From b3bd44d358041f532e24359591c01a7bbb6806a8 Mon Sep 17 00:00:00 2001 From: Philippe Antoine Date: Tue, 4 Mar 2025 16:58:33 +0100 Subject: [PATCH] detect: add tests for file.data with HTTP1 multipart and multiple files Ticket: 7577 --- tests/file-match-crossed/README.md | 7 +++ .../http-multipart-post.pcap | Bin 0 -> 93987 bytes tests/file-match-crossed/test.rules | 13 +++++ tests/file-match-crossed/test.yaml | 47 ++++++++++++++++++ tests/file-match-crossed/titi.txt | 1 + tests/file-match-crossed/toto.txt | 1 + 6 files changed, 69 insertions(+) create mode 100644 tests/file-match-crossed/README.md create mode 100644 tests/file-match-crossed/http-multipart-post.pcap create mode 100644 tests/file-match-crossed/test.rules create mode 100644 tests/file-match-crossed/test.yaml create mode 100644 tests/file-match-crossed/titi.txt create mode 100644 tests/file-match-crossed/toto.txt diff --git a/tests/file-match-crossed/README.md b/tests/file-match-crossed/README.md new file mode 100644 index 000000000..0fb88f716 --- /dev/null +++ b/tests/file-match-crossed/README.md @@ -0,0 +1,7 @@ +# Description + +Test `file.data` with HTTP1 multipart small files + +Cf https://redmine.openinfosecfoundation.org/issues/7577 + +Pcap crafted diff --git a/tests/file-match-crossed/http-multipart-post.pcap b/tests/file-match-crossed/http-multipart-post.pcap new file mode 100644 index 0000000000000000000000000000000000000000..755001e63c832c9507b0bd0b3cca758a2b3a2212 GIT binary patch literal 93987 zcmeIbdyHdQdLP!aT0Oc}?Oh4hLhw4mZT9X|)eJA+WIeiBvo-ygsoj3mc2)1JJl(Fn zBrmJjP4aSi$$Csr+Y8vT97C}cYbEFpBbFT7(jt}&*+2v*MiO}801*&d38cu8BS?v4 zBrq%^2&@Q+Bq+b%ch0#F^0LTcRgc!u^h{Ne_nyahzVn^$eCKnZ@cto@tHrX-~P!fPyYV*=Kt$|@c;bsU;4E#Uw(7t($cqm z_O)03#KOlizwqV!_uM{S`R#xAzC#6&`mI0l(T{w`!VmuPul{Fz@yfS+%eS+)twGqE>PPj7-ah{R@1VExXzQcBU)uhW zh2Qv@KmQ}>@s*$W?%(_9oj(YBv;OM;cElb{Z(l-hUqtWxNf?_o^VnWNk6-)hCtmrz z?