From 25d1b08f674510ff11b3b8bad73dbe25f11c5185 Mon Sep 17 00:00:00 2001 From: Sascha Steinbiss Date: Wed, 11 Oct 2023 22:21:46 +0200 Subject: [PATCH] mqtt: add test case for protocol string keyword Ticket: OISF#6396 --- tests/mqtt-connect-rules/mqtt5_pub_jpeg.pcap | Bin 0 -> 37323 bytes tests/mqtt-connect-rules/suricata.yaml | 16 +++++ tests/mqtt-connect-rules/test.rules | 4 ++ tests/mqtt-connect-rules/test.yaml | 63 +++++++++++++++++++ 4 files changed, 83 insertions(+) create mode 100644 tests/mqtt-connect-rules/mqtt5_pub_jpeg.pcap create mode 100644 tests/mqtt-connect-rules/suricata.yaml create mode 100644 tests/mqtt-connect-rules/test.rules create mode 100644 tests/mqtt-connect-rules/test.yaml diff --git a/tests/mqtt-connect-rules/mqtt5_pub_jpeg.pcap b/tests/mqtt-connect-rules/mqtt5_pub_jpeg.pcap new file mode 100644 index 0000000000000000000000000000000000000000..fd6e905092d5c1ca3446d49274572dbf622eacb0 GIT binary patch literal 37323 zc-ri{Wmp``)+pSAJHcIo26wjvf?IHh1Rop**SMeo0t62_IKdqfGz6D{U?D(o2<|f9 zK(?QAzI)#H+0XrRcky)hs#U9MSygrQTFhu$c?J@I0{mW301)C{3JWmbokRu95wJP% z=kk2!KFZir;1=5LzchgUS|5r>H`%Ilx_4E1hXij2cmV(j1>TN=gn{K_+*Nx`gp7=S z#qI1rb3-op@ZWGlHyMggFz&=aaMXH72(SGsx2x+{Zb(z8fIgy={=e6a{=e2u3&9cd z;SD4JxP?H1e&=+>g&M)d6G80x@3~0-54n&dxG4OY%MEG(MO{l*7qu0TM7{|SUpdeV zV&egzxIKVCu4JJ9&zfG@mHxlBD<(n?*Z-txID$(kf;jZwbJ6`Da=Fsf^v_)A`2m23 z0l*>z*dBO!x^nT!3JS=J^73-=ipmRc3CP~zpso(EBZkBP&_RR%@-;IAI}jy+`U_)A5Y=z61L)Q-GziT=d{=jX z7IAri_^;usDfRjV_}@&b3Y!a_R_*9{}EU z4X}QA-D3)P3gBR1U|?e4U}EABU}Iqukl^Fs;FFLO5s?rPkrUutmtP+LzJPGCv2pQm zZ{XqGAjZSPBfh%f5&!H$@ZSso{{RqR0A|2DWDo;@L;yl20KsPvs$#+0K{5y_Q9;+` z7nP9_%Aug5p<`fTVT1nKh_D&*uZ=eV5DEwx2?Yri9Ss8&8AkxoNPvuTlaLSfj@APr z2KPt&XvEPOWwMM+B-$S>1q3}F56Pi3$LMU&?N~vCNHfcyu-uK+wU%$q@)RZ;)|7t3#uTHhqRbSd9iz00*rBuZQNSTL%&*gHfmMQ)p2E4hsZXXmwF(Xl zI_lxS>g^)7#C2D_bTSDHzmt+Jza7%DPN8$ER9)1AOzC(eS@$8`s7@lRp!a|| z-R6u-ch=$@e^0e!HGX;KX^;3bXDIVjjs904c6GJBuLL49M=CPfX_dt9gi8l@epC_? zqE=N>oONW<;=f9q^2X)^KLz+^t|%V4V%OQaU%ukY4~mAVc3ifBGWFRp$|jC~QVR~i z2me*sj=7FVT;6#M^be){Me@$*uK}4GO;UbC`B8nJbFv^|CFJv#=2Ig2V{o9etTaFT z;!GyU_FO|`)8OF61?dsJ<1`#Vfdj){m${QhsnK^vVENUUTV+Es$KvY=peIS^syp>h zD9!oMGh#mOSCdHHWG5pIu5$jl48w%_8uvUU)}yv0J?84KO7u z@`3|s!KJ5afgAXBUB;@K+nIe#F$Ts3zY2~}kXZ&k^sgGh*8HAeBb{gUsWHDhaz7lK z-83|AToIY7`noBUcF9qEx)@hM8h+cW>Fldaw0Xgr~^6Zh+7NyP>bV~35Q$!YfaKMX3^-6yl5hOooq!--(I}$1&-EOw zMdUTn=A+%{(hWF}hS12|;jbF+J*j@&V7;%)X&}VhR6U~_HwYR1nrJIl0-e%pP$F}g zVG#>*xuCnKS>>!U(RP!(eU*j=IVz!*k^14M9zTbv^&qng9@^wYr3P4VUy1i8 zDl_YqDH(UU46g?9vQPLqm8VpUjy=o4TcieOq3Po{$wjkTSKz>hjXS5Y{XQ3tyT(wl z-JnC!+9ni7%FFERc0RcuP-cHP5O6L{e4)9n{zdG_QiP-$OZB$j`^wZ_n{>sIkgdWK zDWiQ)VXr&)ATwtA{w6Q!a)ct9b7y-GWZXSk4B^0H??6Pz$y!d$XvhwQ!MOs@g&w;o zghH+Eoz3}R;`1jXZ5^%khVCzSzbh{DE{vYm);Pd{0TVdzgGgp`1P)~Dzfe0Jd6DSo zzV)D^zO5?xC4^dY$jbTfYz7WsbaDs0^E?mEO51RXm_p_8om5qF^Ku49!vXR~uzJ7M zi7`tuviHF0S5M~1Q;F)!0Ml_kIa5 z%SSgWM|-F4?Pd-8rF87)D)j~ zkF1E1UvR9!fhmvFs+uoHRqs?