x04, 0x8c, 0x00, 0x04, 0x89, 0x30,
478  0x82, 0x04, 0x85, 0x30, 0x82, 0x03, 0x6d, 0xa0,
479  0x03, 0x02, 0x01, 0x02, 0x02, 0x08, 0x5c, 0x19,
480  0xb7, 0xb1, 0x32, 0x3b, 0x1c, 0xa1, 0x30, 0x0d,
481  0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d,
482  0x01, 0x01, 0x0b, 0x05, 0x00, 0x30, 0x49, 0x31,
483  0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06,
484  0x13, 0x02, 0x55, 0x53, 0x31, 0x13, 0x30, 0x11,
485  0x06, 0x03, 0x55, 0x04, 0x0a, 0x13, 0x0a, 0x47,
486  0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x20, 0x49, 0x6e,
487  0x63, 0x31, 0x25, 0x30, 0x23, 0x06, 0x03, 0x55,
488  0x04, 0x03, 0x13, 0x1c, 0x47, 0x6f, 0x6f, 0x67,
489  0x6c, 0x65, 0x20, 0x49, 0x6e, 0x74, 0x65, 0x72,
490  0x6e, 0x65, 0x74, 0x20, 0x41, 0x75, 0x74, 0x68,
491  0x6f, 0x72, 0x69, 0x74, 0x79, 0x20, 0x47, 0x32,
492  0x30, 0x1e, 0x17, 0x0d, 0x31, 0x36, 0x30, 0x37,
493  0x31, 0x33, 0x31, 0x33, 0x32, 0x34, 0x35, 0x32,
494  0x5a, 0x17, 0x0d, 0x31, 0x36, 0x31, 0x30, 0x30,
495  0x35, 0x31, 0x33, 0x31, 0x36, 0x30, 0x30, 0x5a,
496  0x30, 0x65, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03,
497  0x55, 0x04, 0x06, 0x13, 0x02, 0x55, 0x53, 0x31,
498  0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x08,
499  0x0c, 0x0a, 0x43, 0x61, 0x6c, 0x69, 0x66, 0x6f,
500  0x72, 0x6e, 0x69, 0x61, 0x31, 0x16, 0x30, 0x14,
501  0x06, 0x03, 0x55, 0x04, 0x07, 0x0c, 0x0d, 0x4d,
502  0x6f, 0x75, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x20,
503  0x56, 0x69, 0x65, 0x77, 0x31, 0x13, 0x30, 0x11,
504  0x06, 0x03, 0x55, 0x04, 0x0a, 0x0c, 0x0a, 0x47,
505  0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x20, 0x49, 0x6e,
506  0x63, 0x31, 0x14, 0x30, 0x12, 0x06, 0x03, 0x55,
507  0x04, 0x03, 0x0c, 0x0b, 0x2a, 0x2e, 0x67, 0x6f,
508  0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x6e, 0x6f, 0x30,
509  0x82, 0x01, 0x22, 0x30, 0x0d, 0x06, 0x09, 0x2a,
510  0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01,
511  0x05, 0x00, 0x03, 0x82, 0x01, 0x0f, 0x00, 0x30,
512  0x82, 0x01, 0x0a, 0x02, 0x82, 0x01, 0x01, 0x00,
513  0xa5, 0x0a, 0xb9, 0xb1, 0xca, 0x36, 0xd1, 0xae,
514  0x22, 0x38, 0x07, 0x06, 0xc9, 0x1a, 0x56, 0x4f,
515  0xbb, 0xdf, 0xa8, 0x6d, 0xbd, 0xee, 0x76, 0x16,
516  0xbc, 0x53, 0x3c, 0x03, 0x6a, 0x5c, 0x94, 0x50,
517  0x87, 0x2f, 0x28, 0xb4, 0x4e, 0xd5, 0x9b, 0x8f,
518  0xfe, 0x02, 0xde, 0x2a, 0x83, 0x01, 0xf9, 0x45,
519  0x61, 0x0e, 0x66, 0x0e, 0x24, 0x22, 0xe2, 0x59,
520  0x66, 0x0d, 0xd3, 0xe9, 0x77, 0x8a, 0x7e, 0x42,
521  0xaa, 0x5a, 0xf9, 0x05, 0xbf, 0x30, 0xc7, 0x03,
522  0x2b, 0xdc, 0xa6, 0x9c, 0xe0, 0x9f, 0x0d, 0xf1,
523  0x28, 0x19, 0xf8, 0xf2, 0x02, 0xfa, 0xbd, 0x62,
524  0xa0, 0xf3, 0x02, 0x2b, 0xcd, 0xf7, 0x09, 0x04,
525  0x3b, 0x52, 0xd8, 0x65, 0x4b, 0x4a, 0x70, 0xe4,
526  0x57, 0xc9, 0x2e, 0x2a, 0xf6, 0x9c, 0x6e, 0xd8,
527  0xde, 0x01, 0x52, 0xc9, 0x6f, 0xe9, 0xef, 0x82,
528  0xbc, 0x0b, 0x95, 0xb2, 0xef, 0xcb, 0x91, 0xa6,
529  0x0b, 0x2d, 0x14, 0xc6, 0x00, 0xa9, 0x33, 0x86,
530  0x64, 0x00, 0xd4, 0x92, 0x19, 0x53, 0x3d, 0xfd,
531  0xcd, 0xc6, 0x1a, 0xf2, 0x0e, 0x67, 0xc2, 0x1d,
532  0x2c, 0xe0, 0xe8, 0x29, 0x97, 0x1c, 0xb6, 0xc4,
533  0xb2, 0x02, 0x0c, 0x83, 0xb8, 0x60, 0x61, 0xf5,
534  0x61, 0x2d, 0x73, 0x5e, 0x85, 0x4d, 0xbd, 0x0d,
535  0xe7, 0x1a, 0x37, 0x56, 0x8d, 0xe5, 0x50, 0x0c,
536  0xc9, 0x64, 0x4c, 0x11, 0xea, 0xf3, 0xcb, 0x26,
537  0x34, 0xbd, 0x02, 0xf5, 0xc1, 0xfb, 0xa2, 0xec,
538  0x27, 0xbb, 0x60, 0xbe, 0x0b, 0xf6, 0xe7, 0x3c,
539  0x2d, 0xc9, 0xe7, 0xb0, 0x30, 0x28, 0x17, 0x3d,
540  0x90, 0xf1, 0x63, 0x8e, 0x49, 0xf7, 0x15, 0x78,
541  0x21, 0xcc, 0x45, 0xe6, 0x86, 0xb2, 0xd8, 0xb0,
542  0x2e, 0x5a, 0xb0, 0x58, 0xd3, 0xb6, 0x11, 0x40,
543  0xae, 0x81, 0x1f, 0x6b, 0x7a, 0xaf, 0x40, 0x50,
544  0xf9, 0x2e, 0x81, 0x8b, 0xec, 0x26, 0x11, 0x3f,
545  0x02, 0x03, 0x01, 0x00, 0x01, 0xa3, 0x82, 0x01,
546  0x53, 0x30, 0x82, 0x01, 0x4f, 0x30, 0x1d, 0x06,
547  0x03, 0x55, 0x1d, 0x25, 0x04, 0x16, 0x30, 0x14,
548  0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07,
549  0x03, 0x01, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05,
550  0x05, 0x07, 0x03, 0x02, 0x30, 0x21, 0x06, 0x03,
551  0x55, 0x1d, 0x11, 0x04, 0x1a, 0x30, 0x18, 0x82,
552  0x0b, 0x2a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
553  0x65, 0x2e, 0x6e, 0x6f, 0x82, 0x09, 0x67, 0x6f,
554  0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x6e, 0x6f, 0x30,
555  0x68, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05,
556  0x07, 0x01, 0x01, 0x04, 0x5c, 0x30, 0x5a, 0x30,
557  0x2b, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05,
558  0x07, 0x30, 0x02, 0x86, 0x1f, 0x68, 0x74, 0x74,
559  0x70, 0x3a, 0x2f, 0x2f, 0x70, 0x6b, 0x69, 0x2e,
560  0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x63,
561  0x6f, 0x6d, 0x2f, 0x47, 0x49, 0x41, 0x47, 0x32,
562  0x2e, 0x63, 0x72, 0x74, 0x30, 0x2b, 0x06, 0x08,
563  0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x30, 0x01,
564  0x86, 0x1f, 0x68, 0x74, 0x74, 0x70, 0x3a, 0x2f,
565  0x2f, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x73,
566  0x31, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
567  0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6f, 0x63, 0x73,
568  0x70, 0x30, 0x1d, 0x06, 0x03, 0x55, 0x1d, 0x0e,
569  0x04, 0x16, 0x04, 0x14, 0xc6, 0x53, 0x87, 0x42,
570  0x2d, 0xc8, 0xee, 0x7a, 0x62, 0x1e, 0x83, 0xdb,
571  0x0d, 0xe2, 0x32, 0xeb, 0x8b, 0xaf, 0x69, 0x40,
572  0x30, 0x0c, 0x06, 0x03, 0x55, 0x1d, 0x13, 0x01,
573  0x01, 0xff, 0x04, 0x02, 0x30, 0x00, 0x30, 0x1f,
574  0x06, 0x03, 0x55, 0x1d, 0x23, 0x04, 0x18, 0x30,
575  0x16, 0x80, 0x14, 0x4a, 0xdd, 0x06, 0x16, 0x1b,
576  0xbc, 0xf6, 0x68, 0xb5, 0x76, 0xf5, 0x81, 0xb6,
577  0xbb, 0x62, 0x1a, 0xba, 0x5a, 0x81, 0x2f, 0x30,
578  0x21, 0x06, 0x03, 0x55, 0x1d, 0x20, 0x04, 0x1a,
579  0x30, 0x18, 0x30, 0x0c, 0x06, 0x0a, 0x2b, 0x06,
580  0x01, 0x04, 0x01, 0xd6, 0x79, 0x02, 0x05, 0x01,
581  0x30, 0x08, 0x06, 0x06, 0x67, 0x81, 0x0c, 0x01,
