From 132dde0517fefdfe6b46adc0e1dab77ab6218442 Mon Sep 17 00:00:00 2001 From: Sascha Steinbiss Date: Sun, 20 Oct 2024 03:18:42 +0200 Subject: [PATCH 1/3] mqtt: check reason codes for CONNACK --- tests/mqtt-connect-rules/test.rules | 2 ++ tests/mqtt-connect-rules/test.yaml | 12 ++++++++++++ 2 files changed, 14 insertions(+) diff --git a/tests/mqtt-connect-rules/test.rules b/tests/mqtt-connect-rules/test.rules index 4668f5cb6..36015db66 100644 --- a/tests/mqtt-connect-rules/test.rules +++ b/tests/mqtt-connect-rules/test.rules @@ -1,4 +1,6 @@ alert mqtt any any -> any any (msg:"MQTT CONNECT protocol string SUCCESS"; mqtt.connect.protocol_string; content:"MQTT"; sid:1;) alert mqtt any any -> any any (msg:"MQTT CONNECT protocol string SUCCESS2"; mqtt.connect.protocol_string; content:"M"; sid:2;) alert mqtt any any -> any any (msg:"MQTT CONNECT protocol string FAIL"; mqtt.connect.protocol_string; content:"Foobar"; sid:3;) +alert mqtt any any -> any any (msg:"MQTT CONNACK reason code 0"; mqtt.type:CONNACK; mqtt.reason_code:0; sid:4;) +alert mqtt any any -> any any (msg:"MQTT DISCONNECT reason code 0"; mqtt.type:DISCONNECT; mqtt.reason_code:0; sid:5;) diff --git a/tests/mqtt-connect-rules/test.yaml b/tests/mqtt-connect-rules/test.yaml index c72b79ae9..b097714f8 100644 --- a/tests/mqtt-connect-rules/test.yaml +++ b/tests/mqtt-connect-rules/test.yaml @@ -60,3 +60,15 @@ checks: match: event_type: alert alert.signature: MQTT CONNECT protocol string FAIL + + - filter: + count: 1 + match: + event_type: alert + alert.signature: MQTT CONNACK reason code 0 + + - filter: + count: 1 + match: + event_type: alert + alert.signature: MQTT DISCONNECT reason code 0 From c39450344d491aeb0659d2a2b7ac3555146a278e Mon Sep 17 00:00:00 2001 From: Sascha Steinbiss Date: Sun, 20 Oct 2024 03:19:19 +0200 Subject: [PATCH 2/3] mqtt: check for CONNACK reason code 134 See https://redmine.openinfosecfoundation.org/issues/7323 and https://forum.suricata.io/t/question-about-mqtt-detection/4890/3 --- .../mqtt5_pub_jpeg_connack134.pcap | Bin 0 -> 37323 bytes tests/mqtt-connect-rules-2/suricata.yaml | 16 +++++++++++++++ tests/mqtt-connect-rules-2/test.rules | 4 ++++ tests/mqtt-connect-rules-2/test.yaml | 19 ++++++++++++++++++ 4 files changed, 39 insertions(+) create mode 100644 tests/mqtt-connect-rules-2/mqtt5_pub_jpeg_connack134.pcap create mode 100644 tests/mqtt-connect-rules-2/suricata.yaml create mode 100644 tests/mqtt-connect-rules-2/test.rules create mode 100644 tests/mqtt-connect-rules-2/test.yaml diff --git a/tests/mqtt-connect-rules-2/mqtt5_pub_jpeg_connack134.pcap b/tests/mqtt-connect-rules-2/mqtt5_pub_jpeg_connack134.pcap new file mode 100644 index 0000000000000000000000000000000000000000..a5fafb6d23658f5f41c0de825ac148c864d94d70 GIT binary patch literal 37323 zcmeFZXIKYPX?tA~-XV*Mky=v8}TA`||yVsiP(YDG=6aWqQGob+xuuu*UwAh(M z2P{AsdHk9}XYQblJqE5}T>ljd!pMfdCdg0%rs-C_^KB&ZH435~;0FK{G(O>22@dCR?9>1pFxXAt=a-jsdDE^hp6ww?f*`&}3eDFfrb*A!{jzoF@GcEtwm>h|w6jR3iXfy|M| zuL;x?$wlvf*Yq!3keZtPRZ~VmAe4^@z##@W?s|K<@d(@$7E%!B=jY)UR}kV6x_Lu@ zM^HgRj7LG@2LDZAeo^6@iXuq;U;KOhk+b-3=>OX+b^}LR=HKbxhU9V|oKN8KYx+6T z_x~@r-2a#P#9y0;0$_N#xkIgu0K{j+SKx}OqKYB_L4g3u;158|k*X{BLG1uQLj&Lh zg}?