&l=lm4oX?k~;#~BcPFLSpoN_7%r9Szp+8jVt)v^z> zC^{0^gniQ%UihXv#+Uje1q27OG&5n4%pl{Ao{ui(5B$6qyqp}XpI7YBZJug|jOahz zON_Jt5s+K8vH83Sc0K7uBflH8(R$H#-<$9xWU1kTL-YU#s{%JTy2i8IM`2vNB?sqX zV8+PIYF(&FM(WF(!5%sCaj|}P@bqSvYgNg4UziE>eg$-{f*{H(yr{u3l`5m(D{ZsE z>DH?6 z?71Z004F5k75Q1fWdh9gWEC+-+$P|FOZo*vJziYO#$~#O$y*NL$Eu)d6tUjZdjm73 zA+XETh*5}B7OQusUZaycIJM8!HFV8`qcGc3Vj@z>R!W$%Cp@(al8ji~;U1D{rn}+g z-(Sb`GUq*_P6Ycvs=5eHTkfKgH8&hq<8VTQYYY!1;lQ)|TX2BJ z;@INM=YkcQ1*_Mi(Ig%Le>ptMuf*i^iQ0X;wH$|H9I% zcPuRE$EK>#n{7S5l$-$rgEiQ~FV`$n+VFOD&xtG*@{b!a|VJoU#o|yIJLFa)pBx7<%bbEGZSVc7pm>O z&3oa!mc3&ptI5*IDW^U|w9tz@hpdtMJ^v$ptM}Z&tcJw3WKOJIQfX4qK@Mzz=67K<_pB0uUCqh zXw@yy^eJk)NgJnrz$_dE8 zaFy@!SW-%V3v697B@F-Mo8j!KFwgy!Lu`Kq+^jIZHMe6@p>B^aSvZLp&1|j?OW7Kd zK`muv(LuiZM$us0l6dj1+HK0Ax(>f_rG5W+6ZVoZ({+yOR?2T0TN+(eQ^5&){l#AC zX1kF*F!Ri%w_a7@?r^{Y;@-06Y>Gab1|2@tG^&uupIRB?o6%FW+F;%aauL7RLp@Ve zc$s86cI$h0xYFRO7W~Ck15Pz}>o@YT?@mKj2ILRSm-WW@x`*m;f@}k))`aSL}sb%~UoOlG1r`$fJIG_U7E8u(U41 zF@-x@E|>nx*d^E@3Xe@Oz9;gy*@bR9vxSe&w}ZWqaXVIS&F4Jd=ll*FD6||uo$-MV z^@Xf%*o3$rL|srCh+OiVW?jgFo%Zl|u5;h#=O_pa|`xh|1GsGOw`7r_G%zjIz zt>#-_BjS2N#d*)8lXu|xOG&K*{VKK{e^qWbn-^S20V6E*&alcypGz&rBVv;+v?>Nm*{bRrUNUFE z{F4iVXQo7|XNM4Wx#aTaF}O%Q6W}<^oqg}Gai(z+r6C0eT^`g2&~O*ZoZnC1$tGj>f`Gco9o?{LAJggfd(_{leBL z!lY%*;O2pR6X2Di=q2IomD_od)}mgVQKPvc70~3!Rk5EOL^r5sP<+0&72F&;bD$$= zxM#xh3S!b2H8Mimdg>E0^|DpmnkkYE8R{xzjhIw7@Nv|F^!7r$5Sw?$jF7e0c__Di zkimWP9!g&>ueZekA$_K2$+1JHuk4R(JR76H7t2=7MiNcp9P18S zHoVWw?iDHKM@Vl~S|F@j5aes8?lTr%VRmTXGTA&hq*T^i(s_Y?kr}m3XE(cX3T~8s zIYfPXwU9o2o%#Ou+sJ1dmvz>#gacL{_9ykps|AxY^W)9X_i!L-5%KN|YdP0Lxcyn_ zd1dkYHaHOBI2BZ~A0#vQ#qsD=x^`dY&bsp{U0-n7c~@?ENXLb5-)VoF*;W}Gu&bwB zlec8aKf1_7%)O^4NFKM3c|SY~qo-VFANd${+_AdVaoXdvT@hs6o=~`*9Efq+D1Xk;AQNQl%~!FEgTrP_!3e^ zcjg$9)96nd?*Fw?!fvAGOv)?`x`$XAO`0bAs-HPaiKRI{l^tB3t>F6fS1%gRo|7Ok zQzXjfgz%aXQ7nXeOgk>dk6#QQrkh>9w>oewloH>tZLZ%dPg^Sggf|hfuDiJj4ml1{ zo>jKIFg;CAJa|I5QP1z#Wh0#A{iRE?_BsE!#FtaVsYiS)&r7AO<-z_9ey20uQjsA@ z*;L)YndZ907k)UPc!@oH!Q9+|*!aStLuU)iB99D%hg^%61$nokPa?{Tj}i0m+^ju79qnS~ow%?xKM8 zZt3h}F?-Fs;d79(mV&UjD%H8A0OqU_NJP9axW}MiY?PCz`Qk;$m`$eRHMWo%JBY@87>n;U2o$ci}z%u-|5OSnYCQF>>C1>r5~AbnUg(R*dW7i0u9h z&)N%%8nkezosOexetf7)@z*S$N~6`FjOrkk{=O}n&;(d;-7{DHk7Xr7MpkW79D*`A z;6g{bea<79Q#i2gIGn$KLF%uyx=Fz=LvB00;00Y z>L@=m1?bdQF*XEnjbpyX-B{T%-Q)R4o{+`xF%XJ&x z?=euBhrf)7`%5MQ0BEo46o0NG?_Jk1e~+bJVOeinSFnBytzL6MKKLc#$75@YXmLW^ z(SGUl6O)mc^c#l%`fhv`ar^}%bbaUg9dkYA@ipuQ0PufXkXNpn|NgdXTVVWR(Vx-M z+dr>g+Gu~X)6Y8Pb>vU;H|c+>V0IN{MF6+}1n>ep05D($JODfqmj&PixB_;F>t6%Z ze+gP&jqqE1_CH3o{~+pBaq)6;0)EaMG)q@67i);7rGwS)?b=qJe7`E7i-opJtf#B<&-za>wC(JFX}?wu4dMj0vVrJ3sX?yB{}Uh7>ox>Hcr}-=E6R8O zFgCiKhpU&{pHOJ79$-7Li;atyGopqguXEK&^BQ+$$*YWnqK%7<#{*9r>uc%#+-!a! z#`;Nog}G``cDAGczo0*|mxq(CyrJ%&jsItiI>gTAPZ+cZPM*3C?EZwqv$8?-v+?y* zhA8Q(t693bI$bqj{EGe)F{Zt%hyNWXu-&hg!vCqf(y!<%>ss5`KJaq7%86lm+jw~X z8*=?$(SIh#wzQLTb#nFigK-Idc92#4t>H=x4Of?|C#I*Xo2Hj1#O9BN!*W6x@?Wqx zmad)%gZ>L18{uO6zmi|Cty@3)T}@}1ZQyr2@o#Go>AHSJ0TA*3Vxo753*j!%HvlNP zf1Qya|0e_SPX^+j48%Vfh<`E=|70Nk$w2&*f%qo_@lOWgpA5u58Hj%}5dUN#{>ec6 zlY#gr1MyD=;{U}A#C7!S=5=&P?0Oe<79Q`^djo<;F$1zlvle4&|t*M}_CV$NqM@bFr;)-+w0GwSs zJ+u{N=?#sH>CyWUeJ}wufDZs3SV7#>brf{31HAHb^biEmpTpvZV?RTrBV0=N=;?v~ zSs}1;^YBCrbM-?C0c#tG6#{;WfSr6i-LCLg@ke4y$151=D)LC|fe;V@lV8DhKVi;m znxF7h#(>z`*~J>>Zz?Of2J#Boie-9z&>gIPHU8TQe z#YWF3CMHU+WaHyx17Vw5N6LGZ1O-@3?85JH!k| z_^o>25BiW^%@=!5Pd9NM9v>ecZm^9N_mx3^EB{A=|DybXANSR8znO>r?$78t{gvIU zT%BCKJm?{A53FqHx&Atd|JNP=y&Rm{Hnuh%HZF)B`iNNucCkaa+r=8}33hd%2fO?y zC;l(H{iXbz*H_y`_9Z}U!42FPAO?^(djS+8YyjCb?aJ%F`ArQ|AGlh126W3m=ly?5 zbssmtxIp^<>3wdo|Hocun=1qF+c&(0*t^dfD7OUL;wlkHXskE0Gfa< zU<8;0R*0?28SnsnfI#38@EiyOUITGJ5|9pL1NlG+P!7}pjlf5s6X*d30T?g^d;=DN zbzmDf1kOMp5IP7KLC`cM44^jhZgN#7;L3SV)kQXQr^aKNd8Dq zks^`aB4r{KAyp%NMCw6;A$>zyM>;?Tkg<_Tk#8b%A&Vl*A!