582  0x02, 0x02, 0x30, 0x30, 0x06, 0x03, 0x55, 0x1d,
583  0x1f, 0x04, 0x29, 0x30, 0x27, 0x30, 0x25, 0xa0,
584  0x23, 0xa0, 0x21, 0x86, 0x1f, 0x68, 0x74, 0x74,
585  0x70, 0x3a, 0x2f, 0x2f, 0x70, 0x6b, 0x69, 0x2e,
586  0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x63,
587  0x6f, 0x6d, 0x2f, 0x47, 0x49, 0x41, 0x47, 0x32,
588  0x2e, 0x63, 0x72, 0x6c, 0x30, 0x0d, 0x06, 0x09,
589  0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01,
590  0x0b, 0x05, 0x00, 0x03, 0x82, 0x01, 0x01, 0x00,
591  0x7b, 0x27, 0x00, 0x46, 0x8f, 0xfd, 0x5b, 0xff,
592  0xcb, 0x05, 0x9b, 0xf7, 0xf1, 0x68, 0xf6, 0x9a,
593  0x7b, 0xba, 0x53, 0xdf, 0x63, 0xed, 0x11, 0x94,
594  0x39, 0xf2, 0xd0, 0x20, 0xcd, 0xa3, 0xc4, 0x98,
595  0xa5, 0x10, 0x74, 0xe7, 0x10, 0x6d, 0x07, 0xf8,
596  0x33, 0x87, 0x05, 0x43, 0x0e, 0x64, 0x77, 0x09,
597  0x18, 0x4f, 0x38, 0x2e, 0x45, 0xae, 0xa8, 0x34,
598  0x3a, 0xa8, 0x33, 0xac, 0x9d, 0xdd, 0x25, 0x91,
599  0x59, 0x43, 0xbe, 0x0f, 0x87, 0x16, 0x2f, 0xb5,
600  0x27, 0xfd, 0xce, 0x2f, 0x35, 0x5d, 0x12, 0xa1,
601  0x66, 0xac, 0xf7, 0x95, 0x38, 0x0f, 0xe5, 0xb1,
602  0x18, 0x18, 0xe6, 0x80, 0x52, 0x31, 0x8a, 0x66,
603  0x02, 0x52, 0x1a, 0xa4, 0x32, 0x6a, 0x61, 0x05,
604  0xcf, 0x1d, 0xf9, 0x90, 0x73, 0xf0, 0xeb, 0x20,
605  0x31, 0x7b, 0x2e, 0xc0, 0xb0, 0xfb, 0x5c, 0xcc,
606  0xdc, 0x76, 0x55, 0x72, 0xaf, 0xb1, 0x05, 0xf4,
607  0xad, 0xf9, 0xd7, 0x73, 0x5c, 0x2c, 0xbf, 0x0d,
608  0x84, 0x18, 0x01, 0x1d, 0x4d, 0x08, 0xa9, 0x4e,
609  0x37, 0xb7, 0x58, 0xc4, 0x05, 0x0e, 0x65, 0x63,
610  0xd2, 0x88, 0x02, 0xf5, 0x82, 0x17, 0x08, 0xd5,
611  0x8f, 0x80, 0xc7, 0x82, 0x29, 0xbb, 0xe1, 0x04,
612  0xbe, 0xf6, 0xe1, 0x8c, 0xbc, 0x3a, 0xf8, 0xf9,
613  0x56, 0xda, 0xdc, 0x8e, 0xc6, 0xe6, 0x63, 0x98,
614  0x12, 0x08, 0x41, 0x2c, 0x9d, 0x7c, 0x82, 0x0d,
615  0x1e, 0xea, 0xba, 0xde, 0x32, 0x09, 0xda, 0x52,
616  0x24, 0x4f, 0xcc, 0xb6, 0x09, 0x33, 0x8b, 0x00,
617  0xf9, 0x83, 0xb3, 0xc6, 0xa4, 0x90, 0x49, 0x83,
618  0x2d, 0x36, 0xd9, 0x11, 0x78, 0xd0, 0x62, 0x9f,
619  0xc4, 0x8f, 0x84, 0xba, 0x7f, 0xaa, 0x04, 0xf1,
620  0xd9, 0xa4, 0xad, 0x5d, 0x63, 0xee, 0x72, 0xc6,
621  0x4d, 0xd1, 0x4b, 0x41, 0x8f, 0x40, 0x0f, 0x7d,
622  0xcd, 0xb8, 0x2e, 0x5b, 0x6e, 0x21, 0xc9, 0x3d
623  };
624 
625  Flow f;
626  SSLState *ssl_state = NULL;
627  TcpSession ssn;
628  Packet *p1 = NULL;
629  Packet *p2 = NULL;
630  Packet *p3 = NULL;
631  ThreadVars tv;
632  DetectEngineThreadCtx *det_ctx = NULL;
633  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
634 
635  memset(&tv, 0, sizeof(ThreadVars));
636  StatsThreadInit(&tv.stats);
637  memset(&f, 0, sizeof(Flow));
638  memset(&ssn, 0, sizeof(TcpSession));
639 
640  p1 = UTHBuildPacketReal(client_hello, sizeof(client_hello), IPPROTO_TCP,
641  "192.168.1.5", "192.168.1.1", 51251, 443);
642  p2 = UTHBuildPacketReal(server_hello, sizeof(server_hello), IPPROTO_TCP,
643  "192.168.1.1", "192.168.1.5", 443, 51251);
644  p3 = UTHBuildPacketReal(certificate, sizeof(certificate), IPPROTO_TCP,
645  "192.168.1.1", "192.168.1.5", 443, 51251);
646 
647  FLOW_INITIALIZE(&f);
648  f.flags |= FLOW_IPV4;
649  f.proto = IPPROTO_TCP;
650  f.protomap = FlowGetProtoMapping(f.proto);
651  f.alproto = ALPROTO_TLS;
652 
653  p1->flow = &f;
654  p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
655  p1->flowflags |= FLOW_PKT_TOSERVER;
656  p1->flowflags |= FLOW_PKT_ESTABLISHED;
657  p1->pcap_cnt = 1;
658 
659  p2->flow = &f;
660  p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
661  p2->flowflags |= FLOW_PKT_TOCLIENT;
662  p2->flowflags |= FLOW_PKT_ESTABLISHED;
663  p2->pcap_cnt = 2;
664 
665  p3->flow = &f;
666  p3->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
667  p3->flowflags |= FLOW_PKT_TOCLIENT;
668  p3->flowflags |= FLOW_PKT_ESTABLISHED;
669  p3->pcap_cnt = 3;
670 
671  StreamTcpInitConfig(true);
672 
673  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
674  FAIL_IF_NULL(de_ctx);
675  de_ctx->flags |= DE_QUIET;
676 
677  Signature *s = DetectEngineAppendSig(de_ctx, "alert tls any any -> any any "
678  "(msg:\"Test tls_cert_notbefore\"; "
679  "tls_cert_notbefore:<2016-07-20; sid:1;)");
680  FAIL_IF_NULL(s);
681 
682  s = DetectEngineAppendSig(de_ctx, "alert tls any any -> any any "
683  "(msg:\"Test tls_cert_notafter\"; "
684  "tls_cert_notafter:>2016-09-01; sid:2;)");
685  FAIL_IF_NULL(s);
686 
687  SigGroupBuild(de_ctx);
688  DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
689 
690  int r = AppLayerParserParse(
691  NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, client_hello, sizeof(client_hello));
692  FAIL_IF(r != 0);
693 
694  ssl_state = f.alstate;
695  FAIL_IF_NULL(ssl_state);
696 
697  SigMatchSignatures(&tv, de_ctx, det_ctx, p1);
698  FAIL_IF(PacketAlertCheck(p1, 1));
699  FAIL_IF(PacketAlertCheck(p1, 2));
700 
701  r = AppLayerParserParse(
702  NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOCLIENT, server_hello, sizeof(server_hello));
703  FAIL_IF(r != 0);
704 
705  SigMatchSignatures(&tv, de_ctx, det_ctx, p2);
706  FAIL_IF(PacketAlertCheck(p2, 1));
707  FAIL_IF(PacketAlertCheck(p2, 2));
708 
709  r = AppLayerParserParse(
710  NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOCLIENT, certificate, sizeof(certificate));
711  FAIL_IF(r != 0);
712 
713  SigMatchSignatures(&tv, de_ctx, det_ctx, p3);
714  FAIL_IF_NOT(PacketAlertCheck(p3, 1));
715  FAIL_IF_NOT(PacketAlertCheck(p3, 2));
716 
717  UTHFreePacket(p1);
718  UTHFreePacket(p2);
719  UTHFreePacket(p3);
720  FLOW_DESTROY(&f);
721 
722  AppLayerParserThreadCtxFree(alp_tctx);
723  DetectEngineThreadCtxDeinit(&tv, det_ctx);
724  DetectEngineCtxFree(de_ctx);
725  StreamTcpFreeConfig(true);
726  StatsThreadCleanup(&tv.stats);
727  PASS;
728 }
729 
730 /**
731  * \test Test matching on an expired certificate.
732  *
733  * Traffic from expired.badssl.com
734  *
735  * \retval 1 on success.
736  * \retval 0 on failure.
