From 0d12c0129bce7460bbcd01181e46785bbedfa8a5 Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Tue, 9 Sep 2025 21:45:25 +0200 Subject: [PATCH] tests: add another test for 4702 Based on real traffic. --- tests/bug-4702-02/README.md | 4 ++++ tests/bug-4702-02/test.yaml | 17 +++++++++++++++++ tests/bug-4702-02/tsecr.pcap | Bin 0 -> 8690 bytes 3 files changed, 21 insertions(+) create mode 100644 tests/bug-4702-02/README.md create mode 100644 tests/bug-4702-02/test.yaml create mode 100644 tests/bug-4702-02/tsecr.pcap diff --git a/tests/bug-4702-02/README.md b/tests/bug-4702-02/README.md new file mode 100644 index 000000000..f62e58f1b --- /dev/null +++ b/tests/bug-4702-02/README.md @@ -0,0 +1,4 @@ +PCAP +==== + +Pcap from https://redmine.openinfosecfoundation.org/issues/4702 diff --git a/tests/bug-4702-02/test.yaml b/tests/bug-4702-02/test.yaml new file mode 100644 index 000000000..c5fa03444 --- /dev/null +++ b/tests/bug-4702-02/test.yaml @@ -0,0 +1,17 @@ +requires: + min-version: 7 + +args: + - -k none + +checks: +- filter: + count: 1 + match: + event_type: tls + tls.sni: vlscppe.microsoft.com +- filter: + count: 1 + match: + event_type: flow + tcp.state: closed diff --git a/tests/bug-4702-02/tsecr.pcap b/tests/bug-4702-02/tsecr.pcap new file mode 100644 index 0000000000000000000000000000000000000000..0f069b74081ce4148a85078c52300003471c15f1 GIT binary patch literal 8690 zc-qyPbyQS+x5v)}Fm!h~Gy>8M(p}OWA~lqtG}1_eNF$Aegd!jyozjh>2+~M{2!hgg zz~%cceV*(6`_5W>)~uOxKEHkTcc1S*>zsMlS(OI{pum4$PymE{U;Wa8KxkkA(#X%3 zLBO}rJRVI@Mn;oJ3tDiFmM%rQouJfAeWSc;(w)(fi?{!0DuGn0wW6uI)y-HpLAq>g9lpp?Z#*i=q&4G zgbm-FM=X1n-UVZzBYFfh-^sxQVPJ zKfnoGAk%P1mV*Ky0{~(VM^{T17i$hDJInjduFf`Y9G1>b044y10LY9n01|)*paw_* z8h{)iL+%LzAyorGdEJl%JOBs40wZ`}2sbwuPHqlvaXb{eb?oG``jP6(8psuBCwE0BZ=ac{B$Vw9+28x0IC$BYRE3t9{|2=vBY<0c^ z-OE-#QU9aWAC(jMQU>Ay;!J6my?xc@FE88tlBj_!