$ZA;bVG2tkmSCWIP5zk~t63PSS->XB=$nN6XLm?zAuaOr{1;myaY$Qk0(h4?S;}hw5X5(Y;IahR+())VOaYGp zJS;3MY%Dx%Y&;@d99$wYLOeV|GD;E>G7=I>BD~A=+v#WFUvmgPE-pR+{uKg(E2IPj z1fT%nM z_rk6s`^%gsZ{yoXzwPB#cfc3-4eWeE6Y^?0$CeJnlnm{CpC;zlc8xC|5&v-B~Kzi4%pX=Rbk~|iB(ZmVTsj=RbhFV+Yw~H zM&+|F<)Kh!OL=P2DV*?dS)@kdz(w{j@PHTY-|4-;F2&ABS{w@8BA`DTx_({I$6*ep8@Lfpe!Ury}GP4 z`_Qx{V3joWrR{q`D(KZbaRN%EuG4k@LZxT#m5kEtdF<}VHRQyqm^%GMEd+oV{IAM( z%ymTJ^Uq^pzAqOnQELjau><%JRFr*c7d zXPRQ0hWk&?$qyNwrV#)d0vPtb$eT1yi@7lZFRa1dsu+?xl3Y)OJW4)O`_b@-+Cl&` zGxoz?4TVgJRLIM&6Lkd8D1H%{(XZF|$+hgn*jsbfJd)7*sZR_Kr{&Y$Kr@OGZv=o5 zTz;Z{Z-cPD%S26UJFAZ+*3hKr_fY~BWR*h<{a20PYyOXLQO>ga)LCC2dK`?+ZW@`q zTM?V8{<0~Oe!*3GvKU`Q9&z2f>GX?Sj77`w{ywjU^_dzwxi;Z6!*2dr*6I#_iJfJ0 z$Wlj>O0fJ&V7I7+b8G!_BE_4a__2%gjGPnK3)n_Ri^+O(Sxbm~tK_3q;Kr33^uu!K z(fjiGBknD{LoH5Ird;j`5Brkv8!fj>0#jB)G7&&oS)s`{4P%Oabyy?WE7Npd6{v81*j&awVdw;TN zm{y&B&k`#A2mz=>IkwU4?8@}x2kU=XPKSVVQ|**y+%RPHOOl;LS^kuMqcVl-44Xud z>p8=D?J9TO($elH&$g?S?W=TjsL_e7%(VAE_V_zatp}N(^UhER(vGPeS1Q~?9{UyyhUz!8kRABl~O#rbp-*u-?(uS*YA7ov}2Mlu@iJ4 zUe|=?M17Hy(=H(YJ)boI0R*1OlAdd=YkZbCv=Sq$!BM;J|K@F4uWg3XNXS<4v5fJa zm#FuR+prmPg8h{>S`Skzcp58 z1;rcS4SLvbD0{u&f}Hj-C&$7I*!<7rdRFYC@}a88%O}LPiW8?+cNA9J17S&LzH&hf{?g98>F6>8m&{*^-NQJ}_f! zZoMwjBq#IviAiR5?zW4bq$&KNAumUu16rIYM)7bsfgTKAfs-dr14 zdsSm@>r%M?*@*|rOH^I%RE>YWALlmCwchaQqO)zaX#*3^s``K zB^B8xx$u^YqPO6PNs?oblhwc6+D~&*nch)aW!O4E04~Cd1F|Mm9v@MOm}A%Xg2O|l z1qQfbk~o?OK_UQ!cL%62lM)IAYtU9c4J;*Ri?PB+_$sQmUK zfuA++{tpG(UV&Q??vd&-U+Qe;rPj*~>#B$=XMEIVSb}XXBE2cc#hB@fr?OqFEo2F3 z5>td-Ak8SUi!(vSjqsIM!#1OI+81r9o#4F+PyL%jYLcL;1Z&6YJT>pq_RTBAkDW~T z5F?}OGBQUJ2ZIL}VXf;NGLf#*A!GR?As0F34Dja0gBm>U{NP%n18D^C&-|I3j(_?rjjdE}TYdpFEF?4m^1Tt*A*pr#tmVQK;BDAz0Ye zy>JaCj;fez-0fnGH%ommO^pD$Xc0h3$j*{|XUo~X&eWRRQAF_tGsQ(weAl_>+A(R6 z%|KUf1P#7rj#ph$Ug9~SQ;38Yo#(pw1@~&B2e}*tdOs{E&+N>6_NM4gg0$em((~7B zY?w!8YWY{&di*GZwXOHn!%nKeyP~zC$m2xl>mbRss^&`X?{V>P1{Y&*$)eAb$p?+@ zKEumReG`pS4SmJoS}7_8^499c`eje1Ch05Z7Dl#Ut^K!<+FkqH9mQLW$>AbE^Fj;DwK>T_7n!8KpM96QOn zTd3({^mdaDUc-QSZkm#~o$INFfka|*lE_v`fa_juOYngGGN0ONW_G?+=sA(boqM9y ze#>LYsr@bRb?MY_!sD+-vnQf_cUBH?0~GPI!v)sdkH|&3JwIpTC1EvlxH&H6Xi5jQ zR8+(S`Ry6UK=I2GB)jUisfX%2{Ku8|0uoF)%f`&sxoTReziMu2c2!RWC+_x_dS{sL zMDf8bvX)+XS4Vgt085xh%bJTB=4g8U@QIdjl~m!>%9y~6zLNC@>sFAf>{2k^JEGE zFw0#CmY>v=bF9{fR7sY}jG7^U$_3ks_iyVUDyBkGJI@dJG)_)mo>>-`*GD>~ z^5)3rF@7GqfI3DKa4048L>)D|GHhqH2r&3{a27Lf$H}kxo)!9@-9P}vR^ul#zWGCa zA*&mPRNv>IO;fg!R3cMhBx^ zE*J2^7xNt-)s?mPmCj(Tg%5Z=Wy$z{D3Ls#_6%^T_t+EUD!LcW4MPB{&GAF$Y7HKh z6{q74Z|-rs&Yl!mR66#&cY`->r@5^sOs$JHl`odt%?`Wlox}A{!8xG&eFDy%^NK=8 z-LIim%Y6A`?PsD;m1w#!HfMS$CeM zy^O5hqR%}hQX&W1-X*msU*b7cASBq+4>_jLA)bCB(t z*FJA`#%KZNQ2oNtiyJVf(pMY7neV-cqO;H5kMdGi8B9U+-pV|y(J0NV)mo7WY;xkM+Di#y7}Pf`JzLufZVsE-*A+I} zHD!AaGkq65GD6>a;u|vctX0y6C5i(z-%Z2@oK#l`@zjI#cSF3v#k*rh#K!w9jMpK^ z@Qy_fwI7f7tJ1)bKC{!5xS^Bh4u`g0@1mjS%ht`t=P8o|yWHkVM|E~W!4;pK>JM5r zd```8mnaoR%5J^21g%>Xz(aaQBO85>TTeO`|Nz2j~Y@|iza90$D8xtAb{jW@ZJ~Ra;6Us`;+ps zx212|5J05UR8ZMoklf&Br^6H3x;?oY>ndub4Ufl zsZ&Vqy8!x#fG=;Q>?dkZWz5s_cfm`eNy~Ik?Gtx7sVvvWiv5ez6@1_Rnnjb@Gcpub zs-&B_A^hefR0|QF(@u*CuqjALykgJ zW>u`t%}z3s_8$>%GzdC%*@`CneD0F23l$uf`g{UD^+=8tc&k>l+}*n(=zPjwE;aS(`h+g)clNY__-}>d+{7$gN~qn13tgII?nUTQ>3NR>Y08 z{?N2h*0%6{11+M}0Mn&&SkBCFL#UQo{rnWClTy*3$v7@0{kTXO@A+niif@Q1j3DHw zrL&LC{00Ap?