737  */
738 static int ExpiredTestDetect01(void)
739 {
740  /* client hello */
741  uint8_t client_hello[] = {
742  0x16, 0x03, 0x03, 0x00, 0x5a, 0x01, 0x00, 0x00,
743  0x56, 0x03, 0x03, 0x62, 0x87, 0xa4, 0x11, 0x3e,
744  0x11, 0x32, 0x7d, 0xbc, 0x5b, 0x63, 0xb7, 0xaf,
745  0x55, 0x8d, 0x46, 0x5b, 0x8f, 0xac, 0x50, 0x02,
746  0x90, 0xe3, 0x55, 0x03, 0xfe, 0xad, 0xa6, 0x92,
747  0x56, 0x75, 0xf9, 0x00, 0x00, 0x08, 0x00, 0x35,
748  0x00, 0x2f, 0x00, 0x0a, 0x00, 0xff, 0x01, 0x00,
749  0x00, 0x25, 0x00, 0x00, 0x00, 0x17, 0x00, 0x15,
750  0x00, 0x00, 0x12, 0x65, 0x78, 0x70, 0x69, 0x72,
751  0x65, 0x64, 0x2e, 0x62, 0x61, 0x64, 0x73, 0x73,
752  0x6c, 0x2e, 0x63, 0x6f, 0x6d, 0x00, 0x0d, 0x00,
753  0x06, 0x00, 0x04, 0x04, 0x01, 0x02, 0x01
754  };
755 
756  /* server hello */
757  uint8_t server_hello[] = {
758  0x16, 0x03, 0x03, 0x00, 0x55, 0x02, 0x00, 0x00,
759  0x51, 0x03, 0x03, 0x22, 0xa1, 0xd8, 0xd0, 0x3c,
760  0x8d, 0x32, 0x7e, 0x4f, 0x60, 0x27, 0xf6, 0x0c,
761  0x99, 0x7a, 0x8e, 0x6e, 0x52, 0xa5, 0xf4, 0x20,
762  0x2e, 0xa1, 0xa4, 0x0b, 0xd5, 0x80, 0x9b, 0xec,
763  0xbd, 0x2c, 0x6c, 0x20, 0x7a, 0x9b, 0xcc, 0x6b,
764  0xbf, 0x3d, 0xfc, 0x7c, 0x31, 0x78, 0x65, 0x1e,
765  0xcc, 0x41, 0x0b, 0x8b, 0x3d, 0x4e, 0xde, 0x45,
766  0xe5, 0x20, 0xf5, 0xbd, 0x8e, 0x99, 0xce, 0xc2,
767  0xad, 0x88, 0x08, 0x27, 0x00, 0x2f, 0x00, 0x00,
768  0x09, 0x00, 0x00, 0x00, 0x00, 0xff, 0x01, 0x00,
769  0x01, 0x00
770  };
771 
772  /* certificate */
773  uint8_t certificate[] = {
774  0x16, 0x03, 0x03, 0x05, 0x59, 0x0b, 0x00, 0x05,
775  0x55, 0x00, 0x05, 0x52, 0x00, 0x05, 0x4f, 0x30,
776  0x82, 0x05, 0x4b, 0x30, 0x82, 0x04, 0x33, 0xa0,
777  0x03, 0x02, 0x01, 0x02, 0x02, 0x10, 0x4a, 0xe7,
778  0x95, 0x49, 0xfa, 0x9a, 0xbe, 0x3f, 0x10, 0x0f,
779  0x17, 0xa4, 0x78, 0xe1, 0x69, 0x09, 0x30, 0x0d,
780  0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d,
781  0x01, 0x01, 0x0b, 0x05, 0x00, 0x30, 0x81, 0x90,
782  0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04,
783  0x06, 0x13, 0x02, 0x47, 0x42, 0x31, 0x1b, 0x30,
784  0x19, 0x06, 0x03, 0x55, 0x04, 0x08, 0x13, 0x12,
785  0x47, 0x72, 0x65, 0x61, 0x74, 0x65, 0x72, 0x20,
786  0x4d, 0x61, 0x6e, 0x63, 0x68, 0x65, 0x73, 0x74,
787  0x65, 0x72, 0x31, 0x10, 0x30, 0x0e, 0x06, 0x03,
788  0x55, 0x04, 0x07, 0x13, 0x07, 0x53, 0x61, 0x6c,
789  0x66, 0x6f, 0x72, 0x64, 0x31, 0x1a, 0x30, 0x18,
790  0x06, 0x03, 0x55, 0x04, 0x0a, 0x13, 0x11, 0x43,
791  0x4f, 0x4d, 0x4f, 0x44, 0x4f, 0x20, 0x43, 0x41,
792  0x20, 0x4c, 0x69, 0x6d, 0x69, 0x74, 0x65, 0x64,
793  0x31, 0x36, 0x30, 0x34, 0x06, 0x03, 0x55, 0x04,
794  0x03, 0x13, 0x2d, 0x43, 0x4f, 0x4d, 0x4f, 0x44,
795  0x4f, 0x20, 0x52, 0x53, 0x41, 0x20, 0x44, 0x6f,
796  0x6d, 0x61, 0x69, 0x6e, 0x20, 0x56, 0x61, 0x6c,
797  0x69, 0x64, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x20,
798  0x53, 0x65, 0x63, 0x75, 0x72, 0x65, 0x20, 0x53,
799  0x65, 0x72, 0x76, 0x65, 0x72, 0x20, 0x43, 0x41,
800  0x30, 0x1e, 0x17, 0x0d, 0x31, 0x35, 0x30, 0x34,
801  0x30, 0x39, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30,
802  0x5a, 0x17, 0x0d, 0x31, 0x35, 0x30, 0x34, 0x31,
803  0x32, 0x32, 0x33, 0x35, 0x39, 0x35, 0x39, 0x5a,
804  0x30, 0x59, 0x31, 0x21, 0x30, 0x1f, 0x06, 0x03,
805  0x55, 0x04, 0x0b, 0x13, 0x18, 0x44, 0x6f, 0x6d,
806  0x61, 0x69, 0x6e, 0x20, 0x43, 0x6f, 0x6e, 0x74,
807  0x72, 0x6f, 0x6c, 0x20, 0x56, 0x61, 0x6c, 0x69,
808  0x64, 0x61, 0x74, 0x65, 0x64, 0x31, 0x1d, 0x30,
809  0x1b, 0x06, 0x03, 0x55, 0x04, 0x0b, 0x13, 0x14,
810  0x50, 0x6f, 0x73, 0x69, 0x74, 0x69, 0x76, 0x65,
811  0x53, 0x53, 0x4c, 0x20, 0x57, 0x69, 0x6c, 0x64,
812  0x63, 0x61, 0x72, 0x64, 0x31, 0x15, 0x30, 0x13,
813  0x06, 0x03, 0x55, 0x04, 0x03, 0x14, 0x0c, 0x2a,
814  0x2e, 0x62, 0x61, 0x64, 0x73, 0x73, 0x6c, 0x2e,
815  0x63, 0x6f, 0x6d, 0x30, 0x82, 0x01, 0x22, 0x30,
816  0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7,
817  0x0d, 0x01, 0x01, 0x01, 0x05, 0x00, 0x03, 0x82,
818  0x01, 0x0f, 0x00, 0x30, 0x82, 0x01, 0x0a, 0x02,
819  0x82, 0x01, 0x01, 0x00, 0xc2, 0x04, 0xec, 0xf8,
820  0x8c, 0xee, 0x04, 0xc2, 0xb3, 0xd8, 0x50, 0xd5,
821  0x70, 0x58, 0xcc, 0x93, 0x18, 0xeb, 0x5c, 0xa8,
822  0x68, 0x49, 0xb0, 0x22, 0xb5, 0xf9, 0x95, 0x9e,
823  0xb1, 0x2b, 0x2c, 0x76, 0x3e, 0x6c, 0xc0, 0x4b,
824  0x60, 0x4c, 0x4c, 0xea, 0xb2, 0xb4, 0xc0, 0x0f,
825  0x80, 0xb6, 0xb0, 0xf9, 0x72, 0xc9, 0x86, 0x02,
826  0xf9, 0x5c, 0x41, 0x5d, 0x13, 0x2b, 0x7f, 0x71,
827  0xc4, 0x4b, 0xbc, 0xe9, 0x94, 0x2e, 0x50, 0x37,
828  0xa6, 0x67, 0x1c, 0x61, 0x8c, 0xf6, 0x41, 0x42,
829  0xc5, 0x46, 0xd3, 0x16, 0x87, 0x27, 0x9f, 0x74,
830  0xeb, 0x0a, 0x9d, 0x11, 0x52, 0x26, 0x21, 0x73,
831  0x6c, 0x84, 0x4c, 0x79, 0x55, 0xe4, 0xd1, 0x6b,
832  0xe8, 0x06, 0x3d, 0x48, 0x15, 0x52, 0xad, 0xb3,
833  0x28, 0xdb, 0xaa, 0xff, 0x6e, 0xff, 0x60, 0x95,
834  0x4a, 0x77, 0x6b, 0x39, 0xf1, 0x24, 0xd1, 0x31,
835  0xb6, 0xdd, 0x4d, 0xc0, 0xc4, 0xfc, 0x53, 0xb9,
836  0x6d, 0x42, 0xad, 0xb5, 0x7c, 0xfe, 0xae, 0xf5,
837  0x15, 0xd2, 0x33, 0x48, 0xe7, 0x22, 0x71, 0xc7,
838  0xc2, 0x14, 0x7a, 0x6c, 0x28, 0xea, 0x37, 0x4a,
839  0xdf, 0xea, 0x6c, 0xb5, 0x72, 0xb4, 0x7e, 0x5a,
840  0xa2, 0x16, 0xdc, 0x69, 0xb1, 0x57, 0x44, 0xdb,
841  0x0a, 0x12, 0xab, 0xde, 0xc3, 0x0f, 0x47, 0x74,
842  0x5c, 0x41, 0x22, 0xe1, 0x9a, 0xf9, 0x1b, 0x93,
843  0xe6, 0xad, 0x22, 0x06, 0x29, 0x2e, 0xb1, 0xba,
844  0x49, 0x1c, 0x0c, 0x27, 0x9e, 0xa3, 0xfb, 0x8b,
845  0xf7, 0x40, 0x72, 0x00, 0xac, 0x92, 0x08, 0xd9,
846  0x8c, 0x57, 0x84, 0x53, 0x81, 0x05, 0xcb, 0xe6,
847  0xfe, 0x6b, 0x54, 0x98, 0x40, 0x27, 0x85, 0xc7,
848  0x10, 0xbb, 0x73, 0x70, 0xef, 0x69, 0x18, 0x41,
849  0x07, 0x45, 0x55, 0x7c, 0xf9, 0x64, 0x3f, 0x3d,
850  0x2c, 0xc3, 0xa9, 0x7c, 0xeb, 0x93, 0x1a, 0x4c,
851  0x86, 0xd1, 0xca, 0x85, 0x02, 0x03, 0x01, 0x00,
852  0x01, 0xa3, 0x82, 0x01, 0xd5, 0x30, 0x82, 0x01,
853  0xd1, 0x30, 0x1f, 0x06, 0x03, 0x55, 0x1d, 0x23,
854  0x04, 0x18, 0x30, 0x16, 0x80, 0x14, 0x90, 0xaf,
