From 0ca26ec2a930d0685d02538fd4542c7ff28330de Mon Sep 17 00:00:00 2001 From: Sascha Steinbiss Date: Sun, 20 Oct 2024 03:19:19 +0200 Subject: [PATCH] mqtt: check for CONNACK reason code 134 See https://redmine.openinfosecfoundation.org/issues/7323 and https://forum.suricata.io/t/question-about-mqtt-detection/4890/3 --- .../mqtt5_pub_jpeg_connack134.pcap | Bin 0 -> 37323 bytes tests/mqtt-connect-rules-2/suricata.yaml | 16 +++++++++++++++ tests/mqtt-connect-rules-2/test.rules | 4 ++++ tests/mqtt-connect-rules-2/test.yaml | 19 ++++++++++++++++++ 4 files changed, 39 insertions(+) create mode 100644 tests/mqtt-connect-rules-2/mqtt5_pub_jpeg_connack134.pcap create mode 100644 tests/mqtt-connect-rules-2/suricata.yaml create mode 100644 tests/mqtt-connect-rules-2/test.rules create mode 100644 tests/mqtt-connect-rules-2/test.yaml diff --git a/tests/mqtt-connect-rules-2/mqtt5_pub_jpeg_connack134.pcap b/tests/mqtt-connect-rules-2/mqtt5_pub_jpeg_connack134.pcap new file mode 100644 index 0000000000000000000000000000000000000000..a5fafb6d23658f5f41c0de825ac148c864d94d70 GIT binary patch literal 37323 zc-ri{Wmp``)+pSAJHcIo26wjvf?IHh1Rop**SMeo0t62_IKdqfGz6D{U?D(o2<|f9 zK(?QAzI)#H+0XrRcky)hs#U9MSygrQTFhu$c?J@I0{mW301)C{3JWmbokRu95wJP% z=kk2!KFZir;1=5LzchgUS|5r>H`%Ilx_4E1hXij2cmV(j1>TN=gn{K_+*Nx`gp7=S z#qI1rb3-op@ZWGlHyMggFz&=aaMXH72(SGsx2x+{Zb(z8fIgy={=e6a{=e2u3&9cd z;SD4JxP?H1e&=+>g&M)d6G80x@3~0-54n&dxG4OY%MEG(MO{l*7qu0TM7{|SUpdeV zV&egzxIKVCu4JJ9&zfG@mHxlBD<(n?*Z-txID$(kf;jZwbJ6`Da=Fsf^v_)A`GMy= z3;-4(!1ln))0K-)R!~4*l$V!_S5#hrOF;Gx9~Zy8m_)AR9(3kr%02mt`{JJ9d4y+itSd?dqn$iKoMvtNvZ215RY z7VVFEfM|c$1H|%2JrFkebqsE#-^L~){bf9*Uv#;C{>hfWFSgtSaIST-kW)uc`~dK- zYk>8`>mF0UQve480|OHS2NM&A02>RNfCL{02cLwTh=_!Uh@1fDy8QC^_XUKDjg5Rh126;LA%hqIBmxjJ0SG>WP!$W_4w6Agi3++d zzo?9iP!0tZ4IKj$3mf#;Mug3fe{H-0fKWilNGM3C=x7+I$T$LsMgnA%n}mF*ceEZ5 zF}OeCM5A30Qv@0X_-fAYbz&0Azpz-56zNHl`S56=kLv?HFaI zH#r?ac54*g2NLe`B{t+|#+`!kkC%n2#SWdNj{*+4VSb%n3#<~X^c2q3O?@)msa0@b z&`}TnRc{xuC9b>brISfu_??t&`R%Con#9pEcM6?TrRt&{WJ<>)$+{2eMs*Tl1-%E% z={9Fvy0aGN_lUi^9 zKKQT7cFc7|;_}X8pnoXkFOqjge+|goXp-_9%8%;%oRb9!DoQi=+|KM{iZL)Q_*HO(g3L1Tp?}o~w&wQ)8|gf&PmTHAk^AA; z?53e{Gq)KnX9|J zMYa~rAxj-i%E59g0o}spPOWvz31shs;>Ip7(z8!pE+HG~EynB3B`qOxt>RBsfjc+u z&<@L>MjgmON8DPthguw`OgP-)ANM8VHdt&I1thPAWWa%vl6>Ru?gRw!ibfI5eXi$d zEh4XpHXrRqmu|p;G=xUx4u5so@RoSjn2NX;l(OJ*CoIBflAmi@QVh9Hodj}#yPS$d2MniTe49*pJF7((% zArxwL?`+No6Q4gBY3pdMH*|lw`(1IFcVYCjw#ESt44A-yA4D>nBXA&F|ApG=$cscr z_pJvV^=(zjFCo;LLsrg*XESgBqmw(}o#%OQR@#PB#1txz@1&}do0l^<8V-;@g4O%2 zPK;TSk-Y~_zj`u9o=Q|-2AGcX$9vSQr6n>061r>6L{ zdt^n7{DNZ*4orEZR@Hnts(PoIqP$;V<9xm>73ZSobh`S+;*?WCDD}x#)#d=Is+N72 zMbVMSChVKG@WMCUF}~C%DIhqIrI`tXWCj^`^n7$Nf8gh};N|34{k&q2Zu3+#WJLez zUSgyLh=AOxjm_sxuR zCMWAJ*2(-YO!#My4R`}NLS^=~lau=rNOAnfbYvCJ=`7BdxGhK}6YX*q$XaDu_nThG zt_`fctv0i9&Oi9#$OYyms48`=!o4_%bsgteum616*|yrWfevHvt}PEqyi|EH+JKnr zU6M^jWm%^=u$Ie$N`%M6Nzq72>fUS}q&g~3?<%g+Z5_e^XTik*X=4iaPsjv}G3)!m zVb3M`1~?