|$l9Drj*vnlmdQ>{(-om}GHqk73c+C^t#-`O}ceYlqGkH>+QKYWeY| z(_z~s z_6R^$uP7u!y4-YKW2U)7L+>d*7XL==6{QO*t3d=n-rMD7-YsHwYJMPp6^_#$5Wik$ zgPfahn&0Z*SPwG#_U-c&{(+lA7eVOzy*BfM8rO5nk+b$|r}}v(YcH&~V%-);Ztl(S ztv$7@#fZqa*L89$ObBx={gUnb)_652vnGhGzi-PnED;`D|HRGULq(a0v2~jam#|ze zwAhJZkNZ&W1OaS24Hxd6lLu(8ZqhJER%{}Gtala-Z(1DR&e?pHGh?uYc41mt?%!?P zbUEA7+9f6F=%ISQ@Di>4Y4^2tzVE!D>Uly`w;n4G&j(wSBPI}=lm~zM^MrW$0r8tE z8fZwb8USF@f?h(Tqwo^PdWpNT^22PG?*nCKR-k=phYh>|S%j) ze_Mt4e^Ym93oK;c08&?^xAgkY<2Sn@{kC8L0GVCVQX?T$Ein7353&d#y{afiAb=0R z0B^t(fCARQT`)#*7qA4J0XM)NJT7}jQvW3(eWt%9WDkG%XMaZ`Mfxx4H&KyzS8r!$ z@PwQ>7*=lHt~M|&D@SXv^jkX}YcBz?bg6(I=tg#SbF~M{mr32$&g<9mO)oc>pXHxo z=-4~_R)47+2Fw|1Z3{DSR)>MjA%Ee6epv^iiNOQ&vY>M7m%cIWJ>9(B|ANAB^Mu+% zU2R>xUBEVY3cASNwJvdB86O#uP_lKk^}Oq4YXc$xJ%4xG--vO35+gCl8Wk6NM)36i zwf?Byp3Zs-MtUHt-;9ei{$DW~Fnim-U@-1Fd+FV^{|k=5+7@hQ>*u8cQ`XZ^w{mlH zMs|qxJNhrg*bZ)<0XLkX_P<+-@Tc<1zoWsHm^QX{cfFmFF)?f(TTie5hTPzH^k2zw zt?cF9oZUQsF)q>1{%PU z@#Fv{7*F^$n)6Qt;-3ga*FO=6U&1Z_L?Hf&K>QPd_$LDKPXywh2*f`Th<_pw|3o1E zi9q}lf%qo^@lOQep9sW15s3faMj$S|XIDXg835>m2L$PLBm`~%HlTaj3a|wjf!lxs z2z!AC>=FVU@&L*ILcs{g1G<1PvcsSLx}TnL%uA;<$OAEtXQU!8Z+TlsOHoB#;gT($ zvO3h&4Fz;$ySRFJ>L}f0G%_|}#Ow##V1u4@&}Dts8s@H{tBCZr0xAmfj4+T03ICQr z(GSLc`e8?Sly5UK{$BAn&qUVlo}j-JavP)*!w?T32#5hvz;!?YPzAIAJ-`^;ZDkEEW-ee{&KI}`JODz0 zaNq?H4-C7J+qO8#n+?!TIheC=%hr))!ha!%014Ru*55*kC9>oJC0Oc`C6v``=_qqsp~ zOYxkdjAEGLkdlV-I;AaT7-cynobrT&Wx`Z+Zng7(q2`*>U}lyYX8+!CUz!$riV=BOf$?l%;L;;%rBW+ znYUROSTtDfu@tjRvSPD}vpTRQvUaf^vaz!nvOQ(1Wm{pVWLIGiU@vB$zJ`BI?wZH7 ztZSnj7#!jpP8?|*gPbUwBAgDKDVzgbC|sgkP_8ttA#QYT32s;JEbeh0Jf0goK0L)d zbG+od>bwtmYk9x(vGAGj#qf3UUGR(WJM-u8PYDnUs0ut3Xb{*Dn2)u~e~faZ>Ty;t}E>CD0{q zN`y$flQ@K&+szkgV`U zkx9{Bu~>0iNkl17>Af<#vYK*?^0*3}inU6i%C@SQYLIHX8lIZ2TC&=_I;Xm)dV>av zhN?!K#rLrj)A!bIH6S!FGbl7TG`wXPYxvcO&nU>K$C%m}YFuZ6X<}fKXR>dqU>a|_XeMG7 zYBpxhZtiE^Z9#3}Y|&&%XnEJN>JIuH!#hQH&hBd6&APj9rDBz8wQVhLooKyobKT~p z&8n@8ZLICGos3g3w)M(^h5HssFb9_s$pL((JOW7|{BGYX0eIsKpeF9#?Fb&s0^L*F*uLU{jWW+j8Aw@T~Ec*-)%$;-pv0B^kCtX15p7^_sPY^@TnDtpWNHnp0hI;;j# z<6pB~>rnf(&bV%RAsaWt_dF+(;xdhZZ`h)v(4v~3FnC)lRlHDQ}?IQ zr^9Bh%p`oF{gO4yFxK1iuy1FJkC*V55|$a33s(eJ-mNOG z4z8K5Ev~z-pKgS15^bh_zxMs@*7dF4ZKLhQAD%xDI}y87yZL*V6=P7F_$PkqlY&t9E#oHtykT}&ffz<&cxfv+A|;2jGC1I)4TurRUk2yn2l za0ss8gBtE=cXTrcl$AX}uA$M+TgHd@@6ciL}0z7mOg9;KsE;kJl5nsh5A!QN}yx~zP zB6?F>=dP6}>|tzXRuvgJvyiaYgP4lep z_qyL%f?Z>vK)||N;2uB-3JN+FCI*PP6bfWVghq^hRY2Q=gh}v*&fS;_QX$U=v6&x) zb**5Ptv4SI{a|Lv8lIcC-XUX^-~MY1z2*JyJpRWsIzMGNiS7hti~zCY1c|78dS1RS zd*C}8J__>5QaD-vEVs)Sv6}ra)iO-!1qI1v{+y2V<;jLz>5Gf{Y^&U`Oft=klH{gS zfiG@%+{3D188`Xtp-HN#x*>(0_3-jYii)RfOaYST_7Bw}J6$}-)c3bOB7o6dsts@@ zubU>vO-WQ^F}gaSP|4|$yzG9QL#f&n5R21~rEd1UTCFq^Ar)gab6iIbR_BVw2fbz&9h)30oKk5riZu1j)HrZ`jU5$| zN>8Q(;_Aj3p&7NPEq5lCDScITuBoi8rm*K5NtwBY9SwfZBw^uIJp+-wo6K-x~VB>;Njx{ z5GuX+ABXgBSKcN?;fl5ytQ1MD)NJp0_iQ=jVKw_HlUh6vp2WIWbg=nSHOcM^)K|m9 z&Ae(=l;sI-g}zE$cjIO`le3rf^82!AB`0i6(^Tf>(BLW=I0d@#azvM zzN`EWFOsZhjm4*z(5pBms_a%y{#>wQRE+N1u{?)a@i#mN4P0i}S_;I9U%LIw7B`!w zd4=u@n>&_^m<~q=EXxuJ%nLt}3@Dt;Y0MA_>HZi4 zFe*|v^YRnQvN(-sa=H5z1)BDChTC4b;?i<1FY-7)->I^FpVlU{5uo7xbjg|G6ShUY z2%D3>VVsu#arm?P%mUrmG`n)~cg5Rlld8kscB#;Ohi>!3s)(rTyu|naN8$gED!m7| z?u4pjbVQZ~)+Z+we!lY~$l}`@eNJA@Bx3U8_1IHMMahwGtNrNbwI{oj**HzI zsK3X{^n>yC5+`fx6nx!!