855  0x6a, 0x3a, 0x94, 0x5a, 0x0b, 0xd8, 0x90, 0xea,
856  0x12, 0x56, 0x73, 0xdf, 0x43, 0xb4, 0x3a, 0x28,
857  0xda, 0xe7, 0x30, 0x1d, 0x06, 0x03, 0x55, 0x1d,
858  0x0e, 0x04, 0x16, 0x04, 0x14, 0x9d, 0xee, 0xc1,
859  0x7b, 0x81, 0x0b, 0x3a, 0x47, 0x69, 0x71, 0x18,
860  0x7d, 0x11, 0x37, 0x93, 0xbc, 0xa5, 0x1b, 0x3f,
861  0xfb, 0x30, 0x0e, 0x06, 0x03, 0x55, 0x1d, 0x0f,
862  0x01, 0x01, 0xff, 0x04, 0x04, 0x03, 0x02, 0x05,
863  0xa0, 0x30, 0x0c, 0x06, 0x03, 0x55, 0x1d, 0x13,
864  0x01, 0x01, 0xff, 0x04, 0x02, 0x30, 0x00, 0x30,
865  0x1d, 0x06, 0x03, 0x55, 0x1d, 0x25, 0x04, 0x16,
866  0x30, 0x14, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05,
867  0x05, 0x07, 0x03, 0x01, 0x06, 0x08, 0x2b, 0x06,
868  0x01, 0x05, 0x05, 0x07, 0x03, 0x02, 0x30, 0x4f,
869  0x06, 0x03, 0x55, 0x1d, 0x20, 0x04, 0x48, 0x30,
870  0x46, 0x30, 0x3a, 0x06, 0x0b, 0x2b, 0x06, 0x01,
871  0x04, 0x01, 0xb2, 0x31, 0x01, 0x02, 0x02, 0x07,
872  0x30, 0x2b, 0x30, 0x29, 0x06, 0x08, 0x2b, 0x06,
873  0x01, 0x05, 0x05, 0x07, 0x02, 0x01, 0x16, 0x1d,
874  0x68, 0x74, 0x74, 0x70, 0x73, 0x3a, 0x2f, 0x2f,
875  0x73, 0x65, 0x63, 0x75, 0x72, 0x65, 0x2e, 0x63,
876  0x6f, 0x6d, 0x6f, 0x64, 0x6f, 0x2e, 0x63, 0x6f,
877  0x6d, 0x2f, 0x43, 0x50, 0x53, 0x30, 0x08, 0x06,
878  0x06, 0x67, 0x81, 0x0c, 0x01, 0x02, 0x01, 0x30,
879  0x54, 0x06, 0x03, 0x55, 0x1d, 0x1f, 0x04, 0x4d,
880  0x30, 0x4b, 0x30, 0x49, 0xa0, 0x47, 0xa0, 0x45,
881  0x86, 0x43, 0x68, 0x74, 0x74, 0x70, 0x3a, 0x2f,
882  0x2f, 0x63, 0x72, 0x6c, 0x2e, 0x63, 0x6f, 0x6d,
883  0x6f, 0x64, 0x6f, 0x63, 0x61, 0x2e, 0x63, 0x6f,
884  0x6d, 0x2f, 0x43, 0x4f, 0x4d, 0x4f, 0x44, 0x4f,
885  0x52, 0x53, 0x41, 0x44, 0x6f, 0x6d, 0x61, 0x69,
886  0x6e, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74,
887  0x69, 0x6f, 0x6e, 0x53, 0x65, 0x63, 0x75, 0x72,
888  0x65, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x43,
889  0x41, 0x2e, 0x63, 0x72, 0x6c, 0x30, 0x81, 0x85,
890  0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07,
891  0x01, 0x01, 0x04, 0x79, 0x30, 0x77, 0x30, 0x4f,
892  0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07,
893  0x30, 0x02, 0x86, 0x43, 0x68, 0x74, 0x74, 0x70,
894  0x3a, 0x2f, 0x2f, 0x63, 0x72, 0x74, 0x2e, 0x63,
895  0x6f, 0x6d, 0x6f, 0x64, 0x6f, 0x63, 0x61, 0x2e,
896  0x63, 0x6f, 0x6d, 0x2f, 0x43, 0x4f, 0x4d, 0x4f,
897  0x44, 0x4f, 0x52, 0x53, 0x41, 0x44, 0x6f, 0x6d,
898  0x61, 0x69, 0x6e, 0x56, 0x61, 0x6c, 0x69, 0x64,
899  0x61, 0x74, 0x69, 0x6f, 0x6e, 0x53, 0x65, 0x63,
900  0x75, 0x72, 0x65, 0x53, 0x65, 0x72, 0x76, 0x65,
901  0x72, 0x43, 0x41, 0x2e, 0x63, 0x72, 0x74, 0x30,
902  0x24, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05,
903  0x07, 0x30, 0x01, 0x86, 0x18, 0x68, 0x74, 0x74,
904  0x70, 0x3a, 0x2f, 0x2f, 0x6f, 0x63, 0x73, 0x70,
905  0x2e, 0x63, 0x6f, 0x6d, 0x6f, 0x64, 0x6f, 0x63,
906  0x61, 0x2e, 0x63, 0x6f, 0x6d, 0x30, 0x23, 0x06,
907  0x03, 0x55, 0x1d, 0x11, 0x04, 0x1c, 0x30, 0x1a,
908  0x82, 0x0c, 0x2a, 0x2e, 0x62, 0x61, 0x64, 0x73,
909  0x73, 0x6c, 0x2e, 0x63, 0x6f, 0x6d, 0x82, 0x0a,
910  0x62, 0x61, 0x64, 0x73, 0x73, 0x6c, 0x2e, 0x63,
911  0x6f, 0x6d, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86,
912  0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0b, 0x05,
913  0x00, 0x03, 0x82, 0x01, 0x01, 0x00, 0x6a, 0x7a,
914  0xf1, 0xda, 0xff, 0x03, 0x07, 0x72, 0x78, 0xc5,
915  0x66, 0xa1, 0x4f, 0x46, 0x43, 0x0e, 0x5f, 0x14,
916  0x21, 0x8c, 0x75, 0x1a, 0xeb, 0x36, 0xe0, 0x1f,
917  0xa4, 0x10, 0x15, 0xec, 0xda, 0x33, 0x25, 0x7c,
918  0x3b, 0xb5, 0x0a, 0xc7, 0x01, 0x38, 0x3d, 0x27,
919  0xfd, 0x58, 0xd9, 0xcc, 0xea, 0x2d, 0x69, 0x39,
920  0x7c, 0xbe, 0x97, 0xef, 0x0b, 0xd6, 0x0b, 0x58,
921  0xe7, 0x8c, 0x7f, 0xbf, 0xb3, 0x4c, 0x1d, 0xf3,
922  0xb7, 0x90, 0x80, 0xa6, 0x36, 0x7c, 0x14, 0x5b,
923  0xec, 0x07, 0x2d, 0x02, 0x3e, 0x1b, 0x5b, 0x63,
924  0x5b, 0x15, 0xab, 0x00, 0xfa, 0x1f, 0x3b, 0x19,
925  0x2d, 0xdf, 0xe2, 0x23, 0x10, 0x11, 0x07, 0x7e,
926  0x72, 0x7f, 0xe2, 0xbf, 0xb7, 0x00, 0x1b, 0x98,
927  0x2f, 0x2c, 0x3f, 0xce, 0x85, 0x9a, 0x27, 0x8c,
928  0x10, 0x22, 0x08, 0x41, 0x2b, 0x8a, 0x3e, 0x82,
929  0x4e, 0xfc, 0xdd, 0x21, 0xc6, 0x56, 0x74, 0x70,
930  0xa4, 0x34, 0xf2, 0xb1, 0x40, 0x9e, 0x2b, 0x58,
931  0xa2, 0x59, 0x0f, 0x1d, 0x48, 0xef, 0xeb, 0x11,
932  0x3e, 0xc1, 0x4a, 0x9e, 0xbc, 0x65, 0x55, 0x6d,
933  0xc6, 0xa3, 0xef, 0xd5, 0xd4, 0x96, 0xcd, 0xf1,
934  0xae, 0x27, 0xf7, 0xa4, 0x57, 0x14, 0x3c, 0x94,
935  0x41, 0x05, 0x7a, 0x8b, 0xa1, 0x37, 0x47, 0xd7,
936  0xf5, 0x7d, 0xdc, 0xfa, 0xce, 0x6f, 0x31, 0xa2,
937  0xb0, 0x8c, 0xea, 0xcc, 0x12, 0x9b, 0x22, 0xf1,
938  0x34, 0x70, 0xcf, 0x7d, 0x75, 0x4a, 0x8b, 0x68,
939  0x29, 0x0c, 0x1e, 0xe9, 0x96, 0xa8, 0xcf, 0xb0,
940  0x12, 0x1f, 0x5c, 0x2a, 0xee, 0x67, 0x2f, 0x7f,
941  0xbd, 0x73, 0xf3, 0x5a, 0x01, 0x22, 0x0c, 0x70,
942  0xfa, 0xcd, 0x45, 0xef, 0x78, 0x5c, 0xce, 0x0d,
943  0xfa, 0x4e, 0xe1, 0xef, 0xce, 0x65, 0x9f, 0x47,
944  0x0c, 0x4f, 0xbb, 0x36, 0x44, 0x68, 0x56, 0x5c,
945  0x56, 0x59, 0xad, 0xaa, 0x8a, 0xbc,
946  };
947 
948  Flow f;
949  SSLState *ssl_state = NULL;
950  TcpSession ssn;
951  Packet *p1 = NULL;
952  Packet *p2 = NULL;
953  Packet *p3 = NULL;
954  ThreadVars tv;
955  DetectEngineThreadCtx *det_ctx = NULL;
956  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
957 
958  memset(&tv, 0, sizeof(ThreadVars));
959  StatsThreadInit(&tv.stats);
960  memset(&f, 0, sizeof(Flow));
961  memset(&ssn, 0, sizeof(TcpSession));
962 
963  p1 = UTHBuildPacketReal(client_hello, sizeof(client_hello), IPPROTO_TCP,
964  "192.168.1.5", "192.168.1.1", 51251, 443);
965  p2 = UTHBuildPacketReal(server_hello, sizeof(server_hello), IPPROTO_TCP,
966  "192.168.1.1", "192.168.1.5", 443, 51251);
967  p3 = UTHBuildPacketReal(certificate, sizeof(certificate), IPPROTO_TCP,
968  "192.168.1.1", "192.168.1.5", 443, 51251);
969 
970  FLOW_INITIALIZE(&f);
971  f.flags |= FLOW_IPV4;
972  f.proto = IPPROTO_TCP;
