|
|
|
|
@ -671,7 +671,6 @@ static int ValidityTestDetect01(void)
|
|
|
|
|
|
|
|
|
|
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
|
|
|
|
|
FAIL_IF_NULL(de_ctx);
|
|
|
|
|
|
|
|
|
|
de_ctx->flags |= DE_QUIET;
|
|
|
|
|
|
|
|
|
|
Signature *s = DetectEngineAppendSig(de_ctx, "alert tls any any -> any any "
|
|
|
|
|
@ -687,37 +686,30 @@ static int ValidityTestDetect01(void)
|
|
|
|
|
SigGroupBuild(de_ctx);
|
|
|
|
|
DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
|
|
|
|
|
|
|
|
|
|
int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS,
|
|
|
|
|
STREAM_TOSERVER, client_hello,
|
|
|
|
|
sizeof(client_hello));
|
|
|
|
|
|
|
|
|
|
int r = AppLayerParserParse(
|
|
|
|
|
NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, client_hello, sizeof(client_hello));
|
|
|
|
|
FAIL_IF(r != 0);
|
|
|
|
|
|
|
|
|
|
ssl_state = f.alstate;
|
|
|
|
|
FAIL_IF_NULL(ssl_state);
|
|
|
|
|
|
|
|
|
|
SigMatchSignatures(&tv, de_ctx, det_ctx, p1);
|
|
|
|
|
|
|
|
|
|
FAIL_IF(PacketAlertCheck(p1, 1));
|
|
|
|
|
FAIL_IF(PacketAlertCheck(p1, 2));
|
|
|
|
|
|
|
|
|
|
r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOCLIENT,
|
|
|
|
|
server_hello, sizeof(server_hello));
|
|
|
|
|
|
|
|
|
|
r = AppLayerParserParse(
|
|
|
|
|
NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOCLIENT, server_hello, sizeof(server_hello));
|
|
|
|
|
FAIL_IF(r != 0);
|
|
|
|
|
|
|
|
|
|
SigMatchSignatures(&tv, de_ctx, det_ctx, p2);
|
|
|
|
|
|
|
|
|
|
FAIL_IF(PacketAlertCheck(p2, 1));
|
|
|
|
|
FAIL_IF(PacketAlertCheck(p2, 2));
|
|
|
|
|
|
|
|
|
|
r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOCLIENT,
|
|
|
|
|
certificate, sizeof(certificate));
|
|
|
|
|
|
|
|
|
|
r = AppLayerParserParse(
|
|
|
|
|
NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOCLIENT, certificate, sizeof(certificate));
|
|
|
|
|
FAIL_IF(r != 0);
|
|
|
|
|
|
|
|
|
|
SigMatchSignatures(&tv, de_ctx, det_ctx, p3);
|
|
|
|
|
|
|
|
|
|
FAIL_IF_NOT(PacketAlertCheck(p3, 1));
|
|
|
|
|
FAIL_IF_NOT(PacketAlertCheck(p3, 2));
|
|
|
|
|
|
|
|
|
|
@ -1014,34 +1006,28 @@ static int ExpiredTestDetect01(void)
|
|
|
|
|
SigGroupBuild(de_ctx);
|
|
|
|
|
DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
|
|
|
|
|
|
|
|
|
|
int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER,
|
|
|
|
|
client_hello, sizeof(client_hello));
|
|
|
|
|
|
|
|
|
|
int r = AppLayerParserParse(
|
|
|
|
|
NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, client_hello, sizeof(client_hello));
|
|
|
|
|
FAIL_IF(r != 0);
|
|
|
|
|
|
|
|
|
|
ssl_state = f.alstate;
|
|
|
|
|
FAIL_IF_NULL(ssl_state);
|
|
|
|
|
|
|
|
|
|
SigMatchSignatures(&tv, de_ctx, det_ctx, p1);
|
|
|
|
|
|
|
|
|
|
FAIL_IF(PacketAlertCheck(p1, 1));
|
|
|
|
|
|
|
|
|
|
r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOCLIENT,
|
|
|
|
|
server_hello, sizeof(server_hello));
|
|
|
|
|
|
|
|
|
|
r = AppLayerParserParse(
|
|
|
|
|
NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOCLIENT, server_hello, sizeof(server_hello));
|
|
|
|
|
FAIL_IF(r != 0);
|
|
|
|
|
|
|
|
|
|
SigMatchSignatures(&tv, de_ctx, det_ctx, p2);
|
|
|
|
|
|
|
|
|
|
FAIL_IF(PacketAlertCheck(p2, 1));
|
|
|
|
|
|
|
|
|
|
r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOCLIENT,
|
|
|
|
|
certificate, sizeof(certificate));
|
|
|
|
|
|
|
|
|
|
r = AppLayerParserParse(
|
|
|
|
|
NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOCLIENT, certificate, sizeof(certificate));
|
|
|
|
|
FAIL_IF(r != 0);
|
|
|
|
|
|
|
|
|
|
SigMatchSignatures(&tv, de_ctx, det_ctx, p3);
|
|
|
|
|
|
|
|
|
|
FAIL_IF_NOT(PacketAlertCheck(p3, 1));
|
|
|
|
|
|
|
|
|
|
UTHFreePacket(p1);
|
|
|
|
|
@ -1322,34 +1308,28 @@ static int ValidTestDetect01(void)
|
|
|
|
|
SigGroupBuild(de_ctx);
|
|
|
|
|
DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
|
|
|
|
|
|
|
|
|
|
int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER,
|
|
|
|
|
client_hello, sizeof(client_hello));
|
|
|
|
|
|
|
|
|
|
int r = AppLayerParserParse(
|
|
|
|
|
NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, client_hello, sizeof(client_hello));
|
|
|
|
|
FAIL_IF(r != 0);
|
|
|
|
|
|
|
|
|
|
ssl_state = f.alstate;
|
|
|
|
|
FAIL_IF_NULL(ssl_state);
|
|
|
|
|
|
|
|
|
|
SigMatchSignatures(&tv, de_ctx, det_ctx, p1);
|
|
|
|
|
|
|
|
|
|
FAIL_IF(PacketAlertCheck(p1, 1));
|
|
|
|
|
|
|
|
|
|
r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOCLIENT,
|
|
|
|
|
server_hello, sizeof(server_hello));
|
|
|
|
|
|
|
|
|
|
r = AppLayerParserParse(
|
|
|
|
|
NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOCLIENT, server_hello, sizeof(server_hello));
|
|
|
|
|
FAIL_IF(r != 0);
|
|
|
|
|
|
|
|
|
|
SigMatchSignatures(&tv, de_ctx, det_ctx, p2);
|
|
|
|
|
|
|
|
|
|
FAIL_IF(PacketAlertCheck(p2, 1));
|
|
|
|
|
|
|
|
|
|
r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOCLIENT,
|
|
|
|
|
certificate, sizeof(certificate));
|
|
|
|
|
|
|
|
|
|
r = AppLayerParserParse(
|
|
|
|
|
NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOCLIENT, certificate, sizeof(certificate));
|
|
|
|
|
FAIL_IF(r != 0);
|
|
|
|
|
|
|
|
|
|
SigMatchSignatures(&tv, de_ctx, det_ctx, p3);
|
|
|
|
|
|
|
|
|
|
FAIL_IF_NOT(PacketAlertCheck(p3, 1));
|
|
|
|
|
|
|
|
|
|
UTHFreePacket(p1);
|
|
|
|
|
|