%lDPk1noN&qsSLCgiX-sJwiI{r>)Ze<}b-7}OKd78FFy7v<&l zytU<@F<5BURxOS*&?ucAW_!9MQ%hUKA77M7V$MB0(&WGE8I0y%2BVF3{I*miQ9P^R zU=JNE)>QfOiHu~vic(h}+RtP1-QCHxAL@U#d+Bwdi!GgusiAPPXv>!R=w8}m6R1c< zads*+Z)CEXACS%XPgw!dn#F1J4!7VNpuJmr)8BZyY4bF-z&kx9jLD31NSxST($PPP z&2cz(dSbL=hP{bd#62_DO z`-@-X5se6ix)R+sr;g`}XVs>LPFh6=DJxs=1pFy<`GwE z9t)R#F03L$rz=`iKv8M$BF(lG;CjF&k7MpaIAc&KvdUK5-qilQt+;{TPI1V;xT?SM zM%-MS-rm+&H_fN8v=*!Z%@SHN>T`y<qn#H+AVU>}GJrqN6=H}EtzFO#O9ev#4%vuVM z&3mgi*LzYmS7f51Nn&zJcIPnUyiZoTdakhU6W?*BP(xX40Cf@v=c|f7;+3YBMX68r zZ(P2Z(4>0tnyos~y3?$(Pr{-cvjTm8>0QBy2Yt} zsHHxg^wd@}0GVwvLisQmP1 z*CNM@^Jg6ZflUJdP))Pyy|A#(k251H^%gGuW-k0?d6_bK(q7v@Pe&>gn~ou?p1t5G zKWTKINKY)3y?S-2h$Fd^zeeg?Wz}1aAG*t8SSz9eTSn1Y1uzz6D_0fzb|Z`H3GEq&RJG50s~i`dla}vs&)OQ7H-u&6rIQIhPosZj^gZLJSL#!< zpsE=XVpYw24N3`}hh2WJ@7;507S^hsW$`a&6bY zCc$>=nBhu$g#xYWCabjx+;h83CBgmd}o+QS2e?8M}f3cI?}(UCbR zfy9m2q8kmLdZ-M(H*WMgE`735HtkPYK6T~C9Ib5jXAllg`R3WQKI^%Z-`#0Yum(?4 zI@57Gp_930laJ-2a~-gjxeox<{JGD$_atHLC!ZcGsW*M{5y%gp@KZ4S^kjjeuc|}q zeMKhpraq^h<9BS^?|p$6v92!*S+Q=&=ztH(J?8`O?qgn8`p>8dUQwB(UGb;sqm!a# zTEzh(Uzo-E_g6AGIZMo8YVq^8BE4ScYUGJ%qU$X*ZhBCbuP0DAdZd6qj29zHUyzhfEX!K4BpQBi~aN(Twd<9A&0^XUlKZ z;hqr7&B4=;S+~niiG@q*_ZAv>j#^Gq@8hz(|9g5d@Olc6_3J6-RqKyFd(f{aVz$^_ zsywL;#Xl52YRtQ3|PkFv0-rjlmPyYNM9}XcxOOkZc-#hEuWzq zhurg|W6q#wM@%XzQG74go(p9cTDj*$b_cOJ#L-|}%WIYy6s2g>rSY2X=SvTkpVB<8x=(&Kl2C(7m>-Ccwx+CGlN(6W3hO*#&PyyOO$N`Cv3 zGg!MNTni@41MS|DL&>EnPQ2#Kd=!w;l3!VDK$; zdU>S%kk=JPU1o8TXG{N`bC)8Bedx}P^Gc?vyg{*!e!a>kAMF~uS%gQ(p2wJllOYHX7!GeU_%8#qq3y- z7rz_%DNpCC=f%mR0yB$|8JP^IBLZ?ky7SgQ$<#Q0oR5is`=-%^#1eVf_-0e$M(qm( z;CY4G@h(9$24!tdllT;(97Yww-K3?li;tJ<%=SoT8Q`nZo1M)=pYa zxSz~bHIlv+y^ZD;oA~D+`lF?C3C8zjJ;>U=_Q+_c8FG*{n#oEX79M(pJsQ(IkT33j zsfTYN*x;Kl`XeL!StL)>K54vn|Cf1mIEqWT-n=@;qQv^qyjHIhAEmyqCSIkEbYkR-opvN3{3O&VJuG&JzUCur<1k za_fi4(iUe`Nbe_sOjXXIe9}5*c6z4f_WH^>$)oQhT5ie%6F-_d_W5-T6+eac9(2Zv z2-An{D=yXBjk~`X8FyOCB^zv8Fa*Lp<6*EIXM#$jtx1ul>|#KAY1Yd3PlzksaUs zW6v41ongHDQ0O2@TJE{)t_75_r1;(&_4CqRPciQ4u*k2DKDYEX^OB%zR}0+mbVODY z9~R^n`8E6~#8xet)X~UiuaL3to+}hr;q=hRx3{fp{IE05JQ?k{G|t4y=dYDrF44*p zu|MImwtus={ZP6>%-SIEIy+Dl-2Cjg7! z?B}qp)PZ_wyP+$-eDmXFVW;MnsY+8`$RCYlf4|H^0qWqS=cj8KB%(poPiN%k6#rWy zLiP6ZeXZxwikXMEkF+z6mY;!7Y;FfhC$xWD)p%I+KRcqoTobcCd>CKPovg{DK8{sX zB9?g;;pAz~-AKx2>szs`S1kR|Yp{YKTv1cEwNp1P&ede9aZ;g6QJ`H_K$WvcXS4&#{c-Ch;w)|6uTGH36C#s9)xz+`y}eubdXA`Z@k9b!6G5h-6veoLT+nf~^l` zt`2AVma2LAIyyQo#x-Nr#Y;{L{Cns0u2&+=bbM9V3lo%q)o0fM2w|76ugx#P#=FFQ7OeaP@2D;#Zwdwt98Tbr!Q>iXj@tNiS{*m|%Vy=*KUhS)}R z3$Mkkdt&9en_a!d*D>k6o)XNL3-}HPkrT4@hmk(2EABPl%TRdKU6u8u6mz(|m7y*% zH$b?q=OC>sVR3Y=g_-?^mi8a_$8X5{qx-5-7>C~1>m&~#?P=F}?p+<*q!2oB<$O5a zO6NKRlgpbgdvXeXSB~eRAZ{Zawi3UW_<3#H z!XfS9sfH|Hcl;6Xt^YA%d>r=tSOPn%G!iF21Y-gv95 zsJgl3rW2H#6u~h*-yg=_%gt+H^Cj3SfvRDs%g`xxwPoK@Y*o0JRb!5Wy-*`0-#*Fs zKKSw@<;WPDtRJfPNihp5_O|HRMw1;3+bGSu%;i=e0#H!