%RugK2=E)!s`C##4#;x+*XT+%NX>ha=IHZIdOOx|(`KUM`zqlopM-W!-P z4S`*zMvOw7vRJ)4^%|Yr!Kr<&uAyrl9EI7Q5)+Y1wo<~BJ>jWckYvQ-4)>5uGu;g@ z|Nc6jmpS+0jy!cQ-`#Mx2({?1wbt_z>m>%Y6@=w8-l{W9!Pb`%UgYBroo5%eItG#JdVd?Yme?BEO0lbI0mDCHK;{>bIjkNc(PN|FRRutaP{cxO; zQK_l9oX)qgCi=eT-esyI9(9(!9dc*rQItT~b7SkM-FZ0B;vZ6yK3LYW00;KXUdm|u z^}~VUU{&4VvLz9bjBmC8CFgswc~9{E2ENO}S(Mi4tJtW3(ZA*rGcP3hvaM6R zg*}~1mtexkvbl!6F6KDXltTgbmfFo;aX&S)+XjAT;Mx~hi`-fZjfB@foJI#3Hetw6jLtrUcwCV<}siLX^OmwWw)jf2rS8+nNre3?u- zY;f})UT*4}Xqc++D-0{en=UmRHz+;yPmT5)j34dGoJwsxOSZ`Co6?VhMW#O)tv_VJ zzsF5}m=Hh(NcFlFOb5`MR2ffh%vM}-oHG!#`C2_p#i^~Wu9lNyDnE?SnVB#nxlnEI zZQcv-wd@@;SxuHsPC4}%qJ>`MIb@C0@A)6;TfOHFW;G{9Gub&^d8xoLWD7 z?0V+zd=W6RmT(XGhyo6zbC@a~H^6}oy^v#LIMAa~#>q$Y6m=X&0S?qo4|7 zH`|TmfthD6z4fXJcZUNO5ciffXH)diH0bcDrcs4N{?y7C-;AE3)durckc;@e9_pE* z!pkJnv0LA}!<7bKwcszV8gQz)TfdQyeRmqNG9Z6ozN|OK*F98+6J#4WwJvfQ$B}V5 z1qT>qF8NDOt4rBd>q08TOQc3k;XwI5LC_ zs4rx7!zRT2AnJnBK;)9=Gz%i$bU+#5>cZzP@gzy%5Ff41;R4bqKCPyo=!Rd{i*9&0 z+U0x+%YQxJ@kvcd>p<}w(whH>+e4a!XGf9f>9mKxbDjG>KSx1e7$*b{tTx9DU8vT( zmzSN5+rJOwbeTOZFfVuL`QQp`*iLm_kDpo>ZYo_YwVfSy-oJq9ogwCc&W{NgXZBk% zZ8hKe8WGnED$aWzoxB6jUrK5n=vT4r_^Wce*}UL-ENZjbG82WL4v1b z>U9g@o2c`JToOyJv)T3%O#gTkHJOinE=OO?(BPijWdmtC=Dq%AUAtqp}C*FG9I=l0!X`Y zHSMQo_7;5UF_sWI)bc8-IsF>Pt_&i=w9402#8E`N5cHgwJ21QG`RWKYW^>MFzd8lk zta%=ASEY~Up%2w9486VsaV&nj5j-xJyzXyuC^5Tbb~F}l!i!kC<6kx}A(Y|b=@+&} z5hg8b1~(7nn*gsAMK1|wuiVayv=;T^j2g`qsemR&u8RHSAi6<4gW~hGt>EU+nFAd` z!#xw0R}hoNsF4xc)>EI5sh6$d)=ZIX$WT`yYs93wfsdmWq_-F1h1k41W`wN0&O^EF zgADGQ_fYzBdA%(T2&*AJ-$p*$xU92=B^n$Sj)K{!tKvW z&nt`Hx50r3$El!_{UDjaFOEm2(zW|Cch;Rx>H31p&bxBULpm;e`%e4Y%(lwlfL%T1 zn!F`T{?SDyV(vXXLGrkL%=_U{7(L}W`^d+rj?;FJZ>MImxnIV;57?1umqMo0 zJN;p&(1Weq2cG`*A^Ki%CeLRzl8w72r#M{qxGs>**ER}T1}|feq%?IdXyL%P#g~vW zx--X+oJN1zaR0BB5_S_cXHsTq&^^S`Xwo#F>C%lP>b=}QPaL93p z@~pDuh3RQ};=vQbje35^E*s$_?=M}Fwa@v-CBB>@PCepdd0r}IEf4l@@H?IHmWm8P z%BJcD&NSC0zVO2V#Y^nr3+Cny#KspE9XeZB7I|bCJmgxmEXcbReG*Z=wJn`+d^h|~ zYX9@pQRcR=1AR?`RezJE3rP0NaQ$;l)w=m9c1Oj6LE~|3a@ujB67Gx5bY-6q69`_& zaZ6_(i`i@54WEOQwG@QKRjJM`1u$ogKqBIW!94~AW22lz%@;31CT|@%UCLIy{@k+j zzSB9rW%wX*bz&8FDtLHHbziy#u>uF9mWH1?P9udo*4uF$sud|I8J6xOwaj;2T6DvK zRy#N#ty>ThE?H`_u0GS;p|1M^7lU`B=7!=Wh2z=vle=I8zGO}uu;t-U{ z0T(*b?Q87^Zej`u9ho6arddx@O-d&DSQIHNq+cyJWqg|7Z8@0jZ`kFQ}j0D%A7g1mCo{P(wA+XCYki~fw3 z-u`+0(nkB6oqpCSuOok&ze)d71+%LtD+0g;Ab=O(0e}H3-~r%?xGVrCz!k7VT>l!N z{!7sMYJ}h7v;Q%w{RdI6ii?+%6Yz89pjo}pThBk%Wj$S;f7XABp>1dXOZ&BQXb>l`l?_DSNeyx}{-5}uUbi6t!mGJ_T~WUK zhq2M^JY2op{)9qv^#I#}U2I&uoDnq~d7Z0Hn%B51OI~Fp6m48=JRW%3SYJ!;=VtQ@ zG1gDwE6i1kva=oi{{{V#y*!+Bbh%xP5J^b%Df$e^^6#h@;m3~EES=ZXe_JNnvRZa}k+s4E5 z-;nG7ivBY>wxyk%tCOq8AB;=zvxBVSZw*&sXt=suJuy99-88*CAvS+B9F`NpkpF_k zv2^uB81!H8*a#Qf|CRiDZQc6W?`k^BYy-dJiGN#zNZ0i%3V?|J7ZbfhTnKl8z5zhV z{p*Yb`9B$me=-pNWFY>@K>U+|_$LGLPX^+j48%Vfh<`E=|70Nk$w2&*f%qo_@lOWg zpA5u58Hj%}5dSY`Ag-flH?N~ZdRGymt56X>a0jpkTmehK2A~J-0rm*k6LCSVA-AhY z+y8-r9*_fc0Kwm~1}Hxx7lJCOK)goOpo4==z|HM0ek@PzzX7~uA`uP9pIIhqlX}f{u~xR9Qzp}9pO^CM^6v@ z&kBK+n};W2n5!RB2w2-dtPt>11nlJF>2`&`ia!!tI$ps@SCL0z4}^dSnEVR1`w4Si z)BJ?5G6uxf&Mwvn_)2CsYiH{#xE%q%^!B<6VI!