{NVBikZ-AO|CdBF7_V zB9|c7BX=Q>Ab&&NKt4f1Lm@(;N8v(|Kv6=`L$N|}M+rs=M@d4-L#ak-M;SqxL)k{T zM8!p=M&&>iM^#2OM72ZpL4A%IkD7~Gh1!7%LtR8YL_ycakFefi zm0)#XO=In0V`DR5i(zYFgRviCzr}u!{Rw*x`viv&haE=_#}vm4ClUvW^8sf9XAc(_ zmj(AWt}(7BZX|9#ZX51b++#cKl@%{1R@hk8L z@HcK?-e9>QcjLj0;2X&|>TZnRI3OS*;3Lo^a3%;RC?M!2SRq6wWFeF%v?hE?m_^t| zxIlzV#7HDZWJUCZD4VE*XptC=n3Y(W*nv2VxR|(~c$1DkDKaSw zsWPb(X%uNW=@{uL84cMTG8?j2WF=(7WJlywv}Jt5*vh!gM8~Ag6v$M_G|7y~EXr)poWR`0e8j@aV!-l(rG{mN zm7GyvZ1kwvN^J)vJJ8$u?w-=vnR6;a3FCAbAUNgIfgh< zImI|#I5RoNxp27daCvhTa?Np*a;tGa=C0xX!NbI3%oEMi#dFCk#OuVH%{#?M$fv^h zn6I91m!F;Aia(iuQ~*~%K_En+R$xbvL(oPrP4J5lk&wF33!zq_3tddO)q_4`knMQnVT{XWHM#uZ!_MuzMXq}`3~D1hdV`ge#r95ddODE9?6Nz1<8H5 zi+oq{Zs^^9c|v(T`6T(T3JeN%3WW;Wib9G3iXW6vl~k3YmBy86l&zHWmA6$yRDx96 zRdG~xRFhQa)!5ZM)auod)K%1D)u%O>HC!}mGyzRz%~;Kud#v}|?=@(lY2DLG)>_i$ z(+hP`lX;T`zQqHJiuVI_8VY1a1waOLCGQA z;mA?b5$XtcGH@z&#&EvxT<1dQ;^@-uO6%(DI^@RT_T258ySRIt`?iOwM=k^eF@w~4 z5+e>%y0`vHQL9TlQD*&j~;YunK4myczf?a4zUh zP)0B)*fO{^gfZl4$l^oAhk1{%9yvbhd(8Vd=JEa$gD3S*X`ViOy6{Z#S>bcM=N`|; zUr4-2e~I!E{IdU*z^lYpm!a07pTl^=;=|6vt-?P?@I}0hfJfR!_D2avrM*Ub?ecmo zS|&O#h9Jg2W+7HRw)zeIo6tA=aTami@q+Q`30MhU3E$qTy{%1TN_?Goo@Ac{OO{P8 zO`%SCm2#A7ojRO$JFO(0COs_u^d0!!mkh;>>P(i*_$;(6@2sV4{p_wB(VYBT%G|Kr z3#be9Tb_1ad%j41egSnsR3TEKSK(@rY0+Tu-QwC3u9A#W($cW^z!R8 zTPs8>N-CKvQ>uunLaRa5e%0GG_BG#XjcSMLRO(vmCF-jhxEr92Hye|iNSdOWv6`PY z!(04Y4nDYj*!XDoaiP_sb*jyaFS%>Z|G(?ynvY8K@l;8>}Ca9BLkx8U8qOccgPvd9(+n0UH|A8~ZYDI{xj8 z^_P_ir-_|O@5!^NhtsIjp))sT;=fXV&75VME&V3^t!eJ=T<^Tj{M3Tg!uof}_w&W4 zOSnt%%XG{6EBq^ss|u@wYbI-p>u&338_zchHdB7w`cb)cd#iWbaC>pbV+Xz)zDKbK z-51<%J-B!9_0ak7>?rh@;yCX_^rY+5;B@)S=N$d~?FHLK{iW*VG~5{uhfg6sJuuL& z3gV7|gMp5LgNKEIfrWPi7Z(o~_r`yfaz_jT!oK`XxXRlT{7>`t zATuPxKjiJ(0qUzHJQDIB&oyZ1s2Ct*l&fEEYux}q$Vf;?n0Pp-2+Z{_Ew5Ad1cW!y ziHI5a`0u!v3kl0=X+N;^fIN=L$gChCWfTzfd=y>QIy6isryKi`Nykd>Nmg6s+}-(Y z#E_I%>3?L<9~mNsMnk$1<}Lw%1VTbW#Xv_xV6KHiup>YrM7_zU1X(R_ps6GXyt zX}M4z)__K99x~F&Vi-yPET{8Vk?Mo5RZ zqNJuXzOSzL-9jrM>9Ra_;6#-aosfKwI#_80S=kE~27mDjyT_^#oz5O(Y6n}N;K1k} z#Rg(0ubn2vPEJr|GQ2q;U(W8HwCr}0O|H`9ADz3_&^NgoTW0K@qkG9HCd4HP!*N)wW?;_+e~Q%Mvu_tMmC=4v!}58}X7t!re#Fv8Yjt0FvA~e@->P3RI^2vwVgYgC>yDoVLPxfJC!v&>NUOW*koH_mq?XTpsH)8#DeLm z?8Y@COl590g}&NI%*e^_sP}y-4hgI18Hnih7#aa< zguhu}_6l|i6D4oJovW!w8)FL4iSDQChoBvWtOmcn zySF`nulO4HTgp9RB#tQS!E&LLa*g($#+S<>kE>YE7*yl9aKzRsg$z=2&+D5|FLR~N^SSI!d=7P4*mb&Fd)!8S)ifL3X@8z^yYdup}Bbl(KmBn z?I|_lM3D5XF?sjmdlp7VmfX#T&ILO}M(b3L<=W4RzUMlu=PbK7F37r`$-1yEnG7wtKJn1;MluAn~=C;3Ztg|x)pp~U; z=0f93GT9BOaya`H_?iy1huhw|U{kX%FLF7(+O4qpklH4&;VHC(T%GVgn`djz8oy; zj%nv)J!bbl!_g{Os@w`x?MqAYPcay*;xhI;g;Jd@Ty#%rlR+^LZCpKD$`}C}O!B`^ zTNDXvHWIGUXb*Wc%V{8|S4(Up`J)f-Ncy z0OS~P#8)*@apamv)qdfpqPP|pXN!;7#BaV)R5$cS^X$FzV3jZ(r%Dp`bAOX|INo05 zXl0d*t5aw3q5Q*buNRVkpZLhwVe~WP!Bus(MGi_|y~SuQafX&lU$JK7KMP4DnmVew z*JVtxs{7>fR@Hoz=VE*|bG`DLx0oLu&iAJPfS7(A0d-zp ztiF2j^f1edC8-+f0^YcS3?ehm;gKf4J&#}%zY+*_l*9L>0RZ!2~9QsyUUh%RNeVXmqOzz(2=g`L+(X%O$iDhi& zDZ|PdDdxpHORCGrBxol)&NZ0bjx*eWAzBPoaGL+@cOE4nv+=bwt z8D$(t9J3CMrdB$V&^cCPzhpvy>0#(98;jah=VJ}U&PD^)C25$^_I?3ZVCrg5gSov$ zq}6w^s)9RkfCfs3Q?dP7eVe9_{g#c)9yIlf@LAhfiOFl&25@yUEo-Q3zL+<5ESoxf0B>yvW zU*0+MnEwYycwW#)`Oqn|Id%2Lzb)c&fiu%6deVaTtrqQCr3>|Ctw{?