@<`wpiFu=(fdh~AFimd{u^nWxTzrTpLYKw2najw6=NQHOD!Nc0{mq$-7Dnn2XoOHT;Zm*i@FKq|ZsLLJ67z zcWyVB`@X%WE>b~SuvW+=2Csf0|J&W`Fp@2vhF+J;(9_`K_zp{{lGwzME>P#QYTuwO zna3k8rY@nUkdm|;Ik)JRYMX#cqNx3Hwb9OGT*BqMK#4g{Ol$;vV_(*Z=eqk-b_3Yg zC~L>atTrJcPvb8i@uWmh~n+k3*nen7;?WE@uO*F?gm@P=Y_X+8_(gGE;TI z#$F6b;;Rn`fS|CYJZ{i!O}T63Ov71yP4}UPPt`kvkDs$2cizsw$)8#R-zsdb1hAWe zQS-Ah3yWQxqm7vEJ%d|oQz#T|)G6N(B6?E#)I(oK(`4-JS>%bx>X^oeZ_QLO0J;AO z!e4c#fVbu|*Q~)&njmK}b!QQqronc(z}5wwF1X&mo*n%X8qv`&kb0+-C3#uNTEsT0 zty7a%^M_AB`lz3%^jf_A3(aKms|;`E97;rpN0oF|#|&5;$32w zdz0m)tT&G-b?QG+9ZsbiQERk9cZx0&ooc_$j&>z4SO{)DG{haxiKn97P+mQ}oXk>8 zW7tIP5UgveKEO+*R4cNxOtoj@X5Ldpu{&z@9#hm5!w_H3)pQdt>03D4*y5IQGQ+D5 z2JMe;K6R&bMtJh$cmFW6I@;V+C*ZRGfpb38lBrEW@m6v;s~WV5vth_Mtk=S zwSX~|PDM>K9@ij7gp;fRmy_+-G(CW`sZ_~bRyZAAWmNaytn`!u8MdXzo;yN!n}^h< zqLU2n6G*QT&~;c?ZRMPB(`%%Wa$tHGzG_^R4abbLSHLwP%(Z+h=fS7C2lYtYl#1r* zDTD_rYCcTQ?(tmnwv35;o!h;~`XP31IGR+a@cn&u6x8RE_y2f>(MK9chVD=bk}R z*;rV3YnYzV!|`pIVMoQ~w`Drli>IX?NW;G*oV?I@@%5GoPDyP~&8@{PHchQw`{6xn zX`w<_Z_%{V43SrFy$z`+_==##zNHS2?h`oF1(d#VO^IZcHQtO>r!>{;b#rMBE*=`bc5GgHdSfRJs~pCeq$+W` z@qw=Ti?DiCpE=Q$@}h!ou~6F7Pm3QLY|OF)@|ieK!X#j@L|!ueo;1D8yiLm6`DC{J zmF8p0BSQg;1}-ye$I~zFmhiD|8sug6kl|7&n0*nNPUW!=Z1Awx{Xiy6H1fXPMq31Y zNn&El9&pNbL2piuEKGpYnAH0k+by1&1*%eVv+(c16J=HG6HNo_sQpURi#29;b^Q%} zcBCS?eCeVLL_C9ZV=;DlYfpJNhn*_vbQ-e4A}Mq!S5wmtdBX!ZZ$3*lDZ8ha4M)p9 zO)^x{?RlzI=F*b21JE~`vu)Mu4DD!enQT!=&unC7Qr4>|xWuV=1Vq-0kbXO0nK~qA zBdDsJadFWr1;4;$@a&LtyE?oy;6qM8u4UZ)%?}*t8GX>`F#MzsbW!4cU*__$E$8_X?=ro zm7KGpH@1q)E$`uGu|CbLr@AUKc?pFh4$qfbSwF``e?M>MVaBTqJyns*2fyj981uE+ zn|f~FKLAHpq37P3NZZ=Z9%HLkbb~g$IH`xC_3OQ(y*U|7pAJ>O3r882 zOC<_Uc978|w3##UYI+5l`hU~2U*Z(RNJ(4M$#3AbB&prxS}A~WY6Yr+pW(U#Fq6Iq zP^R0+X!6?RIm=v~p)~cM8yH^p5^+PcYfSR<_51E5c`gMox6m<}_)tnLx9KDtas4nG zgZaI(DF^RXXY_9XQ9M=w-#inkQd{ujRJ`_!y~R1RI_XSzqf3kNZ45=(yGPl^IS+EI z+=AG=l>NKrS0#J}hF1jJoPdB3y z8ihfrdHbb3g*}B=Z)}7u1r=9b$&k;m{tZ(tI(?y`AF9dfo+0VSU-auti5dp9>(|VR zZwP{)$XxJ500L4o6Al8Kf!Z6M5@qU>-@sMneSxA?)-Eq7Fu+aZv zZd!kd_e3k}!?%f{n=gFH{KK2$R^IrFdfl#meWHIPe@MJnu9!#_JW{ta-H>MZ&1QvT zO}dshU;mg&62~m#rWqA4-L)SIoT*qS?u_Db1%EEHxBpyw2V0;Si!E^C;FtSE2jg)< zkA-aHG6#MzP0qFU{~MF@{;SIY?ys zQx{zp>!I+R5%a*7N6P2Tid;IUpy%Z$Tf3JOh1Y|IsgHPZ3xbQFJ_jxO;Q z!b7YQ@~7h*N&z5t`L5{9;^M+o*Y*+2#w`redCA%wSSoL`A9WH>O9XhS%{%evnnP?{ z9%yggHX|{(05V5t?@K_fB8A8LDTzxv}Itg`^dZ}r>ihTku(nnL>-%M`^I0aJCEaKl;2{B730^c>Yy-SpUP zzWBqZ%T_+`zbnOjp?%3D1WD?GQNy=r(c~n86=un^&SI~$VyunKmHpYIn4ki21?^2m zHugCh_?)^It`4KdV^UlHpj$N?^u#Ooha??`A70LTgFGM`4OPYp1%}3&hQI35*;dz} zgxQm2U8Qvn&cKiM5Wno7=#o|%l9CMHnm1SkiWr3cUj6ZasqaR>NOKh#FSmw;A=haZ zaNk=Km0nXDv%w&_^fgm;lZjZOX90S4qR2iqjXUi$2CYOdUMnH5S~?B{XTt^bz4w-j zQcG%bh1XopWKLylkZ-X$x0>XF=`J=K{g1g0rKf4^>vp2wM284MTz4TZ zqeI4dtI>i%sL;*s?I%AgTZ^b2*XFz#+y*bzIfIa~effq~grBu& zDca68GV4%P>NE8XWK1jH$BrIga}_#JmQC)S7?em>vHn?Y%&H+uelui_Hz}f=qt3{1 znT}>I-=???P@IKwGmLdII=t~KxH1Drk<(i9WsGA%vHQDnWsChqn(Z{z>t@?=z!xRO zP<|iWi`t2t9y@;x)!-kUl0VlDP+dwxZuXG^ytKZ>w|RpX7Eci24ABF0K7bGUzxWH% zwD3g)T58j20$7(iryP87n`i7uK#k+Want~oGhub2wxC9q4JM7deDz>GID2=mXCd;p zDeby^J!^O+CZdU-|D%JQx73?v8^7O!w#z_}SESS0;WhmwtT9sLqao}BHybw}R zzjBxFUz_E?e**Tw|6hR3@(-2%KLGoH&;Qzn+;NkT>8xm;5FD)vFW&9;e*bn!)E=t4I8O|taJ~o0L)h#?ZE=s_^fn?>DZqPe>!yTB z_p!lE%qOJ0p~0mJi3`vrq?yg&wWJ6e(=>lvsHLRd&@V_JxHGdPYu%9dupD!Qk&gwK zD*N&Ad18>f{I!MCYw}5*h!v`>;G}_D(%7 zON=%Bo}J!LxN2bv$|)8w*m?N0IYCw~W*F+59rYyD^OoPkm(gyE?gn2M^xbTXD?