From e8a1d7236c674fe5fb0a34ece26d7ba3cc3af437 Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Fri, 12 Jan 2024 14:38:57 +0100 Subject: [PATCH] tests: add test for alert-then-pass issue 5466 --- .../icmp_and_ssh.pcap | Bin 0 -> 57838 bytes .../suricata.yaml | 21 ++++++++++ .../issue-5466-alert-then-pass-01/test.rules | 2 + tests/issue-5466-alert-then-pass-01/test.yaml | 33 ++++++++++++++++ .../icmp_and_ssh-s0.pcap | Bin 0 -> 53278 bytes .../suricata.yaml | 21 ++++++++++ .../issue-5466-alert-then-pass-02/test.rules | 3 ++ tests/issue-5466-alert-then-pass-02/test.yaml | 36 ++++++++++++++++++ .../suricata.yaml | 21 ++++++++++ .../test.rules | 2 + .../test.yaml | 35 +++++++++++++++++ .../suricata.yaml | 21 ++++++++++ .../test.rules | 2 + .../test.yaml | 34 +++++++++++++++++ 14 files changed, 231 insertions(+) create mode 100644 tests/issue-5466-alert-then-pass-01/icmp_and_ssh.pcap create mode 100644 tests/issue-5466-alert-then-pass-01/suricata.yaml create mode 100644 tests/issue-5466-alert-then-pass-01/test.rules create mode 100644 tests/issue-5466-alert-then-pass-01/test.yaml create mode 100644 tests/issue-5466-alert-then-pass-02/icmp_and_ssh-s0.pcap create mode 100644 tests/issue-5466-alert-then-pass-02/suricata.yaml create mode 100644 tests/issue-5466-alert-then-pass-02/test.rules create mode 100644 tests/issue-5466-alert-then-pass-02/test.yaml create mode 100644 tests/issue-5466-alert-then-pass-03-drop-pass/suricata.yaml create mode 100644 tests/issue-5466-alert-then-pass-03-drop-pass/test.rules create mode 100644 tests/issue-5466-alert-then-pass-03-drop-pass/test.yaml create mode 100644 tests/issue-5466-alert-then-pass-04-drop-alert/suricata.yaml create mode 100644 tests/issue-5466-alert-then-pass-04-drop-alert/test.rules create mode 100644 tests/issue-5466-alert-then-pass-04-drop-alert/test.yaml diff --git a/tests/issue-5466-alert-then-pass-01/icmp_and_ssh.pcap b/tests/issue-5466-alert-then-pass-01/icmp_and_ssh.pcap new file mode 100644 index 0000000000000000000000000000000000000000..7708ee4815a7fc2590dce74165a848a3eb23d7be GIT binary patch literal 57838 zc-ri}by$?`+V(x9bV-ABcXx^?(k%kgT}nzSl9D3QAs`~4fOHB72uOEGmvpCqz&qEh z1@{8E=XvgJ{qcR<_q}Xu?u8Tke(b;VxX$yOnQMmrhQc&h5IpFwA9xT9_`l05LWa)~ zkwHe_-+@cSOeKt`K-RNmSnW9^kTeLSP9Q4*l7LYS`kDnILjrz4)q@~d5Df50Kt}=m zXy6A68|Nl29zFpf5itqrEi!TnN-Am^S~_|LMkZz!RyKAHPA+a9UOs-{aWD*jIsVJ* zU%vlx1k{{hocjPXz!d~){I48Wz>gb3hnn#jB%{V(8Ff0rj<75LcFaTn=Z?%w|16{N zf91Feew;Thw2XwrKt`2{zcS`GfgRyi|Lv%S`_COIIR072^8dBB&YrfsD#$ ze`S>X3U-8F`?q5g(LZ-Y;QwbC@Bdeh>)^++QbEnQ49U3kS4Oxpup`3yza8PI{<$Ni z*gwmN`d>M2fFIY*2rVO#I3#1#Um30Qz>bI;|8`7Z{O69mGXE^2;|Hvr9+78Z$ z7=j46fiE8K{XqCk?6pXMODgQqrVk+q1PhN)3=fNh(&uvLH*h@+92}&g43@u?|E2ja z{eLNgK!9?2FQ5v^g8$yHUkLR8td5+DbNaGh|1afa*)APG9juH9C@+JRZ-Z5DUsp2^ zYX_ue^eZ(ZgVld|W5MkEV1a9d0qT_o0m^{l78?r48mwl0o#G?bPCzku_F6?ku%h6F zA`GCYrY6J6#m2#^^u*K-{JXvY8`l#~3JoJ?J11vW9%sn^bFguvqX5=&Jb#7x0~61f z7hpZ6dj-=kusxSI7TnQE(7&v~wvPaN$dHnvUWEBW@zK~bh$7duiiB`SPU07eae(60 zF#K$S;4pVgjVulASUEYEO-zkAIh?uv6~-HE4P|7yAR~i%g(FwL5E|u`kr4�YzVG zRFDIB+XGy#hJiO3dk!cLGhGgYMtL44E$$*r0-y@sHL;-J-iTZ{g>U*g{DYpjcTYpP z6?`99V`m2!Q!ZX!PC-^j3qvkmK9)bOk+88ea&)v{d+cD&Vrpz+0lAvh&eGB832^@_ zS8)sQT)m2yi<8B~(#*`#l-0u2#>N&5(A?p%^AlE6S7Qr9J9E=>>+9~s$p_rZ%gJ^9 ztpZSQ<$1$62hzp{<=_<02DzWggF%4_9`DM`rQImin*kAV^D4_xY(`#pUi2d zu1>6$c4m)Rjlp1cubH4&jZGb#SY0?cFLlz@JA%Xg@9qeW{J*>7zX@J-xlWM9(VF#t zT{$opo0|M<7_YyBHS7O)pZ}cd|A%`(Ed;pN-xYC9qQ47rrRKja_1abG|E@s)cLn-? zT`=Nn7aGVF|KqKHw-){2M1}Tb!5gx*e|UK}jHSZF-bf67vM{?nd9fRQ3#=Z1;(I>u z{u-?2aNX)=!rBLU<}-A8EovnG_gb{)BXO}7-2qg=A}omD=cOPD?GeAImboVju*NDX zZkd!Kw+dS&<_k45Z}zy#_`^GM{*@_52x_JmkW5!YvE;UMRi?6v6+3MdyV&~oj;~{{dTBh}-0)Yxah8AHc>Ej)B+HK#C58m8g z9|XbdAszz!WDXrabZ)}0?Z}(me92aBUx=gEOvl`P-(V?hmo#e41$-Zqzpv*$AR*%1 z|A7rQS3=@dm`{0ty%1V6ne7kuuQQcF2UcQu#+u;!P=Z=XmVffAP<%Uly7xXHBu4KZ znvsBn?RG#&jmCo#F46HzEr^DK_t!tN$1vG46NTnEQ+ZiQTAPL$#0sCy*6fXNjk{|% z6fo@vz!v4zY)N~;OQXjx>q_H zW&4G2@WA`H?f=-v-3K}YP?R!41*rmR*D2m%9e^A=d)F!g#}37Xq7tBZl`r5>frJL_ z*zkoM8=99p83zySq757yo8cFoJOH==il<;jJFuGFbu}BX4nk@kzEZRHMa?1?HM;|< zMDVrjQ#bET4ve=*r7~`_!U})t$sQQ?HT7aO4b0F#Zl1&$2TgQGrg5BE0PY%CQ1kdf z@@QO>CjgR%_ae^_PywLWj`dfbKNJnd{2_`A*D8XK^);c(iuGl>_kCNEzkZEGA~pY7 zX{R;mC0{vpjH^0havDnRzs9S){o1IE&v0d>-yCpX{Es}>^wbcfr{J#83;( zD*wb;Zj*^)0#R$`BpCDApNA`c7@@|&g5syb$5vDflnA%ollAmsYQt50^OT=;165Uv zpn-rX$K^W87GnVr%H&rlOM)wF1t`ybx}ZD@R7Q2594`{pJ;23<9jhqhGcCwymtwki zPmA8CdTXy5Bjl0$?|_W}1*AEq=PKU@4v&_8>be3|M2n(<_+UVg%T+co46HvOY_7cS z*VqcK#2H}Y3xB~T5U8Z(wcPMjKC*JLt|4Lh{hf!;VQV6He3#UiYYSJn#9e+8jVSVD zGu@C{V{yR^QPr>A5~8ioa+rh>nM)l$%_)fyA-2=>!cgUUSFKw;!7M^8nvIy}n#2a)%-x}T5cj^x>{6Wm8X>!Z&bQ?Wo(!EG;b22vlpW3?;p4lA$C!@+bwzPqr)~? zJwrjS=HarZNB3z;zMVF4x3lPu$sx;pe>(kOOIJ5Gq_Xr=K|tnaK1aVknVji&O@hG0 zKtifyi4AnCX^AKd0{)E3pNz@@c)yUtklMw4=e>j*$4$mw!# zHP!SB-4ulMR?GgndO}8) zOZXHeJGW4hQSa_RItPO)Ox4YCI;>;%ffodPUQt0q z&AujW(p9wU7|cs;GdJ%M!4Z8-BsvyLeh_p20S401Zg^iTa#UBK8Q1$t&(HN6qkXdq zwi;H>!rpw{XWNZ8Z%t23L@Jl#PbWR`yWat`sBBomQu2DPM&`|{5sdoeTMrmU;(Xqd z;7AI>>64J#1jN~kU>fIgy;PR%_DZGl!z3P^%hHEm2ieRI;?+p$60EC~sJa>|;d59^ zcmSh&KMW0|2cEn1uA9G<$6i9_FW$>Ne^Zc&{X1kwxJY`@^9R5PH&J5g5Uv<~(uzOB zvd(*yhJwAQiOHAL+?>l)3AojVqk#&+PKDRa;qO^TA@kI$%f0j+yf3(^0hzc`woV5@cqw1ur2$S+39QpAD(AeqX@L}g;(!!7NESQ;%U<_7 zzQ|ZGdeS_-2Hvc=X(#M~Nm95Wf zFlp1@b&U_D7S%hdY($Hu)rCa8^J}1X;UJ zA-YL&idVtVo3#!so-fl|?vlHXA}4*OYoMGD8{}jK1rsA={ws;8_){E;-mhkv5;c3o zZwyu`@Tf%w711&oGALgBg8`_`R|c-0GXweCbxH0~0hU zbdUXzcqC@ui}_PK_`zqi&h~tBi0rA<()XK~GODzDv|zszLi@pXxhxBrAcIB#jkLLr zIo1`SP+P4NxyJuc4=ynvY$xo~%2o=yV}ybhsbqoND@vjlpYt|Qi68uI)X@*ZJFs97 z>W;5}UWlgn&7d28=)I?@>pM}-$6UR_R%z=fVSVu3FJXq4PLz-Bj@d9}d19I$zctD+RnPoZDl?H$3t;c1TTQ2O-Y zEsQNLO51E}DF=OZX5|Z6l!5Hw1-EKEsYkLqo;#IxD2>L4uaBnoqc+v^3L>Dlu5XPb6A&N`v6 zjS=ezH$m6_aFAZzhmo@WQ>r($NhAtJb#Vb3^vQPUI?VnsckWUj)fSgNDr>So?$iEN z`q^LbdHp2s?~ZSzzP&<cqM-5dHNc+Wlo~g736B2Vn$wms zC@rFC_F5tJ9UDBhfvovEoVI7f%Z?&1eL|3snSS|UJWZA>XnqnNVZ1PXOptB)^zkY| z>seVy`qR6C4EOF5ic}RnyWg8@ENga9gwN@}YrSiRs2pz+OE*|9pLCM*L$@B(NlIMv zy?N~!pNpHOXw?t$wBHq-XWGGZca;;fWBbR~EEy1doha=8@1WoqG5-p8@v_$@@_ThAO)*oCkwCW` zB$<$j_Pf8kh+|XUZl5W1u~A+y8^ZyJxGzIxJPu)e@+V`$TVTe!|G{_EQY8XpS>G(n~CK%pDU}tch`~D2nIDb z`Ha*4xEU!EoaF!nmVSW(+tYx!PjCC>287nt43Su<7BZLxTei1hMG4zgJtU*%N8>=F}WLJ1RgF1dx9Au?6 z$@dEpi^pe1(Y&{gXR(`;dgxYjNBK^N9@C)*Wq8IZTouU?Q!KH<5Db1kW`rf5^eH}U z!yvYo@aHyMn~{%0^2r(om@+2c1n)1?AKh6;8n3Y0+CcJMUZC>Vz^{GygnVPzaqiyZ z09Bz2o`_bhj+4=Z||fy%;F$VN%(@qiB^};>LKzoYV#CFsjriZ_@CHrog|s) z1>!wh4SK`>p8dC;%XpD7gIe1SRKgGPo$eC%#FupuSE7V1(`vhG4|SIfZ)?zQE-yw( zKHEQdLR$=9ZA^Vw#@aNkYn}Es@0DYVH@Y2(LG$y&NaujimuX}5U!A_Vhn6sBuUJW? z^;m~krF|Mu(`mhL;@&BBuQF*3iMc1Q)u3g~?ioD_LFq%*G;Ivs{Mh;fE+al9y~hjO)L0b9(Lf_TgR;UQ+{?>WNCn z+&&kAUn;C`xq4}@cUDR9qEC<&ty!$eM|hvl7^6unk+u#-yQi7``%z>m9I<7seVLST z=}THK6sFBY^?ZtZOl~#shGxT2rz4OE8+lO$^w$hI@zy;eupDOT@4M57Jhatf`O-Z+ z3w7sN7AcB`^IU{kl@{k|26|2<5iCcIMZ#vXf1KRIgjxyK*CVmvMYUb@@ACZKypbv9 z#n*iiQy6yGzFf$gJU1oc`~>cZki%u8$r$&0a6(Ncru~c+e~TF%mR7nr&uHOswPLr4 ze1m(efMmG$L-M*6oobfe%}A8=9|oZ?K2rH=c#VjSgvOlO+K*m5_hGZQknN|TAXrO_ zXt>=jSoJMtzd4}&Wz*zi5~FMGGPfP#$nj=%0#MpwzK2$a>O!ts;0mIitH! z)CCl=<&TN;nT0I-6qxOBPWNR*bK*^)+|alXE@o3>+VFzE9EAH&=-E$t>IOBy+6E`Z!A-f9dR}IkAZGP8 zOfluD!nEvX&|ww^k?nJJpn5AZs63`1JeIHFv3G?BERXR0)Ep6z9C(*=5D}f{a1XnjBRg%z+rn?iN6vwp_*qk6VhWtp zw^k7LE|=k)nN3`Er4q&1=JifkQ|HG^blb-L1=vAad4Y=khogB=P z$Ir75Qh(+Js&}J=%3~J7W8oSe*?