=GG)#uRE z7K{OnB5D%K3%a?aRUOv@xhf)@)o#_eoZNB=6agPpLW?Zm%?IlD|P33Pb=mMjFmNr zjL%5!AB9}>NlRAE<=1}ZImr;HFNyJ|Ok`t!Th>Ro($umj@!9UZ^H*c46i;r`RY#h4 zOFYQd<{VQ)?tM%0^>b_3y?J2<)M3h64BqxH3p#v4w4PP9IMxld)TJ>W4(^w}=+KE1 zlPvDk3UVP@3(@I;1C&o;^2N5{O|=J^s{jpn;BWIF8~OxR1BQVt) zQYUY<#P{-wSK6PJ9S--CWA@e4;>nuh)Xn?!E?3CKMWcFO^e4jsr~WC6(?%Yj%()Fu^w1C<`3EVA2L}q6r_ubLl!y)fJr+d=$j>%iKOQF4 zSDL1Lf-&yQG`Uvhh^?FJadN$O^sX0oKr1=*DT>lWlg0;k_(S|{O9Ewc(+b?-fNoXG zq{&d_?hs@>`Q$EuX?qL+m~s<4kspbpT}!;QvXCkH@2ZOX&l>dyJU~FeQkpiEM$p!tgA*_=+>TJb-c~i3EhqMGI?s1O=c@& zn8$XBa=hJrRBO$@X~I&c`A^1c4G$Qw5|WC`@99WJMPw%j5H?^6Z`6P8q0s-)u+i(V z^x0a;q(6E2%!L z9H^>zb6#=oi$hpXKR;DeYx?ZX2MwF>l{fhOY=Nw=qC@jTSq4~Ek6qW{2d2%BzJSXZ zmpA#$7cMOU5s@q?v z=Q?gVO?imT^xu8J0(9ISd?fw43b|E!qc0!zD+rk`b{DHn7v>Y(C@Pb_6~E50dh2UZ zO_>KQ-$r*M^_vfukh^cauY+GsiDnjUoy>||+Z@!~&nln$O${McwRlE0B%?;a>vK|d z@4lt{@`6ks1I(}$4rmv~X$*cX~GkXg$IFAS4&(kqOWoKnpw;jgxU$K-N<3i?dU?#CtQ^VnX6=5lF`-2u+Y?-y8k@lGKyhba0c;WvW85;xXI za@Zr?V=J`Bzx7Gll0ME6kA57USyH}sLMl!ksAHk$T+wZyuy5TLfH-LYZ-hBZST2^ko%Fboh4a2K)}Frn!6oRIWSlWo?aelKjL$H+#BBx)dtyib~*;}jHcGf;MJ74E9G=?Bzy41$G%YC^ddPi$imGb-Xe86PW zVU-^Koy9sY@zPJ-gWBz~Vp6@yM&kCuo6&}fmfr}y&n}fY!fX=Ds;5$r#we1%3681Kb+E0E7S&y=wBgpo z)Ht*8YgwAOj7{&-lxFarpmn&kIKj$$Sr;A9EL<~KH>f4ztuZ~MSNKNV{OpW}H)=k` zfH`2+wMNQF0jA&0;l)|lQ+m;yNGw=ZZ*z4LT=NYMxK}+J>dq0r@E;WpR0uAm zuqcT0v{Ui+5GKtG&=_`)^4i@!=o`m+1_$c5Mz@jf?g%Yyu~&rje&)+iVIP7L*D|uw zGBmf>mCuPE{}|D9RT`MsY3exO)izN0{Ji(DGe$^|HuOMYsm^xX?e)mG<5~{>*v-|- zZaK1-PZ#2giYE14)|Y$>Uu50t5fWX~=;M%y_Pp8sv3s0)MN}uY%PUVs)!9tL&)Hq7 zdmyu3y5f6w78z?fTMP1<0hqhSm9Vm~!=Og5|Gj?G>&>Xiw=buo>s2$8rY6OM1?TbC zzn>+ZsmZ!Ij^Rno@8H&a?lYUs?vHq|lAXYcYxb$<9NbPf-hCu+m?$ap%4N?SOkY$O z_+IUzxYt93b2>EQn}hdV-Ob!Y@Y>BhR~&7j)r7}+&;sB3oqSA{qDgIaC~KLNUH4qR zs4}~|I@Hdlw&COMIOAlL!_qhdJCC1cR;gGkSNIkg_FYexcX5nHru(tNSrrPI?C#M4 z)~X9>jFqZoN&mi=Q3fZzI$KL85)Pt#F(Wsp@NbFm)!Hu(G+#w2WE|Z))=EEKeu+4-xgI8- zQvbH9aWH6q4n%vsCuV;9IKG}US)EIH5~H9RPR zf`(3Or%r6Fi}6&$q^XZ5&EkQejrISQHkBaMJ;% z^iuH94)jKd1?%*{q$Q}wU!QTyZioLUYv?R5@Ye6XjO8TqDXROZ|9LeYoDrZ`;;mHA zt%0kQ8msap?i*!9$)=EaN&cK^-Iu(rkESm6=Xw?@xlnCwZD*tEv8uu)#|7T~3tE>O z;ilR?%B=bEO2F#N+W-i^%g0B1n139(JibswCBHSArKs_UWFn#cAj~ANFjjJc>M$On z*aTY!lRt?WCYfVg_ELkMpGcm$c%EB`-lM{p3NMTl!`emeZ+9ynlPGWrdhjrA8QiK~JV2A-Y$#>>c z!BU;{q60DMtB%^G9+K(Bq7i>ZywsA}pem9&&MyeZ!srallQojlFzU4!dX(~w2tD`& zt?%xTMJ&~Bec*!dkZ>X_(4dKIRJCxM-whNg&DregExe6R>-hq2zLd{rIEWOV zr9YJTNo`@T*?zkGlkSSlXT|8lrLAn=A0<*e034sSEq#@m3m_A&5-we95yjH8{X^nHRec&5NpTOia0% zeDebD#pi}hwNJL6LgX@bOIG6c6TYl%o7<;8K2w+G>5e-FzV|;xu8wCJ&_Th|Q|Mu2 z)YBkV6r(EKVvTk3Qz$kYFyf%;&K;|hGG^(gLpQFE&5rGHoSAZ2Ky^}Q=VFg2ni4WC zeU#WZmmHTUJQ2;3`)!6`ImUOT{>y`KAvTSa6n6QJl3bf-N*ZDr%*;*5GxqhmM(bHc zkMy)e%DX-tdQ^q5&7ptNxEGURmSQ&YjhXy2H@|_pQIpa6n$|yJu)4zQ3ar__%S~lBEC4O&1OXbssqh)6#0S73{*&{H(sljP2RqO16i&_UxCX1u$T>BC4GN74uq-a8khcF`JixNiB`NK71@5%hsH!#eU z9~z_`AG6>9BvX|s`gP}twP_+HM@m!n-98nEWi#f_&Hk&Rw*G}Wm7}Ab7ZKd6YKk{y z1@qS+OC>9cu4l^RSdztd+Ww<{)7FQyw?TagfW+#pHODmyRb|RTno%=zkjDWhzz_nHbUmYQ0zO>b1mkxkN?O#B}A86ZazK7F|X*cy+E zIsf1*GQ*0F35RVQNIP=fc6-695BU~pwMuwaMz;Le zva|uK9|7gpn4~0GKi;^s{n&h{clYTIC83}X25d$G1e_9ul;Eds7P z-&ZOhk$$Cb8=9R$W=b7o!dhmi%G=nFCQ5kw5f0$xx0J>Xx~?g8t(>bnsjcZecK5Dm z)c^D)>uKjbs4QX_3hnY}6{<5g>S0{K8#N zTf=y)@;u^HXmw0|#HV_y5CA>=4C1Z0pT}MOg=1F#IF+Bhkg~IYMMHnPlyB>jMhCIq zzndNX`aHa&pD*QpF;mjAqLq+MWLu{Ox5kdQf7+<8u;f~t-D`~`(wlVe=j@Aw2uBsQ zSI6|39L9yH;#G6fGH+W9?b|8hQhJeOC$Be;DR$~TQyEU78BuMpM0JcR5T0tk$BJ?z zH&_5>HZ;T;$Bv_{RbN^)yqv^TNM+DOX&~1ZcSd~LUv^ju$dQb@Dcu{pZI{?3$c#7a z*xvYP9H%&mMWvrJLJ=wuEAW0(!xR8+t(uqjFcr2jrX1`g2z*=AVb(P#Hci+N74_aK zK1fy3*T4PVTRO|ie$5dkt!