From: Victor Julien Date: Sat, 25 May 2024 18:46:14 +0000 (+0200) Subject: tests: tls store for client certs X-Git-Tag: suricata-6.0.20~30 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=95585e5e761ba8f79a1218f3aa7726c57a5e6b3e;p=thirdparty%2Fsuricata-verify.git tests: tls store for client certs --- diff --git a/tests/tls/tls-store-02/README.md b/tests/tls/tls-store-02/README.md new file mode 100644 index 000000000..38275caaa --- /dev/null +++ b/tests/tls/tls-store-02/README.md @@ -0,0 +1 @@ +PCAP from https://github.com/felin-arch/tls-client-auth diff --git a/tests/tls/tls-store-02/suricata.yaml b/tests/tls/tls-store-02/suricata.yaml new file mode 100644 index 000000000..a19a6de74 --- /dev/null +++ b/tests/tls/tls-store-02/suricata.yaml @@ -0,0 +1,18 @@ +%YAML 1.1 +--- + +outputs: + - eve-log: + enabled: yes + types: + - alert + - tls + - tls-log: + enabled: yes # Log TLS connections. + filename: tls.log # File to store TLS logs. + append: yes + extended: yes # Log extended information like fingerprint + - tls-store: + enabled: yes + certs-log-dir: certs # directory to store the certificates files + diff --git a/tests/tls/tls-store-02/test.yaml b/tests/tls/tls-store-02/test.yaml new file mode 100644 index 000000000..4798c8c8f --- /dev/null +++ b/tests/tls/tls-store-02/test.yaml @@ -0,0 +1,20 @@ +requires: + min-version: 8 + +args: + - -k none + - --runmode=single + +checks: + - shell: + args: find certs -type f -name '1523912382.235074-1.pem' | wc -l | xargs + expect: 1 + - shell: + args: find certs -type f -name '1523912382.235074-1.meta' | wc -l | xargs + expect: 1 + - shell: + args: find certs -type f -name 'client-1523912382.237160-2.pem' | wc -l | xargs + expect: 1 + - shell: + args: find certs -type f -name 'client-1523912382.237160-2.meta' | wc -l | xargs + expect: 1 diff --git a/tests/tls/tls-store-02/tls-client-auth.pcap b/tests/tls/tls-store-02/tls-client-auth.pcap new file mode 100644 index 000000000..cc25ba8bc Binary files /dev/null and b/tests/tls/tls-store-02/tls-client-auth.pcap differ diff --git a/tests/tls/tls-store-02/tls.rules b/tests/tls/tls-store-02/tls.rules new file mode 100644 index 000000000..51f3fd5d5 --- /dev/null +++ b/tests/tls/tls-store-02/tls.rules @@ -0,0 +1,2 @@ +alert tls any any -> any any (tls.cert_subject; content:"O=TLSClientAuthSampleServer"; tls.store; sid:1; rev:1;) +alert tls any any -> any any (tls.cert_subject; content:"O=TLSClientAuthSampleClient"; tls.store; sid:2; rev:1;)