+u{r9>z*v1C|k0M|uC&X7K0=~+9 z5IfsEfB?XCY?H~;#>yT6^Ik}lhB{d)*GS2w@w=qmj! zD>iyQF)>kkB^w_n8&6NJdk?G}A9z^P%egwcJ#g^@fS)>F7s4ys(j$y4%qJ!+%*D^m z_Xk7$|2F=Y<;u4|p*^i@pMgkwf5-hhI@e495IsQH=JoG5%R~UEc?JOFlfUDb-XUf% z!f(|Bf6#~YYQETedb)}8@c8)naD#2ExUUTQTlqf{{1@d9{J5`%`^`M`cYj9L>96c& zCJ=oIMN{CwKrkZC!dRFAs0v_oN&ufQ8t?hye`&Np*e5uIIP5rbIHovWIFUF|oDVn?ID5Fb zxGcE0agA|3aU*f_aocde;vVA>;c??B<5}Z{;3eZ#;|=5ez{kXA#=nDaj_;2jk6(d5 zfWL7A^9IWexf>5|1m8%$QFmkf#sL8l0Uv=TfipokK>l&QNTW#0NykV}$!N&#klB#EA}b*qCOaahBEL;;LmoIE)<^<+0<|7tX76Xclv|DaF?S934<05SW1eW9E}lzXAzmlmY~Cq8LOvC~ z$9(mCyZr3@R{Y8QqXM`B3IZVlwE{bW9D+82X@Xybh=kOIUI?`cT?mT^dkB{ZuZl2< z+!sj^85boMy(bzj`bi8`OjayJtWoSlTv*&wyj*-sf=j|tqCjFrl2y`1GFx&%ib3ju zREE?yX?p4V((k0d$=sBAAd@LGf1B~P_3hl-%XirBINT|^^Fx+b)R_DD`#E=caf zUF5rpcSG;?%M;4$$tTHwRbWuCQz%r}RuobUQ2d~Ts-&tEtu(Goqim&|ue_}yq7tOi zu8O0oqne~Tug0$Cp;oVsq^_bKt3Iv4tl^?jqX}p#YsPBM++)4xey>3bP3xXkveuF| zpLU>jmkyDRg-(Iap{}fMl5-R&rQe7Sj~LRy3Hxgoy?mo@GTx#RNP0sZ*afh{`mvV2bm8J zER`)&EVr%XtP-r&t#4buv0k;2vWc--ww1Dtv0br~vWvA_wU@Dvx8DHEfs?>H4oVK` z4o8lfj!;LqlYvvIGluhh=Qh-$i^~`I|TiQF>``Aa{r^1)O*TuKjkKON;-?G1ge@*~OfK@&kCR8J@O8E9x?QLx$Q{wBy^CbHuSh8$# zX$p19tCXWu>(t@2+i4}~H0fdKr|-b;zGNt7RA;he#%G~rd1ozU>t}c6i00(yQs#!` zUO-)--}1Ec+Ve&7^9!g8q6(1;y$V;0Op6AK?-tjVaFt|~l9qW%A-9n4cO3_-q@FM)A4U# ztiP;GI8E$KdQYBBJ)B0J4xPC%6aSU^YvwH5Z0R@QZ%uP|=X&RL=BE~{7S_K*zMn5X zUBX?8U#45mU*TVATvb>dTr*i)Tz6YP+jzc7u$l7X){n}q+grWchTDrf9y{>e@I8t> z=)T~7>%qN)uZPZuXGfvO6vufdq9MvC4AZE zRSHZC?E!ByU#;D4I8 z2bm!m{vmJQ4p3hu;gOL4c&Tt9G#b*CFn0+6BoGo3Dh4_l0&^`Cf*k=0A?i&&Eq5XY{yW+aqRWT{ zJRZeld=%8Ngp{|+J|5a(WXc?#o448}VV2wea}K@b!+&*9M&%_BBhr~5kLDwEm>?3C zOUs4&um&_*^N^8F7Q;yTXE~j}ic}wbt&(C$%gakD@nd(OElo1uNLyUgV_D^dWRPg2 z7bP{F@qKl@?-p7CNtflZ11GAa=!E2Z)WJ$4$jV-@F!+mK*gaN_=ydiNQ#;uD1P4a< zC^ir~dF?bQc5;F$li|$)`Eqvmq-D30Y;u(*|LEMchQ7(&*fL}H92LC4q)L*LG6TNR zv7V}qFd;5U7>>hYH3NGt_*0|~pMATCsf_lU8kWy%HlxS3@*|c$TC4lYi~Z#iG`YqF zz63)fnT+>sck)8>zTPz>RvW;@)vF<&vQ`PTxocHPJMLC?VwXewQZEvul}|p@F7&b| ztq)?GFqqD1Qi#s}Mkgz7EAV=8m2DfHDwVn$AWN4@V$aY$H2&p<@4$Iu8^ zBmB(*vsbWFm?(Jz?p#eh+89%SPISL@^l}no@}&7##Vwtu3!(~cKH+gAKLqV4WHtEp z-M#Gre8tzm-%{=oBXLAo50(q1lxwv2G`?I8d0fSM#-JLd%Tt175F>SE##kaKj^ zNfKX1Dnif0y^Z_Bs`)KPT&Qp)Vo20dg+uwY$euA;`8JE)ke&}U%67U}Hmr2eUF5)C zXVCc41rF?rLQyq^zq&YvymFq1u#j!buUp*e3AQ=fz z`MS|^6JNl$I-kAtz#%NzQonVUPw328;l_8qk%7=+=1Ir7rBqr{F}MANW1XEb0Ie)# zGZz|PlF4pJmBZPuz}Ix3J>2%z1)G|Ed6CQM)oz8&htxKK4S#vB7fViLpE1qrgjgK) z3}Q9?PQqT+W#s9^q}rB>HWqHLO{xrg*`|P@_T6Sj72%P$xd|Tve_Qby;JE)>IlUvI zB%m%SG5^c`ognk?@AcTZH4+I)Pu643#1+IxzOVK}ZMlvaXGHB%9!!FL<8+7XGr_DO zlm_*RkUGz(hj@Gq4b4qoL3c8ID%LQsq{lYF}ECe~Q6i6_>H+DU|AL;i7v|n+%G1XyfYHQpO0-V3PlR z+M-BUvypI(MtevHj`vw!