^QR zHMk5gQRapW2x9hYeIH5+o`^0WunEra&Wa_~fQ1&Rl%}wg-pZ$vdkJ{=27TNv z^FB8$=2>w_yWG(0d=BBTBm&|m5U|TM*~-new6)=5+}M$*XlHxg7Ib3-Ju_hH@YMC} zUPT*gGOj4)%a04?d`)njQ6yKvXlXR^z0hDTr@XSRJ8+F0YS9H{#xfw;M)wu$uT#+F zv2Vm;0bKUc0qQY^dZgGR? z&tpXgVz5_w$Kh~uPN=YM!Mv`)Rp6@rsA?h2U|_Z8oLAJR0*m_1KJzOqvB4~wAp9~A z!CEFERr3ekU`zw1_Q=P38)yBnY*H-#D$kdD)_W>P6(pFRXuzswth8RBi)j;rmg-YH zHd@k+ps~EzT7sV`Pr{n~x0`6I6T-osmlfVDvZqC&=`Sjb#_D*GP9$v3Fl-1OR zgX_CJ>CE_^(^ici7{}>RT5pn&>`RWOWwKnS^<@TMQ%esRTYak_!zyxxMSvh_@0l*D zf0KO4o$?vU#6Rfn8+O1=&$+)Pv_PDF&I6jGdtL5ChCoVr2u4bzy_W3_$vY zN`25p9?6zrdWKmMIzf+p+f|l5i`94Ic*JCyzL8b6fz2xEjmU_OYtY%j@e*RZD?=#`PIT z)LB@;0-f&y|L1=(f|!&O68tThx-0^^A-7agxZWhw7_$sHOiiF;igv7g9Yo39u^#ry z_~mzP+{A4*iXum4dGpuocxuaj<_P~N^pLtpr{t4}GgUR_6U7`Q^x27qSQ^!OU9{WP z#6_vK=SktyUaMjjEz;4e>~CCXd2fMTC}7)2b`V~80ud&@veF@_^r(`x{)Pm-3d6R& z3!CDQvGU0?LjXdmLHBcsIq%qH^MO`g0NGn|EY}sXj#@WsjbGOs6m^D~Q>`1)WJ1En z28MjP&{Ay~U%pZKGU+zZ5iYAvFTjG)+LcmlU2l!p@;W79|RJZh)G4xwMbT+ zv=i5{B(yBwn3_Ei9JD{dAaUm9!%4?b&NX*Sx1~VXj^Gnta~?s=dOT%5%?y7g*slo%Pm-OE1su}5_e*95U;huL90V?~_YKH@97VZtsVi-l~* zqX@wWmr6k>K%!!-YF8X~`Zga~FB-++i1hCb)vx+$XXtO-DzMxu?`Qw$>e`o%WpENm zt~;|rdF_j`>5c}S5YAHGQ~W#D&RBLRvuWt~M)BIX zeXHVxo*MqDZdZiAH#L1>1WPV4*yyBeIuR|z56^fmm`u8gFsfNyNhkN&$WCt(H`g;= zpDZs0<^V!^^-cH@=KMqO&mQWD?Va|nM)Dk7oU!&?Xr|&cK4Iy@AAU^^l+5~b(O@Ot z+<82)h60O)yl%KC52%O8m1jKJy65~AsZ@sUq$Azqx?FB(?i*$t{%j8R@ZXpYLFeeCRnN}g;8Lo2LU4@eo=z;@KLRMZ zUh3MK!_dKD9=Svw}=&wH{BSqt9Oqnnr7 zet%hhoR!RG%s-ELX~Ku$lSIfQ)(+QquzgNzhBjTcgM;i!L5})vLB}$ZBU_G(oL(=n zSE;7P78@n~P-WxHfVK>c=Xb;s;xFzMkN%A99xzUqST|mhWwhaKGa*z#=|_d>MYT4Z zK7wa9ALsFBBNXv`@O^|Jzl*EdYF|bK9)Q&lwB``VH9i|nl)iL{!SJUF-QTS_cL^~C zIsSz*RY#nhWocQZHdIrkF@{aw?#eX0< zgWEThw>cKoFX$?%wMUTSTJuWcJKoHPRk-QYt_s@AY$+<1X`V#q2*1Uu52VK88PsG) zP&~T;r*wqm0Ns3Ca;MpE6vgygP+4t#a)7KUC`hm!dQ78+=N%Z>OGV;Q(M#W$Uze-I zCEjM9fy0vF*x;$t;DaDzes3N>~)Yd8;4C#U3Zf~qB$ZoZdE3!HZjmB z39noUZ@QVmDHQ1CWnDFY*5vY5r$d3)uwwX>W#9(S16nZmWou0)Nb_mnSQ3Cw%%*J? z0{(ED6J)-o?>Z9w_J+Abg=sCLI|`vVtW%HMG;MzBV5j$#)gr^Us;9lk=TnT_weA8^ zujNur5Trw*z_T&lW^masi+5w^h<)2E&LUN{kjHq7az_~-@JS9-G5=u%*E|R`q4sXY zG6S|V>I15VdHxB=Z?%3v+S>cDpZGMOdx}THo>Z_wAkXab@?7`11k9I<;JD>TKLdl( zIPVE6;Fx;nUa>tSC?ERF3U{4*u^h7`DvxfaS|z+A+qukSxbW#9>cUQD0$5uOpyFkd>fc<5o;*TtmnuXChU%QU~_4uPqt5--qTtl=-XPG5GlY0q+)I5$^c>&+A{2_vH74~z~| zX@G5AX$zLPZ-$_xM47sdlDZ8?1dg0~!=aLwQrJgZ;s=U;y)Z-^zaRtYXHyd?6z_NS zs*%&5I?%$)+FsRfIJz>&pvWpaEn<8H<=w$G$u9u#7D~~>W2^jl#iUH!nk-*US2Z01 zDsl5yM>X45K>AUpKYQr%>^0ompKwCaypmJuI-ZnS)S-+s{Tx#$iv+q%x@K423_suM zu2ai**OIG}Dx6MY3RAP%6!MaaM7zvjv)1=8{I2C?Ze^N2;Vj^oGrO3kW;65TBvoZx zg-RB&8(;cOaNjz2k;@D?VW4_Y=9M2GG0#!<#Xp2Yg^sIrnCQFe=#h~6zNok+`pu}d zN}A<@;IartVlKDv-Q>@KkF?j(ZJ`FgUdsJ-Og%cNJAW5(*1-a}8_ar;s!bI>iW7>4 z6s~^xd}Hl&HG5dT^7f~y;7``LZ#vb%IJmN>8u0m8YePlS(D&Lk_9mGE+ss5{Uk|cQ zi>oLPKqUJ~^s2f=VGa(fer9t_$;|PQc^n7(U>n8iOqXn>ZqgMgA_?*H6ZcI3_j3=m z_f%z$DD&dngYXNMw32jnieDwmhGLGAKgfWwO4fjlO=)PZLB0X(aJ;mwEKuJytaKe^1S7|lK&{K~QOD;+GO zy~EWNv(5%Hm4xRC;djdfHNo~a6>b^=*#`?HSla45ZlkF(U5%u;6uIhM>JXoxIf)LW%|BfTgUF+XD~`2uNr3P zQf7Ktt6*v|!=oYZLDbfM4Yerb2JqVZVQukrv2<1Oib3dXXZ&;c2v%j-PZXYv3l?)F zIiU>XW^*q(lzBW8P!d8pH?_9WY#JJZOWh!KH~x-NvJpYj*H7&#cMo*2UpOe<%w^Ya zrN2_C$?qT=-l8tj5n>w~lS}ujzqZ_U9k*_F!>5fTBa$X!u;zh9EU`jSA+J>L)0R@g zq(@3OmdSYup3}`zQz5L%ZeC`{uH}Q2mqT5en>$dqtVu(?