*TnZ9Zc7vM#8^-GY>*3#JxSpBXE4&cC|&t%=AYdz@HM zB`T*&^X$N@}sDo}k8jMDfWIgdVtMp;!O4qHE3h@GS!o1NvvB+Z|_saVlXS}+Y( zVOaZbc6xHYberN6k6nQW%|ohFQHlBw@g!IAXgbU-x3W(;Y1LDS+0fk$-ZrdChoQ&X z$zvPi=U6Y*bIji0m4hNr>*P^F}j4?()MYEBXs` z`HU+2`P+8w(On!g#6^mo`}$2KW1(TKp}K~T$G4@19Tb);OSEqnPD?zJgnf-aeXaib z+g)Ra8k)U!!~0f}0{Jdp!l`HJLT@X*3@9gf3c!Uv#r97g;@Q{w7r%E& zj$oEH+Kg3zX&lDbt#M5iv;3%rY1@<-ri>j=Aif&&oe4P&j46n;t9_eX?{eGl*xTo8 zm6DySvwqCfc;l>_J+589;1NES6vwYSnm^0$%^^5m|2-#SlAua(IkwJ{+qjX{n~^{( z2Y0PJH9uCkBl^|1?iS7Vm<`X-DQ^58b1jw-$I;|xZERMgw7DHDIkT~6R8{M>bE)>u z?&?0aES|c$W2g43Y(^Qx%CS0e0WNxrkUACbIpLMkg1qlBVCt05i=XPPO|$%=4D6?& zVh~6IH;G#jJj|Q=xfwkq*ktmiUj?R9 zxawJuC7tc%sRLD7*c=urm z(#m!TCIPjSzC~(<>N9&feg@vV5)m9eG?Ds39zi-WXnWi>XI$*Vj^#Ak^_ig&WIE)l zDXB-?VgBs0FO!T*0(G-sC|PHT28ud8FEmS>TQYY6+6FV0tvczrh&mzS?}toNN2Dxx73DL|&bq~LKu`bW5&L#kSaJASO+Qm!U?!s$L4C9k zgHKded4`H0SmBMgyvb>cUoR}5J@(CFwFVs6#v>8X{jp1j=#^^-mX zkQ~bv6?De6*>~P{Yf0+qmnvtU7reJoSZ?_MGmY_XWnNp~`KOV=r-W0#ns}si%9>OTY=zsy2o~_4@87dMx=f zw$Lybdy|VTw`s>8bL^OoL44m@mm=O)=d|wuVH{>YpIl>!VjF%qz-_nKTbMnooyPDW zs<;r>+CZ4Kdz59I{V?0oHHgJi$**gERopQ2b&$4m0RLEIEWVa*7Uq%Bj`3T5VUx;g zheLgZ&?R@RFc#@ zLefsY>eZSM)DLLYt(g|y;opJ-3m$NQPhw`mo^LZiYr{jVL~ZgrVpsW)=jF?3>Mpp) zrEQ!;GZ0eVA42jx4s+3e{*=f665*^Vp^r437p{E^UBj|>72R7*_I!8tUypZQ#MdnL zeCm6Cu-{aB5@!!A^uL~))?4B})y(|(ePT%VwGWA3Saa;kdp}{%dsXjF^^WC^2=_}B z5-5U4YImpWQw_dbuduC2)^J1hPAJ5&Ow(meDY$8F?Z~sIU?92Ci^k^tzRlkIeeWG? z0jDpvzzBoi91t9i#|k_Zu$IXfJTdT8PW&xG)Esk0V~*WN^xgst?Kt6Y0jLuP(~^JN zX5aj}_pbBUOFwhrJB<-6RY^y4%NDVgtidG>lz@~k4QgB85x$!$@Ge(=EZMpsbyHol z*JV{W9ZTvIzXKS~e=#CxF^W216NJK0?U$ z83I!cjuWC8Rhol@rayPlWHKKK&KWWeY`G_Y*(}SUaU2TP8?K^G&CT*@35!Z`eNa#s z=%XUcSx6;ZH}6topIK0~snNrE)GiJ4DXP%@ktAYW*c30~Zk`IgS*jfzmYt(tWNsup z@*`%lmLh}p|7-5NgWAfrbg%Aq#Nal`m}r}5a+5Rewh;tl;3b zr+gXIU4yJf4qL*~J5aS2=!|qYUaR{}mG74mo6lm;iWKgxcw2?1i{Qr9lU0#>Z514&WZKe8`g&N^%j=jbr7F7XX$PBS{eiBbDiIh1M5* z?3YSg!{27@$;{H-G|Z0N=ZZdjx@_(9=T15RUs!K41xb;K3RZ?NV=<{M=YSRSfu}^3zL2D&@Po^FZ&3SG zeEO=HhUs`L`Ds3OX1vfLHH|0jBnGR@ zAW(tjQ`hh9J%(wI2Z9U zP5DV0$C|y^H?cvIF!x=k>&T!<-b%Dk5GHh^YwPjPDmJ3(M>RQb2DX4_7i7QW9+gVp z2;$b;&kgnV;*@)A8=%m4hRH-h`j>yVOxu~3)HBHJHf=qP4bhM??%RSSe`8gEr?G{z z&E1ZSe$FUt;!w7(9pPsqR)V#6i_AJulm1M910B^y``9x8ZLh-mOS7q6;{%e(sy08X zk6PD9DQtwy@+C!-an>3eEdegdX>HNm`)Mx1xfv$98SUQ0WkRW;ljuo}#S+dbzsTcV znTqA!0^M*Y)$3;KQNR~vrBDGM!i$>moNjx6O|{@3os&P;^wV8SLT>g_0=%@p#kYDx z<`<5U;f&G!03YB7gJ1lGCQF?PN#}s&DH24FKC2RZaf^5KP*9!o!%+(m9!e%pKdBO;+ z8lq^Y%lrM?MKK59I{&itydH*ud(3Py&P$|Wzr7E$K51J{xwY|YaA387X}`h&lqK#-2i z;;c0zzJoH{Ax}Q!Vj6%Y~Elv@ma1-d?)hj-OOLqBJwRGVJ(BAQ-hF#lzSkUb^OM zA`9+lH`s&c(X+Sf_*i3X76_;)}$iTSWlDN5Eo@(#E2wkzc%opr4Y&3d=k6RG~bMPQVsaCIkNV6t6X^! zKjE!%BDI@9^r$x=?6BA=X35s>ZY3@CALB+3#l$+= z@-|`X!`SJ5Gsh=xr}xTR*^&u`DPMk^FXL}S=#HSc^G8aeQSXHZa=8>#^gKYT)KJS# z7z>^e#Xhp9=y08eEsK349t-4lhz`(*G2+iJO22OUBpcM6IHGvvg8|*gA&KW$Akq6Y zE8n3?bX6+8(`b_i%y1Sf)*pkv(ldrYSa88a^z!HQ46lM#3`W!n&H-N5t1fwky{ho2 z-yJf)!V~Mwqe&t!1CeZ{lG4@ZfPt8LT+N}6_ZGqCLFt5e{8ipB_iT1m56dZVeX)QQ ztymfTKv%OyC(A~sseous+6&{XCQVi3bEW~bx?ssZm=Wn9_z3{$xOeL@TC&g7;#&zF zQk5?