-3ajRESoMncB*<`o{<=RAgBE_mnzJbrI>B~q`W zj9Ql92cUb(B@&503eUrG*O!B@i|t21oy(m#N(Nj%f?Yp=9Y0*>8aMU^G74ADA0_HI zcWny1?5g|folX9a44EXUnzCKgXePA7h&pU4DnsIMwF#=xg^ipKzk&qww$+pvWFYVT%z#~Ez>YE3 zxxO5WhK%Rb6<3XOSDdQLu6;CRQhC~s-6AG({g^k!gilkj3IeW@q<4 zPA|nxRMFwJf9$~fS*wq23qLD&688*W*4n&t`yQ|Esti1K>@9VeS$@Hk$V%f{|1-#3 z44q93gbn7EDldBdUi9TE<5uw$j=r;IBzc)llIMnLd~7#r>ovP^FY1M*+e^V+Q3~vE zKfrYkx@#=N72}HQMX!HYz3jRhy zvb9ox>rY0gM_3$WL^`gxZk@a4oL#sY0IONe(wD+7ld6>nJLPTVeWa;M>TJvTWW~Hi`GV7)gBJ2= zR>x5qoL!g{?d2$p10EHVwuC-x zjm5B5U1L7_aNFgjNes~ohc3FO6gs&{BZEItMIi6=fnCqvm;1xjbu0nGYUPTn+qvs% z=4Ds%rO{O-&u`w+J#AACjWoN68EI)_Aiao)BN$QnyecRx5+N*5u2fZhUKKjQ<*JSvqJN8Lr&sSZ=?5je zAyf%i?c1%oAKI7xAe|U+&WogYSLQ{;^LbI487j?W2u-BRxk&NObA6+{oa>icD)M_FdfNW} z-p`Mjzs@EoO_IZxIA98fQGaTYlWsVZ@Sz1~O+<)1-?`h8c`lZPS4lrMZQ_!4Si-2lnpfgH=Fhaai zZS;Ay3u~9FwIe^{kimDeUGDxCGD{b2nSfJ%!>D;ZtG%P%t%%rGL}nEB9^kso40Ws* zuKRojWUMQ$8EZqxyP&HWpm4BS_;oqF$5J8G$FJn5IL{I6eUal0pxRzUJ@$+Prq4&* zGFC?#F-sxn)+0E_`nMXlt@qTpBuYv&R+J|8)C>GS@x$`oTZJ86D4tLmUU8@^QRG}@ zI{fv8nY^>O6MgqCUm;`R@V*<* zIW;*ZfEs2*3+!ILR{6T;QsuH?^b}J*x0qv|){jk?1kR<;QW?!WZMJ}`+jlr*B{f`; zOXearAK;n`c7@U*%aE*7SF+N9of$88h#V{63@9G7!a+MC-a(Ft(JMI^&vP`xU*re^ za%fu)^vsbzX|=#tkhK<-{A$9OeN3^{JxQ-g%J=f_X;!*HeXXK(+k@3FRK=nw+U}wlX(FHE&ln2=WXYyX}yu>nCbTl>T62itehb?d$Q709ZeF|EK zcb`r)lsI;~2LrBH%81bDtwFMmU&$&9c8@l9NVojBk|X{+hrHlL z4t5}iQ=#8b?^|>yB8-q1vv9Zh4n#ODgSuT!xjwN!QODBmN*ZetICC6CX#CzoK!7Rm zx~|=JI%f2xDc6SBO&TkR^R#(*MU)^}Z&2c@08 z?qPSiK68v6p#C~k)i87%?mW7GklNV>YmeCixcb8&K%@5oavYvrrbmVhc8&z-CFfqy z`wBQycjzaJ-9Qgel+C@t=Tsx>S)3dYg1ji$0h^E62`l;NJ{^)3;93rLg+g!py0b_- zBEinASLm4n&VXWi#0_Zlb|8vH*D7A3r;H9Lsz@HR(wKQL9`t-Or=-JK?EW6=nq`s6 zs?kr=ZGFczN7cIj1K`>odjlH1ObETxEA&{w&ZPjol8fE!h!x;Gr$Oc)Sz?v@aqsau zk5Q?LcD*dd_bszgjQ5i(IaJPb6s=t3Z~{~b>&4y}9xTaHNVjtes`7^8t6(OMRmafZ zvCsX6sk>qkD*#Vnc_#M>5tX4`@V&6NM<|URi7fHL!B63zQ6r&9^bwl1QhRuLw>yw1 z?@Nm~sfKkwnGSvBz+;L7M?})XAOCsSll9rhaIZm;RO;K7Nd7fXvE838$^j zw1!evqly=0+*sdgoPm7B}5p+z@HvOM7M z>496F=NV94>ldh9wg>65fj_&99N01K{707&0u=&^3(yt!A&ULiDAxU*BJ(|{t7QN8r)>lm5@H$9Wj=sb%uVzdsUwYpf=0S@c@y;A$(&cn`QfdkS@*`4Q5a$5(o@ z4(vPv^d{@YIV=;%fOEziy0=(P5r?8iVUKqe+YMaNlE4kAeuw*V#Y|`-il|Z)H&FoB zrKeE$UB4h%d#_|20XtvWcd6w9&VV9Q9@KT=5TclSt>R^RzX8S3b%m16JZzUp&zCxH z)t#*#?3yd8O<7fgw5neHUR=A$>&|luxSp0lT^Bw<=p9|52kc2s0eY=i7xc6N=XyWs z{kLKGl=etRMKX_=_zZ;Mdt;44l)rm!}XK!!#y=epMiDZqP@PAY(&p7I5~YQPzfQ*qNxbX~7;p4Xo-*EksM zE_fx6jN5s8sG=fic!o_IT>TtyWe`M$M(;NyYv<*xom61wD|-@kBfuF@#88AbJCOos z0>CKT`)hV0@(0fqsJs83D;5;~`CO52^Ur1{%KzFCn+gS5hnzsDWnW9}a)%@X)DFp; znrYvZ;1g}zv!qfQ|N3P&9Qt+Z#q;pt%EMdnTwAnfBbIPtm8kB%yM)@G!I?p@KA&G|B zd+a9fmJX3YE*cdR)dJPq;cMSTauo+t09Ql-G-&klAoLEd&;#%GI;{YDr>N)jCSL%~ zwK3j%i<(p%QD%s#(ywz7`fn$6e#5anqDQLc&jI1^1>7Nm1zZIM(4f#`gM6P)aO;(< zR$%8VufS-~0nUKpb~_rhcLYB}ax`7Z;e4J$*W@BcCZL*L+bl%YqRxvCdlZTmTRyO< z$!rv&TKsKf*xUie>0xu|-To-NAh>%8(W0)o5ieLMIp0j@#CyWtj$A8yc59s$nbC(O5iDt3CH z=7NLdYW_19<&{@NH57nK07ddSsPFj|LUQ$8&PB<1o=cGNJl7Nlpt}D!rLA#78#zku zW{61hf)ZOZdlpDXRSak8w;QXpSZ(t7jZ&CJw=FJx8tG08XJrrf27&yUhj?aa?L^5U z3UTO@sjWa&@^jGM8(@Qn{m z Ggk&_e1$^Ld=;poAJ&MUgTPl-l}mT{%iN-~%gM%@~ErZ?AbF4EWOwhzQCY&K~| zV<{}W6h>(K3Gz2nfPZLLl9j&xo0+6pXm~!zNZ_TJXa1QYdh`qB@q&j|jAGg(ZNgdD zu6DenE_1j#+PotsySqXDZbZTcGiYCsQ0k=h(^d>Vat1Qcbg&QTOjA@fkJ;3_dHdK1 ze&~-{WYd!7pwGYc24S3U(HUK_HB4P1Q=GgyqOc%`GT3!2XVkg8gR{!)*z6l8{Kv47 z_UG@P)ldG=NZi2?#d*WpJQX!fh8JcvHYG{rXk{IVYTkmEcgTTCvBvpXr=j<@v&M_~ zMu+;feN5c#E_3eA-kK6Cf%|CG`wp*sy*+|*@9=mpl74%EAmVH}P5cT?95sA^Jn%EB zpdtR7g_S#=#OI@+2_6B>>qbFltQgX5FqcPxD(!p}NE9!Rg5VhYKf{)u@7YoN*d1;u?=@o}yNt)OiycZ$Kn{;~(j zenshslr^RgH5U5gW>y4^>b%^3odnRDG2?cOohDJ29MMhH9mI_cIUiQS!oPO)!aJH2 zPUW>v-y2ymf#WwnbiE%tOKG-@Av}YW(%0^dfaG5z*m}83pK7 zn^d;1d3V+%BhA;ow+D~zc*wpSOY)+MBcEXx8%jEjUA)t5Xi;1&D|Yrkg0E>e9<`yf z!)96(pxp5j>d}J$IeHrZJbI|oEGHKEqBOn%`l1^sdbXeTN2*vqp&9 z8D$)4b-vG_b*V`3ggpz3E~pRI7gNWhYtK6fo|(g$jIhl`iHn9nIXy>39^uBMMW1SK zo0E}YbkWCq^-A^6mh+^5szbq5mx3!Uy{_u4u~JCYDVM9JAv&*mCibFgE}-hwIZOT* z!C^9WVvROPk8=9^@=Xb%xyMp#s7BuA^kckboT-YVQQMmg)bl$X#>w+&Gzp=@)l44V zlEd4dxjV?_i@o{KUKFL!wzHtz&9u+kF&jdDRXO#@a300r$EJoc} zU@^(7UZ1ew11V~kppNDZ$Y?hFIhr&?S4MN_d^C}kF+dYwwTbJvbdQxmxVT*55_ZnT z`N?H2L7!*U$<+Hs&_XlJGMf5{n^0kn{oV&vtl;a2)xb!*au3&**dfeKztc@mG<}4O zg@>euEHRuiL+Bfk;j!v1(Ux8n%VF(h^ujWUgGO>b_ZKyO#Q!0fcDqs8`1dmh zshay`Qk5a3({NIjh>^0-(qp$NXj*uLg0FGdgH}!G{5)nlXf-VDhI$D z{FaHvAcU;7%TT)k3DOPqe|7_H#+9`e=msu8QEU|hL+nL%FMS%)uy8wL6+iy-{adv5LGeJ@~?= z2nns@7A>prk1%Fq@?>O$F_vX&Z;*7(9*#X6BI5tRCwkfg_XG53O)4xQgKhMd!-+h8 zt+TQyryw66w^Q8A&?&ClZhZ?GQBRV;5OJZ7F(pE#^YWWxlBH)sN(os@kI417g+$|5 zv4~8g^qVEPU%Wmd{oR4z(`8>|@IdTnGQ*A-`I|k_m!=3cJCd1IxVuDJMO)s{Pft%c z5wivH^4XHrqJPo%Z``hK%7t`O7nqhFn3Udiw3NpxAv=?u%e3fToYT5@ahApuH$aPv z41K8U3v4&dKtJ9Gnq_Ru(ekOrP>mOBdp6TOtlRI^F$Hr%`qeuYU+Z@tW|Gn{^G}RS zMJk{ei?$@7-eArBh}800yZCup&cN>+yTc<)?s4fBaW^kP#9Q`}@j^k->bS0Mo@_J3 zFa$Hz@Mmu&W{Y$V4jyu)TeICj#Ry%N9(&4>dvj=n;po8S_CdXS(?)9rN-rAR?EYI5 z@skA^jL4T`(Je0xGk$O&_1bHuqGl(Ee!6jL64%Z)y|NkWE{F0Kv9(CQaLI1~?~ z2DRniCP){|`OssR(iL>>9_pHHo)q4-EP1YcP8&+MBSX5q?$2(gd+~SOjt})b7B&=! z;@3YF>65Qft@Tnz3>JJOxuuXwm23}B z3Xfp^`%$B!5prLNPjs87!LlQ_(dnv*t$=$+X7!5mquXDJh}8&L?Nbhui6>ybFALp2 zOTUvBmTr!VuD(=wpf!4P{d>Rbaf7zz!26Hyvto2O20J~AQ^-97SLelz-#NUhGU|1% zJH}9u!Kj%+4G0-&Ox81sHF&H>B>V}_sNbwrp-lR=oOpLhgCgoPu@udKgOKVRm2Wx5 zvL*ADk`)KZ>WeikiMmX)I)Q9kCMw210UGqsX?%guP`ONl;o&)r3cSlS+V`>uWm&r< zd%yY2MZgU2u?BwI;d47p#B8+x&SGmh>Ghn=&YZ|RaardZ-f_vdo18Eu&aIe_Le+`R z0%!MLuzg*4((uVL*u*-`bdhFcYJ)TXEw8aeE18c_)(ER*(h$aYCZ#`9SfCN}@RwQx z#x*~~R>qB&QBoT?rN6`Brng4a?x}UPlChPC@tI{vBlQb2=q<*p%a_`cS7P0FtUiln6Bi=b*ZuHB1yBcMU^mlUt^~E)nc*4T_mZz3BR7P$_+(>9OCkynwPpQxq zd^VP|y*=r3l!;y=aMP-+j#4Fhh^gzvCF;Fv1O!J+>mjYF&Uv zICL5{5E@EXX!M-Zu%5o4!2{4JY3mgictmVNug658L2}0&m%ORRB<6nRn9__43XNv| z7fcNj@gi(~%%Pl|v&Pa5+Ij2d>?|bp`=#Z?W%eH`Zj~pd@$uxFFN!Cu*;Xp#zIAKk z7C0GZOS_NtN^i7~m@4NXeN|n)W2sVxBc{Qxy~1CvEe7VrZUjQ0dRXt3{MwUGan_tO zCaHd8XUUG5pme!=Ok|JhcAiu$Uc8u;V8PlPp zUjop01*U-kUY9VgTbn>*wGbL&muWCv?CW?MF4M?#Ec6*m^Q>8AqS#k07TjBjP;DqommnGYv* zM+M`5k$%q+?kVuT?%j}Ty`vuaoPURLdl!ri13)JNOlKb4C-c|!%JA4%2p!YQbeJz@ zCcNZJbcXIKe$ymZJN1!@Phb^=@x+F)U6*0Nwc=sK@$H|RKJn=M!h;&Us)%K%;0Zq<0i+h*g*pSFUH9!xzzoEE@^>>3=|0BaeOnI}=+{^sgyWqn z98b+ zq8{77QPHF&AllYgU50fpu{O7{eoHLFC5E>mHtJE!vU;+^*?UVuug7az?$=kTH5Z(MG*Tv0K$+l1z=35dU_( z^o4%9Rx3W8?B>>V7GLnr_u~QadET#f<6-n5R1go5&9jF_EkrZJoHieMn23cP4en}7 z)!rvi8Rju1ul+>@p9@f_--p_L=+~Y93UnW<|CR0=0r~|{boqq=q60IgyKasn9BY7Z zrn=0T)&JrZ`s~Y`?Ui*Ricum`7XBJDmpAMUvDezgGIV8&y{ZCGqGLlRWPt#cOQ-Lv`kmu|xlk=hBHKmLNg;iFW)Dc!}Jcj zJ*S-e%(X4Uqx;~{Vbv$}$M2rub#7-a^PSe;vAzB8H&!-SsBj${BohhK*(_V*J<#&Q z{e=-WZ^M)=O7T~D-xghtu=&no8|2ukqhGhTJ8J{bk9AP&-A0IB(%j5H_UG0!#beWVNIb@+ks_LQrsB>fK7qeqQr{}$;#0Gf3 zumd`d-rgd~G+#2LP|0p2B&_w$u`8=2iWlHR)`$pDzr)piV>#XHaFaGYXG7XF(Hv34 zpM@;7>b{s0ZU$lJqfEc2LCDC`{1vVzC$I~qkLZ4KqiwAFTW2N_Rjgq4}e zCwK0W@1SknHN}izZrJljRVposy<3LEN&h~G_1kY4O?tS!N-Bn;pEEDvb!w$JOnaol zO1rZpq=-gTaGIWy;2r`rxxqBqz$DqOqe(H=1ffZAnI?zf#p|CT7c}{Rl{C#R^9QYQ zcS7`%dW3hpZBym|OaO>I_MQa+3tLm^$|9RNJqbpHAbQ!(0FpU~dAu;zjaNDY>G;Wx zgwE@%7cF;3-~C{19bf$R%9wII_LWAJ4c}r>$~>DIV~sd|!`>G*OnA&b3ij=o8DrzB z@#$Hcak~_SS+jaFIit7|?E&mq%%t3>#4;ZZBfYg}1E)N`!D8dW$5$;bDjz1k%Ij`lf!h=k2RlmaFNLCMWQzFIxte{) z-%s9t{^4C*>lLE3G*QJVctd%R<43etz3dtFFC;_@p{({UyP4_HY9e^IuKRv5a>z9+ zn|5MsI7N{2ig=;-*mnq}E1y;8qCBUxKz^ALyHA7ByM_{msH!J|$D(R@TsW#Jg>p51 z8+rGqsTj>9PFQOe$+7*h6r^3qTiGiEevop>eLZWu^Tn?x-$VcK)svV~rrUwsXRgaJ z&NN@m7LB+Wbp^eKWbE&m$C@sEWXKId%^X8R!