From b607650a4240662c456cb1e2e4f18ad4c11048f3 Mon Sep 17 00:00:00 2001
From: Philippe Antoine <pantoine@oisf.net>
Date: Tue, 20 Jun 2023 10:29:00 +0200
Subject: [PATCH] tls: adds a test for certificate without issuer

Ticket: #5439
---
 tests/tls/tls-cert-noissuer/README.md |   9 +++++++++
 tests/tls/tls-cert-noissuer/test.yaml |   9 +++++++++
 tests/tls/tls-cert-noissuer/tls.pcap  | Bin 0 -> 3320 bytes
 tests/tls/tls-cert-noissuer/tls.rules |   1 +
 4 files changed, 19 insertions(+)
 create mode 100644 tests/tls/tls-cert-noissuer/README.md
 create mode 100644 tests/tls/tls-cert-noissuer/test.yaml
 create mode 100644 tests/tls/tls-cert-noissuer/tls.pcap
 create mode 100644 tests/tls/tls-cert-noissuer/tls.rules

diff --git a/tests/tls/tls-cert-noissuer/README.md b/tests/tls/tls-cert-noissuer/README.md
new file mode 100644
index 000000000..da5a8c027
--- /dev/null
+++ b/tests/tls/tls-cert-noissuer/README.md
@@ -0,0 +1,9 @@
+## PCAP
+
+PCAP comes from https://redmine.openinfosecfoundation.org/issues/5439
+
+## Related Ticket
+
+https://redmine.openinfosecfoundation.org/issues/5439
+
+Tests that certificates lacking an issuer are still parsed by Suricata
diff --git a/tests/tls/tls-cert-noissuer/test.yaml b/tests/tls/tls-cert-noissuer/test.yaml
new file mode 100644
index 000000000..c898d0038
--- /dev/null
+++ b/tests/tls/tls-cert-noissuer/test.yaml
@@ -0,0 +1,9 @@
+args:
+- -k none
+
+checks:
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 1
diff --git a/tests/tls/tls-cert-noissuer/tls.pcap b/tests/tls/tls-cert-noissuer/tls.pcap
new file mode 100644
index 0000000000000000000000000000000000000000..7e5f5938cc5411c6c2aef74cd4231b36890ce214
GIT binary patch
literal 3320
zc-noI3pkY98pqdnnK3gi(a5b7F$nRE+s<w0PEu?_r5k3*aVb$G`;;jOkxRNLL-*``
zN;}1lVnoR$+Dau`@hGRueq2gu*k{iAhMwfiG0(H+S!+FOe((Q%|7+gwds2J-3<_}Y
z?SlgZe!HdD1#PyF0`7254&db{l*<A#OE~p4G~f(?4gU{2U`MTN6kLwwS+vCJKDI+D
zMN6~`$iqdbaIkwd04Pqmful5r#e3^}<UWF7QY5)!0Rz~;H901klYBARkdp$yKI(`z
zNhRq><zu_V5+x5v=Wm%S9Avvpk|$MasWX5D#8^mDsmE^<tL&Pgk`H;SyyT%ut4WF|
zkpXa+I63}@GQxi>rpQU8s0aspXaFc-2xx%6zK3DTp9YOBv|luNZB|`lq@Nq&q+IE|
z^2Ym^A0D)=di~;TBLK?;h5`Z<HWxQvZvI7JATS1efwn*ogbTC;x*$}*5GVpm0bRfZ
zrl0_v2DY$N=D-+;U;qw~1~>)~6fl4c9O^(BECi}R#WWUbmj`k{2Hk2x+Zr3Y-I#5}
z21;;O84g*X5A<-1f>AM=6pcos(-<^q8cw6os5nAFsL&h?!B8Bfpj4Es33cx*F6nU&
ziCxm2;nFJ65>^CRSvT{qH;QBxN6CUXc+JQ$lZA(IQc2d(8;LAfUt|MWUktdQ061XS
zm50V!%4PxUE);L!wU@ARC*~dxz1w}7;pFMR+SS_$0kEDx4b}=F>md#3--;m(P=rLG
z<#1LC&}#s_Lh#UHIEW$)MNm`$ocwT59~pD&x_;5}quK<vhG0->`Ul-wY;g=D0I^V6