$2T@ugJLmF?-{f{(!xF1ij#AyqAxhwU_UG<@b($A>PaOgPmO~YrVa@yPeHv@>dq# z_WZ%Rb>MZ}OyAva4KiMT|H{H6-|gF*`)(KS>cf6JyPC;M@y&YO?cw2T+1IWt-1NEw z6tVBR-TlGAx>a0T3m@*D^xSo;Gi(o9J*Pj&HobnwZa4$yx>fUr-G2t(M>O{MMl5b=R#3FkPqPR#U@X z+jAQE)OD-bYP;&$z#Dj(!SNt9I;eqrJjnLiPOD3hSj=+$fz@!jzBTMxHD};D!wt-;){k5-$3ov21TQe{BuWfzz<5#c%f2aMQDxk6W{xX*OKV~mKdXc?sOE0_Q zy;OhpJ1+g*PhOIr@v(fecc!sOFaPFs)5~vuC&yyew^hjHtOuXJvTzGDxo+(^gS1sB zTc2~fc!Ll5+ma#ZnlsqWy)*T(k-{va=Ob`7VfsX z&(^IQ2ZKS+U(aUaOe1^Lv!D82H@k7&>bvb~$`o^Yt;`YGN)`+0i&*yPK)8r~yIc1f ztuFY@ZXau>37%sff$ba&yU*N4;@UeHblTTZ!s+|&p!#U{j=jp2SgJS6R~Bwuz4hSc z?)PuswpeUq0q}O(R@>?BS5t1+ezcRa>TSpOtEsLBh*K=#I*pBm%QrgizzLd7NxOKh zpDU(t*m940UVnf_6!)v9j#`buLABu?w(71eU(!~qizVQ+ZNKic-D+N1X#;%*7E@dCrWR#C<+4SO5e{uQ6@>0XA4?E!78S~+G+vWG=>o>BxyM-Hr)}ZZf z?0Oa^eRym+-G)_jPdxm&YQ1`GwUEzWx3<9o{Z`+%Trj_H{Dpt=b-&ea4}C!CTaBUB zL1`Di8*abr-pHyJ7Zj2OnTvg|<_-MC0F{d!=h$v_oPF2s^?^_KXua+9_uWM+i&+Zr zx7g_VEYNfZ^@Bx)#KkOjnC`&O?0epR+Xd12nY!1B)D&DV8miQV{ed%R)m6zl7?tn! zTl=l9Ow%H|z$ACw`XJJb(6-YaU{F|7DQkdzu9|Xsy>_dPwy*&DzW@4hr;S&{VKp@Y ziGAlQL+`qE$8{S~LP%IyO%%zd;y6fMAP6_T4(H#W1s32`%4Q=#UA1j%_n_rl*j`<0 z=)1l(IB>1EWG1Z5uG2mNl6|XoV%-C60CihkzqNmW9((N}(S5iAUQ@7a>yZzB5UDcg zJN0LLWP`#L+c`Qq%7C=kOiMSz`O8|iy@A!QC|FO6?9@-4Lq|PLVUHd-cD?ENC*68A z)pXjvn?kM2hfW`R)E?L$$=5Rfs@9@Fws<`(BOvWzlzmmIY7P2BH&USM?Wr<-*8xMs z;#`#ax`{^1cWP~SXVB-HeaF@h>_?k+p}4YI#E+e44OGa!X5G;%--4LYa0j49%j*r? zhUE(78^{{f3W7!H<}t>-9ox$h2!{jOz}J}~D!Yq^;g zmg@0?=28T>*R91WN4B_ZZCG}m1AJj%x~0Z|k?ZMcHD$^Hm`$)$tCoA*^06cpd?>Os z5jG9o5#aES-VLF60vs9i2EAiU(n~PniQ`8}fTPE5jgA^^hdo(lyw?GCuhn<`>h8fX zZ58v@Ew_&Ca&65j6xYjZ_}_Z8d-J;0bHMhqGPRa94f4xCpI`t~7NHBR`aFD|Qfb2;*CX;BSmF>Niz*BBl+ z!-0oN047!gas`V6+Pb^5a~GdUh2!P=?pKDO6_y1lVb48j0(V1DPeP-S!raSR4OUa1 zGTfUJpy;B^VhSqPb+6q9rEy0K@cq=!s>OU+IA+)LdQCF8ko**20iWp(+id~r z@(cBcjF#2-VveesubsKe9%|^i8Ax9^vtip-5cNpac&!Fwo`C=ooMSlky&-7_=1$ER;`?6X3Zc`mje64Dipjoqiwy5ns)w4v@H(KYg$d~ zDjHn$6vwdMe;-e(ctYIsn<5 z(Qs=|vA-SbSdex{QFIH#*odxFr zo~9t&WoMG*W{|%&7Ql*bTz&WEt)6oi?