_z%(IkCC%LYmAmLc~26rbeYIyaS6+ ziqFU4Rog=u7ZiPjwih#ktON~8u6?hLn4bS!6T0Qobs&SRkK&_GiXnj@6u!U`_hHZ( zIV12HI-4DQ9giVBXHS4}EW^RN9pa}Cl>IS2Wd1`RrSe8zEo>r2l}Q+yV%}kYv&pX^ zU^*s}=CuxaPn_=z>Z_P75PCG1>2af<(+df^OmDuTUo|$%+R`QwqlVtY_h$9P?~f9F z*$6&7DJ6|`t?D23c7MRkY+-6M9f@wfk`r@m=&NMC{8~MRb^9tlHx)d`lpH1V)e_42giz<1TR&C7~E09vHKh2h%*xdOMCGH3%N%Q56 zz6jRk=0^HdwutU*VXJI$P-T||iIn}2`*>C)?v}=F>Kdw~VXNEx+hkaqPmGx%qe7%VSVM2TE*$Uy$eTDzhIscf8PvlSW1G@|o9vTYA{frw1AGB|m z6=JD+(}m2CpMB-#T*iC;@bKoWiJ4z;$l5J=BxNRPc=XR`Ff2#pn&g-fbD~3-k0#cv zi39karm)gg3llUsq^5P@mk^7{%zx<&^&hh{r0jbbfWPZM5vcILSZRAd!cD*{>_M$ft9RkHPL$(rwH}&sOPb`ruy!Djyi2%$k@jm z$$;FKVxRp6{8N5NaLl2mV};-Rz(TlIqFO6#Iv__Q(-ZVK;|JZ*Ryyp=+$O9FqB8zd z(Rx_xf?78l0&X6@$>#TZ{f0;I6kOms;G37Fw3DN{G;JDNfoWZd*N`cY@XoYtRI z0V)Y#Dp1x1$Y1&zWxPy<*X^7Ne9mPm@Y9<)Eja{8dUZRA&7d{STZ1j9agEgl2v0+Q zXZ7TACTzbIAtv`4Wg;8;i0Gqh;qWoxhKlcc(TlF7yX79gMfSgZ5s50;n(0hOQHVF* zD`JfnC4ca9*jVNW#W$PbEJSrM1;^@Yb2WkJt92-lhQ%vP+R=$24^&x8@l zh%OOJlgJqYP)dSM3G(;SM(Hn8;=fouV=un1U`ha>)Ms17?~Et%VJPr)%PL50l0nNq zHegpNiOj)`ij@DU^@@2zLdYsc_2+!}uKG_Vt)X7s5-F2fyaxE;RI}>DHU`+ZEMxT= z7Q23JE|gh6UTPQGsOwc5PL`xE8r2%pqjm|b>@R%GcEpHwymeDqDmk*DNN_85hT{{R zXHwF!Fw!S+(-+D!O~@&Nyt>Vrn=%_nyGCI-cs7v@GUUGZ8Ez(`{J3S9@X|x|&cocM z0G&K-jdl$?lv*>C;@$Tn-M8hZxgFu_{G)3-P=*%wX|3=wmf7zK%T2kE#x5zna37Ohf3Ag0{ruTq zxA`dLWT`!d87{{0G&)QoqaIt{p((HTpWY^rKVBo%X9=T zUKL7`xJ*af>sh+fYc(VEs)mA4tRE+NW%BGOA70|cVfMhpV7#HtElPgW_E6mqb(V+E zG|iQLb`)MCT+~D~D5D4sUQD6`$G!VCvGCsX6Y6GbDlsdB78mWKCwhNIBRHzqmv`W)H;2S@9x9~`$_Fg(k48vRaefSDD~hIb8h_?`Bb$X`b!gJluD8W z$X~ej4BmWL;bFgWJXw9Je!4TpWeNMh{TnhlkpAIFPO@|Fi1^ub!tl z4v+v8)o)-zdo368_o_zKFLM>VI8RgW$7QZK->`A(ViG!i@8oflHp>>~5l7#aA$t2O zlDG_$GNe`-`++&PJoPTq8+Pe9*8V08uGviDSo7e-Cu(@Ft-{}tRWi8?s#|8{`qxdP zGOikbM`@Su7TCBYVpJ}s`+_U7-A|1KWuT`7U%!phaC-Rw)-1Ns!%#@VX5gnhj*O&Y zC$2}6ki}qBG%OrOjUz!TqP!6;GwGaI8MS{$GmnjunCY707LZy4oO&Icc>TK6Q)9i5 z)N+?o3tgPg^2GciwIGn%->8&=s&z_maAg$E2XT!rFvRp%T9D+jU*X8162oY@smtgZ zOJ1=g;-ey$Jo&9DZ1|gBcUcF_x_?^mZ|DyCg*vu)=sQ`d)_osle2$jDf^Bf%!=(B7 zAzGGxMQuH?OPshd2;F^$w`0IfFO|#gPA$E;?*Jjg|0(Udr)a}vcFY1N4%C9@F`W}^z_g!8N%)*bbEi|zRl;`+1 znk}(+eaW0uUwrD%=9W6{rN|IPr}UN2gRywF+2=KUa)#f4?pCbUWWKp!jkb*TB{l)%$mg6}M5)UACt63O4A zMa=OB8IP^FgX_s1XD)OAw<^PP;ms6yV+zC-)&*hu-!2qS!Mae6#o31<>P;^u?jM$I zpRIzru6P|~BQGAq<%zaf=A$iYY7=`iIbKI5%=A@?p&`3V*%x--{PNLrq@AfW zyU{!b;Y_oGNRLKw)^P93d(=3bZu?Ft-U~&2J@WhnGog>m>$PY#`I1baXZ_BAs>~xJ z<&ld^6%d@7EULq!S1B)c09Bnh2*<}!c>AKl&!BTgXd=<95TMEqnbhG6TiT`BP#<9{ zYU3XEJd0MPn%N}tTVx3=o#W0Fd<(n`b396$jj4;=DpELhLIZm*WUXhP=X&h>NmUG^ z5z+a7$zdqJQFoE3yyX59E1LYsrzN%=I)0Cu*2}fVy~+ErZW>j6k5H!Mw#~!#2vAxhf^2O}CQr^m|!-J)pV^ zv1;({6NoCTY7yv6nT7;bHQ_1Y4qu*-HkPDc!iQjQ&e!qk(-t15#TDp3UvzV#v%exM zTqoKKMtZv66fB4ju<}~ zq;C?6-oFawi3xOrY+BH8FVApfy++E(dyLf%sCL0cI4%-_CtbK~MHP{rVC zC*Ea5-v@#>zCh01i6gT8+s9*VSRWU(2g=QTpKR&HChcXb$i8GJVt62ut3*x9JBIv3 z^ID`eX{=u>HNUMT%HHR?%oK^*>4r?({!zF%;;K-h1xa%~qQ&NP7tq#QL^7 z(TT|L@};{HSH!Nm%ZWkO<=#Z`uKKbK2Bi38soj>fz)cTM81eE!lO~ribK>&C5FWks zY7cpfo?w#A6g>^vhJ+X)EnJMT+^cEitWOwpsaB(~Km%9z`tEJCyh&Dwowl zS#@MzI(&9oV)X>n>LFGO-cth6f>kR9{l4;w8&vHrV1`H3kh_Z1!#>1(x|QD${G^z8 zM)hl8@74uPZmh8I@}dN)F9YeS9^P^5jFsL}SNu|xxuY~+W25e8ATl&QUs{gCq($vguq+L5rfVd z^f6%7&dG1(am(~KpbA{&E)vgkncOiy?f)blLcs7^71K(|PNT=I?nDy#d080-w0f~-}4EF<+U z&W@3)uGKI$d}Q{7u0u9Vu@Gqu5t$|5Q?$GWMHly(jW=mU!d%PuQ5rTW=r!a0X?27l zYno)*xja`R=RTbb`EW_y8*eh^OMGifFh`Hx@cI(qf&pR|z=V5wc8=njv68-JF;9CET|gBF-_J_AH24L?K2=;|FXETQF)E=0_U}FcT{{g z(?9ku;1=6|9Nv5{4GCrFNf(z;ypv&qRJ@V;WhKjl>(XaIHl>IC?zI7Q{C2TX!8(h- z3=Yevy7V?F!sq2rt$j%h`B|$(b}1u7u}lFM3<(iFZ@>(Ch&-$d5^TR+I3$2|!8A`N zWwp70reNREfOF6Aka5&bS)cJ#VEx$O$ON;jlh#?DoFUzjv!~oXpG;84EPAoxZGRi1 z2roJ7pu%D+>5#>7cbi(y=%?xwa?EEBLnmseeCW~>LZ6`MKcbv3s^ugdQWhP%T8%6D zgQ!jwg&4X1v=Op~>G6W=WA=^jO99^$eUyg@K9lOzzqs(Wr`(Gt;W64R=hddK$(M{4 zTpjti1qhr0)kcU_gE{$-bN8l5K)<w@+Ni7ol< zs8S*?$fZrL&9}IlJ?KCyEDYApu^xQ7x5k1`ekjQHMsTJ}GBv}RS|bR8%zM>@p)HN} zq@3Sf4VDmzQT-hCJ@i8{A{Bl|+7!F*Ynw zcTXn>T{%Ch#k%d+i88+b&zW7NdX;ErB`k;^PI&U#g$>JZ_M6~2azcbp2@>!r@$%27 zgyi{m*e}1I5>})LeFRgiA+oSON$*H1>yQXzI{jEE8B_}Fy;6Z=<_ee$Bh%C~%-$-GBz zP%eKRF!_O#Adxm)R`xJac#Yuai#dseiN#wSg~G${?xV*ItWue(2bvhx${6-fP938WX|`(_{}zrntp#sUbRjRA%;Fozx;@BE z%KB8EB!-vkH8pjM&@AAY9|L`f2a?L8_wikrfrM2|YL=ec8u9xnj*a}HQg7@yhS9Lw z%rEFgXbzCAFzuIS3v9&9iac6WeCB@l*ptA!?_h(u= zg}TcV8tzh($QS@F+ma&OWdU=yA+)eAOG8H{W|ngPb} zZZ>7rj^=Up2m01F_ap9BdV++F%Yuf7Vil zQ5@hm#Z1zXT*eqEnh{+?$l0MFMhfmL-yub~$}tab#v+sQ+Z8)wSXaJZnlh@vvwu~k zY=(JdLHA3QBDz|!roGGb?92Js#4N^{2Ps&imsnmYWGfs9e?z*{NfW8`-fR5g;f|{T zdO_40wUpe{+c+y;Tp{ryS}iT)N8A#xM%M630~rX_eHQs`3APiST#Ksza-=qYs}xsB z=$Jw=(dulb!?W@J^D#wV_2-A%UYLF}I<}E=t~LX7et|MNJze+Q<0xiG4XUmTyS**E zulZJ%gtD4)DF9G!cc$JM1qu8+uO7v03QWJAsDo86EAd-B67;5nSrK4{Pj|zb-A6jx zabFbQdo%)F*h!{mF6iCuXM3;Q)4B6_EbI1MClx1 z6T>SnE%MUzdsiWU0Y#lf0Gmt*iaG7pWFE@r}nqZ&8&SoT+Z1INhF8**JNOsbXJ63lXs6_gh#AB?1?~R>$vctk28=iZO zVYhAFmTNZSO}0imqw%OimR;scrp7OB^H#Ta!i}x^`&naklNODzKV4^%@hCq+Bd)%Q zLhiKMpB=EhFtb5__aK1ig;PL|P6;l#zx{0nG3P2y%fqyb^zoRem#vadqA2!aHzwL#*+^ti*W06u&}}F2e58_*e@>?$CnuM7ETfZvUt0MUS+M0fjlwZTlr&*EB>#Ib z{WhA=I~VNEIF5kGB=Rox;hx9N?ADy>I7lWZnPk;hq<8z5fa;qfML269g_j`)%o^m+ zpNyUZet&yFu9gxrG)xe!RlR4rp2rio~ML*eMu{9MD1zDUT9H zaYGzcmXqb)j?o5MnidJi;k~^udf(n*ei>j<*or9ohMf%TyBBc!E+4kG^F^PF6en`_YPQH2E1D)ZcpE}in`9`lFs}}Pg9r;ciGR(7eSAT z3esc^?p{!TnMz5cIdF@-yFX!2z>O>D*1ZRxioV?3#Q@lhw;^;HOfZI2oMST$eJ;d9 z*{}m_YU(*v#GhSS&}ADYF<~?R<&HOKtXW$AE9%}26_&8sq}F+-hQr%Og^hc|c?HXh zpNCO4&;S;g?Fd~a2VJg)@d9<~oYOh{TW4_>!ioUXiXmm^ zbm~CAa*T%6xxUFK9JI})>9;o%_~=M!mx4w^)xPy|cR!m_hPUobm3B{@;;#zdtUf6= zO02U49jdK-Tme{=AZ7vP2t%HqV-fY61$Hwm3zSq!((9jViC$3EkqNjqezGf1gl^${jg^+A4M<**hZ7KnT4TRnf?g!(h3N$G9X zg`*u4t?p8NTcGut0fa77fi9Q*>9Qj7IhRKO2H>cT81Wjs#4-?(?Qe*$2GJ3Hn+;|k zPoBGXL=n1fr1SazJ7hHULg-i&xp?*=&*sGI>@e!50n^{md5@TzUt>8NsrB;@Or`Xi z66~8Y?~wI7DjlOS#b*=c$k>RgYZH>x`qfrjH0yHN>)Orj_HDWH?!ILf+o=+bX);bu z>mBj7kg~bvO54P|_mz=R^4U1bHfR z4yzkP=eJC=`gY#8d#O8>s2JXNl71KZSqtM7chqt;JYD*6>VT+$w|Rz!Zb?!o~Sw=Xy6c~)p(5LfP&YY&-&T(+S>4pmpoCC=aeBv4 zDVyy@y~o5NPs!}9vzE2>x+#=6mAIdt&x#pzUrM#8gx0mv1#W-P^lA6XtEx>uoXIEI=!CE#50F zsVH06?v$eE&bpcL3m$eP_c6*?3}KGO1FS+aT=SDJZP%FV1giTTcH~`{;*>b0ZNu>* zHrPo}0rkHI5mqNPSe>PRR;Lm(>^+!9qra<@atI;fb-4L!0OAO29tnuZ2_V|*Bb>7W znSaR2B_rGa$`kz`nIQu_#ekruj|2u1{H@@l~WDIWvFGuj5svbQTj*5C%xHYOZ=bULSF>!q{`X0c- z$R7z&ebRvSS@LInDxb@wG;ar(0Ej992z7zU+mJ$7UCNlhbrpp{bzKK^J&kCcQLZyW zW^Gg1v00ED_| z;U@P1y3XAiXWjuY0T3yJkPyue!2EAW@;O~1zja->3#*Ikp;xg$W}SC`_-ktFg=29( z^J(duTvA@y96J-;OfOSbO%i*UN?h_e3Du&i*|GV zeA!21PSG;{-@lEsc}b3lAKO>HoUtUl=zS`AcRt1zGwx0egZ&pPl9msuI7IfC>0}-I zwpwh7m%p-o(UI|wU$`8T!#{t_cKW5dLr6NVBnf|95&N29v=VV{zs`Y@ra3n))9d>j z{b48LZG11{BQk@C`F|p+qWz7dek4NAf53a5s-i)^ovws>P792Ng~eQj$R&5v z2X%-w8V)HLTECmrmuuuw~!w zKR>>*k`$L`pg8j&urfS3;;wbFAPLaEila-l66jx$!|S3 z4Pf{XoGTpF2moJ92Y`Kw1??|PJd zyk(1XSkZuUy04p*N4T8#<`8>PLoOtYET4vm;W_7Ogp&7X8xnwxs24()SwWX`;JBRl zHr*>Dhh;UE$Lh)cc*`|T&ZwI9`9=-DY^SjRk{O)uk>Vd{nro(Pivs?cof z{YfUwTIzgIBG-et8XAqA`Xpg-G3YkS@I(Czu1Dzkue);q7UK62>S70VW&Np3?c8dM zZQXBOIKc=j0nAK?B*N-agRUNlKZeyMXL{W($2EJSM~JnyLoStkC0X`1qsuC_XMp(I zFScWboDWT^jrwT{@}9W1pz+@Qg}V62jHJ{z>4s-&C%^_b7@^Bx7C9vS92@8iIv*33 z%}!@=WB2^+EAb77`rAg{wjt=KzL>ar4DA?oXqGg*6Kxg?x~4Lk-6Yh<(HGD|I_=^31ABnBQ|J&HV@;|kB1iVk(MWm669n@I(uSO!