&RgECzWvAo{5a$gs&Mcfdi8HiZ`ieCp|5->P(bQ4Z zy)I*lRoy3-x2oo&JQw4$nd_C`yv6+RaK1kU0L1j`2&nV&BIgTob9yRmcxUt%nzd94 zWA)XGr-xZyEJ@W+7x2avWDuEg4v#eX?Rf;F_?1AYqa4036^Iqis@vOv2MaZnzkVhm zny(<&(F6B$8UJu|bm<5C-Rxd^m+x#tBV}SBm?Ye?r8c^s`qUUKR92Xk0?r+otl|Zv z)Bi3jfLb%ztsAlPz5`l&HL`w2(@mRaDS2LL$)OCU>_ei2e&P;(kt`0wG1C*H9W$&= zj6!Z1InIw^9=Q=zOp!5^P=ABVuvxP(RVjT!ImS=Pm^I z%qZhH;+S=4G_}%^gwC-V`y~?sOb*;v%3Iv;B&b~YNYE=j|Tw)YFT0#jFe8qDo2 zBCWoQRTbQU12j-NoQmzw>f1DZ?6=IEqh~o(3RZ^vtUQ(r+ueECOq^Q-%$)Q_ds-sA zs(h(o3w#0nva>bgA3d@{s}m=>*zFQH49XoFS@I$BmM~-X@O0^z8gegR!pi3~Bl(}1 z`|{42$NWE_3f%p>yg)6cl~-bpGS>2-JG9*^|Bg*jDj91bspvUa9GDqog(B=m(7|nFVb>V_tl}WTm@*r1Am(b+0ZAj8d$VVj2mr?7BzNVDNbIs z#^EuR94qV@+zU%_4u+A1(H@O=vaI?~@J^6UMt)r^QTP!FO>1^3aJam9*#Y2L*8>2> zG_&q&b1P`9DM_)HVDWb|!LQ59-CBBzeywd)(>~OfB9J8;U7Ejh3r*7V-cez3?E*jPQqCXi9IQ36ioHp|KWX=T% zBpOf!%%tb%V!iSx$~7M?+aK(^ze-tSFr>WaHK>eSv6UMWjP=0EF~5+!TS%NDx@4fb zYklB{^ne+skVfBX%lCMj%fxhsV(m(iNyn3{I5<$iJdNh}q(p4+@3AO4Kz_FA`tdNS zzS1=16O3_ZrpdK3M{M0(kCW@Qqj$Zy16s+cPf?U6nlwJR!yn>rTM{Unn^xcs2Xw1i zCQXJacZVSB$tQOKOxt4sz?7TViTp?$?ONg;zoJZso&BWD!+YO@VaX0#(TwXy;w|$c zh=Gb-ZlzLeRCX%VJ&PQS^*#RU?Obn_Dq&-+6RFz4~7h3J;@2JU}js2it@$n!Uwu}!&3wV zpTiZ8l=>$Uy0HzNN#odt+a-IX?Q0vHU?EG)V_h}cLbvw(s^e|8PUvp5m&sGBY%*IJ z!#uW2l;iF0qgreJO%s+n&3`gpYk0tbm5@|ieosd-Dk3{MfUp5mc%%Mv4~71ZhK*i_ zrO(z%CjH6FXD+Pz-PF+kll6 z;y_i!oAZiuUmU`E`uVA%TGMB5K4{p4ue`zMXA5L~6&;!%$}+&RdhEImKQL{6^aWhT zxV*_{#<(M;jW{UxTnscmM8B>0cdbl{4C1c1v$WAk;S$Y4f1$68BK-#|8SLyuW)Ri5 z`MVLG?{d_0g)~rg7aBI*Gjcd~4Z+OA`Mu_s37@7uXb+fk72jKy@ljm5e;b|C;`-oF zo|^1@m(R!5G5Cmq%-=gS1aIU=@*;|nZL)*Zbnk5G-CFEZLYX;O+6nV^=^3G5QQiJR zJ=bx|Y05)vrvL5(7NFzy;3MhRRmiQ<8-4kxUqQ%pvAbApx-g&MMp2pct@w40)mvYS zYRWud`8K*6so#9Kgxr1WeI5LAN;I=*>tt5!+UB6L(1AsICSUZ0by zd-pBnmltIE7+{92a6r2-PGj(^LhGn&F~t2bx|E61yhF`^o7r24!FfFRex8mQDr>Xx zKtQQa0=G-8F8hf=Fm#F!cUP#d26MdAzab|v0wdqiKPIq+o=?-vCe!sxVi+2ivIYiMn3BM5xmbkG# zlEWV99$TS3{;f~amh^Fsc=Y4&%#!l86H;;VKphJ`=ZbCvg?;P30L0NNa5*wbY&)!z(K}kBs+8Z4=L062 z4y*L=?=04NiI;xr9@K6>CH&T1HqO*AWRxq=?ia+?GHJI0*%=@}>{zp#0{e`sA6~FB zuD(rg&fgKp+IOJy!hc2q2O@o=PIKV^I6XtAEiR4>TS&;vBzo^tq(L14kz`8#hm;Ok z<72tvNp8FSY3(7Bb=}fiqxoz_5tHgoJ_?c1IU2;7a~K`Vs@gR=0#EJ8X9_ooN6YUi zMb{fqj~7(YBr!rZUh&~f;IDW}>&+0RNqameEqXU?tkUNYpq2F`+~y^ef@#EmWa52P zAf!Fy+LGv9l8P5PSEl-aoV4GoIjeh|2pP%?8kHutyZqJ2FSt72zA8)_<(pZINY9`{ z9^sP-(wVpVNv6uSb1^0a2Xs&bL=w1IcxIDhNA2?XV7d8Pan3Cn7BdcLbB6EMcwVT=#<|}nmm8fq;ccZz*I_}lS{wRqY zyzv8RcapYmJyPnb25ck^rqU8e`A6=dPsTJ3*WFszUD&Jk<9{9%4jx=&&hNK42$j5zWOV%lKTLB_ z&XmiD9=j`eURQoQ+l)3;wERZseRiqL5oVKERy~!1G)9s9O>j(=u7hoTw5aY{r46?x zrpB3#U(3?OWo&wvrZj{11g*oR#R*p4%ev@*X5pH_x*;Tc#Hg4b^5x#DOGttLFqgBJMK@8n~u6isTYLs`qD?7HXj zMU~mz)uDDawGAJ4#~CN19G1oz*m?Xkvr5HUxx%-|u`Y?&xG z<%ay$N&5G_j50X!)!AA)k#G>@iy65&g?~$guhxEXp!q6FA>-)Yu~z!=@=L^t&Gj(x zl=`<-je|k^b0FI5Ju&m+$MN-?$?9CnlNbd>LaCSGjvi*54a6)qK4r_gg_4gw2g~rn z6f|^NJ9T1XU5uw1Cgr;n_}W$YRM>m8N2`%BLkpLxC!l#y|1R-D3ZfCtA=B?;iN|7z z^%KSt0WS=F3KbP3kBl7#uXZU3f)INNm1m6Y~xVUk_xku#iFo4gqsd9 zrI&(-cAz&xELf)pCM`id{`!ntc02q>Swm-efwzA5Wh^I=Pf^`R{m-lM;EVvh5^tq? zZVg%Qb|eKd8kKi9KR$%SfbYdafNk5v^eIWF+-U(mYT z2shRCQD)7LR{~aF-UdMUT|PeA!~EmO`HZbQ0ssKdhr(lp@>+0YePHNxn0m z3YO}m7afR6Uv<jM{rhlCSh87Hhr$5>|h5tkf!