973  f.protomap = FlowGetProtoMapping(f.proto);
974  f.alproto = ALPROTO_TLS;
975 
976  p1->flow = &f;
977  p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
978  p1->flowflags |= FLOW_PKT_TOSERVER;
979  p1->flowflags |= FLOW_PKT_ESTABLISHED;
980  p1->pcap_cnt = 1;
981 
982  p2->flow = &f;
983  p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
984  p2->flowflags |= FLOW_PKT_TOCLIENT;
985  p2->flowflags |= FLOW_PKT_ESTABLISHED;
986  p2->pcap_cnt = 2;
987 
988  p3->flow = &f;
989  p3->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
990  p3->flowflags |= FLOW_PKT_TOCLIENT;
991  p3->flowflags |= FLOW_PKT_ESTABLISHED;
992  p3->pcap_cnt = 3;
993 
994  f.lastts = SCTIME_FROM_SECS(1474978656L); /* 2016-09-27 */
995 
996  StreamTcpInitConfig(true);
997 
998  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
999  FAIL_IF_NULL(de_ctx);
1000 
1001  de_ctx->flags |= DE_QUIET;
1002 
1003  Signature *s = DetectEngineAppendSig(de_ctx, "alert tls any any -> any any "
1004  "(msg:\"Test tls_cert_expired\"; "
1005  "tls_cert_expired; sid:1;)");
1006  FAIL_IF_NULL(s);
1007 
1008  SigGroupBuild(de_ctx);
1009  DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
1010 
1011  int r = AppLayerParserParse(
1012  NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, client_hello, sizeof(client_hello));
1013  FAIL_IF(r != 0);
1014 
1015  ssl_state = f.alstate;
1016  FAIL_IF_NULL(ssl_state);
1017 
1018  SigMatchSignatures(&tv, de_ctx, det_ctx, p1);
1019  FAIL_IF(PacketAlertCheck(p1, 1));
1020 
1021  r = AppLayerParserParse(
1022  NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOCLIENT, server_hello, sizeof(server_hello));
1023  FAIL_IF(r != 0);
1024 
1025  SigMatchSignatures(&tv, de_ctx, det_ctx, p2);
1026  FAIL_IF(PacketAlertCheck(p2, 1));
1027 
1028  r = AppLayerParserParse(
1029  NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOCLIENT, certificate, sizeof(certificate));
1030  FAIL_IF(r != 0);
1031 
1032  SigMatchSignatures(&tv, de_ctx, det_ctx, p3);
1033  FAIL_IF_NOT(PacketAlertCheck(p3, 1));
1034 
1035  UTHFreePacket(p1);
1036  UTHFreePacket(p2);
1037  UTHFreePacket(p3);
1038  FLOW_DESTROY(&f);
1039 
1040  AppLayerParserThreadCtxFree(alp_tctx);
1041  DetectEngineThreadCtxDeinit(&tv, det_ctx);
1042  DetectEngineCtxFree(de_ctx);
1043  StreamTcpFreeConfig(true);
1044  StatsThreadCleanup(&tv.stats);
1045  PASS;
1046 }
1047 
1048 /**
1049  * \test Test matching on a valid TLS certificate.
1050  *
1051  * \retval 1 on success.
1052  * \retval 0 on failure.
1053  */
1054 static int ValidTestDetect01(void)
1055 {
1056  /* client hello */
1057  uint8_t client_hello[] = {
1058  0x16, 0x03, 0x01, 0x00, 0xc8, 0x01, 0x00, 0x00,
1059  0xc4, 0x03, 0x03, 0xd6, 0x08, 0x5a, 0xa2, 0x86,
1060  0x5b, 0x85, 0xd4, 0x40, 0xab, 0xbe, 0xc0, 0xbc,
1061  0x41, 0xf2, 0x26, 0xf0, 0xfe, 0x21, 0xee, 0x8b,
1062  0x4c, 0x7e, 0x07, 0xc8, 0xec, 0xd2, 0x00, 0x46,
1063  0x4c, 0xeb, 0xb7, 0x00, 0x00, 0x16, 0xc0, 0x2b,
1064  0xc0, 0x2f, 0xc0, 0x0a, 0xc0, 0x09, 0xc0, 0x13,
1065  0xc0, 0x14, 0x00, 0x33, 0x00, 0x39, 0x00, 0x2f,
1066  0x00, 0x35, 0x00, 0x0a, 0x01, 0x00, 0x00, 0x85,
1067  0x00, 0x00, 0x00, 0x12, 0x00, 0x10, 0x00, 0x00,
1068  0x0d, 0x77, 0x77, 0x77, 0x2e, 0x67, 0x6f, 0x6f,
1069  0x67, 0x6c, 0x65, 0x2e, 0x6e, 0x6f, 0xff, 0x01,
1070  0x00, 0x01, 0x00, 0x00, 0x0a, 0x00, 0x08, 0x00,
1071  0x06, 0x00, 0x17, 0x00, 0x18, 0x00, 0x19, 0x00,
1072  0x0b, 0x00, 0x02, 0x01, 0x00, 0x00, 0x23, 0x00,
1073  0x00, 0x33, 0x74, 0x00, 0x00, 0x00, 0x10, 0x00,
1074  0x29, 0x00, 0x27, 0x05, 0x68, 0x32, 0x2d, 0x31,
1075  0x36, 0x05, 0x68, 0x32, 0x2d, 0x31, 0x35, 0x05,
1076  0x68, 0x32, 0x2d, 0x31, 0x34, 0x02, 0x68, 0x32,
1077  0x08, 0x73, 0x70, 0x64, 0x79, 0x2f, 0x33, 0x2e,
1078  0x31, 0x08, 0x68, 0x74, 0x74, 0x70, 0x2f, 0x31,
1079  0x2e, 0x31, 0x00, 0x05, 0x00, 0x05, 0x01, 0x00,
1080  0x00, 0x00, 0x00, 0x00, 0x0d, 0x00, 0x16, 0x00,
1081  0x14, 0x04, 0x01, 0x05, 0x01, 0x06, 0x01, 0x02,
1082  0x01, 0x04, 0x03, 0x05, 0x03, 0x06, 0x03, 0x02,
1083  0x03, 0x04, 0x02, 0x02, 0x02
1084  };
1085 
1086  /* server hello */
1087  uint8_t server_hello[] = {
1088  0x16, 0x03, 0x03, 0x00, 0x48, 0x02, 0x00, 0x00,
1089  0x44, 0x03, 0x03, 0x57, 0x91, 0xb8, 0x63, 0xdd,
1090  0xdb, 0xbb, 0x23, 0xcf, 0x0b, 0x43, 0x02, 0x1d,
1091  0x46, 0x11, 0x27, 0x5c, 0x98, 0xcf, 0x67, 0xe1,
1092  0x94, 0x3d, 0x62, 0x7d, 0x38, 0x48, 0x21, 0x23,
1093  0xa5, 0x62, 0x31, 0x00, 0xc0, 0x2f, 0x00, 0x00,
1094  0x1c, 0xff, 0x01, 0x00, 0x01, 0x00, 0x00, 0x00,
1095  0x00, 0x00, 0x00, 0x23, 0x00, 0x00, 0x00, 0x10,
1096  0x00, 0x05, 0x00, 0x03, 0x02, 0x68, 0x32, 0x00,
1097  0x0b, 0x00, 0x02, 0x01, 0x00
1098  };
1099 
1100  /* certificate */
1101  uint8_t certificate[] = {
1102  0x16, 0x03, 0x03, 0x04, 0x93, 0x0b, 0x00, 0x04,
1103  0x8f, 0x00, 0x04, 0x8c, 0x00, 0x04, 0x89, 0x30,
1104  0x82, 0x04, 0x85, 0x30, 0x82, 0x03, 0x6d, 0xa0,
1105  0x03, 0x02, 0x01, 0x02, 0x02, 0x08, 0x5c, 0x19,
1106  0xb7, 0xb1, 0x32, 0x3b, 0x1c, 0xa1, 0x30, 0x0d,
1107  0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d,
1108  0x01, 0x01, 0x0b, 0x05, 0x00, 0x30, 0x49, 0x31,
1109  0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06,
1110  0x13, 0x02, 0x55, 0x53, 0x31, 0x13, 0x30, 0x11,
1111  0x06, 0x03, 0x55, 0x04, 0x0a, 0x13, 0x0a, 0x47,
1112  0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x20, 0x49, 0x6e,
1113  0x63, 0x31, 0x25, 0x30, 0x23, 0x06, 0x03, 0x55,
1114  0x04, 0x03, 0x13, 0x1c, 0x47, 0x6f, 0x6f, 0x67,
1115  0x6c, 0x65, 0x20, 0x49, 0x6e, 0x74, 0x65, 0x72,
1116  0x6e, 0x65, 0x74, 0x20, 0x41, 0x75, 0x74, 0x68,
1117  0x6f, 0x72, 0x69, 0x74, 0x79, 0x20, 0x47, 0x32,
1118  0x30, 0x1e, 0x17, 0x0d, 0x31, 0x36, 0x30, 0x37,
1119  0x31, 0x33, 0x31, 0x33, 0x32, 0x34, 0x35, 0x32,
1120  0x5a, 0x17, 0x0d, 0x31, 0x36, 0x31, 0x30, 0x30,
1121  0x35, 0x31, 0x33, 0x31, 0x36, 0x30, 0x30, 0x5a,