{vlj7>{%LW^^}n|m9Q)ri zQvOdZ{yh6XcN%0w6%QuTL(Yq8uCt&lzvinZNYJUoCJ-$|UEM5cO|5?YasXh{Op8z-H>fWij=nE& z^j!cDuQDR)w`nAJDW_^*e(OWCh1HjxVu_iKPt`w25Urs#KO z0iK=2s&-paT)hV4mjPBunof544yDrEFwj1LW^UuU9}5-7dnFK_vo0c^aP5LOeITn|Y)#|HY%&;#f_2nVPDoA;h; zR^L8c9VTITl0Abr^>wn1XHJLsRRP8&t2%p=REsP=qj?92yqjyevqvS}3tn~O4NHK9 z4`LRm@a6*Q&|3)vKf|)n8$IeO65KLio9`#I*GOb2x!62No&ESy3I6eEik1Mcj!#>z zl#fUlVH=nIQA5Dslg`RIu&)ub0Q0#a3FlZq^UnCQ{yz(+lFxLxKIF}=ftljUgKMa0 zEv%Z0yIg8qGCX*>{Yak@9X;7`Bm6V=pKH9fd^PdC4b^Wgn;&5DjtODK@qrbW0;l3q z{#J3bh!Ocg#AG;#AK)OO0*D)k5d}cRM{p32|Au&o81W{EnDi&22G`#Z2iOpfP+&GX zBoMYYHK6Zra+1*AL<4#gQ^R2FVwd8igj8ks8(a2iBigsCMHn8}_)rdRe`&-@ELYU) zy*lv=+nkZ$cwp4HS2@*6y?CUR#83G##8UQ9lL&0MdE9ZOCY0Qy#=it1rJB9 zbCOcXW50$Gd=qzzo6hZAF924U>=B?erm~)is(aob2G|gtvHAPW>C<3dF~sT|8|Z0x zYg1S@bX^4dv>&;Q4Qi!^?Hn-0BY7($`Dg3yxfM(dB>6B+`Xo!GYsu4AZq%=6G03c- z*b_HX=2jYMicAsY943CrL3-9$xY9v&f{RvwcYMY4qOS}^rtE#@sR%+tM}RHy8QZ=y zrhV|(Hcex}%WTnv-rCdt6Uz1?@C)maZKPjQ4va0SywN9*ljpRKg3+ko;;4{4U52Wn zDz=2@odXlA2B9 zj}_arJL@EziI!~luclK9ZfQh^aPMo$DGu@CEgmxq<@nh8Ore=cTr;l>Ey5gDYam6| zrZO&nGW$sjP)EXnaNGv7cOlW|)Iq;*`m6`5PSRwZpfWnDCh$7?RZjnq9LiMmPoky0 z<Rbazg4^fVnksO zG44-9O^v@H8X!g#0TE;2AWp-sm4b*D0Ypp0h@v3k!#@$V@c)K*nGYGkxq)dg#}q;i z+nZX@Z?HTXVSCfwno)q*%Dx-hhVn_u(tF0uun!)roijbbF|)n?1A}q5b%ibnj*yRA z)?-@VB%5ZxhjVyPvNa$*dwZ6VbTp-MDuTF2@BLhK&9w<9jbd3&i;}yCvboX&zOne7 zmAeiEkCLNno}zvoHl{9!&B@+;ZEf|l%nmb-5HI7j#6YB;St=(}apHM?=ci>%^u~tz zIe*b4f}lqbJ;K?g70ax5LNAKRhXB>L_z?Oi2KpES$H!XOy?Cdx-#&8iBO~}mei}^V zoIH2WnHF@H%5@Lc#|Qq;?uRB+3>6pZqwW?h8($roy=RvtSL5xN#n7A_ndrjvEvDKn zl;)OnMj4ugM8__7+P%@EpZZfD$mlI!ATLa)Ji-o9EiBG5(_6f(PI9Bli02`}o4|%~ z*(k{Ej<@BWj^3)A6$<%gIsFm?4Kj2%&-b(vmQW=DMYG0kMsx21enmQ^860fnR!OHB1u& zVJ1Q1I77OteKSAhwvj1}XdfC!Tu8!*A{Q38ugsFnl*(JSvOiPL_%)?K{w-~`g({wG zvYy+O9w&y87TL*{SA&`Z=jKf`BuN|lw)?vW1iU;0?yRY!`W5?-9EBf#*=o2y>5aGR zzu^&tAD_HA>NHnwMcOFrb?w?vr*MLuz+8&y&w|%EAql3ginZ^BQfiWKpAe?HI*&2z z&(YMMT!@P|x!NQ(Nx+ zD>m1iWi>Ag{Uvwt1WCaU4qqGCq8kpsd!*%fJS)-AYHSSu)O#bz`QY+tzyE1#>)hdIq^ao+PYYgyZw7Vh9j3UL5u|NVtG&dc2YZ_PZx639BTXt* z$4-QII*n`o`hrR#`W)#}PQ-TSKYJ(M_}G!&PO6FDn%` zOE9;ET@!L_HrENYONNd*r^(;22uWMHzY*#6IWn~_Tu!_^JQERpIbGlWdg{&v3B6Gt z=}(34Crx#}J)`}$FTDCr`laTlUn66Fhci!i$%QDNzMCDEq3EeEB&$Zh`z2ti%acRq z>h@RjoRcTTt*lz>RUB3Mh2{?oP!&A$8@mDbx&#o8aA3yK79qSM3`KoXTB&eis&MJ z2?=!G_$mHssDf3{bhG$svCgw&WfR)ZJLbHHALLg=#`?Eeiz2>!sQf7x7%ZJwLT>fr zXXse7JVTWEboC1yeQY9ACciS;qF0@gzI(MvmXIq2F(#;2Ylv$AS3U?Je13u%JP<-y zSM;DsM4`}|;|?%@r*ccXd0m}6hWT~emqM@Q539!*+*l%Fi3qK%E@OTPgTxwKbZGg| z@<};3XFpG8jc!C^T27g9{I34ZBz5_>w?5cxyK_CgtIZ#Ov}~}oLo~09CSUo}rd`B2 z8k@15bSJn?XLy(94Z0nNtj44E99eI}6I~zEr&qjFY7(oQgqb9Smb+9m84A@en_s=e z?A&Z@)nRtr9QlxwMJ2-%PrvCMuh(vhHlX_Bnd-mq)=d+_n*-`YQ*h&4U{#}ZuT$B6 zEy_pxR;j{sF#bvJr-!ea;xx4=Im4V`$^-T*VfC0K0*p@XY0@}A>q$2eK2;>Zr%KeH zPZj-h`$+#jRStv@&S}A{2T0I4JBQogV( zbf`D32WOwIsl?^?glEf-KrP?uHMZsv*vCM*@zeOD7F;z=%U-poE>F{Nh_8N<)W zF+Qo@V5#ta)4s(jq4&#+1!p&4|G3{B-LSxxq4!lZyR2aw#$kliS_2GMxX zB+o}}X1W$7Y7>+FwA`_=WQ-rMkA0^?^&h<9Ib6!@@%-`7uBc2e&+|kRG-SbK(Oc28jdkhz^=2b}OU-w|<_v_4kCdY4GIm3%1ebLJ5b1)Z?N~u@OlKLUo?g)X~{`uA%0FaUBp0Kb4=vrSV9yPw(bRJGJ@^3B{{v#ymWxAHzA?epur#>M|>&ljLRJGccx$))| zjRP`G1NFY-%DZM0{J3czREmp_O7*&>4+X}qrLmB>nwiLm89#~v+^M>S@HZj}{zfAI z{EZl%J0ay%0XPI8iisj4NCKP&&s9R60ZeG^tif6bh1+E>F{$C6TQ z9XR@U6(rIg#_JA*Dh6(i=;%fYuDD7%Uj!Qo)lH^HI}D@k?3uHw>v{tDYUiIX18nfb z5dOlXz+YIzpT96;zH`5@N`Mi77$}DDsS2Jvf&|0rGv@oPFIf#%pUo|nm{&(*F|>xn zcE|p!JlN@}A-5T{y|mKr2TEifw9fMB9TJWROCGE}W&m1mK&(d^)DsRzkNMy9AW0)5 zv7C(-EbvAQ%4zVd&t&^KJ5e=!|*(9b!PoH8KTz4yt`Hqiw$w1nuIsK_F(?r5HMQN=w-;d>+2S=#t z_ks&2riSapuS{uU6tIUwhFSLyLmEA0_)i%Z-P9lU3wxqcZRV`4 z=NV6fClE{~uJZZ( zy${?iHk3x#7cyX9g#FnUCJN{Jq6%;iKuqvPxX11U?y=kayT_idg@l4c@bjM?Z+-9o zzT>@?{NMK2pZ!lQ{sIzxuVW&b#epZmAl|U`W}*Q7=4$?Ty&dlZ&iOrg`O5AfzT93% zUV35RDsk>rGHs#bX-&5U^|;btMYSGuhCGHBO}vYIn=(O0NIgj3Jx%}?U1uy1^qnl& zccF0l&L6h#+_L~C0OCbjgu1}9R}imry8M6ZiWq~{MThLB`qP14q%63(X2|Q)YtJVb zjvvU9V84 zM2Z8x7lfzl!8CXR408LNu4-tm1Q%4-4?vex^I@xLgEa@&JFW~bQWR3ZRN25-9`DRs z{q0J790w}}^M$MKiV^f^Otj2s#1ev%eHX$)o|mcDdWw@esco^~c~R2Rimz$zGD0K( zcJ_1#T?bD9LGGPn_wW0z1T4GF*Hq#-7k3mtO^;#xpb3WTJl1UDe=7BWEb^yK=!-N? z`r0y5LG(E>N&O4ifoOcl(ny)CXO5?i< zV!yyVs9U9K?ZGd*&_^bIh3UZZ*#0?3Ow`MRTL<+4H0}9lA^f(6QfYJVzv@8Hb2OKa z05-XF2x~wdtbt%SHE;~427UmD9f%PXK*XRw5pQ$-4RIPVq9Ta+01l$l-w;(<5mo{X zym`lM=*%~b8nzD%!nLO-w;x@*Kpq776{UaBU@&sgkp^AMPI@$Oa26*+L=Y*#F0kxn zNYee{31xz)XDrWf0T$|rS%BwQAa3VaK;L(adSF?!znUknm9U+0X2>C1qYA|w#6iZ{ z8(b8iO*UrKe90>MIELPY@P%qV9arbVhv4u0ZJ!*C02Ugo2GUvQ46}! zk06&C;g5n8#n>08*lm2;i05MD78sv}0c?v{5mu%WSeb!vD)U_OfqTyH${a?Fs0<9~{Kg4epA&_4b#UNjO}`a}*At^0qa@=o(4n)| zDNvBWzdw?1E=_}HDkeUjYdzz4>xymA)(?R(W;9>(ZfvQdak-6#itW`a3wy!LL!NAI zgXLC1%UT4k$XCCW>+_RrRw~obLgWN7uxBzI#(4IcRASb2B2QKdkxSx3LLy~-@Dc>> zboywM>TS8mdKOizg@v(qtjeQ?lsuHFPt32VO%)YO zhKgKfb<0M!KXDa9KviSHtok}$NbB|F!}%v|52lSrO-vaI!faGOjXw~XNBc;AjGv%R zF;7KmY5j4wMRoYs$Qyk(`6u?NkV?F}(^dJH1-Ax@0>9|dJk=X{xFqpW?rGnPu{eiH zrGim)fe=Wh_mxqy>CXh__YbhLK5TGf)MH@ykmnw{yw)o8^?0Uzqpd!>_IujXvf&iV zx1B6l_76!`3YWgcg+KGl>q3#s_kMD3BNz7?+vzkNPj6yw@Q?QkJ=U5%SIoaQWp!RD zW%Ef(5>MRq#NtP?XCWjHKWD0HDqiL6mpg(|fC>AtXf;Vh^i)+(?o-ZsQV^$$z7foek47Yw9T8<04-Kab?@(Cv!u7 z_Ik_AKx}gXuWG`f&H3kMsywb%p(v65OkK_GaGG#?8M^DF0ScTE)>Jw!llICA#^{K+Pq8w<~Wj>UWJ4fAEv<9lF*G!k5O}Nxo>id(45Szn&+*j(J-bK7Q+i z7U_yy0!P~&UOFo@55S!-YzUuc%1BHwY%v^jhC70$5@otVFs|AXG1tsz5(wp zYzyehFaEbXYcnJ%Upj$Hf}jD?=Z$r*oFE7(%QW9 zBe9-OqMj2sYQ5QO6N^$WZMXD3^^$qQ`hu?D6*HuEN^ZnnSDEUi3=q$$$f~0jP`3ArowH30{E#_qePo_(6DZ)iTYIzP&ReG) z36Vht>ZMq%S>I8Hi$nms2E=-GK)v_i=rw^;iJ;!69GFN&XJ|$6^rlaPCyXFB&*_Dp z<08t1)oUfV$GDf8#b)}zMv*#CQYujI+XVOXsh1zVzNhr9y(2nJ6Y0{paLeN+sc{~m z)n|!=tjmt{ObMgipWivR-F?M8>{w@Ml5Djmxkb-ztNbcrT`-*5eD$%bn)1r$*Fh7J zALxs_Kp!{|`k)K?-~q>n=D+#yg9j7Qx;A(s38Ht-2k1WM03oaoE)Xu`63^G!L`{%tTVMTR9Ej&~seg~89>i(06Ez@kaQr6=h>% zqjVprMRXg7-u4yf?ALP}|pZ@XqMJc%I2l&^9J*bknuNARTp7razfE9jXJiBu^2 zU%-0=M!g3^n$OGB-gga^s6Kf%Q8t;h9dnw^{T5?T<8CmG_2fqWGFXDF@2zvoLca<2$1{8+RgVhBftudrH0@)LspF zN3gM>_9~VlTvMhk73rBe?ZZq-9zSpIwgJ`Hk9TGFe?0PPyeCt&=ww25%g=;}@Ry?8 z72LhDPaCF~7b=kVr*0ncK8OqYjD<%Ym_{~%D%;(CljKE(=@b>Rw|s#d2}Cv;a3w() zVU_5ERpRz%l~|vffHUybw9XDt#P|I;E-*ne-a any 22 (alert; sid:2; gid:10000003; msg:"PASS SSH";) +drop tcp any any -> any any (noalert; sid:1; rev:1; msg:"DROP all TCP";) diff --git a/tests/issue-5466-alert-then-pass-01/test.yaml b/tests/issue-5466-alert-then-pass-01/test.yaml new file mode 100644 index 000000000..7c29856e6 --- /dev/null +++ b/tests/issue-5466-alert-then-pass-01/test.yaml @@ -0,0 +1,33 @@ +requires: + min-version: 8 + +args: + - --simulate-ips + - -k none + +checks: + - filter: + count: 0 + match: + event_type: alert + alert.signature_id: 1 + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 2 + alert.signature: "PASS SSH" + - filter: + count: 0 + match: + event_type: drop + - filter: + count: 2 + match: + event_type: flow + - filter: + min-version: 7 + count: 1 + match: + event_type: flow + flow.action: pass diff --git a/tests/issue-5466-alert-then-pass-02/icmp_and_ssh-s0.pcap b/tests/issue-5466-alert-then-pass-02/icmp_and_ssh-s0.pcap new file mode 100644 index 0000000000000000000000000000000000000000..fbfc65418389c6c4f6c6531ce2b2523134bc4e68 GIT binary patch literal 53278 zc-ri}bzGEf`|dlWba!`2cZY}~-6Gu$(vpg#fFLRz0wMwmNT-0bbVx~;bf_ z?*sD8Z~eFTXYb|b86TV(j^jMO*Lh#pHFMts1C2%LupoHQfB(RPV8DNGtqL38Wk3PR zfxiZBY8s#lwFlWxS73GKkw7vakSJTHBuEl59PwK=hyr}`{tyTvVBx4k0yNTKkGK4Z zKpoHRX`m?