#a?N5R~r`~rQpi~6EAbT z>wR?v0ssJJZJ6WJm@0Kfw)v-`dec*~@3oGsE4!z_&|_V1@s@_y0~`7wq~g{Y=b8xJ zo0Tl;F)j-Z@*H8MuFu5h~YNQ5gpFDP||q_e^^>AjRHQNhy zH40wWwglVSmuBZn6^WVA3WPE7#T$nfX**sS(P#07tlwn+8YL^MR>y3tl5x3179ohu zc0n|fAW`b$ciQ&#JX_ddT1D=Ih=c;Yk|jx$!Uv}S!bGWwYXk!BVRODtFAvazpwqARq**Z+`0d^`;?JJ4$M z4H6n*EE%#KP0WvvAzpR&-w|9?ywN%4stDxyGyx=sSI-Nk(T{8G@l?`7hF2VoydZ@U zgf$3s2szaotDf)eZS*>0Reu1*F48WB%eR?qGq6v%DmdWk-@#P!jHZql*IGI?RtI_7 zFxq-meRPj?I}RJyL?d#GqRI@fJ&H2m_A6pGybwsT(2UiRk zx z#ju7{tilZL^Ol91fz~EVzNEm$-67QHbbO?Qd&P{{hP!@J`cnn96MN`TYBEH0ebW@hKy&66TG1fl_3E!Xbz@?(CM7a`MqA`hlzg@Qd5JY!-VbJ~Hz-Hf`I9F3 zE262)cr>xPEo1zs($&S57wZ;MT^AwIbvv^FiBN2MPrw8c8(66+UMY*AScZKn-@5ru5=a^s`BE_YM4VoX1=Mn~rwU3aM-6uG9mNkp~-NX|113O{d-f7-HG> zNROkMclS;FI5?W-h|c)%#fN{d9|dA|*%iy@1>bgBNoZ|y$4frb?@R$wCqGHH$6H%u zngaFsjyscN^Y1>+;IClJ^-wZy%vM+dT~pM*+KsyY2c491x|@7mgsj|-5nk^Q*`*}1 zn4elIIYTqw__?M`Mo6^Z&MZv(-k$}3TbIR4geo#Q$Glq3&vVqc#oS;+2}WB%RjWs7 zQ76KIkJl~ZL{?_qIqJF+oiXP;s-r>+)ZX8GQlo2a6_;;rI$HR#&J{GA>-eE{GpB3` zTiSQ#Wmy7S5B2D!C82I{E^J(EssTd;D}s!F?GD{BQk9OYx*Trr_K2VUe647YO$cK3S4CI+rPOssqnyJlOF zamw_|4{9YpNVlkRQ_2CAUvzbg??gC+=n$*+k>)Ax(|E9i)6-+A@IUB^jc7G2zZLeS+gzQm8o z^IpXkLSgwb-9_uk5QhD7IgGUy5MR|Dp<#BY)0(8nKURMow)l3ifaVk5 zXRXln8e3yb%3G>#?T}Kz%O1R9d5Q5qzyFizo68!4XFTb_l9#P%k!J|%A9OoTM^xo$ zz4Ly-Kj@OC*Ahw`M;T4!LNELRg2EGfp>V{DPJ(D?v7;B&PlD|m`hc0=PaE;fs;+ew z#`e{nuQ)@&SZJVc!>=LSrQf85gpMwmDg2--A=S#_~!P9{|NfZf#h?Z&7L_cT1CG*YEWCWK)C5R@9MFXs_u8_+`W` zQc=m8ftADV@vTCG}Xz|3syJ6GjEE6+7`_nX~wjU^1`B+tC zWwE3+mK!>=-v zO`BfC;QW}LWTGlj5MR#=YM=iVCpp?$O1^{X>c+W3T6SR@x!W3`2C~5)DdrJav~HPW zl+v<;#65shPj4jzXPNg}7%X=fM2LFG@jq>Hrn}Ws1ixy*6VmE`<}Gic*flP^1-RV> z%t@!PJViV&IplBduNeSFikasd*^nH?tkNe9VzN`eF2Q#=hkEXPp=rQ^9m^;rU^@hi zcC6rR`1(Y*#;LK$BCK4vPC`(Wl75=za@v}`eqc-1*@-yVo;#0rpwk!6Ui*vmOyomd z8_cV}y8j$B42zxOC3m3!76AEieH_u~!aw+kb$uT5V1_3u|{=YLP; z^8MBigDICSw+QPVsTS?(&u{%mcWs__@rNt)0Tvw}zqhCfn0|ccr&p^8>zkuLE#z~E z0fk$WOzh9?t$Is?t8lPYNCXEx#;0{e%^&^-lmL(9EE$=f;(z9`o+9A?5!g><4O6w2fCdBukYcgV_~+IJX`lOsj2+C4MtJVsr|n}GSq)3C7h8S%!aeO>#IPM8Cg4>)pW9N@Cd(EoXJvdqe0ILrR~$O7JXEYSSLq>UWF!B4Q$p@1HyX{ZR2#VNRQCA%0}ZQ66@ zwdi}ZQ3=iM9o){b_MB<*IFL?cRA(qmS4@@%xYA~xwsa|Mz6@T?go9DVp$k146&HPoQRBP6riY98O_HbQq)7hvR4CD z+9Xz4pokQpu>Q2AuS9@qAZcBI97JC!uBWT<8r}X36VOElS?yWl-R_b7Q_qVr$rIKi z@M^XQ2Y-Kp$qX3EAIN27$PHi7HWCdMdcEQ}evcR+zW_m5%9maJeAG7Cy8WUnczLcu zEYV#a>iSg71w9vZY7EgHR1*xLJ)N`81H@P4v{wN|evWVn8beJWjU z&9r1VR@BFIQkXs56K>I}g=gZ7O5%fQYA!rVV4VBy-%PR_sB@`Hx&L~B8YSUkPLHPK78kgTp?PEZIPT>>hbT_DcP;1UALHfs%1B~!eSLSIb5GoroVD} zOgVcS*8CjBrtCL{-j@BzakaN*%`7$%M{ zuXt4`T$pIl7EP(zJk9Fmb|q1-yXHHb>WO^TUT<@rs_BAPxpk?&wqTYLn!J8A%JsXA z0KdalOpHU(aV!4n%@y}03pu-9)cXzbYO>a{vsb_094!KRh!WuDBrZM$D?+58e36vc zunRR3@6PIG@rAXC3^X~tjE#tSW4w8B96#ahlF zj+&UZZN^M-NA6J<6k*1^FgEjPDkN{z#gXLT{x|E_%hG8a%oCj zXo^-NpQ~e%!`b(@eIv?|>DOj)X8ndf?`4jH!G^DiozPV$OOB&}CasJkhQB63o*+E= zwl#Lz+Fvw;0e|=}{|BAwj+qPRW<|$Lu$!+8tZ}fxD9IprVIh98Pmwh_Sp@q~%q?jQ zSh8i}VNst=(Z5J{XfO6Iw7kwEE_ALlHhQsk=|wqsbM*&+$ysDm*Z3dc;0Dg_C(@-PWLy7GU`_rW4x$w0QjA)MI$!jIEef{ z38~zt4iXMOk*{ZlCkNlwFb&}_@{g!bfBacYjiUTMbx1lG^h$39Uwa$!mIgkU75pfB zvymdy3?EWy^+amf-r$tSj}#e|UNV@+=UMudp^e+@ZYgXOYF*&r@K5Y94Hm?|XnM<0 zGq*Xq{l?Qnaqk+RC+x#{3#(m`x!s>( zC8bA>S8UEigl=2t1+=r_bVI8_C{F=+)1YDIB(x!