=?C_DS>aif@7j)@FA7_Lfz8`9owq*p*f~h6YV!qpF45{BEE~Y0hR>Z{clpTF)1F^QC+~!$G9@ zEd8OxPihN$&GysfpLADbJ}X8aE^Vc&O~~;VtnE2W?TTLg^kGIme3_)aa=S!ZQslfrR%e>fqXkJuxV`9q9 z7&HPx#YM+;fZLL+;1}k%Q3zy^L2U}kPYp0TgjHCoRq zdZec%Qr`9H(4#7ZZ4UjD#=V#nvlO$DZ_MPMx%my$jj|-d3Kwe4YVLB6Jh2aRG~dll z+7E|KMpX9_Xd*cT?#eUuOhNXdgEuOb6jV01T(yI862sZX=lerhdpWtyt-l6a##7V} zbs0FOthO9jh^z`0GON$AvF59XKc@+ zl{nw+g9Gwv-#tSc@%mz1f~j6U@wm@ocb1+9tZ8^rZo&5 zg3>lQ{|KENs9I+iT+}*nGFco|=h}~WmjTVRBSjNRJcJP$Uz9M4&L6HBdr#)4zJXz; z{Lmon_?QI;AepL6(XTsCtW6UsIZ~Rk@Aj!UESoWZZuValwe>I5sT>{cyolglRa3kv zE116qSt?mkbUjlh$C50z)Ak?ro3=iry$$M103=p#tvRkys47!-3mg|~jI$T)3Ss7u zb`|L}7Ost}`x;@fC@)J$UJzM6$7>4My;pDMQyHixR7RY)md_yqt9mW>%iHTHf+dcM zR)@pDL;utGE>p3h$i$EiQ0u*FSFa_W%OxtJCZ;Q&oVXV;x9FN;6OT-!p!H_8!Pa+D~E{8HUR<;qpzQ06AhGu)S0a5tX0CZGP32z zmZc3?{Rk+(#v~=l`tio49WNfA+vOg(&Y7ubV z`My&5i1aIc+tBP3GE?dx6V@_ARo=#aG*QCak8l7lzoj&G&~;6zYvo+sNo`H%vAcIg zqyDEaSx-CfL1lSUieOv$&E)`QQ!p|#Gb6vy*(u79A@C*4N{dXsV53&)jsU^4;ur3E z+8V}VmFE$sLaSryBRhLG&+d= z{@v{8*XQ9K{d_6+i|Sdmk=~?xKWASgL^!Ib zy*j4PYge4zsQ~v1!7FsHpc= z@jB9nZ1WMrmvuoU?iQphT`;wv`pj6VbNHQ z3d7oev(uCFrP~yrc#C*}owJ{SsGP9eDGh#{&)vk=eXlQH z$Ss-;ajf!`!M-&PNuVAk1zN;%Y=gQ}F;{C2WTSdIMr7C6OhR;Toi~~Za+e=ISFdkM822Audwv+}Cd^84C?-4b?S#JiaY8?4Yn*S)zTra9ZM#B1*}Z z-|iY?71i`q-(B2d(a`L*8{W5)6v%h+5>7o!7kXRiWk5N>QvfdXDYk#|5YN8WzxcgN zas;!q(PpdyOye-dZjEcInB_+`Oxvc!FlFp`0`b+D?@Y*PU`#=zUG3ZCdY9XV$KF0) ztCZ|qo%Lg;#v5nd>~Zb-1&{Etq&R-v(fnC{Zw|rn`tLarlLS?Q%dvHq+{TTp-i!oV zIk;=(srj+O9nr78b+>4?$830xPI2S+m}{|wIF2SiYh$w_rOoYN$(fBkqpDi3olCWM zc31bYW%1P29XqvOWi!ekR*uz)3vkg}gw&~c&k3)T7UX@80aK@ZUi?&VZJOl|Wne!I z6@x$$xJmSSQgt(OH_7ioNo@Md&Bl~QhWr=xooCigre8lO;$hy@&&}u|!6uV8{VFh> z!etjw?{25_kwlPS*Hq&^DN{Y}IKG?W%JaZ;?sPY-D7R z*D1?8$11z~N7M-se?MfJIwEDkt0!Iu~9!R z+PN5UYM-Ae%RmPKEQRQA&0dsq2Y&uoI`Tb%YeH>nyZgksFDW5o+J_d27V`V-0ji$> zj1K;ZRw5v0Mc|D2~}>J9D9k26PT**OFiA2UII>#R<$t{s@Hcv(PPP< zv4w`g*qdBzxlKF%m}AFu4C4FNx)kxYI;VXP2;(sG`Q#c)6x;B_0dBj+-oorz?KFl5 zQN@M0)&|0?-J>ky?1$Nwu0brGN`77QtKx>CuYZF&0Bhkn;?!B=ivm^8DjS06Qqu|Ib8uA|2yJMnBqbD%5qmrcN z5t4TDRj<~BpngEBZq2mt4*wP$Snz-Yd=fJg_I#TGS{oi>C2Eu35xdHVJTG5PQ+L5V zE^Xr+nt_n={t%MqahQw#^QS!imk4J~34NsLym0MX=o*&2tLWZhvgfkdWCIGvW6R~cS0eKWtuK)O2JKYYe$|v1p~>AUNkoE_igsx?|biH z3pjnT1x6VB=78XEJXYYTfVE7<;E92!a^i0hqUM-08guMEqW2bHXvYbE3qYMXn3nw8 zHv8t+y?33*Uiz5}-)W3ssY*JUTegU`WDPE9pai6RX;9nxj_}=7fp@v`W69P9shjGW zy)LW5@p#3j!xn;$_w{xJH=A0b(E;j=L0ZJnY?6&;!U)jpIw|*A zKpz!h&O$2Tx_Orx`^O^qJTqjqVSPf>;Lk0cT6!lrl;ck@)}%~I{)u>@fzoVORe6Chu0iq|=w?iyq@a@Z1<-hryMKxd@G@mk$)s(ink*nAdyR-|xm#oH=8T?99-rgZ;jK?*Vd zAY3A@8=*K6DdH(;5GTLqo0_lFXER9jFk^_Od%T%i7jzD!V_7A>HFxN=Kw;vPA|loh z{Inqtb<45fibh$qQM|d}Gd`x8a{%{<^c}(PGI-Bx~H_(^|{j zlJe13DtGp0(;|{8)D65l8QIY5Wax9^QLr+E8H-76IR~tm4?HER^o1lHg&$nbdxP4i z8V^>)3I~S9nuWjW)!ow2q=h+9<=kX+_fH`YcagvB9qUn+>ywg<-dfaK28tSn{!#UD zpSkx&z;II~l_ zY06L1IM(dNzKIQzgt_lRT}K8@@>ZgSf-s>QU0aWTR{WGfXB5(!cz>W!lcPq@F=$w`uEXY>0-Gao-js`5UVOJdG`! zZSHnt^m9gG6Nj>O?Fc^`u@bDkTV&ROn)GM-8|bJu+Q*&&XnPgbUz$zr8Xu5MR<-$A zebl->N?