@F8$O81)dW zj+};b_F};Bzsf0cJ-UE8SQ!yeUI8oL0ju7*sb*fbE=bMj*J?%vtN-@Hf;sTV0@nxw z)GGr5lmW$Ub`+2;Sk3k(MSZqzKrw9YMnxj9qR^!x44|m4F3ZNv&dH|iXzl?1+E9?4 z+mVY()5Oie)s2nU4f20Zb{=#Tz*?U7zhVBu#5?W_SdZ&n!}J?$&+Uf=cYGT9A8W9! zK41?SQZm%bFn=lPk3WSda^I*(1b6Hzaj6&&C|(aEz%B$1bJyI&+Sq}Oi}SXbxd|7i z8~1<0_<^mVj7$$?WKgeh7jJ99UB~XLoaMK0YoXHWw>nZa#k2 zzwVK=vo>*Yv0{JhY{_bFYGwtwo6W)6#nlmb{IIZ8 z{{eg>I5->l4j|IS-51Hh-)IM}AN(ITC!6DAJ5MeiPCm)U;C=yUnLf5>H8ywQ;ud5x zb#;b(Da3v8CHT89?*%`>($xO?_W{qicK81SeuHlI#-?oiylm#KSHA;tKOlAe0W08v z3wlr<1%v+AN4ajc9s2~~JW`vH07GkkR|Y9{&L zYtg>HO24^twCvIcEP}&jUb0)NSA+J8Yh$TaTI(oAIAviqN;69p(prrjyaCoie!%}Xsi7PFLhJyd! zf8>l~vS%d;FL0&tv5~g7j4+88J)NuFALX9#(rGMYIS7U=&ad5;@rB7P*;@?lb8n>D zCK0Wex39aut5eT-N6w++m9eIso_5?aNADuz?9*oT>Iu4+WH3rr3WQPbC_e{!3hD7m+{5mZICjW=39^7p%q3s3#!yBNbm1!%ksh!-poF)B2U*0nkP+= z5N8^)>``yX3hk6kC}BeLDuZ+dwH(xa+`vumbTrEi2;<;`_i;P_*vCBpIs;IYHbDic z0ctlX-entv96S3rDgwt2)uo~`pm?1x;82N#2JP4gfE*iIS34O8AMBz792;Aamz_Ka zxB!Z0U_}S8n!`;s8?g;RY96^(v(9DBqL(#$0jk9CbsW>U_ooIY+N9H%ci3P>KKJDe zjs%$dvYCfu8lJRH;Y@%gd*7sUo?8L#npjZt1VZv?-jF94l85gy&oEE{pxBA^-#mXQ z8jS}*6q#;R1Rv|`!dDd=%Jm)uw55Fe_6CW}@>`XI_LQ$e)$|FT+N{~xOUj^iK9!x< zCguFbtE&T+fcw%v^4!os$!S#TsiGScv~luyWN-+I2b7&h4eH*Npn1AlP82?wzrdEEa!e5tp;Me zGz}AyI1@Rsp<$v%xZ{;#U=UjusTz>4^0XJIszwwI1WY;ZH&M144~9^tyhd3HTv|tbV($Xq8*S{TK155^oO6E$MYucf4>l!@6x@`i5-hDHzfD zw2`yi(pXUv2Q6O=HSYH{dNq@`MQO!y5c304r8mo$8OOfwZrc{W$w>2htn;yF5pnv7 z-AQ%Xa9hGhlA+UkIn2M`xrD^qoH#mFlH}|koOz=d3_n*r-|b_IX^bz#m(vpnqko+C zlqSU(F+^3C>R|_rVmU?YWQn|$069XclVX9zw}g9?ZWX~cZkk$hxgUjaeZ=#o@2ted zZ5$`vVi0a>_F9)uq+m)r%*jscPMIaLVa`%4yDN=)1W*)~Ljxg#2?Dpj#`5=g2taWx z^4eIsv2e810%IBPb~%;{0LgD0jN#+N#4P>JGg!WZ2G6|M7}=~gJM8~7m2wwGM4};W zENYb=a79{laJqkc=Bq!l>#iLgU5^*t=E&{FoQgh!|3?0ieGGzhUqgm^bWydBjW%C& zhD23dkL3(sGLf4vqS~LIc#`1`(Rn*<`5R*+cG-Qyp|2L;a%RR3=t`T;T6j8H^~U9q zWxqd}dAO~o7Z+Yt_PH=PYpZ~Bz>q@T{JR!mNKyz9O^W0uy3LGaGzOtSX4Nldm0^^I*5pc3kOwYOSo2ZV8jAib4**;_9GGHR`puNbvk z_H*_$WhTYG4k0o9R0!yrCbrvE=Rd2&)MuKjG;d+a{Suy(7hsv6xMt2EPV{ch6!8Ub zwZtX?<1~lsd=&~*rOWU=(iOZB8xBG+n?-Ptm~WZXvoKoJ@Gszc8x!Ze`%OG zP9wuHJkGVc?Lo1cJ@Za(!xLqY9DXQHEo{$cgvfu`GvFP;-p&)R3dXFMfX$G7kFW8f z=bz`dJ{_D}RKUEMD{7kiD3cV@Z+weIna?*mbhtIZtV5=negot7a>p$0ePTG`Pf5fl z;wcYfA3VfBI^K)?5r-Vz6Jo*rp~~k=!{*qJIYoO-8#fU@{@(MQW?b@_$;me=6$CTM zj)4!lV3t&jOIb@_&)3SneKm^FkV5{DX*Ayd11XM_5S$??rCo5mlPIQX9`_3sxnAEi znm|mFvH5I6_zjTV!VrF~v>xGxYN?usu`&Utt)w?Fx(_1IKnCEs%iyN@OJ)28Wd7p2 z+Vi+VEF9k3m+8-vVKudepecksRdR}(Ua`(5@@GT>OG)}8$6dnSB;!Gw3hrVp!lT|KBA zRog~sUVm+vG7Y^@2%aX7hEDHLgIb3c>>rOxoR5p92>=uDCLZ0|rdIb~lENRTFp4sD$dh450j z#!C~Nq6%22S5+@~_0j_=0L4LRbdVf)29~?&eSFdJFv$D(_it1Lj{sTQr6L2M=rE$C z9KO4)c=m2Ok7kI%o#z(Kp?$%3KIKopj;h+9)nd|TyziM9PAhJ3QQeFYORo=)ejnIK z>ndQ^hs|L9q*g+3=7cM2P{ywPkx8#+E8DEXMl_H5**@3TX{YrT@GGQj2AR1X~{p~mpgd!dFZsgjaBLldk;E3Ib&#T+1 z94=9c+GJ9N@~^0gpMS~UL?wCnt6A4D6#vkQNw_zm;aL%yQj<|H{O|`KbC368T#vc? zMQqYHP$GW7_r8D`Sw2-caX4Yel;e$Uef-XR+ux){xiJBA?YFq#)Z6*4TUkhMEq7`8 z7uFGoD{MBjnPu`Sh(Evl`hNcy{w;57T$l3akMCgY@lZPE+RHc@YqF}I%b^VBj4XQA z;7jYv?fUFiIiNI~9=$%EK8W7Z$d_-SnvVW_gw?m*JmUNXPJSCk!If`l_;;iyYdOzr zJdWfsq9zVuS+WYNG+}DYv2RLJojd0%45+d03dklyID&V_bocDFYMId$Yd_I9G5Aw0 z*N{-NQ@zJp)qE^ANO9}V*+^>`VgjrhmU|z5VB}k$kkyl%SeUa&(qlYb4>XCLn!5+} zybVA7a@X@^em{#$mfRe5WALdb^9!qcx-CnZG!-&F zcj@)jKR@`MKO0hzaW0FG+46K{;)`9U16RFp#OA1Nl&6r#KqSbZ{^Mx*z!}Zkx@1yC zllu7JO~w=lbluxQFn90K9@mwW>6f=So&3=GUG^nN=vl)Q-=D4~vVeYJCI91ZNtW9d z550LjEWGbT3RBVf2N+>ba!F5^x`)O5Y0vG*9Fh^$vUshS_MROc+epsxJx<5dkrfxw z7yjW$$Sl7DF`lHz7q&V^Mwu?ooDk+%KY6@H*nVCfp7G>f2-E$0M55KjPapK>naWul z787s@hI2u*{=F+k=loX4|uCvu)LYFrognJ@_6ly8wz}E9f9t@IC*`HZZbC^qvSG}Rf0CE7k8n~ss% zEX0V@fluu{kC@xB*rKyFq{%@)c3D=c^32hS7+cz0mzb&CW|6LKZ83@u5n99ZjGyQ$ zbqO%92Yt@Zl|(nF^&Te z@mhh(cml%s^l!#QTtx?kf!6}yc1;lr-iK`xPz?TXqat{X4A#D? zND{(B5lh@lz|o7k!@_!p--Au?yT@pI6qCBALgv{({H(MY&Pp%>>wsXP{aJAQ=XV40 zgTfo?#z?F*i1w#Gs>D@=8OQgaR}R2VH<1EX7HNVs3F;m>Qf`j8%-??;tfpMd6pKVzDcRyj$f+DMCM;Uo_yfmt zewIR4zIh?Ns@v$vi27i?KzXHNRR6KC#6Uvv$B@B*UO&dUhdZ}x^Gx5zkMS=KC_4HI z`E1l;cbhWdsd3(^>R{cU9P`~fHV?yRIYy)zg{2pX^hJLg|7fl*+8X(3QD-I7=P~3Q z6q6d{fR&~8cnTzi4Q18@5n7nzpK67XEv<5Fk+H#Wg|%-H!XzI5z&~9oaB@`|VRcrZ zCVEclO0P#`^9cDVt!1i<^tY)cg3s*ar^#jpA^1<%Lf;B};P_+UK2dDSq~380mFS~F zx0mF7i4{G>)o2mx^t#@AX%4@wV- z78nNgxADTxW*g!XV(@N%;LOx9g_&G1L#p6BNI#A~%1Y|evxrDOz{qMk>yioMoZVRt zhx6Uws>L@3%ws@U8EEyklfvfW1* z;fJZcQa;dg+^JwUv_E9l7FZTy+xea zCwTua7-Pw-Z|t2-_Rg{f4x%YiIpfOPe`Ha|XDn+!SDdjBGw?6zGb3;0dzk}An}I+o zV&Y2^JWxCA%2%&XXg$I@@Z;_ela>;*{Hiuv&m32-R7e#sLCDuu@y&jE=EUxQee4iiq_N{CQAA#QU*rJG|&Xpp*l=*2M!wk0|R`b!%Arx89&+{4{zA z<1byHj^B*fOk~QXqoe=)nLoRemD~Uw72$e%RO6jaq3WjCgVx~A7cEndNlgmyrWQSI zGb5;OzvcQa#It4A`EI1r+j0Nb&nD|7DZgbtJ9@%VoJz+zUx{W?$JwSetO~snKCj;P zQ{l3o)yt@7)fo{6XKAGDP7)3T0dNni9a#C$*Wt>QKEz8fo`xSKr15?E6Yz4Qy_3?# z&a>l-{HJ=HZU4>=){PWYsW4MuW@_Goy7zqv+50M9o&AZ(Svb02fxYic_2ulZ2Fy-? zq7^X)C?Bkr|F#^&b$by!H_kJ7@`E1ghT$SN|__KNfiIpMuQ& zt5;|0E?97a(5vg~Js2PXpx8nVl}99mN6$4Lp%*+H+b?+-06gZNxldTw9G_)jW$dg{ z^^p1FGEr*wcfMrieS2T-YawM7QS-U`JnPi5==&_2)u;Lhi;00X_vc17$|~M#vfT0; z4Nl3oz~o|tu`^1EvBODq_Ec%7U65TNj9t3}Q$l^FI3xE3bd-%jZ2wFHsNRMGDvxOh zkChvE>|f&n3nTy(=fH{&k z7w6OM^NLIbTqC--3#ae!R&we*7(D6s}!AO5Anf+7fcrRqxe%yMmvYvdPl5<$I_xENDkj z_1H8t#w3yIlQd(Co4Fr400PV$n7!|EJ&I7xQWy($Vfz+ zP)&AVHCGT*!nKbhI3|I@0H0b}p*bzS@rn8P07d?g1{can3XNYYNKPP`0|CB(^ z*0Ou&KA+y2EIf7`xdzOffKck2D$}~4bI4o_olPu+4d%5fFMIud%+)I6*YFjOzq4f~ z`&vv<=0#|J>NM%-x43mb`nk2|3!yzRD(uKWz;zzFYaGNCbe)RQ<(Bj z<7xVRQ9XV;6CvT2uMvjMA{I`&Q@yDfCdkrqb<%+AFJ`DmSUhAzx~{oyU%2L;U%DCr zt6A;x*P^czJJHW7G>|Q}hCIHVjwjvPC}~d^xF6*d5hOmSQ-fTuLvzsh7&GS9S| zrkxl&^4Wx_QZ? zL%&c(A!qu)t{3O!{&MvgPlT{qz2@q9;kuS})s=F2Y)#px$xo)QW7@fy?lwy|(F^^% zHl&s!)Bs)_Fp-J>wqcXG3K7>u(Ki&%bNoHk3>#J&2EcfXySX`1GY(FjGj{>)!?-sd({tK{>XTkK?1n) zvtaz&*+49i)p#<5#nCm_nG08`l}lG+z_oIC{@~e160PPpVtHlx>`@%g;g#yS-`Eq( zkVQ?O*}92!wgoS}oBLF&Wj~=vr#Y-M;N}Wck;DRZUR;38i}Qcai)8rM=0(Jdc~Ryz zRGKLenn+i3k>OwDYNEcH>$hhb@&{o?`hkJ|FOP43n@d!lqJ%GX#uSR6{oE!m(|9iF zPY<}>2fG3n&b+(HHER6bO}k+-p$k{4w5zTkt*!W6`gK^`lCq7ya%M*Az@!)~ zJjs2~usrq98RnZvDw%+M;ywkj6yRXhISz4;O zsyw-`Q5f`D0G99m8tm9&$)xJYs&jp*64x5b(eJOfDZ5L$(f9807eV%L+3QgAEu-3WeSZBfa-WUpypkL_CNpqJ%6Wv~F30C|2F5c(q&l07a1A9ctO{lJDzl zMZbqnd?0T!Q0!d(R*@OMUP^%&Z6qXgiY^Vfjw>TV>y`{ix4>Sb>;`s*oTV*vzo0zC z4meZx`{gH%_IJ za$x6#YxI5q&VVA38X~lA`2gvbpVx9ET;xy?y3D}=3M{ytLE zGR)Afh(A&A`>cg%#U}v^#^vnTgKrtig z7BqUh5XIsf6|c}!K?f97r4HNaEWDWy`}8Fd)e7dJY)v@odPI z(x=yQs9xkKUcJoW3aAn_h`%*HT$ZDf>Esep)3m8nzcgNUE^OF9EmIg-W0Un0MvM_(c_MrqYa@8jp+=|ZA@AS3Fk7SZcC^YWE5 zuQ?Xgy_RHB=j@r+a%uA~R$dVMr1w##)M0QIkbrLbvxT&nBrta*dHLA+~W9JC? z(VwQg6-1C`Ra?GH9l_tP7m1UwrC47fbEWJYTcmL<11-p%j&c83bagJJdJ~M#& zOE7gP>q8Etdj_sjr*ylZK74+a`jJh3#ycMPgmL0Q3LAH2oQ`_)T537XYCbpxTVc~6 z9W6O^m0lcU)?uWQ-WgVFw`VSK!(1U}I#mSKp6)BgR=pspir}Lsho1F5=RkGsU!iu{ zKBUVA|L!tMU^lV*k1ituDg+c4p(`Fh6bEiltiMTd5BR*c1JwP=Aw==Zjfz)}diBqM z;{6V096|jLrvqO+PVzC})5;Z2{(K^8YOWz_Tk>7(;_fKV`~bK0Yl{%cuB!Oqv#YxO+98Bk=&hdO5-K@{_DRJ=;>51=@66A?dn&5mez6kym-$5*Ryh{bLM9Vz2j^2fc5$epx2IdNlyoGZU~e) zco#uH?Syn(EUVALZzKZWA7>J-^4-@bt2d_KwX>h(G2qHw0k!vzAz6E`Wjz}Zrn|f*=!xW)?y&(CzNPqG##K9c8V@d|Q{ zINl})s@Uy=nhOq+tM%_()Ysl+(o_U00Te0cp`K$Xg5>&fH5WDWMJ^%ci(J#3fa<~H z)Q;v!9pq?v+;Gv>MP>F@j%<*wnmEq#A5S(J@w$|WTV*gyp4;4pbTZvmZYthhje-TU zkMJ$fI*C(6730yT(%ONl6y~A57s(C}$=Py4PWx*)2Z71}#qeJkAb0R94)>d0by$rT zLtb^vUdw5JkyAVIGA9?1ljGgs;_<^x-B%3zpOZ|ItmDgOlw~n1O?ovA%yBnxml*5y zItODHw_3DfuoM?xh#++Q0tHzp!as5-&Cb~PbDOkPcw`~eMDT@$Pr_WNA(_~E0)}O#w|J!0p%U|xndM|%lha(Tb^Kg}lWGUGnT9|S*s|Brp z8HpD=FI|vVuyNrFj2m$ywf1xgM-#Q6G-!RDb~0{8aB5k}7Gm~cQR%=#VuE{7J9Nj! zi)yH7p!