1122  0x30, 0x65, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03,
1123  0x55, 0x04, 0x06, 0x13, 0x02, 0x55, 0x53, 0x31,
1124  0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x08,
1125  0x0c, 0x0a, 0x43, 0x61, 0x6c, 0x69, 0x66, 0x6f,
1126  0x72, 0x6e, 0x69, 0x61, 0x31, 0x16, 0x30, 0x14,
1127  0x06, 0x03, 0x55, 0x04, 0x07, 0x0c, 0x0d, 0x4d,
1128  0x6f, 0x75, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x20,
1129  0x56, 0x69, 0x65, 0x77, 0x31, 0x13, 0x30, 0x11,
1130  0x06, 0x03, 0x55, 0x04, 0x0a, 0x0c, 0x0a, 0x47,
1131  0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x20, 0x49, 0x6e,
1132  0x63, 0x31, 0x14, 0x30, 0x12, 0x06, 0x03, 0x55,
1133  0x04, 0x03, 0x0c, 0x0b, 0x2a, 0x2e, 0x67, 0x6f,
1134  0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x6e, 0x6f, 0x30,
1135  0x82, 0x01, 0x22, 0x30, 0x0d, 0x06, 0x09, 0x2a,
1136  0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01,
1137  0x05, 0x00, 0x03, 0x82, 0x01, 0x0f, 0x00, 0x30,
1138  0x82, 0x01, 0x0a, 0x02, 0x82, 0x01, 0x01, 0x00,
1139  0xa5, 0x0a, 0xb9, 0xb1, 0xca, 0x36, 0xd1, 0xae,
1140  0x22, 0x38, 0x07, 0x06, 0xc9, 0x1a, 0x56, 0x4f,
1141  0xbb, 0xdf, 0xa8, 0x6d, 0xbd, 0xee, 0x76, 0x16,
1142  0xbc, 0x53, 0x3c, 0x03, 0x6a, 0x5c, 0x94, 0x50,
1143  0x87, 0x2f, 0x28, 0xb4, 0x4e, 0xd5, 0x9b, 0x8f,
1144  0xfe, 0x02, 0xde, 0x2a, 0x83, 0x01, 0xf9, 0x45,
1145  0x61, 0x0e, 0x66, 0x0e, 0x24, 0x22, 0xe2, 0x59,
1146  0x66, 0x0d, 0xd3, 0xe9, 0x77, 0x8a, 0x7e, 0x42,
1147  0xaa, 0x5a, 0xf9, 0x05, 0xbf, 0x30, 0xc7, 0x03,
1148  0x2b, 0xdc, 0xa6, 0x9c, 0xe0, 0x9f, 0x0d, 0xf1,
1149  0x28, 0x19, 0xf8, 0xf2, 0x02, 0xfa, 0xbd, 0x62,
1150  0xa0, 0xf3, 0x02, 0x2b, 0xcd, 0xf7, 0x09, 0x04,
1151  0x3b, 0x52, 0xd8, 0x65, 0x4b, 0x4a, 0x70, 0xe4,
1152  0x57, 0xc9, 0x2e, 0x2a, 0xf6, 0x9c, 0x6e, 0xd8,
1153  0xde, 0x01, 0x52, 0xc9, 0x6f, 0xe9, 0xef, 0x82,
1154  0xbc, 0x0b, 0x95, 0xb2, 0xef, 0xcb, 0x91, 0xa6,
1155  0x0b, 0x2d, 0x14, 0xc6, 0x00, 0xa9, 0x33, 0x86,
1156  0x64, 0x00, 0xd4, 0x92, 0x19, 0x53, 0x3d, 0xfd,
1157  0xcd, 0xc6, 0x1a, 0xf2, 0x0e, 0x67, 0xc2, 0x1d,
1158  0x2c, 0xe0, 0xe8, 0x29, 0x97, 0x1c, 0xb6, 0xc4,
1159  0xb2, 0x02, 0x0c, 0x83, 0xb8, 0x60, 0x61, 0xf5,
1160  0x61, 0x2d, 0x73, 0x5e, 0x85, 0x4d, 0xbd, 0x0d,
1161  0xe7, 0x1a, 0x37, 0x56, 0x8d, 0xe5, 0x50, 0x0c,
1162  0xc9, 0x64, 0x4c, 0x11, 0xea, 0xf3, 0xcb, 0x26,
1163  0x34, 0xbd, 0x02, 0xf5, 0xc1, 0xfb, 0xa2, 0xec,
1164  0x27, 0xbb, 0x60, 0xbe, 0x0b, 0xf6, 0xe7, 0x3c,
1165  0x2d, 0xc9, 0xe7, 0xb0, 0x30, 0x28, 0x17, 0x3d,
1166  0x90, 0xf1, 0x63, 0x8e, 0x49, 0xf7, 0x15, 0x78,
1167  0x21, 0xcc, 0x45, 0xe6, 0x86, 0xb2, 0xd8, 0xb0,
1168  0x2e, 0x5a, 0xb0, 0x58, 0xd3, 0xb6, 0x11, 0x40,
1169  0xae, 0x81, 0x1f, 0x6b, 0x7a, 0xaf, 0x40, 0x50,
1170  0xf9, 0x2e, 0x81, 0x8b, 0xec, 0x26, 0x11, 0x3f,
1171  0x02, 0x03, 0x01, 0x00, 0x01, 0xa3, 0x82, 0x01,
1172  0x53, 0x30, 0x82, 0x01, 0x4f, 0x30, 0x1d, 0x06,
1173  0x03, 0x55, 0x1d, 0x25, 0x04, 0x16, 0x30, 0x14,
1174  0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07,
1175  0x03, 0x01, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05,
1176  0x05, 0x07, 0x03, 0x02, 0x30, 0x21, 0x06, 0x03,
1177  0x55, 0x1d, 0x11, 0x04, 0x1a, 0x30, 0x18, 0x82,
1178  0x0b, 0x2a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
1179  0x65, 0x2e, 0x6e, 0x6f, 0x82, 0x09, 0x67, 0x6f,
1180  0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x6e, 0x6f, 0x30,
1181  0x68, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05,
1182  0x07, 0x01, 0x01, 0x04, 0x5c, 0x30, 0x5a, 0x30,
1183  0x2b, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05,
1184  0x07, 0x30, 0x02, 0x86, 0x1f, 0x68, 0x74, 0x74,
1185  0x70, 0x3a, 0x2f, 0x2f, 0x70, 0x6b, 0x69, 0x2e,
1186  0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x63,
1187  0x6f, 0x6d, 0x2f, 0x47, 0x49, 0x41, 0x47, 0x32,
1188  0x2e, 0x63, 0x72, 0x74, 0x30, 0x2b, 0x06, 0x08,
1189  0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x30, 0x01,
1190  0x86, 0x1f, 0x68, 0x74, 0x74, 0x70, 0x3a, 0x2f,
1191  0x2f, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x73,
1192  0x31, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
1193  0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6f, 0x63, 0x73,
1194  0x70, 0x30, 0x1d, 0x06, 0x03, 0x55, 0x1d, 0x0e,
1195  0x04, 0x16, 0x04, 0x14, 0xc6, 0x53, 0x87, 0x42,
1196  0x2d, 0xc8, 0xee, 0x7a, 0x62, 0x1e, 0x83, 0xdb,
1197  0x0d, 0xe2, 0x32, 0xeb, 0x8b, 0xaf, 0x69, 0x40,
1198  0x30, 0x0c, 0x06, 0x03, 0x55, 0x1d, 0x13, 0x01,
1199  0x01, 0xff, 0x04, 0x02, 0x30, 0x00, 0x30, 0x1f,
1200  0x06, 0x03, 0x55, 0x1d, 0x23, 0x04, 0x18, 0x30,
1201  0x16, 0x80, 0x14, 0x4a, 0xdd, 0x06, 0x16, 0x1b,
1202  0xbc, 0xf6, 0x68, 0xb5, 0x76, 0xf5, 0x81, 0xb6,
1203  0xbb, 0x62, 0x1a, 0xba, 0x5a, 0x81, 0x2f, 0x30,
1204  0x21, 0x06, 0x03, 0x55, 0x1d, 0x20, 0x04, 0x1a,
1205  0x30, 0x18, 0x30, 0x0c, 0x06, 0x0a, 0x2b, 0x06,
1206  0x01, 0x04, 0x01, 0xd6, 0x79, 0x02, 0x05, 0x01,
1207  0x30, 0x08, 0x06, 0x06, 0x67, 0x81, 0x0c, 0x01,
1208  0x02, 0x02, 0x30, 0x30, 0x06, 0x03, 0x55, 0x1d,
1209  0x1f, 0x04, 0x29, 0x30, 0x27, 0x30, 0x25, 0xa0,
1210  0x23, 0xa0, 0x21, 0x86, 0x1f, 0x68, 0x74, 0x74,
1211  0x70, 0x3a, 0x2f, 0x2f, 0x70, 0x6b, 0x69, 0x2e,
1212  0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x63,
1213  0x6f, 0x6d, 0x2f, 0x47, 0x49, 0x41, 0x47, 0x32,
1214  0x2e, 0x63, 0x72, 0x6c, 0x30, 0x0d, 0x06, 0x09,
1215  0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01,
1216  0x0b, 0x05, 0x00, 0x03, 0x82, 0x01, 0x01, 0x00,
1217  0x7b, 0x27, 0x00, 0x46, 0x8f, 0xfd, 0x5b, 0xff,
1218  0xcb, 0x05, 0x9b, 0xf7, 0xf1, 0x68, 0xf6, 0x9a,
1219  0x7b, 0xba, 0x53, 0xdf, 0x63, 0xed, 0x11, 0x94,
1220  0x39, 0xf2, 0xd0, 0x20, 0xcd, 0xa3, 0xc4, 0x98,
1221  0xa5, 0x10, 0x74, 0xe7, 0x10, 0x6d, 0x07, 0xf8,
1222  0x33, 0x87, 0x05, 0x43, 0x0e, 0x64, 0x77, 0x09,
1223  0x18, 0x4f, 0x38, 0x2e, 0x45, 0xae, 0xa8, 0x34,
1224  0x3a, 0xa8, 0x33, 0xac, 0x9d, 0xdd, 0x25, 0x91,