*qaNUY+S+jk0}z4_7@wzVj_*F| zw^Qr-EcrP5IP0skA7`K9 z2M?r@jdKOWMK=RY2{wZ_Ac*l#tUvih9W0Ap25(qMV{g)B36_u@s+ zeQybU5HuI(RM+W0#OAV;OXt$~?sOrdXVlp__-jIfON7i?;E*be2PmhpgoLQRA@HnuX?pINFZkW0PQ~IKyS-!5<`XGa?x_=Vx z=0M-_bN$i;;g7ApzaC9YO!L=Z(PlR?6Xby#knm&xOe6a^$lc`5Y;~(u{U5&FbzWjgLG*7b8#5(Z~~YH}V9X z#-E_;R2%Z`2DFsYvYC@-+i(^c6AASIaMS3;A%?n`YLzDEiQ3<0RLF zwzZMETGbo;J6<1W!MEC8&1vt{A^g4is_(X&P*P#Nck2`t#)`Z_dVbJsLL7J9?oC;s zOT}C+oiFE>*IOfJgp^vrspYg&?QVJJ%mUN4n)GE~o0Qx#}0i-q2?wb_R<4Gp~rRtK1Z*S`%tWn_IU zKlk2spHv4pU$|g2>>$L`fb2*yjxp%9c3}DXK#ne0Xc-_89QbN3-O5lqn1O=F?KW;6 zwAu|UtQSdW-tK#ymJj4Ec~A=WZb$dC9mQ+?RNAk;t5ziTCYDG&Np~}v75mlavgQW| z;H5xOI{bF~n1+`-Sjt3Q+7<4ndyJu=m2n!4+lRpNT^zo-LoB6kJ-8GNKk_USY^9(DqLydt$X`&7IXze+kBUqoi#C`1^f29n45eOYph@k<7C89c zlJGI`Z_8Z{nFqvys*7I{exgJOVJFqFVC3nmuZE9VRk0=<8wVs^Lu-DdM#zYgTMXZi zw7q=&-0fYBv_Po_BL!>Y&T>+{n#VUNt{NxiC>u`0^7ClH+=~~>BWMlfs)ScWwwnz6 z`|kruu}(3sOJL3!buxJWeQa6Kumop=H?R#wzb~)58GZD5^;NKiBiR#xdzRDRNGU<7 zWl#qGUm8`MEvF}(q@Y#8nd`}u4IUDLgB|qbgA*Pl8r8+%2qKSs98kCw+jSq787`jc zqAVVM-&lYav$GG7ZNGz~$O$Z6_$okK&!L~tO0ad%CL6J?wmLjxINbr2TQ#o_W6(N| zs0pu*ZU4Z5_BZjhIt#2@dABptrW_iQUUZ;+Xu;N>vvQf-%2++f)-X!IMCY_y`zU7T zGUJU?BLe$1xMU(!J#4kysnJJlpf8AM;x}fsQs_N!p;|O}ueH7UGrQfY^9G_uTb-v3Go(WTnwxhrHtUUu0T7d_?-s zRF~HDR-5wAsk|5|`drUGCZ9ADc@2}Z`&<)Z9-<`_sI7)|tzNHRS5NJ}(`XI-^%5Wy zfSV3T{bc=~+iiPk$Wf@__-UA+oVv$9o)3Gud)*L2W)-v+@6&~V(714%Olma&CsK3_ zCo*Bay$>3|LDRm72|K;X1js~enPurZB>=z^26 znFV1>(fERprbY*<9;!jkJB+}^3+goB<8TcA%z@+EA>*-O?mrl4exM-b=42*S-o}Qh zSGg*h3&yAlCJb`4KgH;Dhd@61iZ?lmaI!>kf{4t!V2Uq#hyUQt;gBaOsBz>&>?I#Q})yR$to;@05gx&FJJDJ2z;qQXqHUe(k! z$cA86tI#f$t>%H6Xg*15S|D-Sy#qKI95`?tX^+8_PpSt(7%YVo3Yo@T9(mS)r_3@m zDeyH~&*yTz?MQ7C2u<^=1xkt>0U>ml2) zwX|7;CrxowqFcj12z50tIBE#>%Wlwss~4CF1Xd7N$duP{LZ~lgDit0eUbjHY%djEh zQ9e^F7K3L|$u=WfY=kyxvk4hxc%rzbfz%*#AW5J^4-+A#_eGnlHh?Kdwwl*Cd2ZVf zY3MWuyN#`|WJ6*HH0##2ocz02pn+3PvCYNgup-}OLzO5=?61)2ffXZ4f zH&Y#l`a8m0uT8E(IROZOGTbIgP<*ARK0Eb71OfBo~xX*ZSTO z=d_e7)QS_(qlayZuB?