27 static void DetectTlsJa3SHashRegisterTests(
void)
37 static int DetectTlsJa3SHashTest01(
void)
40 uint8_t client_hello[] = {
41 0x16, 0x03, 0x01, 0x00, 0xc8, 0x01, 0x00, 0x00,
42 0xc4, 0x03, 0x03, 0xd6, 0x08, 0x5a, 0xa2, 0x86,
43 0x5b, 0x85, 0xd4, 0x40, 0xab, 0xbe, 0xc0, 0xbc,
44 0x41, 0xf2, 0x26, 0xf0, 0xfe, 0x21, 0xee, 0x8b,
45 0x4c, 0x7e, 0x07, 0xc8, 0xec, 0xd2, 0x00, 0x46,
46 0x4c, 0xeb, 0xb7, 0x00, 0x00, 0x16, 0xc0, 0x2b,
47 0xc0, 0x2f, 0xc0, 0x0a, 0xc0, 0x09, 0xc0, 0x13,
48 0xc0, 0x14, 0x00, 0x33, 0x00, 0x39, 0x00, 0x2f,
49 0x00, 0x35, 0x00, 0x0a, 0x01, 0x00, 0x00, 0x85,
50 0x00, 0x00, 0x00, 0x12, 0x00, 0x10, 0x00, 0x00,
51 0x0d, 0x77, 0x77, 0x77, 0x2e, 0x67, 0x6f, 0x6f,
52 0x67, 0x6c, 0x65, 0x2e, 0x6e, 0x6f, 0xff, 0x01,
53 0x00, 0x01, 0x00, 0x00, 0x0a, 0x00, 0x08, 0x00,
54 0x06, 0x00, 0x17, 0x00, 0x18, 0x00, 0x19, 0x00,
55 0x0b, 0x00, 0x02, 0x01, 0x00, 0x00, 0x23, 0x00,
56 0x00, 0x33, 0x74, 0x00, 0x00, 0x00, 0x10, 0x00,
57 0x29, 0x00, 0x27, 0x05, 0x68, 0x32, 0x2d, 0x31,
58 0x36, 0x05, 0x68, 0x32, 0x2d, 0x31, 0x35, 0x05,
59 0x68, 0x32, 0x2d, 0x31, 0x34, 0x02, 0x68, 0x32,
60 0x08, 0x73, 0x70, 0x64, 0x79, 0x2f, 0x33, 0x2e,
61 0x31, 0x08, 0x68, 0x74, 0x74, 0x70, 0x2f, 0x31,
62 0x2e, 0x31, 0x00, 0x05, 0x00, 0x05, 0x01, 0x00,
63 0x00, 0x00, 0x00, 0x00, 0x0d, 0x00, 0x16, 0x00,
64 0x14, 0x04, 0x01, 0x05, 0x01, 0x06, 0x01, 0x02,
65 0x01, 0x04, 0x03, 0x05, 0x03, 0x06, 0x03, 0x02,
66 0x03, 0x04, 0x02, 0x02, 0x02
70 uint8_t server_hello[] = {
71 0x16, 0x03, 0x03, 0x00, 0x48, 0x02, 0x00, 0x00,
72 0x44, 0x03, 0x03, 0x57, 0x91, 0xb8, 0x63, 0xdd,
73 0xdb, 0xbb, 0x23, 0xcf, 0x0b, 0x43, 0x02, 0x1d,
74 0x46, 0x11, 0x27, 0x5c, 0x98, 0xcf, 0x67, 0xe1,
75 0x94, 0x3d, 0x62, 0x7d, 0x38, 0x48, 0x21, 0x23,
76 0xa5, 0x62, 0x31, 0x00, 0xc0, 0x2f, 0x00, 0x00,
77 0x1c, 0xff, 0x01, 0x00, 0x01, 0x00, 0x00, 0x00,
78 0x00, 0x00, 0x00, 0x23, 0x00, 0x00, 0x00, 0x10,
79 0x00, 0x05, 0x00, 0x03, 0x02, 0x68, 0x32, 0x00,
80 0x0b, 0x00, 0x02, 0x01, 0x00
93 memset(&f, 0,
sizeof(
Flow));
97 "192.168.1.5",
"192.168.1.1", 51251, 443);
99 "192.168.1.1",
"192.168.1.5", 443, 51251);
103 f.
proto = IPPROTO_TCP;
128 "(msg:\"Test ja3s.hash\"; " 130 "content:\"8217013c502e3461d19c75bb02a12aaf\"; " 139 sizeof(client_hello));
151 server_hello,
sizeof(server_hello));
172 void DetectTlsJa3SHashRegisterTests(
void)
174 UtRegisterTest(
"DetectTlsJa3SHashTest01", DetectTlsJa3SHashTest01);
Signature * DetectEngineAppendSig(DetectEngineCtx *de_ctx, const char *sigstr)
Parse and append a Signature into the Detection Engine Context signature list.
int PacketAlertCheck(Packet *p, uint32_t sid)
Check if a certain sid alerted, this is used in the test functions.
#define PASS
Pass the test.
SSLStateConnp server_connp
#define FAIL_IF(expr)
Fail a test if expression evaluates to false.
void AppLayerParserThreadCtxFree(AppLayerParserThreadCtx *tctx)
Destroys the app layer parser thread context obtained using AppLayerParserThreadCtxAlloc().
uint8_t FlowGetProtoMapping(uint8_t proto)
Function to map the protocol to the defined FLOW_PROTO_* enumeration.
#define FLOW_PKT_ESTABLISHED
void StreamTcpFreeConfig(char quiet)
TmEcode DetectEngineThreadCtxInit(ThreadVars *, void *, void **)
initialize thread specific detection engine context
main detection engine ctx
TmEcode DetectEngineThreadCtxDeinit(ThreadVars *, void *)
SSLv[2.0|3.[0|1|2|3]] state structure.
int SigGroupBuild(DetectEngineCtx *de_ctx)
Convert the signature list into the runtime match structure.
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
void SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p)
wrapper for old tests
void StreamTcpInitConfig(char)
To initialize the stream global configuration data.
Packet * UTHBuildPacketReal(uint8_t *payload, uint16_t payload_len, uint8_t ipproto, const char *src, const char *dst, uint16_t sport, uint16_t dport)
UTHBuildPacketReal is a function that create tcp/udp packets for unittests specifying ip and port sou...
#define FLOW_PKT_TOSERVER
AppLayerParserThreadCtx * AppLayerParserThreadCtxAlloc(void)
Gets a new app layer protocol's parser thread context.
int AppLayerParserParse(ThreadVars *tv, AppLayerParserThreadCtx *alp_tctx, Flow *f, AppProto alproto, uint8_t flags, const uint8_t *input, uint32_t input_len)
#define FLOW_INITIALIZE(f)
void UTHFreePacket(Packet *p)
UTHFreePacket: function to release the allocated data from UTHBuildPacket and the packet itself...
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
Per thread variable structure.
#define FLOW_PKT_TOCLIENT
AppProto alproto
application level protocol
void DetectEngineCtxFree(DetectEngineCtx *)
Free a DetectEngineCtx::
#define FAIL_IF_NOT(expr)
Fail a test if expression to true.
DetectEngineCtx * DetectEngineCtxInit(void)