{{pmM@mvWj<2Cu! za_n#!!sV;`Yr)w&yWR7VzfbDaqV;VM6}X5-0fCQ>_TJKOnr!|42-+$ILtjx&YKB$~ z7V#!1(T_&(W5P__Tv+wO_T2Ja{(lzBf&T#Z{{LUVX8l)S@ALa#TbDm-6gHa?%M(Um z)euEHUEc5CE{Zt-*ZG&FCntN2fn88Y$n}>?O2Q53;SR4#b|wumyf9k`YhVQZG=PYAV=(jWW<1%h;B z7H6#)@g0=m4si;xKr!~$wsOAtP1t(o@$BrSuUKUr-gaD^7hj0cKoF35v7^gm0`z60>P*aDIUfS@zOP4 z6IpOayTKkjkDk3<$Hy9D!?0_w{}Z7~gobgB1rBr^JZVahlaCpK`DRBwPJMdI@4?Gx z_XQ8buk!}(wk8#!#(J9EhPWsTBSs`S`?Y}&Erm$N=9Ackruk;XlWM@9&5^aoTjk1= z_z7>76RF(}VTWap2OjgRD5On(@HLuKBrJ)9{0R)|G)uO2cPnYB{}?xVC??j? zmbVF8AI47in>jvlJH1!l%9czhO!@NTd>MZuLU#nkoj+0%je0LUkjtf@qUQlxrG{E| z!dUQ(DE5&(MThG&Y+39Z@mL_YLv(;fj1hl+QTlb$C)uFp#1X|S9}MU|4oN)60*T(I zS@{lCqN`Hzokp8HV1~0;vHlqRm7XyK!h#DXqL)9XXLuE~Vlbjsa1QXYUUkVU>{W$F z{qB(Y6`ojc9!(N?8Hi*nm6WbN2Mom2<7y6lytfE84@xJ*x%`f zXvNCt2fCUyBF_OQ60y-z?j+5ng{Crh5Q7+QF*_wEPz`v`D&xwwXPCnMFL!gUzCkl= zB|A8mx_f%P;#5&r9}2GPdI~V-|7-g+rZEPL_M0RW$D)&2sT}u7U8&*M)RKLs7T-$f zkg9w^AuveBd%BbE->6W0r)*j(@f>j9s2yQ;#`7(q8H$h09EwFH8GWpM3BUDBWF%nL zfLzu7^ofF>nfI_(OfQap#sy`bg}0r}8`rCi5yRP~Lf;8n)~TNC$0KO$KWiE6_6TS> zhg=;Kh*wp+YNA}E=V~chi=pAW9ac)UlZ>p>wGcOdBW+(q1oAC(WCt5hN4*iW5`+%) z+hTJbeI>wu2LhqislRnnhqGmwpW&8;kFlfQc2wj}V-4InA2OSzuV+=RR5f2^$a z^7=Ym*_`i?aedkea~hUE5AdBA`25cl6q9mHLA<5XmqfugsR;n) zXs3$TLA2a$n<1}^U;fY`jNfLbDREYmHGR#Fr#J6q4hxLH4(JO2WuHWXnVJc|8168k z*Iq2d%DBesqWz8*Axgb1PnwwaS`D{gnT}oIc;m`<4ghsxK&`{sK}3;pWSGSAa=Vc7 z!wR;#8`H?sD#y=^fJo_jz0buKe4`Uh``UQ{RBx%#TsP<%X3e}MeobpY z%mr>ix2aE)4GACZAN1+OO1EZw`9|l@1gv8tTvwc5K!l=oDx}#v-x}Y=E9RKyMF)U3 z&D4q(E#V)CYA0Ur4E#acsWUu00HVJ%a@bATUqXs_e9 zKoT=KsnDec#YT{E=01{wm7+aQIBgp2!$nug^R&?f-@^FLDgJ0`m6wfORM>38Pn^C* zl%VhP+c*gPbipL;ka2LRhga*msXl9BchJ+kT#r#t<|)D&&I639CC?eQE;ldKz8lPu z8`WE@s>O2(lo#SUMUjc@X7kevA9K+%ArVfTnoc@TCQtHR=RTYfB*;GROKL|fCGFK> zPo^{4BVX5a ze^gSu=UoW>!0(^MzqnStFH;0xOo_p_4x?67bbp6;xuaW_ZGbIl`sz1?ee_0$ znxGFxKSO|;oVh6+0(0K?f#gpljSj>E9LdKUpITKz870K3l8Hy(u8ldgD2?l@6R+xZM)-Tv)8~ir)MCT+4%&t@*;3-*l=p(^gqtXny7iTG zYOk%_)CPHDEz|As(qdo^Fr>%8Q~+rqFo^i%fg=E=uDUkvaI` z*W^H{tiO^58};V)qw!S?L_Fkm{Y3>}9aO$7%q$Az4AqTFAM9aV?kOPFjwOujwuxF|*wT;}#Rv4u$4|1hO{t%E z*8Us3zg++TF574^Lz_+l zN0Wg3;K;t%gt(-JTOS5A>BH{hFQ}SM|=GzY?c|mmECQH zKA&RbuXW{9daM?!gP`q_`A-|-Z3mW&viR1w4>`8X<1ACv3V2O6X?IkJ0iWc-<#Qi~ z2~7haQ+m&4EDLZeqb{Iwi1!~reyjZh%Fe-u5nIdi^2fc1wV4hJ(jSs7PXbUPKo612&RDwR;h*VHGK#oQYD~Ozq#xzP4!W zaUYgL`*`^8U-J(%FO2S`vcd7su-$J(m}W7uJW1DPM(h8^b^4Nu?w=$ zK6Z7{0*O91uWEUN$$f32oZVG}`ok-;j7n^BQ=%qUFy8Il69R%jZ{ZYuBEHg(Ph8s6 zz0vB`RAu7Vv@$dEOqw*7IbWi7@e)6Xe|wm<@8 z0-D_TGW>k2I!~2GDuBCXi0r%KYD*G;iJH=epxaGqiCS_YwCEfEe?4^y|pb13n*Vud7NK`Chxm(I}g5 zmzjv_?MBsVa~I|T$y7hd9yRwU-2Or3&+JYqnK?ePkK*7T?4sCQ0Lj)Grk#&VDlw=y6T6C(HEL!-!IQxTlye~XS z#@mOThq^9?c=-I8EVq>#-rcV%iC8mOc#CeNQM9=e)REGLs;$0cg)&oupqF#b0j?{< zr(A-Sgv-xbH$e$-9SJ&b51KjpWVG(99-5|1ou5&B%f4S0c!JWY@xqfoxz4E?&paCV z%DMe30G`p-?&gMDV~3kbA##O@JEcNe5C_|GcTK_U{rO`2_v}1otEDZDx61tvH&>WCkF{XqwwzyB7VxFv+Y+dQGRa$muPqJ1 zlA(PvW$2OP2&qobrGTG)07vEdgNvig>&kTq8tlW)t}Dy9A=N-D5qD-kjM_6p=K_Z0 z6XOv7yp^P2PJw2nP6XRNYu~j63-e()!