>Y0_Kxi>wRdgFG@H5_e#)>|8(_V2fFbGMmPSAfA}4j{@lkd z$H?}!Q}KwHBw_KUo1CVc+TzDoTW-SUs_2Q3M=XS zvX%P`A1>v~<@9PE4@=8%e9wJmd4wKJLpBsL@x>nY9bM6r`(Mfz3g`#MvejJBeJ)+d zt)}xuJeksaoTCYMA_NmS-DEJFr9!y?7|O6v2Wa5Kayp;W56=XOVy+=JWU^21Khl++ zhC*&7U8>;!X?URZJD3XRgxwly2sfk2y)PAtt7-icOhUf0285K-`L*)2?%~7QW}in6 z0+;+AycPPx&boCG^U#od+SneRLT2y)1DqJ3pk$r_*b?9(c~s0Z zR>nlFtu9-u!83GFT1~G^MITrnwroYphW(!cJgK6Pt6&6ZS$CEv`IG^DX)4jG-sEiI z43AGmQ=yC@U|9JI<{&bxQaN41ld|a?bdpO~3e)B(SQd?;4`F8N5R2)29*vq_*4D@r z@@sfxdai&^fOK*|`{~O=wr#KOQXH7pFGg3$6~lg4$sxd^2#e{M^IZYUTE%KTy=OQJ zfgT}ggK7Ex>AmOB6DTHMzjCJmdX=m zFVINYup>bI2>m@3!tsqfQb=vR>sUdjl@c`x!VoK`6*^Yxl69*DVSc1XDsrLEx9vg> zI{i$k1gE-5MT%0SvT{n15{l$cd0*!HO!<@&6_hAI|8Yu@6%;9EimRs-Sw#^z##IuE zh{eUWVUZm69ZUmICqFnRS+bGl(w6=|QyASamA%Hc8?M{KNT@uKUuDeFSnblJ+GwSZ z>Za$Ux)Xbbb3fM|&Ir-!HfTxpPo{=|H}fmMoDK@cN0*-j9m22tQ=vo6K%*t9I(W4X z>}DG-rqA~sRLy0maZM<*-)}YIWq4Avl)^7)<#}LIW1H7sB$nYT`>430z%xF7fIzAk7hn=oJGB`c_LKH!P>V3RQ1Y^ln z=vV;lu2OX*_odVr;d}($O{yE|)YQ#T=Ks}ycyTiS&p(FD|KAmUa$M%$|3ALt(m%U; zNq)v<{;NMetIYrNkB!V<{P{rU|5HEs%m4B|72=`@P+9@4SFvFAUW)T$(Nk!p!E)5# z`9kzbqq5nI&5c$|Xjya$Gd3q>6WR#W4l}kBluu|&9YY}e&e&E^KB28ZdQpY6ge|C^ zIunU?r}v=_6mxYURg-!cJuuDK`bf2emK9pUW7nBb9#%_eIj(b=vE6v3gjN;2hN$61 zLEGQdnH;G#v0Wv{pQ%w*C80&N=0{bh&qp7uUjQchJk)49fZ zTAz)VoTmpxKj26S*h%CP_IY|sY;k(eitk)t$1`)IbM-j~k2+6(qYN(ruW=@HuBnVS zmC)A+XF6ABBW+FWO>?>PV{sbq6L&PtO|@B6`1OVGyg3@5o!8CL_zXO5j#g*nZF96d z2Tz-$m-F$m^LIEq51Xg2d3e_x{mj9$=IG_@ylRe4&dQ_a?qVWu8i63xwrjQ+m?=X3 z7?G!vSXWSEnoT8vBhO+A2~04N-C<^sX6YaauCo|P&IjOGdYTStf(_*&!Aod90j3#D zE9U}ghV~PnO0>9~3y#DV6M7!Em7J^F@#ZG>X)Goe(4T24p|4<dn+u_PSl2mh?TZhWYn7Zc6ARkm^= zTSi=#ge4$O1Xdxq)3GRXjBXHo5_oj zOl=Hkc|(O-RPVX{e(MN{bTBucDQ=eFtWmfL|6}}ygBE_{3H;rWaZNoBKI5(aymAw% z#syIQj4Iwpx;Q^}F;o>vh4fcCa0=9paEW4WI>gA4@-C8lwFlPLZ5ZyKoEr8OM|4XE z+D!