1225  0x59, 0x43, 0xbe, 0x0f, 0x87, 0x16, 0x2f, 0xb5,
1226  0x27, 0xfd, 0xce, 0x2f, 0x35, 0x5d, 0x12, 0xa1,
1227  0x66, 0xac, 0xf7, 0x95, 0x38, 0x0f, 0xe5, 0xb1,
1228  0x18, 0x18, 0xe6, 0x80, 0x52, 0x31, 0x8a, 0x66,
1229  0x02, 0x52, 0x1a, 0xa4, 0x32, 0x6a, 0x61, 0x05,
1230  0xcf, 0x1d, 0xf9, 0x90, 0x73, 0xf0, 0xeb, 0x20,
1231  0x31, 0x7b, 0x2e, 0xc0, 0xb0, 0xfb, 0x5c, 0xcc,
1232  0xdc, 0x76, 0x55, 0x72, 0xaf, 0xb1, 0x05, 0xf4,
1233  0xad, 0xf9, 0xd7, 0x73, 0x5c, 0x2c, 0xbf, 0x0d,
1234  0x84, 0x18, 0x01, 0x1d, 0x4d, 0x08, 0xa9, 0x4e,
1235  0x37, 0xb7, 0x58, 0xc4, 0x05, 0x0e, 0x65, 0x63,
1236  0xd2, 0x88, 0x02, 0xf5, 0x82, 0x17, 0x08, 0xd5,
1237  0x8f, 0x80, 0xc7, 0x82, 0x29, 0xbb, 0xe1, 0x04,
1238  0xbe, 0xf6, 0xe1, 0x8c, 0xbc, 0x3a, 0xf8, 0xf9,
1239  0x56, 0xda, 0xdc, 0x8e, 0xc6, 0xe6, 0x63, 0x98,
1240  0x12, 0x08, 0x41, 0x2c, 0x9d, 0x7c, 0x82, 0x0d,
1241  0x1e, 0xea, 0xba, 0xde, 0x32, 0x09, 0xda, 0x52,
1242  0x24, 0x4f, 0xcc, 0xb6, 0x09, 0x33, 0x8b, 0x00,
1243  0xf9, 0x83, 0xb3, 0xc6, 0xa4, 0x90, 0x49, 0x83,
1244  0x2d, 0x36, 0xd9, 0x11, 0x78, 0xd0, 0x62, 0x9f,
1245  0xc4, 0x8f, 0x84, 0xba, 0x7f, 0xaa, 0x04, 0xf1,
1246  0xd9, 0xa4, 0xad, 0x5d, 0x63, 0xee, 0x72, 0xc6,
1247  0x4d, 0xd1, 0x4b, 0x41, 0x8f, 0x40, 0x0f, 0x7d,
1248  0xcd, 0xb8, 0x2e, 0x5b, 0x6e, 0x21, 0xc9, 0x3d
1249  };
1250 
1251  Flow f;
1252  SSLState *ssl_state = NULL;
1253  TcpSession ssn;
1254  Packet *p1 = NULL;
1255  Packet *p2 = NULL;
1256  Packet *p3 = NULL;
1257  ThreadVars tv;
1258  DetectEngineThreadCtx *det_ctx = NULL;
1259  AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
1260 
1261  memset(&tv, 0, sizeof(ThreadVars));
1262  StatsThreadInit(&tv.stats);
1263  memset(&f, 0, sizeof(Flow));
1264  memset(&ssn, 0, sizeof(TcpSession));
1265 
1266  p1 = UTHBuildPacketReal(client_hello, sizeof(client_hello), IPPROTO_TCP,
1267  "192.168.1.5", "192.168.1.1", 51251, 443);
1268  p2 = UTHBuildPacketReal(server_hello, sizeof(server_hello), IPPROTO_TCP,
1269  "192.168.1.1", "192.168.1.5", 443, 51251);
1270  p3 = UTHBuildPacketReal(certificate, sizeof(certificate), IPPROTO_TCP,
1271  "192.168.1.1", "192.168.1.5", 443, 51251);
1272 
1273  FLOW_INITIALIZE(&f);
1274  f.flags |= FLOW_IPV4;
1275  f.proto = IPPROTO_TCP;
1276  f.protomap = FlowGetProtoMapping(f.proto);
1277  f.alproto = ALPROTO_TLS;
1278 
1279  p1->flow = &f;
1280  p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
1281  p1->flowflags |= FLOW_PKT_TOSERVER;
1282  p1->flowflags |= FLOW_PKT_ESTABLISHED;
1283  p1->pcap_cnt = 1;
1284 
1285  p2->flow = &f;
1286  p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
1287  p2->flowflags |= FLOW_PKT_TOCLIENT;
1288  p2->flowflags |= FLOW_PKT_ESTABLISHED;
1289  p2->pcap_cnt = 2;
1290 
1291  p3->flow = &f;
1292  p3->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
1293  p3->flowflags |= FLOW_PKT_TOCLIENT;
1294  p3->flowflags |= FLOW_PKT_ESTABLISHED;
1295  p3->pcap_cnt = 3;
1296 
1297  f.lastts = SCTIME_FROM_SECS(1474978656L); /* 2016-09-27 */
1298 
1299  StreamTcpInitConfig(true);
1300 
1301  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
1302  FAIL_IF_NULL(de_ctx);
1303 
1304  de_ctx->flags |= DE_QUIET;
1305 
1306  Signature *s = DetectEngineAppendSig(de_ctx, "alert tls any any -> any any "
1307  "(msg:\"Test tls_cert_valid\"; "
1308  "tls_cert_valid; sid:1;)");
1309  FAIL_IF_NULL(s);
1310 
1311  SigGroupBuild(de_ctx);
1312  DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
1313 
1314  int r = AppLayerParserParse(
1315  NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, client_hello, sizeof(client_hello));
1316  FAIL_IF(r != 0);
1317 
1318  ssl_state = f.alstate;
1319  FAIL_IF_NULL(ssl_state);
1320 
1321  SigMatchSignatures(&tv, de_ctx, det_ctx, p1);
1322  FAIL_IF(PacketAlertCheck(p1, 1));
1323 
1324  r = AppLayerParserParse(
1325  NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOCLIENT, server_hello, sizeof(server_hello));
1326  FAIL_IF(r != 0);
1327 
1328  SigMatchSignatures(&tv, de_ctx, det_ctx, p2);
1329  FAIL_IF(PacketAlertCheck(p2, 1));
1330 
1331  r = AppLayerParserParse(
1332  NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOCLIENT, certificate, sizeof(certificate));
1333  FAIL_IF(r != 0);
1334 
1335  SigMatchSignatures(&tv, de_ctx, det_ctx, p3);
1336  FAIL_IF_NOT(PacketAlertCheck(p3, 1));
1337 
1338  UTHFreePacket(p1);
1339  UTHFreePacket(p2);
1340  UTHFreePacket(p3);
1341  FLOW_DESTROY(&f);
1342 
1343  AppLayerParserThreadCtxFree(alp_tctx);
1344  DetectEngineThreadCtxDeinit(&tv, det_ctx);
1345  DetectEngineCtxFree(de_ctx);
1346  StreamTcpFreeConfig(true);
1347  StatsThreadCleanup(&tv.stats);
1348  PASS;
1349 }
1350 
1351 /**
1352  * \brief Register unit tests for tls_cert_notbefore.
1353  */
1354 void TlsNotBeforeRegisterTests(void)
1355 {
1356  UtRegisterTest("ValidityTestParse01", ValidityTestParse01);
1357  UtRegisterTest("ValidityTestParse03", ValidityTestParse03);
1358  UtRegisterTest("ValidityTestParse05", ValidityTestParse05);
1359  UtRegisterTest("ValidityTestParse07", ValidityTestParse07);
1360  UtRegisterTest("ValidityTestParse09", ValidityTestParse09);
1361  UtRegisterTest("ValidityTestParse11", ValidityTestParse11);
1362  UtRegisterTest("ValidityTestParse13", ValidityTestParse13);
1363  UtRegisterTest("ValidityTestParse15", ValidityTestParse15);
1364  UtRegisterTest("ValidityTestParse17", ValidityTestParse17);
1365  UtRegisterTest("ValidityTestParse19", ValidityTestParse19);
1366  UtRegisterTest("ValidityTestParse21", ValidityTestParse21);
1367  UtRegisterTest("ValidityTestParse23", ValidityTestParse23);
1368  UtRegisterTest("ValidityTestParse24", ValidityTestParse24);
1369  UtRegisterTest("ValidityTestParse25", ValidityTestParse25);
1370  UtRegisterTest("ValidityTestDetect01", ValidityTestDetect01);
1371 }
1372 
1373 /**
1374  * \brief Register unit tests for tls_cert_notafter.