~i9dRI4HMK>zIFcUuR%Kh-yB_P$R?*Z$sT z2u3ik3U1_DYIa#We{vzivp(;)sLj17(6#qNIuhyP>1q;h}J3$&L|jY(3ze(G0wx?u}_ zB0=%yt~-9qeHF@$e*4*oW)0Ey5WCozT)?mXI`Y?b-Mcu9o-|O5DO$*Z>fbD5$>mCl zc_sRvHkA`5JX5;x%r1+FoG#YtauGESi&7&FZ6B0^Jm%8u?7oIobsFX^{z{vN`j{Xk zg;*Mxc$xEE&#Nm?AP_iX%Mzc)T%kL>B`_J)lb(`&uVr{m#Ulld9qoKev@*ILSl98v4BQB8|dx{p`3h2$-&P%(0~1ydD=qTJbeL8;3W-DTbh@5NMEZ(i*zb;g^d zx<3CF&zg9=aqyas6~xY=BpWSVC~h8WkjTs*ZxULl<8)=%fYlqic9Y|4l$@M;EsKe2 z#^rW7q!2#a71=<6Mrn-QY2DL*+ROphF7!xB0op$Udt`*VOAWm=ce+qq4%gEAZpY>6 zHHdk{6=h%#bMOLK2ZJ`CF8y%x=N+8}(;~;8y)tpco!`WfP`{ghJ9F_fvHqAb z?Zp!l4e(Q2COfanj~=n^M`2@HSY&QtRH@Om-{kAjh%2PQ&?)CQjomxdo!>4Q;HwZT zPMB4e;POEe!dNLbC8rp)(UblSXU$|FUHX<|9&+c$$Bu^*^#eQ#z;bO8*8n_GD)&sqvGo z?$GatK&@II>T_1{?YxN}gG8TXK4*IH;={k^k9=|a?DD0v{BPSW6s!)l{UyKIpH2Z< zt1v-zAlg`Fnt}BBk2;d%(03nY2$VDBdMcYVWGgO%uPGT^?ZR9?2S}@=yDQX2$jNUT z6ZH>JoywvM=+qLa>HhDT(=BBpLbC04W~{%0^M2K>OG`TSThLK@@rhBkWy+J-lAAi$kgo z5-VQBuG*DnoG}0LgL?4~GRttFzYlyJ{5B{Q{ej@mLUV#7v-4ixq^k^(So3XpAfZ2u3 zx!DhUNdTAUy@D@*!To8hiR3jBeZizzZ7|+HPg7O}(bdr1V&70Decz<$&`=>znJKq5 z)Xg@mz<47QzVnpps5ki;x8;4b<~;xt zAbh6;LoUZbWmIlsr;<23_30N)!9E939A!w8(74$&-%-08V*F=!wX@a=zM}svq<@7R z6P>Q4*#K_cwCisxt4uuy3zqb8zkl)isc$X`0c3&$a|quBWxUu{CkTdZnnmsTap?Z0AuiSs|Z|C8C9%bG%`yy?MGmu;6)+clhNSazrD0UiQGLsLz@Cz7*NbG?jkS{t&VxdJ&UUWZ6_HWpI76CsU z0&7^JbM?MP9v#YNFcX}IIXVEZU+=VD1rDBLflq~+spJH3Ate&I9L$#5_B_R4AvIXS(# zEub;M?_*%$y;dJVgMs;k@|=?^3FG*5 z%J7H9y3}t&si8A!pG5O)TpTlOtjvDw<;%kw%C3$cy?1^(B~tSkPMdHK64Q`>fmH>6IE%8t( zkHo5d%L1pImK`MF37ULzD#QxUoS+pa-Kq7nf zZ__i5hPl;SRDJdMIcNwTJIP1(()uf*C45Cn-e>qCMs)DSS;PMwy{4Xa;o zL<=%|0DD{&=rap{kIk`TtdzGxU_FKTD`5P<8xK8nRda;J! zDxRt7`i#fHY#(-ezya{ESw%5UaeZG>*VKRC`})N}v3bgE>3`~d=_Q9+KjRk)w}Fg5 zxvm8zL*#AQAeLT)7e_wKuzoa5G~a((djl8^glQQGuixuQy<2dw~?^!$(Do<3<$7NqL0@K*Mn! zR{bCRw$fJp6zn-EBH*|7R8n^*HSGO)Rr1D z^y%p3-2F}y__LRB-^HcsRhvz&A~Hz?gPpDejg|R* zZqXR=2Bu~+ONw4#jl3Gm%*;ZHcPz0<(PKK=nQU7?j`uB|M;cBp;y_6PGsJBSlxZ5YXDCj8(KRPvJM}8Y<)vFSsOITwB)@YdvRN@SA7-AllCW)Ko1E%* z#`uS;WhLLCC(BC!>ou+TABHy=?Oe0Wgd5y*SEtf$O1HLk-o+;G)}-WdrAQgQSVz^Z zd8^$239(%01XhPJuR3e3 z`e*+o+x~p(dw%7V57!QP1mG&%F019*N4jnc9+nEhfr<*N!b7v5OovR;=@)mX3rV#^7dw>JI~4Gto$JJ!ThWwm&tge}OoPk{Pp*@1Q7?Ao+65pm%p7^`2;UfxhOf{+{Ckbg`q{@m8DE8-X{3eHI*JxAe)4btPZ)3m$Xj`b^#YN8_a?mZs z{stw^FV6urJ?^Jg9ojFX3K;xU^=iQW$Py@= zAD>B5z!G3)i8m6AfiJlZ2u-+kai8H)>@xZwB@cF>|KvhA(_Y$k0GxIler&PPsN``D z7z~bOJAu3oPm^oe<}_2x0^N7Y*ZRe@l^Vb)K(g1Rfghx4stQphXoNCl`H39+y}Lt~3P#ST{1NBNVQpS9uamaszI?cDDkej!=9vA6-0|bEhlluqGK8P7`k;v(@}^t{Q$V+RZo{O zja3mWqy#9gJ!$SO7Ni?W+2o@Juvd!e0M%Y2Tc6>AdZ-}lT^pkNJ*t1|SrIOI+-4Y2 z#UA14?@uzFhQI^@xs8o@5X(BoV!^_%mz~D$kpmRwp%^QL(yN~jTPIq!UUUX8&6bNN zdMLo$o`}0*XM;{mpgIHULZNz7hYo`Ic_o`0hPFD-%b)VK5jjNdYiF;daQnb+GYJeB z@9q$7r*1x62hFBsUOtnVn41)%*F4!l_-TRU&H+&hL(75plO=7md&Hnab&DL6>GG>) z#Y3@TK4udl9N|w9mMz*uX0E6tez=y_{KEvM+28-&Np^vBFLjE(O?flD9fe?#B%Nx1 z(WQ( zUge4x#+!A-QYtr2vU+&jDD>-YXvY(M(a$<-tuB+*orp^JPPNyTEYiXg*AGXy|F9Jl zaNLZEaV$J)Azrhqf|02dC@0^FS?Bqrg7$P|n(iWVDo zp<43YY3(!