@jI+ZdAJ94;1;I8CW^OYIkeit$At>zPCZjnSU;ULz|Hip%UnShqNdZD9OJ=-W& zE@~7j=N*MgNH8ghA%ZqjBN-6wW?y(m0~tq|FcgVR$-DXvGLMd?++jTHNcBBaUGnZc z_4kl?0Nhh$s)I)aQra;88KSHapouUzr?H3DU8G+GYr{*VZ%ez!Zu+U8?lqd}UT=^d z?7x?OuhmN*w~_Q9)#^&p=RM}kV}*C0KTh%UK1R=^rD2vkY@L0Z@eXv@_Oo#DaR)x~1!c`VMbiXHhRPH}N@t*o z)J7x*IL5bR$)8SmvkfY7_X6z9Sz9)_jf$C-Oi=+HXNXct^72LjjWVk9z!-$j0-mSH zMbbaff1(H_Yi4Xjn|`DZXfR4nv%vArTe{lrgzYLqwgcynZCLGLkbiwz&i>l?zMiWL3K6g&X1uqjNcPgXCuS!V3AOK3a z4F5;wYKCqY1YFbGb!uY=rJ1-@Ke&-~7(#!U8K>z(@)zOVaZ!Hb|KgY6L-L<|*J|KH z@&tb4e~P{Q@Bijv{Ko&qFBu<_ga0P(LjnXS{^R&q{SGGAV2fzv6X4P6BUfb=S=|Dx zUY7Y7FKTxXu_$;4szxUTvGNdFuqSa|@K61gkHBj_*0W?_2Fr6!r+$DY8OuRKspOp3 zoVXj=gS_rj_tuMbhMaD)C16iXZET+@H+C=5?hS4*@+fz?Wpf~$zC7v)%}xTl64^)xg05PV9q#ynjkQdu@+@& zH7V$6Mhy;2er_N$>wXzCnoYn5KwPeYr|7OE_iT| zYXF%i5Wmo{kVJ*)A(^6Y-xIfTW;GAK;&K8=8VIf?_>vAD1g+^(Y8o2m=RUzk$gI~c#c}nS{X9}Nm$P( zwt143T+(Fo*?S;^y=}7E4fB?;TS!z1e$i7nU^>GVQh~zGQD!CO>#53o3$_iwt0xE%JTr;u6TMbm;HZj2v($(@Ix{@yEdY9L~DKE|y%M>jaCBbdTKahQxQha9MDrAq#yMmHiVWnd_vH;CLX{LabcJH2?!J zaSKP44pIcS8F6Y!$iKDK?IAflfYq==87r&Vv37Remao%n_F>6FmK~7+ z9o!dyh=0h82-nnb^iB^7zUbSq-f`kuy)A}%w})48DO@DF88GQ z=gj}hL`PsrhowFC#wScLg&9y>gb%a|S#r}_2pGxaE4UUZlTSy!AhyL~qGpw=9ytJj zYBlPx7q!#i&L!^|;3Gy1(|`vy&BxuYOqBsreXts{6lp4h?;Q7|W z2ir){ObFFTUtlgU4`hUL4a7e9I8xM#&-wvbRyI)X^A`81~xDJGo_}01Pbz1Yar4C7Stq?vEFV;@?tCu>`Q#p zaj=;%%Qax&j@P9${;wg8f6Kxp`5E`e2n1zc14G_rCHwKl9%P()g#~(fvS> z(8R?oARV9^c!Mz34AO0bB=HEiH3bMEH&_KF-}$`wq#?C&X$L~OnUq;-={Fo+u={~E za9Sgc0*kn80cZg3nCV+yIUr?W97Yz9PC=%~XfM01Vn+m7gQ)nGT(pp|-dQucz8^YA z)*x60#fl;f77A9w4gkw*$_Bl5DHNi@ zjL?k&5<;6VPk^>C2JJf#b}%TQ6o?ge7oe-}B9n@mD&c;JLmT|)wmL|yu*8`{}r&(?c2bVdE3fm#$i?LTD zo|XN8U79)tmBxLXB`4HTES6Ir_7i2WU`z%l0hgut6fj!F^@P=i(=nBJE?+*!T#i;Q zM98*O7$*cX?0n82XXqgt4heeOqlkC+6X!UC*jW?SBC=^!%s1-%I97)p2!