1375  */
1376 void TlsNotAfterRegisterTests(void)
1377 {
1378  UtRegisterTest("ValidityTestParse02", ValidityTestParse02);
1379  UtRegisterTest("ValidityTestParse04", ValidityTestParse04);
1380  UtRegisterTest("ValidityTestParse06", ValidityTestParse06);
1381  UtRegisterTest("ValidityTestParse08", ValidityTestParse08);
1382  UtRegisterTest("ValidityTestParse10", ValidityTestParse10);
1383  UtRegisterTest("ValidityTestParse12", ValidityTestParse12);
1384  UtRegisterTest("ValidityTestParse14", ValidityTestParse14);
1385  UtRegisterTest("ValidityTestParse16", ValidityTestParse16);
1386  UtRegisterTest("ValidityTestParse18", ValidityTestParse18);
1387  UtRegisterTest("ValidityTestParse20", ValidityTestParse20);
1388  UtRegisterTest("ValidityTestParse22", ValidityTestParse22);
1389 }
1390 
1391 /**
1392  * \brief Register unit tests for tls_cert_expired
1393  */
1394 void TlsExpiredRegisterTests(void)
1395 {
1396  UtRegisterTest("ExpiredTestDetect01", ExpiredTestDetect01);
1397 }
1398 
1399 /**
1400  * \brief Register unit tests for tls_cert_valid
1401  */
1402 void TlsValidRegisterTests(void)
1403 {
1404  UtRegisterTest("ValidTestDetect01", ValidTestDetect01);
1405 }
SSLState_
SSLv[2.0|3.[0|1|2|3]] state structure.
Definition: app-layer-ssl.h:227
FAIL_IF_NULL
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
Definition: util-unittest.h:89
PKT_HAS_FLOW
#define PKT_HAS_FLOW
Definition: decode.h:1268
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
ALPROTO_TLS
@ ALPROTO_TLS
Definition: app-layer-protos.h:39
DETECT_TLS_VALIDITY_EQ
#define DETECT_TLS_VALIDITY_EQ
Definition: detect-tls-cert-validity.h:27
Packet_::pcap_cnt
uint64_t pcap_cnt
Definition: decode.h:626
TlsNotBeforeRegisterTests
void TlsNotBeforeRegisterTests(void)
Register unit tests for tls_cert_notbefore.
Definition: detect-tls-cert-validity.c:1354
Flow_::proto
uint8_t proto
Definition: flow.h:370
TlsNotAfterRegisterTests
void TlsNotAfterRegisterTests(void)
Register unit tests for tls_cert_notafter.
Definition: detect-tls-cert-validity.c:1376
PacketAlertCheck
int PacketAlertCheck(Packet *p, uint32_t sid)
Check if a certain sid alerted, this is used in the test functions.
Definition: detect-engine-alert.c:142
Packet_::flags
uint32_t flags
Definition: decode.h:544
Flow_
Flow data structure.
Definition: flow.h:348
Flow_::protomap
uint8_t protomap
Definition: flow.h:437
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:933
DetectEngineCtxFree
void DetectEngineCtxFree(DetectEngineCtx *)
Free a DetectEngineCtx::
Definition: detect-engine.c:2634
DETECT_TLS_VALIDITY_RA
#define DETECT_TLS_VALIDITY_RA
Definition: detect-tls-cert-validity.h:30
AppLayerParserThreadCtxFree
void AppLayerParserThreadCtxFree(AppLayerParserThreadCtx *tctx)
Destroys the app layer parser thread context obtained using AppLayerParserThreadCtxAlloc().
Definition: app-layer-parser.c:324
FLOW_PKT_TOSERVER
#define FLOW_PKT_TOSERVER
Definition: flow.h:225
DE_QUIET
#define DE_QUIET
Definition: detect.h:330
SigMatchSignatures
void SigMatchSignatures(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p)
wrapper for old tests
Definition: detect.c:2418
DetectEngineAppendSig
Signature * DetectEngineAppendSig(DetectEngineCtx *, const char *)
Parse and append a Signature into the Detection Engine Context signature list.
Definition: detect-parse.c:3447
Packet_::flowflags
uint8_t flowflags
Definition: decode.h:532
UTHBuildPacketReal
Packet * UTHBuildPacketReal(uint8_t *payload, uint16_t payload_len, uint8_t ipproto, const char *src, const char *dst, uint16_t sport, uint16_t dport)
UTHBuildPacketReal is a function that create tcp/udp packets for unittests specifying ip and port sou...
Definition: util-unittest-helper.c:260
FLOW_IPV4
#define FLOW_IPV4
Definition: flow.h:100
FAIL_IF_NOT
#define FAIL_IF_NOT(expr)
Fail a test if expression evaluates to false.
Definition: util-unittest.h:82
SCTIME_FROM_SECS
#define SCTIME_FROM_SECS(s)
Definition: util-time.h:69
StreamTcpInitConfig
void StreamTcpInitConfig(bool)
To initialize the stream global configuration data.
Definition: stream-tcp.c:496
FLOW_INITIALIZE
#define FLOW_INITIALIZE(f)
Definition: flow-util.h:38
FAIL_IF_NOT_NULL
#define FAIL_IF_NOT_NULL(expr)
Fail a test if expression evaluates to non-NULL.
Definition: util-unittest.h:96
PASS
#define PASS
Pass the test.
Definition: util-unittest.h:105
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:18
DetectEngineThreadCtx_
Definition: detect.h:1245
Flow_::lastts
SCTime_t lastts
Definition: flow.h:402
alp_tctx
AppLayerParserThreadCtx * alp_tctx
Definition: fuzz_applayerparserparse.c:23
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:58
DetectTlsValidityData_
Definition: detect-tls-cert-validity.h:41
DetectEngineThreadCtxInit
TmEcode DetectEngineThreadCtxInit(ThreadVars *tv, void *initdata, void **data)
initialize thread specific detection engine context
Definition: detect-engine.c:3364
DetectTlsValidityData_::mode
uint8_t mode
Definition: detect-tls-cert-validity.h:44
app-layer-parser.h
FlowGetProtoMapping
uint8_t FlowGetProtoMapping(uint8_t proto)
Function to map the protocol to the defined FLOW_PROTO_* enumeration.
Definition: flow-util.c:99
Packet_
Definition: decode.h:501
detect-engine-build.h
detect-engine-alert.h
FLOW_PKT_TOCLIENT
#define FLOW_PKT_TOCLIENT
Definition: flow.h:226
SigGroupBuild
int SigGroupBuild(DetectEngineCtx *de_ctx)
Convert the signature list into the runtime match structure.
Definition: detect-engine-build.c:2194
StatsThreadInit
void StatsThreadInit(StatsThreadContext *stats)
Definition: counters.c:1258
AppLayerParserThreadCtxAlloc
AppLayerParserThreadCtx * AppLayerParserThreadCtxAlloc(void)
Gets a new app layer protocol's parser thread context.
Definition: app-layer-parser.c:297
Packet_::flow
struct Flow_ * flow
Definition: decode.h:546
FAIL_IF
#define FAIL_IF(expr)
Fail a test if expression evaluates to true.
Definition: util-unittest.h:71
StreamTcpFreeConfig
void StreamTcpFreeConfig(bool quiet)
Definition: stream-tcp.c:867
DETECT_TLS_VALIDITY_LT
#define DETECT_TLS_VALIDITY_LT
Definition: detect-tls-cert-validity.h:28
AppLayerParserParse
int AppLayerParserParse(ThreadVars *tv, AppLayerParserThreadCtx *alp_tctx, Flow *f, AppProto alproto, uint8_t flags, const uint8_t *input, uint32_t input_len)
Definition: app-layer-parser.c:1277
DetectEngineThreadCtxDeinit
TmEcode DetectEngineThreadCtxDeinit(ThreadVars *tv, void *data)
Definition: detect-engine.c:3601
DetectTlsValidityData_::epoch2
time_t epoch2
Definition: detect-tls-cert-validity.h:43
DETECT_TLS_VALIDITY_GT
#define DETECT_TLS_VALIDITY_GT
Definition: detect-tls-cert-validity.h:29
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:32
UTHFreePacket
void UTHFreePacket(Packet *p)
UTHFreePacket: function to release the allocated data from UTHBuildPacket and the packet itself.
Definition: util-unittest-helper.c:473
Flow_::alstate
void * alstate
Definition: flow.h:471
TlsValidRegisterTests
void TlsValidRegisterTests(void)
Register unit tests for tls_cert_valid.
Definition: detect-tls-cert-validity.c:1402
Flow_::flags
uint32_t flags
Definition: flow.h:413
DetectTlsValidityData_::epoch
time_t epoch
Definition: detect-tls-cert-validity.h:42
Signature_
Signature container.
Definition: detect.h:668
FLOW_PKT_ESTABLISHED
#define FLOW_PKT_ESTABLISHED
Definition: flow.h:227
DetectEngineCtxInit
DetectEngineCtx * DetectEngineCtxInit(void)
Definition: detect-engine.c:2595
DetectEngineCtx_::flags
uint8_t flags
Definition: detect.h:935
AppLayerParserThreadCtx_
Definition: app-layer-parser.c:60
TcpSession_
Definition: stream-tcp-private.h:283
Flow_::alproto
AppProto alproto
application level protocol
Definition: flow.h:442
ThreadVars_::stats
StatsThreadContext stats
Definition: threadvars.h:121
StatsThreadCleanup
void StatsThreadCleanup(StatsThreadContext *stats)
Definition: counters.c:1354
FLOW_DESTROY
#define FLOW_DESTROY(f)
Definition: flow-util.h:119
TlsExpiredRegisterTests
void TlsExpiredRegisterTests(void)
Register unit tests for tls_cert_expired.
Definition: detect-tls-cert-validity.c:1394
PKT_STREAM_EST
#define PKT_STREAM_EST
Definition: decode.h:1264