`d>SV^+E-hDB0v3ca6ZT5HjC)aY8hn4(SOWNvSbeA{dQ4Q$gyX0sRTZ) zQac29#qr|{-{8JGQ-4Ks+5}<<)KH)>_xHJCnlEp7#+cHYh}U$8!V8uya4>P9hAW7( zI;M4tDO19UXT%jlnzks2&3uvy%^PubqBwf|O9e1-?ajzXxc|B&-WBQAKj*Skk`fo1 zqTRsn=9J`k`lrGhG0sfCR?AbHHw<|%a}*8NeNF9!uR2?C9tJdOXB;yAJqZdVk%_l0 zu~RnwVj+yggMZcwx>fDd7tYKJkC@>%Um4mE-~&-oL5P9^;zF+yTXM1}{(-oA(kQ5S z)6~5pduj{w}nv)-x`2wj(xrp=R+#Kygu5dEbYOrrE}FQN0>V9M{`H)25T4 z$Ptld0a%Gq8Mw?kvhA0nR1##)d2!}g@_tU&H_1}^S5_0Em`MQSot;WYM-s7rtJSzMi_@;-G?CK&umf0~c$gT%OkV3Cx}`L8Ld-6vz-)jp3ohVtfDIwNztKEsPk z4xO&po{9?Jw$u-3V<+f^R)H~31rdz{Mwt_^`gm3?!atW!SL7>{{z5brx6#HZWZs4< z@2Rb&$GAkLNoas-H-|eVDnPhg1gUbsW-YDw?|G8@sPN0>wqVcCB{h;BqqS*b6F)x0 zyx-6qrUzW+Xp+%RRk3|K-WbJ6x62TJP_VY%?KJiL$3&i6>JB=!Tf`|8tAd|I9Q>I9 zxU6A_@yigba>KRi9FR6XU3HW$Ua+DG5>5|JTVcWi2_7qLg?S5+^&j+QN4pXa>*_2$ zC;xfv8Dz~#O+j<|h&|?0M_TzuhUzbjcfXeoN{SaER=YCA%EBI`b~$Kn94-xo&C*8a zW|EuTzAvGaS01SdT2Tv9U*nsV3Eo%!Bjb^aGI=$|bR|GR1|^^jbV{~NDIV~eb=v;d z3S!8fw`+^3&wqKtrb}^Y+u{JHKc35D@ zd*__#xG|!w68VQv+TV!rNofnEZ4MNEZEF-feR`Bg>MCh9dXajmt=@4w1f;P_w&448 z4!9g*T77n-Lh@3~K?F`apX44tI5fWdgj@f4g6MMYRed0+s>wM)s`&VRS8ceC|-<-r16%5$1S-yz25QtegAR6 zT&qpMono6Mx)|+B*gc`EwL%17rB>I&$ChBVtU(e4`il;ObeN8K<9=e@--|$^CkDb) zz}r5%LdE+pc*IU7qIdhJT-^1rxouxG2QctN4`ctyjXve{u_E$4upOZ_-yCp9iTr!f zfg5^iY;`~(uji-KEN+1yDaj_*a?elK956>sL{Xy}E21QejMIet?Qbh+UwPlkcQERA zbW5qe8+BD4jseyB2?aRV{U-7E)PDJAIOG2cCnVJ-I_D>uQPt|1HHZriMkZh#_!<~< z1UDg{Q4xwt6XkJ-_9R1+fSMW^ z4?iFK(;y6eHwdQR>wHtde=-O^;XVQG{LcpAveiJ!pXOkbbR_ot#t&|Qd;ifO{HZeb zUFFYrjG6=fD;omf|G%{%M`C~55P;Z!RG9(%sWbE6kLFLEJO9@@5`XD1f7kghMk7D@ azZf&g|4v0^@_%V8lHZjypWpb;D*p$Ly$4(X literal 0 Hc-jL100001 diff --git a/tests/mqtt-connect-rules-2/suricata.yaml b/tests/mqtt-connect-rules-2/suricata.yaml new file mode 100644 index 000000000..6fb68aab1 --- /dev/null +++ b/tests/mqtt-connect-rules-2/suricata.yaml @@ -0,0 +1,16 @@ +%YAML 1.1 +--- + +outputs: + - eve-log: + enabled: yes + filetype: regular + filename: eve.json + types: + - mqtt + - alert + +app-layer: + protocols: + mqtt: + enabled: yes \ No newline at end of file diff --git a/tests/mqtt-connect-rules-2/test.rules b/tests/mqtt-connect-rules-2/test.rules new file mode 100644 index 000000000..7f3655ef9 --- /dev/null +++ b/tests/mqtt-connect-rules-2/test.rules @@ -0,0 +1,4 @@ +alert mqtt any any -> any any (msg:"MQTT CONNACK reason code 134"; mqtt.type:CONNACK; mqtt.reason_code:134; sid:1;) +alert mqtt any any -> any any (msg:"MQTT CONNACK reason code 0"; mqtt.type:CONNACK; mqtt.reason_code:0; sid:2;) + + diff --git a/tests/mqtt-connect-rules-2/test.yaml b/tests/mqtt-connect-rules-2/test.yaml new file mode 100644 index 000000000..34b3cc021 --- /dev/null +++ b/tests/mqtt-connect-rules-2/test.yaml @@ -0,0 +1,19 @@ +requires: + min-version: 8 + +args: + - -k none + +checks: + + - filter: + count: 1 + match: + event_type: alert + alert.signature: MQTT CONNACK reason code 134 + + - filter: + count: 0 + match: + event_type: alert + alert.signature: MQTT CONNACK reason code 0 -- 2.47.2