#1O~}?Pj}M&8x@N0lub(|o&)Y1wIj^Vc)lexL-CQBL$RnNqmQ*O;kTZNj0DUY zkgM9CK2h*9^B&fU>BZ5{xS-6l@V2vg<9f9*VmP~0=sRJ{I@Oc?cm$38XDx%>9sw=q zkgH|o>Rs5gREg3y6} zTWrpwuLSt-Kp@mQ^|wyyaJDS-Gu*Q9F?RIZj*8rAtbse{LuRw|^{mQud{%K!L^hm_ zb`FS;X43I;nMsdrXuiho_vx^uuA>ID;$`M&c%W9)gQ7&&F_0}Ymk0sCLU(5MkCnAv zUSFpxoAVtqu1`B*PQ&u&0lxDBpZ}SHVp5JNh__Vwk|_9w{9Mb>z>jquJteLmOuW1d4 zxxg*xHuY(;A>pI_gFc;D>DG)d-{}0AfOTwy>x%OWh)}dng*1ETTjRTU#T?VT=m5~B znOf1JCH$k9RWsYW@Vt4GbvQab4(x(Wmk!jEfyhIp)YuJIEBYx?L|+LV=}>Imrsd5_ z!DA|RQ%|3U{Wj=~dV}-X^g2QF1Ei9EYs!3n<)&=2SZnC)iwx>CtYr##4)DVc?RESX zNMa@@6}r@**a$Mt+(%NdQncp@r%i)>xacZ*o;I4`TNvLt#UD+r^0Kju3Y%^CiPN`; z67+q38wY`(E|{bpG7b*)@M>K*)n`rY4tkoG>oMxdJVjW;d4N&1rOjcY`@{ zqk3yqwRlc}@ZEs7zVl8M=}*0+|5i`kSReD_ zk4lR7ybGZp`2Dl^7uTxyWh$nmV4P@-DKYrgVbqF>?(gs}cXZ3L4X`CmU;T!#kKX7| z6ZFC8X9!S}GdG1pV9xtKko<|H(Sdk?Bl&paQ>$tyql8#hGV!Q9cm(C^%x;1gb$0(q zEboGgxQZ?mupf;eg(6%lgkV6)^3lp23HZrdG^$Q4iqi?@-xF$3`PJUY-=sxwsYk)j z;o;TQFYQZ^B(Qu}X1U7h7ZtN@O@J`LO5v%*Uk?ZiDRW;jiY_6z#hOltqHbF${V4V{ zU($BN$mxyJwK0blrEz_A;#IxQ2!C&S`us4ST5P!9LECU9TS^?9@?J2Va1&)xx4x22 z?X{Jg+8}SNWx73HS`5qqhV&Si3Lq^61`(eJl?$L@)f0AitPYU?r~o(GqUgvGYNk- z3xDwMOow9ism(9%j_gx43gPwpHA-FR;PlSdrv+Z|vZHw#7?vr4na=WX>$rep89}md z4htnnX6A*5n;;gouHu8SZXh$fBUZ5ndEmQ4@I2Q~QAKL37#GeJ zcw3w_MGrVuC9?z|gD0GpbR-eGYlH7uhwti92b8@s%670!c_z>tI}Tc4FNPtqx>2T*OZ-*3nTh3kaUV>@Br~8jL-Y9^@r3w`yG0{E5WHu0@+9L$XmQd ze`+j|QC)5r!@C1?PDe`h1LoqAJIsHlDW%_n$>|tS1LVxWK|*b?qwm)6tQ`k`sYE_3 zeCZqW>r$nJC2*-y%kN~zl6c(-w=MGb!E#$H&f~0=2ll-;f7fEfJgD%R)GSIfWwyV)F(E=G7 zw<4QVlNe~6L{zCjG~UeM5)Sn8vZz7T@~zA;*?^oMoz70k6p>?T!jD;FCPKeD1?A zp=khQO7Gc>WdUww)CE)y@%{tIZ?%6w**W-d9Q)K`yNgD`9+$I2q0j8|^4#{g1ud2e z5rm~kKSRTkIPY;f@Q8lrUXcSd2n~B?O}NgpP=;F+Q@}RStrOl+?OmrcT={j8wPDB8 z0c!Dy3m!W6gu|pRrErWi$M+ZhdSQ?}c0m@} z$F43~AkpXMRV{BYxvx!>v%6|ge|TkAcEu5lH#8>+9iA$Th zH(I@#s%$&}RuJZ{j%c+lgAJn0e)iPk-L1d3H|~r98M3C-wm&Ylti_mQ`Z=Z07D#|h zK$9C^hM#X$=ZV$3Ysr;K<<7@31*uuBig`(eVx8vj8Jl}J0k^VJ_fjpNa8^jnseMdi zletB5l9~#kTs4c_MJ)Lyv}cpMz-fCBw!%RTZwH3|*f5al|Q$=s)aHxiqyW7Z{ z|FbyX=N-)q-68fEkC zG80j~-Kbh^?!r7End&Fmqvjrk+druMncXQRGsj2vQ5^h(T@;%OAlX{Ov@=pv3hL)4 z;hO;I;~8x0uFM=(;Ujni5$CPW0d2KPU!_V1V-Ax)$U^YSHo)}_8Cb3%+7Ny)R?=D; zsc2R)wMHCHuA<6NpVla9blr@xt{Gi)T-(uM|MfDNl1!shi%#{DMGM~-XMgaH_k}0P zc>A#PP}ju}51&7i<+gIeyZcoo5o-nuZ_$l3iZ*wGI#SwDwbhrbP-aRH^m5KQz;$K# zluNLZaQRv5CMW@}BSGiwK{H36jMjbCL(`P0^D~NX+4su=Pf$8FUU>2+*Ev<=nMVU( zIk$fWz%$y~-P~|%>~J$FM6NJ#r&LG_;$U0ut|^$kKVOXho}I^RwN$67FqLPYe;B)t zrWd)gmLcfSMW}t)b&;-5k7@<&R=MBd<_c5iu@-FHmh%hC0=_hSTLN`ZCV6Y{wWT3g zGPF;o3_WrjA=T-*6!6mz;HW%*aB-A*UAYcHgMHZ9b!8bhq#9@?;?C@cQF~_ST)>cg zVjSY1w~`dhDbTFciD27j?Yp*MVLmK}7@$OwYBhu&=$}3OZtH;er}`$%-uLO~+TZ&O z!3gG6!Hrx?%`R)_PcCG5*5~~ewYgVKFATW>y7qoZM4H-p3el8g)uITEv?o`{+dFIU0@A&f%X!rF-gkTPyH%SH*BF# zBq-k8b;obHuR^)eZ$BH+tRdPSViy~e3;5MvNB+95dl!e%lLm@0MGHAl{hMVhxm-yx zuSEaTrgFlBXG#~I*<}%t)5Tg{E~3U^QEJ4Y?SoQ~$6T77-Pf?HPQ$##UupAD9}}dc z5K99SFLS=@d36N}1OjJlS>n@}D|Cmq1SX?;(o?eUwG6MRc%;Cwqn&SwRz}wY>-(UT zqLyiw>Il7?6|5R#RnZze=YR}hqV0*&^Vou1vGM{#h7FaBP`!gPGi{MulnhE%(xG(% zS>kD#BWgW1s%cS5_wmZMki10|Dn_ohV5;I!lsh{wD0P{lyUaV`y_hQN&8wZI&Ulkl z*XQ5jSrd;p4qnr-g4j8fWTT}E#m!?45}EnqO+pKGoURNTuzEw+ZgPB$l9N-fWie6B zxZEy>6vAh_A{!{sD2=f@t$X@Un>paxg&s*MK>KH4kBm@vsiBwVP8W*H;aYm%?YKO> z1~HGgq73X|4t^rILuw`x$x{#n!9>x@hV9+($Y)k$nt3!lu}qEI)}i*Xp71h%-vb)? z(G=8tU%SCKNO+j3c+hGj5gi{xzUtw>EwrF?qhr)f3B>zp97GMTniEQ67}MV6tzdu- zEjt-|K?@>Ct5Db=YO*I*1MTf?