(MHBb0&!;=`6;f|8nvB_OXAm@N zM^^OK)lp-dqte9HfpuFWUE-BMOfH;IHE6w_R`S<8$$pgo<#Kzl$LG>o3HPzOG||Z) zAEDlFYK%|=F0(gFYo#jNcuq7$aZqhD#2yx|Z}d1$KmRe2`<9x$cHK698p$H>CmsiT zrVlD_9A@}346WL9ss4j5ZDOYSI9;r8RRbuL9-Owyhz8)?SKEv779$%z=*f(ACmz+; zTX;)kVm8dDkqX4FwT)Thq0ijVX)Ul{JvwhoF47b4cWGeyh89;SBNYiu4Z4~NZB z#^z^}TU=?MP|7R!R5+!$6``m8&C(d_EBBG%*jb6V7Gts+ATN#NR{}UDTcnf>dd)fR z{Cx*8Y{%2R&Dih1vT5C|usq>CsnCF%2)0Q%GSrSKcwC&pLGAeSk35Td56T&&~$>r#h6G6PZ?;!f|JAR9q(WN zA1BnM#u(Hkx>c%!(yD^q6TDg{hyzq z{H^%VHGg`1ZBRb1_ovh>F8&}%iDs4xk5AX^QOC`A5yM(byacnf#yfa=umX zpkx|!ORBsZb5R7g!x2w=f5Wimn{cVzLSG3!m;S{8$Y any any (msg:"MQTT CONNACK reason code 134"; mqtt.type:CONNACK; mqtt.reason_code:134; sid:1;) +alert mqtt any any -> any any (msg:"MQTT CONNACK reason code 0"; mqtt.type:CONNACK; mqtt.reason_code:0; sid:2;) + + diff --git a/tests/mqtt-connect-rules-2/test.yaml b/tests/mqtt-connect-rules-2/test.yaml new file mode 100644 index 000000000..34b3cc021 --- /dev/null +++ b/tests/mqtt-connect-rules-2/test.yaml @@ -0,0 +1,19 @@ +requires: + min-version: 8 + +args: + - -k none + +checks: + + - filter: + count: 1 + match: + event_type: alert + alert.signature: MQTT CONNACK reason code 134 + + - filter: + count: 0 + match: + event_type: alert + alert.signature: MQTT CONNACK reason code 0 From fa6a630fa5950388674c8eb8bced6f86dd2e452f Mon Sep 17 00:00:00 2001 From: Sascha Steinbiss Date: Sun, 20 Oct 2024 03:20:05 +0200 Subject: [PATCH 3/3] mqtt: check SUBACK This requires SUBACK matching support. --- tests/mqtt-sub-rules/test.rules | 2 +- tests/mqtt-sub-rules/test.yaml | 16 ++++++++++++++++ 2 files changed, 17 insertions(+), 1 deletion(-) diff --git a/tests/mqtt-sub-rules/test.rules b/tests/mqtt-sub-rules/test.rules index 7639ec7ab..af559f020 100644 --- a/tests/mqtt-sub-rules/test.rules +++ b/tests/mqtt-sub-rules/test.rules @@ -7,4 +7,4 @@ alert mqtt any any -> any any (msg:"MQTT CONNECT flags"; mqtt.connect.flags:user alert mqtt any any -> any any (msg:"MQTT CONNECT username"; mqtt.connect.username; content:"user"; sid:19;) alert mqtt any any -> any any (msg:"MQTT CONNECT password"; mqtt.connect.password; content:"pass"; sid:20;) alert mqtt any any -> any any (msg:"MQTT SUBSCRIBE topicY"; mqtt.type:SUBSCRIBE; mqtt.subscribe.topic; content:"topicY"; sid:15;) -alert mqtt any any -> any any (msg:"MQTT SUBSCRIBE topicY"; mqtt.type:SUBACK; mqtt.reason_code:0; sid:16;) +alert mqtt any any -> any any (msg:"MQTT SUBACK topicY reason code 0"; mqtt.type:SUBACK; mqtt.subscribe.topic; content:"topicY"; mqtt.reason_code:0; sid:16;) diff --git a/tests/mqtt-sub-rules/test.yaml b/tests/mqtt-sub-rules/test.yaml index 2b909e885..0bddb81cc 100644 --- a/tests/mqtt-sub-rules/test.yaml +++ b/tests/mqtt-sub-rules/test.yaml @@ -47,6 +47,16 @@ checks: mqtt.subscribe.dup: false mqtt.subscribe.topics: [{topic: topicX, qos: 0}, {topic: topicY, qos: 0} ] + - filter: + count: 1 + match: + event_type: mqtt + mqtt.suback.qos: 0 + mqtt.suback.retain: false + mqtt.suback.dup: false + mqtt.suback.message_id: 1 + mqtt.suback.qos_granted: [ 0, 0 ] + - filter: count: 1 match: @@ -109,3 +119,9 @@ checks: match: event_type: alert alert.signature: MQTT SUBSCRIBE topicY + + - filter: + count: 1 + match: + event_type: alert + alert.signature: MQTT SUBACK topicY reason code 0