{JqvYQbDD0lsWdh{Sbj-KYfj~<%ztFL_^M-LaExCC7h5u(`iw<2vRSaJIw zibEHQ;mc6Z1D8TNq2OvK(3W0w!XKlnoxqlbyfVH-(kJGu7eOie1$O$#@-B=1`wn;X zT{?WOT45eHlnJD@g&#)k%f&*c9NAb5p+8^)Fm=6q_WeTPZ*#g)5OugKbJG#3WaO$U zAl#a=`k~g};c8+WQ~c?EgL1>um3(QS>X+cE%fJp~5noh28+TbX zH&FH3ytTmdun5_D@n$AmJB*^yBl$7$aC<#&eq1# zNjYk1Z(;1$td(e%??HBn$l$cK;H0%Tr7ak*fTWGNnwI`@&2*^0l6KI=dbfH!rD)Eh z*y771DAOS6>vxkL*js7=$sp(GO2uv=T0dkbsr^*YpQ$w3_xIY{>C5m|28x?M5&RTN zztgN@`sb;$bnSz3>8fzD8I;w;TI+O^{K0#9CeP3!$ywbwlk-fb5x5=CZax2l7Wm;q z@}AZ^m0);8pW%7#HMCI>_az4jlN9NiQX^!!t-L)UU49y>oS40= zPiep-ES9i_MQk2z*ec2M{Pi)}pDu#F9;afXhvLUmnGPh#O-{sLTcXq*NN3mJ?h$Jj zZ~MhOIXmS-%n`ybU{6tx`OP@6d8ei&57JFNU|I%XQU*8CQW>v;>`ZpA(qediLF@kI zS>b6OfEG6e`f$%z*j~E90sN12E7;a!71PZxHJ`8V+s*W`?R?O{6v_=B(CAuvZP1r!#+y_LpWOlfBsH#u2}c*@DX>0E&DB0jF&4i<4-vAaEC{kjt|}M95#5hY_?aT z^rOMe9lSG>I9-&*c=KXBrtO7s=1)$fekZLo)SN`I&$rIZ;yc-AR=483L&C_xn-Z%V-Wf{rt<*)ION^qoZADxU!{Fo+*QU`aEr9xac%Zq&o}B{E_xx*axcC3 zdv2E-4%MURAsvNxi86)r{*2gV429i$M|u`pr$zUyOP{G+(1z0O$dGQY|GV26p8s37 z6F@z0&W-|6{PwpZW6BMRJb)s@HU{Vntaf(O{IWG(4LN?)u66`t%0)+@wO{Fop~6q3 zh>u~rSu6|TaYk) z@BFITq~ERn1Vd34qjnlKIDE7@#lR%a=&?Gn$Y*?$0gHCUa+y2w61}C3N~ll8Q?-H* z!)tO?n{rL%N*Ao9Di2dMmTKFQ^jPL}L)f>?R84;YG#H`N_zIz+dX)y#qYE09_*ZFk z?q?IpvGqvxH~G&;!Hn#)g*5H*d!8j>HamT1wYQ$~ea7x!No<+4qT7UjQrd*e1ykzQ zj;a4rgZMmTZvQ#^w?)Us&(>jPw&~_ebfeRoTm|p=OeNbX{Dree*{qX?F($I8gIFR$ zOm2^Stuta?4>WFP-h2@)y@^xyClYREdsO|tdQUqAdqo7lMWzhWfC!VpQi6s;nLT9{ z)&m#LNL7z|-5eQP{8FXPR~0E}E*V7Ynup_v+aT%1Lx4v8Hq>rIg>+lp-`&Q1?FuB# zpBLTsau+J!8VKKOpSxwozu?P*ewA-evz&?HUT%n?gqAXIMC6Z^>E%t;QQW9oiS3pY zApsAl6??+Y$8&dfru>hy&}#*8ZOZGZRbz%(dS2aGCdTV~lQX#9*V)6+;2bkYFQUIk z|D}BkJF&g5K6-t0(NPxN9C-`D(={e1RG##atT<7x-JcS&V515US7@}ZaK10^)2M~eP`*Z^?}CQy%q0z8fJSLYzl5MZi5;T>3za76T}wR5mOiuC2U+9F zv$803S_NM*HAy9ku>~-Pb92v|%Qop3Y+G}(ku)BZRgjcBeXJy}NJ{7DEwEgYNL;tC zQp|hj*})@tI>Mg*0PB^(SP=Qj-{3#7R$4RIg*H+j0Xt;aWGvGIwy^>Z|o61Ipn2CY>7W3%| zx}Q{Rm$G3gK;spd1_pRt!nkQ|0*%)}Xoz2>!E(8;<88c3Bg>`8e>~l%c8!JVK&?b* ze>F<=nQ_8>*mwjEb@kAN$oxY5U-2;;+6SFtcI!*%0+sIhP0!fW!q?~)qUpJN_rDn> zYemQCK9tMF8emtiqO1A3l!*0_xg%5<*`yqUa&p5b+YBESb-3}?DH|O_go?tcfsmB_ z7;2u>ml-EuV1DM*yZb9IYRsAv zma(p@wlR0XG?7<@Vp%Q1V;jtgqT5BPq~Q~^l;5$x>YbW$M?7Jc8GCNb@yjiu;Ea-# zH(lc{9D&H|pT05lpBXocgAd4H$g`69_i_ERSFsdvl4Hb6wKQZ{KwU~o@q(MQGS5&HcVlA17V7J{QaJr`(xIJB8Bb zLvo;%mO4W8W2d*OTJ(g(JDO`NuwJFMmUg!9D5phM;o9(sFic(2MiTz$X2sWG+F)Be z+RY3gW@d`0<9gx#w2Xsix8$jBn$nMvln5CCRqTo1Q!PfT69G96Md_Yga3acg_WW0+ zf09H9c_7LJ8wqY@g6^)+acJ2U2RV`D`TO1?m|voBaYH9L$3VKp+Xwy;TWrlIp2g(Ra@k^E z^KvHoiN1B@Us96kYkKbuRjt0AcI4PGv1-%3i74X!CP!Sobz=2#`gL?CGCudqt^2N0 zX)%%#O()A=8E5LW6EY}pw`a2X!*;))3`#8UeRG(IU<9Fpc!}+vJ~C+|o*m(``^3va zBI06nPe;1$0io&$uQ_GiZyNYKfJ(yw)b2yS>6${I``Ci6b>Aq^FMy)^ZwwFvm@&gm za~#olBZM=}RnBZdm+#Q$T;=Sfq8n9$QhA3PCc_{qtVa}1^QR4UdBm%rfiS%DdCy&i z+as_R1-uh9Fw{KKJhV>7Zb<8quQBuZBHogCK1|fEe-P-#_NUS<5%aESywQQv+N#%F zOc%nW6EhiZ=Yo@6Y@t>1c}7`|B~86zpGtpA+?<^CeOjW1NLkl2IPr0*dI?$>%nsU_ zsC{;pW7BaYtYbyy00UM{$swK!ZYrnsvd6usda@`<$FEov_?D<%V+$N<+zuZ<3hH{6 z6TzH~5T__C5WaED-ijX)=hT{_tF{m+!pCs*J6(0&#TdWvRo5FlbI7ju2M6A4xHmnka0l1Iu7jC7vm7~^XfRXP4AXHs(T_lJL>=9 zLy{#-|A^-^>iI9+JF>ib509MJ{9pe3(>JogLx1W=b zb$fz0T0vxx2*TDKnDQlQfoi`yVk=R0-+AprUD|aG>vug!1=lkDSKbn#;agoCvu- z>n|fQ!vBpO+;#kpoHWaF*_cW-rqyVPl!ji%UBiD^}=h92gEW z9qB|=Zc|R}-lN<_+rDRx8FjmHKL}O1tTgUkISv=&hfubrKQLO1aQjs>OvS%uU%>0u zNpqU_Nk^3RW=l#FkE-IdJR!w90%-DpX|jV!vfo6LYPKf^C+@&hYr zx?dc+eUor3Nnp~ zRz%dpU&hzoi9^upfBxI#Zs}PMMLc#lnS#b|eb5_#9xs?40hk=YP4tk)TOst=uhQdE zyr75fdX?Ver~(mf4t@#pqEfG{fMad6!k6*7^;M@$d_QQZ%63j1mvY}Wf5EWpc^jV* zvr9f?%asz#z>$uv6aizzB|D`%XR`dK;JC`llOSAI*jx{EW@Xl1Yb7y9((8=1pe*6& zhi!DWt5qB#Owz(#M$bOairw7td|meShB?AsU#r+g3H;h9gIS^HG!iEVO5AV7;u&PB zgtYnE1D8LJ@4o!>E2;AhS6-g1<`TN4GQ{~a#oqLpxVXOF||%vcREyl2mY zz*u?Y+SM%wadw?`m#JbL9ATgGxH zgy-C2CDx7Zo5hj|53`<-@35@XeakrWrzrxglqUJVj@BfUoB@X5{J%HjQIC+;Bkr{E>Pf)}JD1_>*-0=&Qvo#OQKKV{^>A z9B;P-GzHDaMbmvZAm_yS&!N7H*#@CUcas;&zoA>%+Rj!$zbm%%2&m&PvJo=}gM!#{M3*-!6;NF!wD zg&PGY)_uTD6}(^FdGI4jk5Sd<{hK||>2z#5%TZd3s*rJnk+)OscjQkZ3g|vuJo0>} zfg)<7ujO_8Yuy%{#QUG|3}2cLa9MT|oe? zg>$Iu4c1Lp?*r=%&+@hPX8dBki3edqd+pf{;m>o8|MCU@*vn4i*04~+IUVqQ#{W9kh+*?EJZwwPlkD8xtEv^;(kO98NLn<1wET2`!DigHOC)*eLIP)jN@pcC6?EDt2 zDxwO(6R`$Z+rklyO?SfYuBzjk4T%#X{~oSS68XxL!W?OEtjOp-7o)zapkGIzCvH7R%)?F^&O zMYwD~s{vFJ!Bn8E3y|L|G{$_D3ZLf%75Ln%RN!Z}a@%qVkqqj0lUhORTI54*XYtK7 zg$Pex{>kpk<4W9lCrU!;JH|pW{0Y%t&&v5z;w{yHjpFA$%l9h0|A-!Z{VEz=xINpQ zfufjTx?ju|BS!h~*NCa?F~;u$ibPSrs3Zwd>{s$LoQ`w@bI-y!Ujo_z0zhl_Wgq_8XUVQ+(Vs{G?b*z!8x>y&lUYkX;K>-UgYiMC(Id8N}4TCf-? z=pfuTwO(19R1({bP`({c+PBT(7n)g2UC5*3_veo8#M~to0Hq}8lpw#$Xzbe0ujRj7 zJ!4I;QhG4Ol{%oj{e&VIa~50f=-a~)3TMBi1%z5k7i?>3g-WIu4Y^MQEcfZ*zqJ1` zlKcioV_{_Xx`1{q{nnbLw;nZa#e;7vWvQQP4E4)wO;t4oAEvbn;pwxyPfcdgL{nVE zcp=waP?tWu*5%-!IFLTnX3S+ZktdBA!c?92L~#D8NJJvdC|a>8h|II-!&rv&-^Ok<2!DG6Mzo^h9-kDe9;DE+W67I4EC{Wu(QwrvwC zKE7kV4Hd(ag@&kJTx;s$;Za;f=LS*Ujp45q~U|IZ`wBC{rZ|;#ci1atx3*uhP zGAx+;eTSb~UXB(-`c0kxH9MK>7-^PI5-j&80rOZ&`y{(F;~9H(`&$y@MvHa)pRVzfh!mOO^f3ux-P43{S< zsFkG%k-u{98@>Iw%FA&tD|Z9V8Ov#x%>}{NEq-^jq$C=Loe`iQ01vh6a3Eb*@psn= zUB6Cq0w4h>YTUwv_FgXJ_v4IdT;(csd7Y-g&#PQMS zC4Tq&4M{mBb$Fc&_Cre^1=>B9w;VF@Yy&MA+;dqZah738j_UZYZ6e=ORIzvoX;^3G z1=Y`>GOw9_N9k1P72G5jHK`ESd(Qo)Gfm>3@jW*tqWm0qJjziZL)dsa@wG-R$e=0ar1ShZ6LKKIQ0fN@y1Q5 zr^ovtspYSx7QVcm#nJLIwGfax$fS&lrhQsyXmt$EA90;OB;5RWdZ^S&VA1H2GSgUv zx%=2UYkr9oqJFV^zQXo2HazaPJ+?uM-d|P%n|ecmFJ0Qa4P9;2>c5XLKSN7o#Wp(h zXVLod2rb*NvaW%|Jzl~TgzmM=*EQ&AkjCwBw~o;=V33GO8ew^!(v!-ra{E>qTNndH z>>_iD%icSEuR66ReWTk|OfKJ;<_k3L!u~KrAz&3;!*=*WGX%M&^A^-D!oBG;gg_Sw zH(%?b$%`&(LWjx|@|!Kj<1UaZ!~hS01(9ve)sak#5YzXUW(hmYMn{&ty5ahEinqzbrB1balb+uf3Q@_3A6$ zY>eezT3D=r6_Dm2UtKnlMSq5I7Ccz^;7fzu>a#J0j3T>x@U;;guE@$6c~0bZjX`Wn z+BJd^6}VZJ*;c81nW;?y6eM^|&fGQRWw!kTp`Ko!UkQ*r=g2l#B@Yjb@rLk3hdMVw ze%ryA)YbGNP8aEw{ja8fJX`R~gDX)pNdTdV_#P*+^A<5J6iLW~|2Q>2UMu_n3%g&!qt%$9_vs*RQ#XX~>^=;$wrxn15Kd zUA8jvw!%H6oxFH7=T};ynJ@OKsEqAQWqBMJ(bG4{M@Mb3rXu@Vvu_-||Lv{oKr>%$ zdcSQF#F1tTlA4I(sN*`3bFZ_%I`ElQcp8e_F#h@yJz#1Mf!!I z()i7_DiC&E7UkLbyOcMFU{yWXaQnvzSl>m3${=$_NCL`&AXt?xB8mMXYZ}%)(Mu(O-X4j+KrUL9~DhaVAZ|w zRReb|fK;GW3qxkg)Wp!L39bkZdGiFdFeLmEJ_mboG{mdTnY&+=RH6QQ)5n3z_Kvh@ zoA5Xoq41>DQK{Uy=+08=M-yBE`>U;X3reg;_hzRh4o~r0w`j@MTuVbpRN9B1S?~lA zqGpKZF&W*g@VYx;oaR~VfNgpnu`!=?I<|6=Gn6v5OVTfVswF3JLACZ7YTuW@!fy>Md5>M{o(?+ih6I(>A?x(p57=@Wa6fdoStYx6Ikz# z5%=lv7x=K*_{`tTrEl0EW2_u;i)v4T)ehpq^^XYF>1wclBC#<169mR-0=WK7!Y)@YMqMB7iiZ)rvy)SKfAosC@{Y;So0HZX)!vjWS*B=QjtxDj}Lz z*$o`nzoEf}5f)xqoItraoUY>T6}Qb$?In5JFGYzfN`AI|7SAXgxTXkKYLrQh$ ztDhLUw-oCVSq6ke5@}5JUt1YGn$a9QzreG65`ow(=QDl~s>YX-|rg;&xKL!WA5e=mJj9h}DJ;UIz)Fz;(HSP?GqUT>4d?O6u!) zIl8ynS20bU!=Qmauf%P0J15pR0anH5LvHl}w0yR)QNh})zxB^5 zD0_AH$itWAuB?2B4ft4UgpVj9L@-RiE*KEN9dCflYmgkY3*xMQT{y#scEKc1J7u%2 zfV$wsL7(H;;EZ9yR!NWHihuh;|J)e8qKC#wj*LFtfuq0DE}v9D+cbK$>cdbcgD?*n z%ZU7H2g#`UMPH|C&cxT+6f*R(=b_Vel-{)I38Al$^j=Ub7uR!;j4Fvt-l@fr_(|BP zf<%PabkzddLU(_|`6c`QkF|jB3f@X%_}@r$o8H{`&|m4vo$wOnq0?sTZZekPii-m; z7eBreShXR1)j%#c=-NFE;*dR8ZGzCMl}it#?iU`-9%b(eA0#)4Srv3WOKi{YLY5SM zLndW>ce&lo^jSAbQBkl~j@3xv@fI^4*_ipx|ymq2`$F*zpQ_*6Rx zRVhEJ-Kz8Vr4pY1ulXazCgo@+MGTN1c6jpEjU9{cc6-1XYXZ2V1Tip5y#4PeA#wd3 zcJc2hVMzklM<6v9Bm?cE1mqp|2MFS$5cr)&a=hhRvyT)S$iPSVZYrO00sHucek4MV zU&mvf@?P0;HEO#U6_St3ddY}c%0zAq5itVnUwUt#WBzWnOJ0@V_@1vlllS61(yiTL zS~QIwUXc6idWjhOesL!o4h=) zMO5HSR!