z)`ZPAF|i;BQ%m-;^>Aqhm*!JTB8V+b(5aX&PGzFLK5ThHj$F`~QuaH-61GJJvYCVe
zxg*77_yli@jg8?1MsV45LW<m^GXYzckS3=JOx(iU!kj&qkSCWIlOC}xI51-CwwPFg
zhb$&!sdT97;HWHuAQXV{kU0SEGf*CafR;m=;d6ekynpQZ#iN?7y|j}4;G<GC53dh>
z;5HS%-L->T)mMKkE#w0`+o(M6ZO~Db^p;2cd1rR&ZqHC(xz<|t6lHA>|3RRORk|%!
z+MV>_O7g_XYyNKxF23W|#r;@bG4}F#S;ue_uPQ9PeEiU7<(?zDXX54-hB)6k@P%m@
z@HD2l#xqsbd9`TB{pnlJH;RSl%kttq<vmQxcAre5-E9m&2`7WL3(RBZJQ6GCGxU>F
z9tt??_BZEx`aibZ`%;Ek6lpeUWmX&6b*-%~@x8}#_YALHUdI`t-ox~92Vq6tQ2$8f
z*)PX(s_QQG77lh$bzAPH{rd8*yZM-CvD=MPDEu=b=Qa@=#Kl*igCHUt$52WU!6er#
zT!u8&fQnEkQW!!kA~&^g6+&sBqD*P3yQ)V}*IzZNL+^&|wG6QHa)cszKmmu&@TR#i
z?OtG^fZ(765Z<zSW*f91<EnS`KtRmp`Oz1pA}Q}KPqfM%-~~o$<yaesC0n#*j_fI^
zAC#v|pu~1ySRV3s^-?44<o%AET_vFnWmM}F9nGUd8eriTzY#M9M-Sd_3bb&WXRbMU
zNjmWEB8D;m(Zhhc#-q5QW;C~_lz-Ls9}Zk@P+8w@=X}4@IZ2;Hd#qhs)M>Dt<ym#s
zRg@=fV76qmKWaYx@7l(na(-59U}X8MEPAtXFuTd9gmE_9SQcEGx1iIzD%pQiaCLs{
zWx?E*oTjt`*=U`a$x3vQ(VYwVGTQd|k(k8=>CLaty>`e??V;BVJAoEqQ5g51hf&4w
z8Yh+Rxsi3jMMVadDr!quuQsuMKkv#yw)UX>+MagAZB;4#zQdr6Z10vmn8+qD^R4OF
znqr5%!uw0Rd42USAH1Y<D||Q`?v19#n>D_0TUS>zuLKY6)U@xug`CN97b&~(`}J?U
zX_7Y2jr&ra{D+DCD}zP4x!$dR#$^8x5Mh3HlyZvx`Iq19Zu=&%7Pb~?5#z%r$i9Kg
zO|_v0*oJ0#SUeH8`Ofd#JS!rxL@m=xex%~-!=g1_7UV)et|Uq_zg<lESt3ORQjSkH
zGnPC6ni}~g%_{Fhq7#bjHYD!L*>mV8sfZr~Cn!;=E&=h}6=;+qJc%IWc|9|ao7ou}
zOJn%!-<Db9!6OQt4(T7q!uA*38ECjuYk#43WUP%9;AKim97vFzt#_x1dpGO*eyf%V
zWj2t#+wu6<-n{~{=BXnf49>$Ou>v^hB<u5#L>BDbiE{v$mc&=^10H3hU}a~LOHfrr
z_{jrDhTTK_d^~Te-Y&6RUcPbcIT_dx2A;*Or{X$y%&2n%3|{lqEs}C&5dw<Hml8>o
z9R4#gB}yWNbn85PdP3pcsp`iHoG^O$5yQZx>j;~1xAf}lG@+ePYv;}?1?T)hgIs^Z
zkz}mh>F(>bPx1;!M~&83Y~Q=%#Fw$&(fGVit2QUQtmhByp^sBFqTRlf`l;uI_PTDq
z5w=vbyIgqh>N!$xmj*JMb%({)Y0W5ijcAFEDQTU9aJqG;s5t0=^A1U@CQgRfy1f!v
z(7O0blezP!h{(9@U=1hJ-+RGTPtji=RV_IS2Yr>g=6vpNb6Xwe*P2ov#p)dB`)K<4
zbfD^gXxzM4Jq0O7e{*@~?G5_={FD^U<ZhgwI#m0b`_!kT|7G6tv|E*N2Uh0V><o9j
zm*vz@SQS10U-#RLeauRn{f$z#H1#gfX^nM?SaHv4cU^UYnoprG#<OmYRL?4pbkq<3
zHMgo!>GshfGSPCF=qy*|x!B}q-<zysnpiTQGyST>$l<^j0(>P=T=^YhO1VS|c~#Z{
zFb|eXZR)D*Tw#r_DO5ExX<E#>>9|2Rf8SFw2quru=5MChU(N45na_cNyv6=5o9?fQ
z;;d=E5DRXfA=q0iSm9gRo%3c@bVRI3LxLh7sA%AOMHa)<ZzY_`a^+-+SwJF7RX7l-
zI#t3cBKqh=V|~t+l!jWJzE{Go%7m^mGRQg@<o~A)0GamsYctaJ5g&%{pY5&y{1=#J
BlVAV<

literal 0
Hc-jL100001

diff --git a/tests/tls/tls-cert-noissuer/tls.rules b/tests/tls/tls-cert-noissuer/tls.rules
new file mode 100644
index 000000000..7d613d2ef
--- /dev/null
+++ b/tests/tls/tls-cert-noissuer/tls.rules
@@ -0,0 +1 @@
+alert tls any any -> any any (msg:"test"; flow:established,to_client; tls.cert_subject; content:"localhost"; sid:1;)
-- 
2.47.2