tests: tls store for client certs

diff --git a/tests/tls/tls-store-02/README.md b/tests/tls/tls-store-02/README.md
new file mode 100644 (file)
index 0000000..38275ca
--- /dev/null
+++ b/tests/tls/tls-store-02/README.md
@@ -0,0 +1 @@
+PCAP from https://github.com/felin-arch/tls-client-auth

diff --git a/tests/tls/tls-store-02/suricata.yaml b/tests/tls/tls-store-02/suricata.yaml
new file mode 100644 (file)
index 0000000..a19a6de
--- /dev/null
+++ b/tests/tls/tls-store-02/suricata.yaml
@@ -0,0 +1,18 @@
+%YAML 1.1
+---
+
+outputs:
+  - eve-log:
+      enabled: yes
+      types:
+        - alert
+        - tls
+  - tls-log:
+      enabled: yes  # Log TLS connections.
+      filename: tls.log # File to store TLS logs.
+      append: yes
+      extended: yes     # Log extended information like fingerprint
+  - tls-store:
+      enabled: yes
+      certs-log-dir: certs # directory to store the certificates files
+

diff --git a/tests/tls/tls-store-02/test.yaml b/tests/tls/tls-store-02/test.yaml
new file mode 100644 (file)
index 0000000..4798c8c
--- /dev/null
+++ b/tests/tls/tls-store-02/test.yaml
@@ -0,0 +1,20 @@
+requires:
+  min-version: 8
+
+args:
+  - -k none
+  - --runmode=single
+
+checks:
+  - shell:
+      args: find certs -type f -name '1523912382.235074-1.pem' | wc -l | xargs
+      expect: 1
+  - shell:
+      args: find certs -type f -name '1523912382.235074-1.meta' | wc -l | xargs
+      expect: 1
+  - shell:
+      args: find certs -type f -name 'client-1523912382.237160-2.pem' | wc -l | xargs
+      expect: 1
+  - shell:
+      args: find certs -type f -name 'client-1523912382.237160-2.meta' | wc -l | xargs
+      expect: 1

diff --git a/tests/tls/tls-store-02/tls-client-auth.pcap b/tests/tls/tls-store-02/tls-client-auth.pcap
new file mode 100644 (file)
index 0000000..cc25ba8
Binary files /dev/null and b/tests/tls/tls-store-02/tls-client-auth.pcap differ

diff --git a/tests/tls/tls-store-02/tls.rules b/tests/tls/tls-store-02/tls.rules
new file mode 100644 (file)
index 0000000..51f3fd5
--- /dev/null
+++ b/tests/tls/tls-store-02/tls.rules
@@ -0,0 +1,2 @@
+alert tls any any -> any any (tls.cert_subject; content:"O=TLSClientAuthSampleServer"; tls.store; sid:1; rev:1;)
+alert tls any any -> any any (tls.cert_subject; content:"O=TLSClientAuthSampleClient"; tls.store; sid:2; rev:1;)