{5oUBpdZ5_+9pmw+fK9^IwV{b>UZ;RXD)sw)*myb zy?A1x0e))BWam}+(IeLVC~Qm%i_9&IDmA+Hn|wVQafLJ(I^`Uvv3sYw^V=l@d=+BF z3A4%)Ts~+*7%Ro5sa!X!X50$yGbP59Vq& zXouGYk|qSoqvLSJcsj4g7zPRvB$;H9wXA=@0>%^rv&)EQWU7e(5O6T-l>EFP{p6pB|HGZtRYGmt+2QAd&-`tG9)fpVr?Pi2#aY{g~pH6??qU6||V0BMzUcZJ#rIr(j4 zqW%G@Q(1HYomwI_-Tysvx}{7+NVeV1EJ*uvJoEl`t_zn)l~ihuMU}kY(-D(q3&V9~ z`1cH|Ry9(X6ebe*Xw524ba}>uv$iwQ1$V})HX=Mv@A=&)HM+)5Y3b&MlcgWqY<~Tj zt{+w}bJC8qsdHyejy165K%YTI3g#Z?%FfNM7BEP%CJ7r?hjz93@9m9SPNAE?wL$@t zPMucH>9q1?w`%^CmzR6zH#^ta4(z2~*(mB0XdioLi%3;Dh(ga`guQF9hu151aY)rc zV#SNtRlD+x6XsujP%r*Lrdf@LRtBv2qNi7MC&DpAmt47rvPkimB0?mcpBzbtp96}F z&jIwWg+OgIsHiF}+B{muLpB`@cY>H}2@0%1I8Y%=TGv&61 zy4i*m7;j|4cb;+`^(H^#w!Dwlya!-{JR7CO29Ya|l7dH)%0@FGqDI}IZV>SySkgH$7PDvQ5`H07*Xw zY&##)Ri^aM`h?B_NmHu{#ZDtkX7ZsIegVS}i9Ij`@cL->p=cu9-@EQtAMV;`+DySl7ta=xK!{*fU=2%juHM(kW7deaLp3>O z!H*HlH}Iz^!jAegQ?c^;SyMn z**fH9#4So;@v5P<k92W94T88?J>|)GkH$xG-qp*wMRw!}c^2H#hUs6s@KY zBvkQ8O>}voxF|X)4R^d4Y#)W~Tr7zRh5MzHw0!(+r}vM-FMP&28Scg2URkXnC#N^J z1vG|UWhR?7zKA0N4X=CR?Wej-dpzO>T+zfTk@vV$Z%L6c8zB?M<#^jI1$wHro=dCChsX>MlfFwd4(H@jvxeFjeXt z6WIjb?gZte(^#J%pBEnpH1$>YgCfN((8jhDCvofa3B#D|)US((ZLY!YdtY)>ID(x@ zX%tW!6oPds=c@nuSg+c-q0lm{Or%y)NQ{<#lID8SlD)QXN7dbq*x#Bxi*^JUNMx`6 zZFV(s;?eD2MxhvC;7-;T7M<9gs(`+`wU;ihz`D(yw2~)CZ8>S6Hy=Wad(PE zY9Bd)@6E%@)@?5$kU|elJxxc(Hui@}%C5p8-|0lL9^F()mr|b-D3P1Sp2nMBosz|n zXrV>`07dEhnzzsRZiGz4%xYB#rG9eA)Q9mbC)WpduadRaehZj1e`Dns*D3x^FV+xT z#WOWspYb@D?Za*lH~=0tt0=}PuJ23gn)>g1U%xmgHcz=N{ZG9wz2s2qXZ%9pHjwcr z*R`Nzh`cQu#L|oK;>d>?){lmX=KD`;Zvdl#FfAkD^?N<3cWdu{x&7`SR@D^K+B9c_oPh=_I-i;)9FOcGV_^60++=v1>DX*{qXgJQp zs{e!ER@$n+LaYBDgIwJCJyBSs15(tolp1W?J8==f%n11F_}9-H+V2;JUtgQJ^y~ld zKBgZAQZ8FTu>@-BS`=Nr10FBRCmwJ}twduM2|dA0cG%EWx;J1)nM0qS!L#TB^l@+EPP? zJ{`TByWeR7UvCiUPJCx;UVz7%j~}XVMK4N$J&3UNySP-nYO~2zL?($~u+w#*u`<8U zEgB=rm8&Exx7%qg@B&w~r zW-PR?`GG!eIbqWrmjx_ned08cnOR8jjwLoJdQ3+9ookkvaD#j9>QvfI>DIQ+yV&I2nv^`Q6e*(@>!`Xl zZF;o2dO09=LJWwl)UNY`z_!%`tQP*Gu3cxV>1X{*;+S#Pb8{E)B; z4>sz4y@t0U{o)RFA*q(=Vu#XthXOvdbDdaoE1J@cT&orQ>UW?TYTa6~SxRij=;#2f zJDER)K`}4KwR-Q8)io23GmvXOv_}vZ15&?9;@fm86iiz)1J#se2~g$St?GfpWr1b7bORrn|M~QFtiA~vXp7%`_ek{OqP5zcaW$yn5UN|=gh$2bfVE0 zJ!TS>1RHES2N0u|MkvGSqr`7q!8vK9=O`SpL3;kTW!#GEZ46idZ3{KLxaj#q4!Wh- z-=M_#C0O;55kq31&iqqRm;vI<{D|*P9^$ zQKS{nokEmmUuwj3V7#w#I7l9W@D23IkGcQN;>8f6MEW?f5)V8FFpk{PKe^Q(SptRg z<1|SX>u*woMwtyp!-hwTECdKQUf>zNcOrk@Pjl>RUxVbjZmg+A9D^6IAd9j zzBdz<(A3t>;}Yw@m8L)d>qbU(gu+#nT(vV{?}w&_NJ`AAL$1`A=oPR9;D_W-AsubH z?K%R+-9h5kBf>64H7IrlCEhi6*pn2if@l$_gh73 zu_}UvlmNxGC(XUZf^>oZ(X4;5s+YeRIuNA*uVE5ap@+YBSB z*drYM{Yj?N5STz9x3LiqVp+#nELiyUveVc-a)81-6l0}OdiC>R>qN`ei_YMs*>dqj z4+WUp6LDAUY|x1bRA)e4C{%Ci&_OUiuViz>&{pSp`BT0&B8RAb?d+8lZXeifCV>It z-5sLs)Xj(MpxLy{%V#nZbCY89nkPF5KP`~lIUq`5XgTnHvZRf6j~H~QZjoa$U4GT9 zcqmrP$817`Bm61CvPGN7%oUZy57*L~f0)2D`}@B;$u5xYrB2beDQ~8?qYx~Tq*LuL zy43L?uDt^)+-2$DogZqMY$Lu&ac-_7zF(tdx0H0=V(G4u+t>_?RodWmdqSJ~%H=uf z;%!v@a}>LZ-zauV?kA^}p6b=7!NVC)#D1Bg%8}t)pN8G)jYxlj;?R=odTjp?d2DIf zt6cHIc(aaJO6A5$Ru7LGg?`-)?RcUu`dMeK)n&4}6H)2jsrK5EMOt{``r!!oAGU%5 zj+-$tj)g}p#H%-#Jr*tH?Rzlq*Cnc`+Dk58eSWhA;KD&#fV;DV#3Z~BnS${}(PG0c zR7<`)t(``LPvc}q`)cb?aS={n?MYK8VVHV{ytYs^W_cC7*kpk@tO`%c)_v-4kj+ta0PKz z$Fy!SWlA{ljJRS*(-sA>nNL!oc_Xe)6i1JLsQ@Ofy&3rk_g|O9yCU8C=UkRbQsP2W zv>W){oRS<*|5SJ*#+m8YYI$n&h9U1|j-uhZuc^K8Rc9;C!+=KZj6=r1CqaQEGV!)0 zcFM+IEQFDG@XvZdx2k>m!kKyD5i|VeD?=Lsd>~3H2vJZ#T?504p&n1D9Dxw*7LHN`lNeFU}lG-p}d!CRs}V%4$LsGYNpav$Jf#XB-7l-zT9| zdNsfz;l~PfEQsXb+nQz}oW}kUb?J{ji>uRA-lq=A1cP7cFB5BSL*IUf4{n(_!qH@` z1T!awR9HWjUUD!z;q{|LMx_@I;J_57J_jLRRd(47`h%Xx7a#qi7 zjBLHJJhTli?U@MQ;%2gDlq1$Afj==D02cU-W z_ZynS^nlA8O)}c4Dz;C@8>2Ysb{XOi3f9)Uou;1un8 zmo*GAei?