_6Ew&_>+k8=|Jz2cu@Gi5yN_a zCz2o~@Ikh@2Lxh#&uSq_UbXPYkG^4yL5y;OT^}#^D&^v9%v4U^Nip>QXQL7#IUGo3 z!4N1?&?`Cj=2c+uDlheK@Ix1+NJY`LbiM9t4?p+p(O)|}@XK%`LM{&iks{w&waI^E z!J>!Mc^p5{QkJ-JExtC#@6KL{aA zxnmbzJ!*%dEH=ePJm2~jl#;*A?1U)AA#ZxAtuHu0_0|+WBn6j)m(7z)sWxZy9ey0M zZ@eJZ{bqt&T;3v?;2P4B*m8Xh@tF*AtH8i;VlL3Dn`h5WdHOmtNWhX>ERn=dnb;SS zU0cPENM2A#SS4o(#-ONxG<~hYLKa^{JRfVi7tK=Knr-kfvS`eCyZ&4r7o#qf8b@2k zZpbFkeD$M(2h}bGEaOR6J0;md#c;%#w_TXg6vw_AA4pBXd$Z4QWM#h<*&I3|`~nwrPA;Nd+l0twI>h z=V%6lR57roj&&Ns4Asn5Q>RSBbLay=lHX$5^-pCMSGeVOGTy8T0vdGOC(NM=vkY@@ zSCn~t*hc(pVOc39^egXc&aLl`z8Atkqv9Q@Qg9xv0^=sJeJ?)Il*SkK`!KX$5gE^? zL09ExRbN%uTtj)9ZTZh2R-1VNb;!5vjr=OIDfJG%32JT1Xp>J!{`eHX6OIHpX<<+Gn^?Rnj zw{=DxBG9K#6h%0w^!N2^`JgBBZ24tAdWL5WZFC)-zFBs{Bo#=3*9G3^iBXY$uwCp( z;ucR)RUbHMMqi<{)gi@@Bxu8DA&*6)|7d%maMvY&>Vr+}>yx{1V~jNZDSc9@TT^M6 z6Jhh)I8u`5jqE(;+bBj-y-^!VA7$}A&e7gw`TQz$k#2PZpUacsNeCMz3bgw{96?{a z!~p@F5Fyru%g48v-|HxirR7b1M_M?T*=!FC1uTMGr{(cWO*1Y~+!86?aFk^aIX5t` z#ljI%L7xoQBi|-%&ZISv3j4w!5p9?Z3lqyiLh8|K#uIuY@DrCi6;Iy!2&ynX5OOEA zPelmM8jG}0iRQy)cuw_m_IZJWrShU-Ku2*mcyF)#7-fCT{ay0+W_M-$sWLPyvfIqP z3Nn89A*4Q^9)3KKHgi%vXHD=4@VkzbI>_`6(sAL8|`^sj1&>Oqgl+ zQN26!1xJ1O94>VMm)8^ZvVnfj*@j~WSj6Hx(E2pn9lqNyXo#Td_n%KP*n0V&mC#Un z`;<%(HH=90bAC~pd>+w0&o9k-&aB__iQU(<=Q@{K71P5e8p<8{&P1or`^{2*4Mjj& zeYif&O4V|aPIvS+_QwWmaceoI8p^`Kg4#%1-V*t2c!+`JNS9rO#Ui_GP=ITjm!{#!ncAk`~9#~ znX*6tYczE}m7(7*+okiHasz+6xPe|>+&usNvc#8CZ(CbH0}rfld2w?|LHvDw=wHo` zg5T$dw!qc=AOpk`;(nhWZ&?_!%F;afE*My|#7eie5;iLb4LOQnRMz!c*z*lhIGa zaVRY)w9JTq)UFOwOQ$pyyK$DoY1F zC3ccsBr1UecN8tf59c-QQu|YL!9d)un@XsWOoTdEpOzQE1IQIqZZhQXyw zQz_7=4(6M}zs7z#ZR*{suH6mDvtV0){I#c-`FONE>fP>-0j66Sx%NI?XC^`_&!6$Q z?EWYT&eE~NRHSA+Sjud~{NhD*YDDGl&%Y?0g62X>B|EwSHcB1EZDnPl-2SlM>4#4G zbnU@NsiPct-PHm!EwRa?L0gjIyoKa0;4qEl&%Ff{?pBAwOLxGuyyYN}g} zfug+1dA)LZ7xM;~#{o~^_)~kdAw8x67)@^E8(HEq`WD<8RR)&d2Hxr4O-ptj_gY=y