>aAc2gj#%WXaUkX1lVxr;O!xc#Jra_iYl&X1z_y-xK9#BGRUJ06#z%Y5TO zo!cy}p!*S#nayugKY>+S|4|L+Bo&aPJ9911L9!WgZm%0!b>X_gsz^a6OEJ^jh2Byr zW}bgCUh>@jF_H=4RE~_<{LE*Zwv5G$PjA*p?JvWv1Rj$2BCZ-Q;2FibKFdwY`dXPJ ziks^>JNuBpG@#6np03m#LHWg}_+Iotf*M9u3y%Z!_>&Ze7CsTl_qOa~D43mQH*_O3 zhDkRVPs+3TcVZTVU#u#Wxjnh?V6h%N5U5m9dqRc6hd-{p`L2rQ+aWdP=v(<8&v206 zV>bFf=Wpk*quio>^sKlp$%u{R#`(cdL0z9S?FcKfrUvB1pmMjvoeX*$LlQiL&kRe= z54M~QaEz;kcS1ftkJHYnI%;W??DZe_>`W{!B^M(4WOfpL{OfTUrS8R0rj=u;n;e0` z5e2cdKGv)NZGWd zewqE5uA|fKoU4NlKXnyLq<RXQ7WH(J34$K>rJ_{vUJP~q(p72f0+@ZYzoR&Bhlrvf5*5@hAxZBSa zu5Q!4Wxz=L<+Ra%G*+=t%@SSOarjh=h9H{b726t`$?JS4bn&bmra;uP_6oF;0KZu# z;_l=MhCq>w=sE(9Zh27>;Jfl;61b}z%dloF(kXvku{DBrs zi!}F?ZWxGI>*bk)vg&3c>z7A*IG?Po&SvU zm%9zC#2oKU6b#zzMOT(xqK-HWde_UShEB}C+z6m*Ara7V$WHaA&ec6LuX-=~6_*7e zB6Bi-Dchlri{B#`DRDr7?%cYoRVr1p{F9QVN^j4B5Vm`n#PZ}#149a@2+M_zK7y&0AiyDv=FO+ctM49PFv$=2u!pi{Xdghz3ozp%LlXY)-C3)QeJC_h{Z3 z!nsMgx`$^pwRt4nC*u)O*0vVp(YUK*w=}C*?T(YwC2&wpiCFgaTexJzE8*o_%nA(U zkb8z1JWi&>ST?w$xHo^=<0m`n#a*b`4_706N#ZtA$MeEWy*y-Qiw)1cOMle4ZNs^c z@jhF$2se!*Crk1}zi;^O!1m*t-raM3p{OF9? z6UQD9nMBsBHrD^riOq^b4I9DuGLy9Sw$#zk8o2sqN#M>JNML18foBbJ*H1<-fuFyV zKZy1nsPImkSND`OvxyN5M?Mh?AYD z2myc40$}NKnFX?1K_%C8LCzYxbwlgY=h-)QE&SLa;gj!D=CFmNj%CN@vq$GeEyrVd1?#Kd z#*lVUz%0k%mg2i96+r3FQPmi3`90CV!|IpIEe&64k;)b+9`Rw zzfK+PLpzmxY${e=U{pg&Hc4mA9Ls+Y#?Mri;JO)DQiO*+fn$`&I*Qdq6dq{d;PnZ8 zPc${zPUmi9t`O<{Rcmjvdr~iHF|>KXtX{&`c^g*x6QEQ3n$EGmI!k)tRs@ia3aYrK zQya1aFdACt_8zZL&;h50-|>9li*v;za%y!IyN+9ZL#&D!UOEqyyF9Q1shDkKpd>^O?-LNYGsNuQU@w4 z=ZD6cedT&K;D4_hhU+pV;Bv)(T~m-hYUyG2wsRFmMlEy-kWa74x=gznEQ^(bI#P(fZ=4QI>a|Tn=)X6 ze`3OPNIK-8c!9zgpG}w}Z7rgvML=BdS6^%1ro(BcW4m-TxbMPq^npqAutp@N)hIb_ zVBE`G()z9oO)Jy!E(3!^*%Z!PZorMrsPoa6GE|7fi?PGS-JgOiX$MkM?#Kg zwap^S`zBd~ho8DU)f`Ke4SXG?K8AkNM7zS7u$Tx>mwK5xETZpamZ9!b<1$|NTXC45 zyMwLI#I&%k4`CM9|DE+K6^B!GY{Il0i7$PI+UuP!jw~D6+v}3L0}+;XTjl3ZXTfg1|Klc{xj&HP3Sx(LQxUQ@%NPQ2lLP#0^}CQZ&K{143l5c}caN5{ z+T7HANhDlIYG;+TuBF>YuE?Rt^@^>0$c+p1OOA26>R$Nimz`vi%Lk@{fiFAB-iFE; zd}+lD_9YxmG|^_Y+YWA$DV#<*+SiY%CD*ImZ*_cn>^mRkWj)|!KGw!hBX~F7GcBn& zTgdi`y#MjGsnHv5HUzgxidZxu_LftOB2pZ)%f-&SOpW}tL-vPq&Wv%298xynxDh*S z#K>UvzenI!Clyeg<^QctMJDJw=?o|SRwuk)>RnMF|X8Uh{)2Zyk{OtXZe#hAl$|>sjz%04~bO&_6FmNyG0eU zD$@km(ypfJ80;s(A_xKAxB_JHf|9T468@{} z#uI2=oX5hQb@Ds8%k-c+KXd9&oD7qr{hrC)IXe2#HiE-PJ$*%<5WZEye0R z$D`stA-BpFar5<0H%kho4^I+1M!>8d2Eo-y3+OC{p)=@TItfGIwjYqg3o5v#6Owa4 zXARLw4c19$$Y@_l%T3szAIo0CwH!Vogts-IDc5G?DS@i8ckV>~OKLSPdRtbl#ek4} z`ob=v-n;|Mf(SkfAiEdz>KY5kzS*$b&@86tly$y5L3XJQX1~JvzWqV`Qn#w=n17-q7y27yr#^mt(QI^2cE^e<=e+LI4(edghSQM+ zZfM&mjhtwUYKhKot}ux!5~8d5W0H8ivPpBC3xS!Ry(=TdkTJ3;94Ob~1 zYQdeGTd4LLjy$gVH+dyAomXv_{CTs_Cmo}u{eOI)V)c|57rU^lemieLaMSBb;>mK1 z4SL+;I(oZBOXBv=D%gZ}=;@^0CpMa_iMMuH7qzAR<5zCQg0XX<*}gU7q;O9b|E4R0p4uy1lBvP@-!q1 z;T+lpB5AFx>em@gen}w*J3LMIIEXz}?g$e|#HY2scQ7j?)aJ;&b$c$TtYGLQ5B%>L zVQ_1V0jRNp|JIl?-M?zA0zM)mfcOdq;xzPl`ai^W_=rpZV*Y;-RZ#xLQ7;m%=RaYM zrz$9r{ixLt&uPHDVNnTZ5n}0+^bu_$_2x4QhPV%6{RJ!AzR#XS8lsad)&5>u2t5mK zHK28Wt_S}2r;%{=Favt>VCcDa6PH;pn86wNW;G8qczRA@jiV}@fAxHv_^aoT0E~(~ z$2S}k(bE303T=AofU~Mf?J!2fw?n&6H=WX*e&4Rkp1>ne>4$Hp`$Pr!--Z7CI~+at z0X?}e^jy0++2%c%0T_|e6AfOE4kQbMvaabd{;TJKKD3@2B1p}=(w|u$9qci57#j`= zN1YKl_w*vC#qn3g3r4=+c32{E^j2W69alRnlpt^&h$M{%v$*?*1)Saz$ovJpxW*z8 zvf5M*VL=FHK~2K4a0mMlr+Q{12O*tZ{^t4a6ZeWQ4{fl|s+zH{PIQv;2-fr7pJA@5 z%Z7xJ=2H{WzvkGCQ1tp{O$=ru;tAJf7Qp2k7%nIN%Vll&h^zo&HVni87>I;m#5Etd z?e+`S`?Sgc4LiO{-KA#dbj zFQIkGn%uL^amn847i6jLmQ5wwNS1lT;JiuY5g_(q(Pq+s#bf@`>j)}BJA2HQM^bM45cG|~{^nlC3a9w5xT+W2y^0isB&4<4( z+rmfW01#ioKzsrV@z)-=@<6bX##wac={i>rqdV;kD? zaW&T4CpIC>v3wWFcZnF4I;dHyn=PJyecG(?H(kD`t$}^mjKPfNwIH@1wo$Wwyp68TZwUq zMsD&NbDBDuQB@-eCoDG|?=d5-H}KZtCumn=;)@g^Z|;?Lq}DdP9R{;$qk*fB3(%Ji zL*F6{eK){}cNpNc+Z+O{G(OeEzxq&Yp!H>^SfHolQ4WpZN9(HiBEJURY)_&cdR%KX z-rFB$JfdLz-sa8y8tmxP)bqi)UG>|l4@YajEGYl5`1f1f9FU+43Wa8&21!wJ>4s); zLU^0{mXJ@)E^Y@h?(S^RbFC1PPv*C_v;vXTBF8S(<|KwlN0TbExft+dihsx$d#p@1 zJoMrS@aQ2@vE7&C9MGS-1!kqm0M~79!0ojEx~+CCEy}U%uiL)x5qSW_R2Yc*|3dU+ zgjb()Kvpv-=9+Vm6rEd-p`DY==4+6kdi2JNQI2&p-j|yvNb^2Hpj~KJ&L`JlPR{cEFD_Sh=c5!8D7@lt?faR6*?2L+ttKF08I*L54dmPQGe}Y z0cPP1p9M0kF+>fLo-ObVnuYGfd2g}6zCP>n5P_X~B7N!2wh^lAmsq8E7gs5o{5;y; zow<_U!eIoRoOb8U0VA(^svCi}hR*`Xkp(4OV*$zK;mi8}EF4R}(dK%SwYdaliYbk3 zA)~ajXsjM_s&YzmR9p&- zic9%d#Vx=`bj& zWcY#tp<7cOGVhm_fV3tGxHZw$^(SxkD$IyWR`GaWJ3r1q4 zg6_bb>ED=U4EPtr6Gj6{sg`Obcyzi$+s19CM%me<%o zPHkG5K(nFk#Xq6>!fB*mFF9swk1iI;Qys~-(D>A~V0t*on{mcFSu$Nyj;4C2X+x7< zdIQOhsEs1G+E7Dy7C+}KaWMy>tfgq9oAMF|r2zNhw#iK&Y4S`NU#8gz0s{vyTcST~ z2mde~gvGXX4g*%UfCl7tiLPG|wl~2~SiejQ-Ih{dY-#oVK{@O^$899E7QJ={`Rut0 zWMv(3L0hx6krXnc{x2HrFMf4YbV**$TZ*>sAa5ZMsa6=Ln)OsPl7=Q&SA0qUF$$H| z?HPTkI-oh+Cgw=AVD-I|P9d9b|!e=`Lv*2cjTk#KpijRj;@yGwFczO7U zLI7gie-Sm*|AnXzA5j=UjD>+X2fh9TAl?KcTEIsX0T7@67f}=MUx>GO5#j7_odfdr zKxELZsR`K+;obt>ns!zU{6v;^eVEo1uTs`NG33Yctc>E zY|5eu-Rc499NSauv(wW3VX1{j3k)O^Db=$PME$y-mZIzKPCKfX$Z(jKJ~@-gl^XVm z#p|g)vd4ds99>t4ygOz@RS=t#z1Lu6`K!VfJ&pi3$}@OO8x*=Kda2 z>l#Y^P%5JW#az7mh%4>s#Q871+0UeO7H<$&rj=h{hNu*kWSQ!&-clpJUt`Gq9RGb_ z^OQ^!=u!8FN)LzFOWD#7@wJtxo1A(m7Hj0Tqla!uSx3+AMVo@KIyi=w$S5)_gITR6 zlD-mN9$frH9T#i-!LYY&;Z(q7fpisk#H5GxoF2#2Zqs!w--UTokb_@7>CysSt&OWG zz&eP(#}Vv`IUih~#Q>k9|Le1s_aC1R|DVs5e|_%aM}+f*cn(O016{k#UJG)PqeLCr z=gl!j0irkq+B<{uzhn;($qi|q8%5kmLW?33;`dczPG(Hysn|G~Z(`U@DUka>lWneo zE0e72db{6|e!N{~=Ix!Jw!o!jV|59VmcfIezF~e(kATNpYRG;i-o)qOXN&vIzB699 zNB%qRL3r`WdlQaJm6jweLY{Z;j`j#8*zzx>nEWbe$O%a>aZ#xMB$!f{{OFP()x~L& z{$z=|>GDRrU_s$ag;CLu&cndmvipzve`hYu0l8~4gV5@=A>S!(LvmS8QNilDf1+#2 zetO61a=5PQX|A{CCYB%}@Y#O1nKiok?1y_=j(b_Dx@JpD_}77_5e3oV$|^rbyh$Yb z)8oD9Vn>igeikRmTqZr9)-X^X=Ij_0I=%OUN+-&E9{&dte$lH0Upm!q8;zze`Vt(P zv0kQirDh}RS3~|+9UV(&-w@p}=OSmZSVR!+nZBtfKFJt5gR$I#7ONwqJRT6ps6^of|~$Y`5Ye13vY znicuw&V&~PQxB!8PgAP~vOz)F6>`pqe84QC2flkiiqOmew0k;`zOD=r+C5UbcWY0o zx{RHf>{ZLhqBi%%JJ^176g{yYV&r8TGnDUHm0gy)dQr6&J^cN%*`wq5rMEfqA11=+ zLVpIT$LpNdyew}M*GhM%G8gFm6+146Q2%UHe`UoJm;ET7e)A=N%*3AQ>#>@Ov$xgq zd!^_HLM{n8)_dCoTBW1sJ#%F5nFXaR-QEiic%PeC6|E=U8k>)ZzLl*7nwcNN0#@qbU{xKC=H(V{yIzxqV!s{PFXL!i+A_^NUKW!a4|x zA%RXizr@~+Rrzw43kIj&E#0NpN#F-E>qM^p!PN|@tDU5GWsZm?B(Su+g}xXDiq*eq-~PG% zt5R^zNuKr=?YR1!tP;c26TJsXYH}YQezrbv<1Bol#TS3RuD^dsxU7UCSN+SnOV}wI zlc9^`Ft}5D?1=h3sx7;W`irg{883rN9dDDu+g>Ski8YQwjN*dpy~-N&MQXRq?qD%F zwHaAVJRbnInKT2h@Y4HO4tZt48YErnK2D z&PVxPt;~Ho^;P$myN{~E9F+(e{gOe-Gq&4dP3Xk@432JTQrO^sPkI1%R1pV8m8k!Y zDtgzxKm2c0ITeIErv=U=gMzNTote7E0&-SU(g&J_ zHr0-9U%XjXW^)SDG8X-Q%^o#XF%svq&^FUIm}ezHh8Zk8zb$GMW^`~So4>0y(_UmA zY_j-#Z9SaMUHF>mR=}xEDd;7mcPuQhJ$LgqM>|8!;SLn{#Nj zY{}6TH+#!-l5S`3C-2$)0c8;-D#K|8~aL8wW|AOMtir_ zPf0cO)drKRpO{Yb;iS1!Dy+UJ*X@%!<}1HR0I)DV$~dQHehBR+HV8MPJXjdh~Ma7zsE1Q!a}DxH>!n5*-r~o z8z(fJYIN;m_-QdFqA=u{wl9|Pr;_t;ZB}A%iy-%Rl;ehBZ2Q5r~mN82{WP~QWk@7ZGEoR!WZ=4swZ8nc*M>D#g)V3xq9qorccvGyN z{Ue(Z4ew^$ulk-B&%GDkw{VkVbm==q%BQLMb=(-r3nniPVm$ZDQgqW{{P|M*cfYX9 zmi}bMH~w5&6k2im0tPU<6RiyXx(=kejGNIK%P7bMhpXCpsohZw58MDnjBXn3eb+R{y?PY7W?$4-&e@3X(#7 zYXzDWUJJ7)xpavq=2{2cI)hpqC5ND>KkF@&*&kM#Zc0?+Ot{V?@70kAH|*%7w%0xv zO;~Z8lfFLAY_a;f&C6PKXKO5*9;=hTo)=YS=|QNVf z{Q8;CdzPw7<49CPnZ$!wI{3^%m|DaC<=E}1x^8gf}!;p@&479tO~8q`XO`7yYtBy8UrHR z3;#`S%=FZdNAy~rn(4lQ;+dx%3%t5#1mi*yr&}-S!T;V2Uyl@^CmejSNG^hSx6`vKkDn!