#QZn##R1JcH)tB%se3sy8i!s)?jD@<4*!DFSZFmEBU{)4{kXjkH4U7e-p zFoH%7EoBL5Id`x`MnDQ%&&&4I$NZH2Wx%(1v1I zP#lT_5FI{S)?L&TM*hW3Z5e}W+u8K3+LC3vD&eUF#fveKG~QD1xFr{-*E_zy?>{b> zYqbfuQ*5(D7o%MXyC-zDR)_$s)arWp*b=OkHAsR$f6-x(4$~2D+)u3gdl5+V#6Xw| zc-v=JsCfSckJ!mX^ltx@i@P2+x9yAO00y4uVeCJ-(Wjg~Rz$uBwj;FWn*;7Bk$*2b za6?axtqv&U_575Y#VrsdCE3JU?)mAO1LmlSC~8z=MU-Tbahj07{cQ#9EALzR4o3Zs zZYkAwqpr%sF`!yMp#TTF-z5H?+AseMXZ&B`grwR;=lmoys#-m>264f`$ONndUjt)~ z;3niVDne0d0zGaQJmEV*oF8}F+XeGf)A}`byyw@`6?=jgOzY!$DpjnGPX^&9+$X@D|Jfj1wi-zJ(;RG)j>Mkd_`wZu?>`!ZKUK!Q ztNi(nQFFk5WkUe`|F<^eNbGML0ucL;Dl>pTb!Pti(fp}%=l@zq;x8TM?>hg*XyhmV a7h@**->Ilf{x6M1^1G7e^BezJ<^KSnqz2Xi literal 0 Hc-jL100001 diff --git a/tests/mqtt-connect-rules/suricata.yaml b/tests/mqtt-connect-rules/suricata.yaml new file mode 100644 index 000000000..6fb68aab1 --- /dev/null +++ b/tests/mqtt-connect-rules/suricata.yaml @@ -0,0 +1,16 @@ +%YAML 1.1 +--- + +outputs: + - eve-log: + enabled: yes + filetype: regular + filename: eve.json + types: + - mqtt + - alert + +app-layer: + protocols: + mqtt: + enabled: yes \ No newline at end of file diff --git a/tests/mqtt-connect-rules/test.rules b/tests/mqtt-connect-rules/test.rules new file mode 100644 index 000000000..4668f5cb6 --- /dev/null +++ b/tests/mqtt-connect-rules/test.rules @@ -0,0 +1,4 @@ +alert mqtt any any -> any any (msg:"MQTT CONNECT protocol string SUCCESS"; mqtt.connect.protocol_string; content:"MQTT"; sid:1;) +alert mqtt any any -> any any (msg:"MQTT CONNECT protocol string SUCCESS2"; mqtt.connect.protocol_string; content:"M"; sid:2;) +alert mqtt any any -> any any (msg:"MQTT CONNECT protocol string FAIL"; mqtt.connect.protocol_string; content:"Foobar"; sid:3;) + diff --git a/tests/mqtt-connect-rules/test.yaml b/tests/mqtt-connect-rules/test.yaml new file mode 100644 index 000000000..191314072 --- /dev/null +++ b/tests/mqtt-connect-rules/test.yaml @@ -0,0 +1,63 @@ +requires: + files: + - src/detect-mqtt-connect-protocol-string.c + +args: + - -k none + +checks: + + - filter: + count: 1 + match: + event_type: mqtt + mqtt.connect.protocol_string: MQTT + mqtt.connect.protocol_version: 5 + mqtt.connect.flags.username: true + mqtt.connect.flags.password: true + mqtt.connect.flags.will: false + mqtt.connect.flags.will_retain: false + mqtt.connect.flags.clean_session: true + mqtt.connect.client_id: "" + mqtt.connect.username: user + mqtt.connect.password: pass + mqtt.connect.properties.receive_maximum: 20 + mqtt.connack.session_present: false + mqtt.connack.return_code: 0 + mqtt.connack.properties.topic_alias_maximum: 10 + + - filter: + count: 1 + match: + event_type: mqtt + mqtt.publish.qos: 0 + mqtt.publish.retain: false + mqtt.publish.dup: false + mqtt.publish.topic: topicX + + - filter: + count: 1 + match: + event_type: mqtt + mqtt.disconnect.qos: 0 + mqtt.disconnect.retain: false + mqtt.disconnect.dup: false + mqtt.disconnect.reason_code: 0 + + - filter: + count: 1 + match: + event_type: alert + alert.signature: MQTT CONNECT protocol string SUCCESS + + - filter: + count: 1 + match: + event_type: alert + alert.signature: MQTT CONNECT protocol string SUCCESS2 + + - filter: + count: 0 + match: + event_type: alert + alert.signature: MQTT CONNECT protocol string FAIL -- 2.47.2