zy1pr5mT}Z8@#u4Dn#$|cZA9|m9QFr3$=fU~(iZ2o=y9;}wf=PD2XR5?VYNNs7z?1< zDBkwCsv%1*rcm{Me7U<^mRy5+{GACJs_-sMHrAvwW*r`<8aR)U_)+%8w}KC9cuVr- zHV>|CqNcVI)-x`6S+tGj6H7cL#Y}AY(m$I~cisRMPLFz@HDdC}8@~9XfFyHsZU-M` zpUJ~7mfwg@rn|qkWJDtyvzX&hto#Q2jItU**EhY(ACK|%L%-|X9WC6@;CRb}hXy}f zRjlKOa0v&RER)W30(W}LPF!X2$a{)8y0=jh7m_NN+%K|qs9PyuA|=-L!|7$-PIuGw zh4vMF!!YCOn&wD67_c=>v03US#k7_EdyZXj@65NW>VsxaX1z-+ir8oy1Q3G~B@H`e zSQRZ7`-`BFem;SwQ#9fE5!&{i)kVpSDG{2!#jeS)jE$# zRU>6k^bDw|wi|W(BV2^xpCyfM8{TrdQ^??$_GXi*mU~z_H^*-NTJQ0f^D~o?523Ms zsN~h(xxM6jwbPV>Fg!O+&DYj1o!{l}^8@8-ew6)lei+Om=SSkN`QeYG>_LCVpYsE{ zd|+@nKMpf~pC1OZzvjm=>F@I+Q(rpql;JSv9XVeMS+`&ik3^~<{G-=VfRVoKQeR*G zc`1SD&;mt)GnL0u$q^itTCYVI^W1%k@KnO=;|=Qqs)=N=;x`#G(i21`mDx& z3HZzb2REOmQIe+(Stn=>;_Sple&iO=nse1vQ9S<`{JJao_H5pI!^e4d`I9f1T_MlY zS#p&~8uGAaQ8+!<7O&wIHX813V!7DlsizlzB}*Zljx-I5h8r|1_vKV7K8RzTOSvV^ zt<8VudPRsvz%6U{ICV2NhS$se{>`t@6a>&Eu_+q5mCXm@Ce!~-3vT1<=d=U>SC@lTp4%jeZZ6wc_u zEBoJXhu5Y{e~ht-qnVlAU<*6MUnL}=$5XvI%~an(rJ+c)^0|o1_G?&nO4xz2WD{i%GslnZ~4o>_E*JDw2XhKO2dJGM+`;^}Gd5_74!a&&p!u9_#&eqW{w!Pl#v9NHSQBVuiDDCklYl^*{cGlSUKf@6H z&ghwZ_F;X3?088bP!jwIH_pcYZry_H+m~B2GNvL$B`_GNFv=ADH?V?Ch2si3-?+|`7BrR4YE3mg zMKNeg5Unm7yff;%2l4&tac$fJFFscs^_hzFc65?87cZQO)SI91ZaS^T@I)fw1Z801Q(9MV`|A7}Vld97b}+)_HX!TQr>~H&Slhqd{Atxo^9Z zizOp4Stf1JlKjS)+|9)3vA5 z7w|*il_+JN;Mc`v-f~t1nTmI7gg%zSCtQrt?Ux@|z z2jNvuzFkipl>Ksl;yAb2S&%y1(V?hS=!ab=ov+}lfdfYdNl zCCchc+PA<88uJ{FRaz(p&(^4>g7U331#H4@rX782cCY<5mhsS84-83gNrB4(x{VoF zEWxV%G|0i0LO%1ID_)cl3f^gti6U;nt;iJ3OUx@ z-@}MCG5&hWM5$;ao7V`AvcMWFG)G_+c%XUrh%#=`XfYYR!?X%NeiD%)%A51}dCFbK z7RuAFKTL?n1Ok>uhvx`aeK;kbK^<9(Z*$%n)p_?`Y#*Vj$E(FI>+n2ZIw_snOHt%t zc4|6Yv-%Cr@dJ~i#{B~ATM~xF;ku>RCmTnKd?o6+DpbeP8z}_RXk0sAMT)RrkR=6d zyDcSjAkI5(GE>1Yz&NkEly^`W!&qeQ^?S&(a1XlZ-~15wq6-Vnz9OMykMCa1t|vL2 z$Cg;2Ezzd^!v}l)(ne*^t|g<9rev3%P$y7UzgPvv#msZv=OeLo(Ty(7!9FD&ON%K( z8uzqu?9Nrc4}a^D*IQwBAG0Wl&doD$yk2NcIw&?