From a8d942408edd6c9168c20e619c9a14cbbfb95920 Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Sat, 25 May 2024 20:45:00 +0200 Subject: [PATCH] tests: add tls client cert match test --- tests/tls/tls-client-cert-01/test.yaml | 19 +++++++++++++++++++ tests/tls/tls-client-cert-01/tls.rules | 5 +++++ 2 files changed, 24 insertions(+) create mode 100644 tests/tls/tls-client-cert-01/test.yaml create mode 100644 tests/tls/tls-client-cert-01/tls.rules diff --git a/tests/tls/tls-client-cert-01/test.yaml b/tests/tls/tls-client-cert-01/test.yaml new file mode 100644 index 000000000..f6188f1a0 --- /dev/null +++ b/tests/tls/tls-client-cert-01/test.yaml @@ -0,0 +1,19 @@ +requires: + min-version: 7 + +args: + - -k none + +pcap: ../tls-store-02/tls-client-auth.pcap + +checks: + - filter: + count: 1 + match: + event_type: alert + app_proto: tls + alert.signature_id: 1 + - filter: + count: 1 + match: + event_type: tls diff --git a/tests/tls/tls-client-cert-01/tls.rules b/tests/tls/tls-client-cert-01/tls.rules new file mode 100644 index 000000000..7b46c4603 --- /dev/null +++ b/tests/tls/tls-client-cert-01/tls.rules @@ -0,0 +1,5 @@ +alert tls any any -> any any ( \ + tls.cert_subject; content:"O=TLSClientAuthSampleClient"; \ + tls.cert_issuer; content:"O=TLSClientAuthSampleCA"; \ + tls.cert_fingerprint; content:"32:56:41:d0:6a:ff:47:cb:21:e4:89:c5:ae:2a:a2:d8:1b:c9:70:0c"; \ + sid:1; rev:1;) -- 2.47.2