%2=UN`~0}mHVU&^p8y-J5(m-2;{kJWQ<*&6x4cNWk;8ezY=bLpY)|7W?X=~jR)+5o<=!FH613YIaCON7 zxI^2X?B1o?c`3zjr}#Xm)!Ilw#O74;8-7O``pz4h9{*)M(`^ zlzc`S`O7-=O&SMXeFcdC>XN90-i_=)6kbHKli*um7WRKwz!?vK-R&R;Xcmtk-<+mo zpjo^%+fdk)!gCS8e1m@4xJlX3k5_SHkW}n82paNxmi1O88M_%w;%W7HaTW0Q=@auGd&V-UST%p;>gjTPCX)x0!dM z&mrBS3`HNoM#MfIS>>lmHe%3t%OdhJhR&GajY>W(XV1##;2(UQUmXm=EYw-x)+4a1 z9b|ir1>|gmC1g+Y#VMG@=g9lfQY7=N$0=;dek~(+$=(&d$uXo|w3ZUlxBL-W{%%d| zD4a}4XH`zZxKe!lHa=1AZI-<@sW;B?i(obyf7rnJW=01q?ZpJL+Vyl0noUW6V_2f8 z5tWY5#q+*L zZaIG|a|}MB5`Y*019ALch~MBNDg%iA|3x&xgMoMoM%;prr~)AR!9cwJJm&sIoMT0Y zH;1H$H6EHko<|Wm=vK!Qmf=e%iOo~UGcp`HufCnamLhB@s2t>*6NPeTWcWedkR_Vu zE5jVaB%?{dp+Emlj)VaG{*zvSH3#hBp8j&}-!uOHyFw@A-_O8(%tXG%lh|?vqe^Ra zWt%&0m%xWVa{jTPjVl(D#vVTM_z6e zA(qC6gha}C<0kMw?(x_Y3)7SkdAxFXUnfTpUoLf7@N=+gjuV6 zoq8s`jPix-0xv<0e3_EO!s^RHyUN(_@%MVJaf zolV*GKhg>-#!@Uk^e|)CJty8MTKgUsUgnqAizJ)x_3G(PF3w%nt2tWkfyCV4pPyFx ztu*>?o9(t{_1rFJ^-fC?OFZ(x;6t!(TPZgvC><_1BX~b+FeX|gc%xuR2)TkUR`HjQ z)I446iu;Zfh2%ooV0zzalviBg)6Mb_;^Jx1=QZB0#7W(caPTYSzEjIAgz1{LdtJFB zCBJD1c#it1J&G|3F~~H9+RB~4G1ug!@{P&XG!&aUD-nlq?On-TDhFEpnG;10?pP4G zQWpMH3Y^s&U~m4+ICQ0$LH0wU)IwJZMrEXClUI#|R{A4-VtcpOkzCz6z0p0~HN*7} zilqXUe&-7A50oa_W#wG7aAySEt*?AiL$8^S`Q_PFI4i$Bmr2OSHj1e3h@w`}iNuH% zGnBBn-A=Pbf4cP?t&c{5omMHFEcNSUUj%Q4;W;W)KeYG8=(C+jkU@@lg+bCft zrLR$+rxqy-pNLY5#h@WsvpN@zi(x8@ns%Xm@EokXXs(ED$$J|Yw4DfMvGj*U>K_KF zuvkRSF~iF5HHWlOVKaoqIhcjmaU1pY5$Q`TwO=9@)9a^7XAO2jvb3dUYAJ=T#vWse zSexddc>q3&I8fnc=K3)d=XINc zSuV4}ohjdkb)Ts@WYv_M4w|K^@rWx|{3ZS6%dg>dZHq4UtHIePgGSQ#-jhyQEX&zX zvJvzm{{(fk9sW#g;uUY=z=_&!^W4Lr&`mok_oZ4hOW0n~5x8xNFqv-zW=F;bw})2+ zdU#(LJ$%N$dUz4|h-v_$&wmlko)fE ziDwq_K;2U@NWA+71&9gsHv$QhTQIkkX9p+(#B!>#8mah|?EGSvY!U-MXUKj?n^!SPUBc!Zv6Emm{EXM+AFA(&k=e7)L$-ls718pEhWKyM*CIzsUuv|?C# z)8~Lw8=wc*^g_h=h%g^s}8cP`r{P>;r zYS$FyQD{D`AcoSuGu;L$nAIsa+%W_=6#=q_W@QOES@u~2n$`R7N~v}qf@#PzENHR4 zitx$xXC9T_e(z)zquFOFWSPll{;k>UrR||07bueG@Y6y%3n40)MG_BOw{-!x-Tv#g zrNA|}^ZvR${16?X>JM5KEM0kXz}XBC>or{hkX2xRh^}8?UF7YkpA;CBmI#~nQU%)S zy45FnB7C-rvoSG|`cBoN5#pvd!b6+JU5~9ciH~%#6_J@kGwfNOz_pl&R4?&y?Wy^YZE(R*C)cMCRn@3(uCP(lx7& z#*`2Jj0p*TE6Co)Ij;D+V}gF83h`w2!8y;fxS($sxMYE8q|?YUeSHsz-&C2*QX+cE i7042UWTL^YBnZK+5o1oR@d%(bbAGE*Z%`zjW^Z+ literal 0 Hc-jL100001 diff --git a/tests/issue-5466-alert-then-pass-02/suricata.yaml b/tests/issue-5466-alert-then-pass-02/suricata.yaml new file mode 100644 index 000000000..bf8a47e9b --- /dev/null +++ b/tests/issue-5466-alert-then-pass-02/suricata.yaml @@ -0,0 +1,21 @@ +%YAML 1.1 +--- + +action-order: + - pass + - drop + - reject + - alert + +outputs: + - eve-log: + enabled: yes + filetype: regular + types: + - alert + - drop: + flows: all + alerts: yes + - files + - http + - flow diff --git a/tests/issue-5466-alert-then-pass-02/test.rules b/tests/issue-5466-alert-then-pass-02/test.rules new file mode 100644 index 000000000..53c347063 --- /dev/null +++ b/tests/issue-5466-alert-then-pass-02/test.rules @@ -0,0 +1,3 @@ +pass ssh any any -> any any (msg:"pass rule with alert"; ssh.proto; content:"2"; alert; flow:established, to_server; sid:10201;) +pass tcp any any -> any any (msg:"allow session establishment"; alert; flow:not_established; sid:10202;) +drop ip any any -> any any (msg:"drop all packets"; sid:10211;) diff --git a/tests/issue-5466-alert-then-pass-02/test.yaml b/tests/issue-5466-alert-then-pass-02/test.yaml new file mode 100644 index 000000000..9f63dba06 --- /dev/null +++ b/tests/issue-5466-alert-then-pass-02/test.yaml @@ -0,0 +1,36 @@ +requires: + min-version: 8 + +args: + - --simulate-ips + - -k none + +checks: + - filter: + count: 0 + match: + event_type: alert + alert.signature_id: 10211 + - filter: + count: 3 + match: + event_type: alert + alert.signature_id: 10202 + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 10201 + - filter: + count: 0 + match: + event_type: drop + - filter: + count: 1 + match: + event_type: flow + - filter: + count: 1 + match: + event_type: flow + flow.action: pass diff --git a/tests/issue-5466-alert-then-pass-03-drop-pass/suricata.yaml b/tests/issue-5466-alert-then-pass-03-drop-pass/suricata.yaml new file mode 100644 index 000000000..4d96ebf7c --- /dev/null +++ b/tests/issue-5466-alert-then-pass-03-drop-pass/suricata.yaml @@ -0,0 +1,21 @@ +%YAML 1.1 +--- + +action-order: + - drop + - reject + - alert + - pass + +outputs: + - eve-log: + enabled: yes + filetype: regular + types: + - alert + - drop: + flows: all + alerts: yes + - files + - http + - flow diff --git a/tests/issue-5466-alert-then-pass-03-drop-pass/test.rules b/tests/issue-5466-alert-then-pass-03-drop-pass/test.rules new file mode 100644 index 000000000..f697f217d --- /dev/null +++ b/tests/issue-5466-alert-then-pass-03-drop-pass/test.rules @@ -0,0 +1,2 @@ +pass tcp any any -> any 22 (alert; sid:2; gid:10000003; msg:"PASS SSH";) +drop tcp any any -> any any (noalert; sid:1; rev:1; msg:"DROP all TCP";) diff --git a/tests/issue-5466-alert-then-pass-03-drop-pass/test.yaml b/tests/issue-5466-alert-then-pass-03-drop-pass/test.yaml new file mode 100644 index 000000000..3187671c6 --- /dev/null +++ b/tests/issue-5466-alert-then-pass-03-drop-pass/test.yaml @@ -0,0 +1,35 @@ +requires: + min-version: 8 + +args: + - --simulate-ips + - -k none + +pcap: ../issue-5466-alert-then-pass-01/icmp_and_ssh.pcap + +checks: + - filter: + count: 0 + match: + event_type: alert + alert.signature_id: 1 + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 2 + alert.signature: "PASS SSH" + - filter: + count: 322 + match: + event_type: drop + - filter: + count: 2 + match: + event_type: flow + - filter: + min-version: 7 + count: 1 + match: + event_type: flow + flow.action: drop diff --git a/tests/issue-5466-alert-then-pass-04-drop-alert/suricata.yaml b/tests/issue-5466-alert-then-pass-04-drop-alert/suricata.yaml new file mode 100644 index 000000000..4d96ebf7c --- /dev/null +++ b/tests/issue-5466-alert-then-pass-04-drop-alert/suricata.yaml @@ -0,0 +1,21 @@ +%YAML 1.1 +--- + +action-order: + - drop + - reject + - alert + - pass + +outputs: + - eve-log: + enabled: yes + filetype: regular + types: + - alert + - drop: + flows: all + alerts: yes + - files + - http + - flow diff --git a/tests/issue-5466-alert-then-pass-04-drop-alert/test.rules b/tests/issue-5466-alert-then-pass-04-drop-alert/test.rules new file mode 100644 index 000000000..2f707c4ea --- /dev/null +++ b/tests/issue-5466-alert-then-pass-04-drop-alert/test.rules @@ -0,0 +1,2 @@ +alert tcp any any -> any 22 (sid:2; gid:10000003;) +drop tcp any any -> any any (noalert; sid:1; rev:1; msg:"DROP all TCP";) diff --git a/tests/issue-5466-alert-then-pass-04-drop-alert/test.yaml b/tests/issue-5466-alert-then-pass-04-drop-alert/test.yaml new file mode 100644 index 000000000..8ecad2eb3 --- /dev/null +++ b/tests/issue-5466-alert-then-pass-04-drop-alert/test.yaml @@ -0,0 +1,34 @@ +requires: + min-version: 7 + +args: + - --simulate-ips + - -k none + +pcap: ../issue-5466-alert-then-pass-01/icmp_and_ssh.pcap + +checks: + - filter: + count: 0 + match: + event_type: alert + alert.signature_id: 1 + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 2 + - filter: + count: 322 + match: + event_type: drop + - filter: + count: 2 + match: + event_type: flow + - filter: + min-version: 7 + count: 1 + match: + event_type: flow + flow.action: drop -- 2.47.2