(cTS}$q|93iP4jp|u^tkaI*T{O zTcu;of6WAUPcdh`v~rn-;Rqs2Y5phYi7fB3K7diS58E16x1DG9Gr&u z99=elva>g?90G{4^4P;m2@{qFYqee~9vx3b3KxNysdF=^I z_T+duAw6BLk!qE`vaZ2s2Bzy~?B0Tqv=5ruRa$u|8vWr~3^mU?Q8@Z!mmj;oeDKXP z`;j2gsi?BUp}UKX$9er(GNd{8 zu_Jo!A?HPayWJs6gR=?V=WICR7?Zl99$e}osHSryHxVe;BS285TpgHeo}h%kVHA zIP*@@1iyc4sPDL;iT$&U9V)c2CEb^DU4?i`EBnJ3*J8(9W0nS#tG_K#1*GL1yh!Zu ziAlAN>+2EV{KgPC7CBk2K00jBDLcxP1 zt^vsL<6}#r7&J77`+H(x;fvwU!`Gvn1Y%n$RP{a$*;yG+(V2XdCv}WCIhnQ@QOD|* zlvQHOPbOn4!eFCf0{=SQ~}jLG18jy?LAW1X+<@zQOBY zAvac31ru7Oc>3wnM9*b?l2J)^EblgLPqa%zc`xu+TSB|CrILTzl0_`imU4dCQp8OF z2m^k`KPX-ruq%qezf#DMlqdlB?>$|)%I^yLCGKdjyfa{^(e~cZ0n-f}Y%)WB^!+vQ z=;|{j*N2F6E7MUv?Mbt5Ws2j6@ZD9fk`Hjq&KX*p`IAn}9@b|wQ# z&crd*XDw&;zN0sZ57s-pSEVYRQ&cgXQy*ZLOc#&Ua}40u*7U2@L1@ofqF7{-=6)P@ zb=~z_gc~$Y_|MkMCe1kKm|i9fAV5G62)K$r-5un5V07v3#~8o6yG86}(wFYO@9`gZ zzqoYw%hO2YGnL>rIq!O2^=MY4+k7?7@-d0$mjov#)QYYgZ(-M5bmJO=FuaQ+T>Bg4 zLS^6a_p+6a(ZeA!pS$FmqB&t5cZwWD??g|B@IQIK4i{XSJ&q?lMAg&86CRvh}4=kv05w}5r2wW4$YV_*@# zq^SDsbC?|v)t4l=p(MT*v#IcO1kw26R(!cqGqa}w4tK=l?gIt_E*ips`J|de;Az`| z=96qo+|8v`v7T_5x}r9XsZEPlXC-*HMYE@veGw?zRHvgZP^}z158kQ zspm@!xURl-MF_Ei%==Tgh zhDS87kvoby4PRe$cA!4b3nlw;?Xjv4Eu|AxtkqkU6d4RQ=zgeZ1i4597H~#6eZhY? zKbZ{+W+#C;dQGqFZJj-#e>`NCHS1#O3nqszdKpubLo`vn6K=;nKsTLCew#P$p_687Z11`r&z9{bKD z8itl1cxqXPZVn)@?gTWvq8- z0dt&UKa6Q59npCljdRQ*O_!o0ojvd_tX+>*#g4w7kJGzYbppVp8m~LA5uu+v$Y$E^ z7S`Rtwai&Z6`*0YvX`J7uaQe|mst{VlB^x>9NdX;mlKwjYJL+->vt*0Q=}k&u`7(L zQ@ZGnQ~JH$wiPDQuJV7`)hv?2kCc@E-(+PzFu9Ud=XY7HFn`H=`Dz$$-_)~HT#l_5fO`_uNZ{M24Wu-g$ea;#j zs8H6d$2-nwa!WEDnD#YbxM3BMM_7D^#sV2LLOtzJUnfn)`7CyPCt3tPWCq$3};6hU-+ZG?H%Muq=uBWqG*8x{O&qhKUO9Z69CH;SYN))gh@Unyiriq_BhLI~9iNXty{ zy5`USRg+_pV3^Kfg@vk{z|Jy$(e0Q$s`2Wo@I|cl=+L>R~PWF%5ks?W7E+712 NXaB05sOn|y{s)%xsK)>R literal 0 Hc-jL100001 -- 2.47.3