@0f`>lxjYF!3?!iR|Z! z8-SSfCO%U21Ka1Z+nak~tW`g{<>%G)C~_H4C>2Bm0ZFKDa6^26DRM%%@nH`%`29cs z=8yk}dWJR@Hc`xMcU)~ybwlif6c8@9Z73w<^zltC0+}_PkF3v^#|OSCMJ*$B=WqcQ z79=tfhLYC#g)eZ=Z$cgjv71usI4}DwHwCk)oyG{M6joy4cq211#Mr{SLzW0NK6nsz zxsGxZ!QK}LBTx~yacFTN3V7BbF1Aw=%?0T{?i)=GbtP1SsGU_^Zu!yQzBo1TZ~i{i z!2kER>L5RegMZejf&b(M_VU|b|LP~c zkIpLI{`S|6viaXW4aD2mIi6z9!Ns-EeT8~bk@1aULTkQms7!)!J)L@{l$226bj{n^ z33N_SQ{9L@M3y%Q_|{<^8brLJj)%II#YIu#ENYjCdC!fmE>cf%UTp&)*?(rQFJBPLpC-Q3Sr6v zvNyPvv{n_ySPS<*K{*`WftjEYQ&W(YtBJFzjfcFVSgAjyLEUZ)461`+{h<;*_B;u^ zZ7EAlhG}VvrNF4;4A+>Zz{Ne9&@aX`$+&ZbYD;~Tmn#Wfma3-MxSdQqeLM9lP zHk>gSPHw=Vj+tS#kw-B@&Hco+C##Jrs=zg_5c}FS#V3;tF2&VAYb<38NTUOd#(4}b z`rbMEU_$tfT47$k$)%FbtwEtKYlJ2t8j4z71VeP-ae3ZrABSciK0QvrReJLvz?}<08Y3zRwrqi5%~7v~Yb`RoEF+&aTzw&7f$MCl=^% znnN&bv`TEP->CJ)6hCEcBpVB4I(Ec(4h0%=WdLGiT*+7L+?t&)*}0sZFW9BBT-v3! z-C*aL-->dkUX@KHoB$3QnowdkFtn6QrHG*g_ca?fKW1nF>Y#xM%`7F9g&ByO{MpPb zXBmS9_|9t1n6-VeKUMOaAhGQvnmW*bXzGwJ%G5zay0V&)vPe?2pUQ9Nrm14i zF0Vvrie7A>?<)Mw-h(asgCQ{iLYeQ1IRR#r)WB$nkATdetBR0W5nr@4F-B(N_Po-{ z%OkY0k<4S|n}OhhX|vYKt7kK+g_QQ73#(WU7sUvB6D2e~9H|u_+uwVJ5zECMP`<#q z5qWF8tlQ1PDI6L#ZQ-V;8a$(L%>)Rflz+HClb^&t-Yn3QA;y;apjOg&;fh`&s6la>Ew@g(df(JeJFE`3263 z!0A{UxNRGK1r{&R5fY*r`v;7U7`SZ7VmETQr-F)b48U_WJeZUCc#qk|J&>lsgAgVX zX@afdoTE2z!x?4rY~IFs7U(aljTMKABCoG571s+$1!n$Pujg=O-IaycUw=JemIQA#jg`Jc$(5kNujjO*MhT=7q2J12++u?(lTyUaoT&*0Gy3YhwQNnb@))I zg)PUv>&k#rg2MP-e~M1`eGi)|4Q5?<6mmvk9);ip+oIS+u!tyn;fdJ5zhqWwdE-ry z8r3?4nbZ)CA_x#FMT~ykPy)9`T6wVc(J)POjVO6%l8K-O*BcNIA{o$FNZJ|yARGc9 z_+qPLIKswl$H$os270Voup|sf)-HA+_D?>gI1F;EMFB`=BB*6cEx4g|;r0VN`p7~t zrbaQR!OHE$S`F$`-WFaN@}aS�chbF8X>|0gGrMKw_+E>Y<_Z5Uu3UuNI=sjcoxV zN6WcIjzZ2Z{gI0tArMN`_#&oO9fFh@J7A50$gxs@*N|}`DwZmfMUFAa79#P>l5B%< zSb*;(NVd|x63t45(?#2r9P%R?FP^A-&zgEsS)qGR?8T}G!CllpRW+}nbhqqsYZE>?#{yAf$kA3H0 zSQAZVKo}}sZ(P*b4rGK5eB7EX-Lg-qC$d#r9s2M2aU*%KL5tvlUAe*CT7NmBJAvpw zsS=zFQnv3LWjk2aZa;g=ed>I1xPuF95cucmub(O8_ym9W5Pu+M;dcOdW-w?jURh|? zarqH2W7&tz0E`K{ykgj=Gn)NjizBHjm>ye%;ju*!9`nHS*a`r6jBv4l6@94Eo~AOt zaFw<>1TOLrxELM+|5$6drT=`PkqlN`5CuY{>gteqrDP67xw*CS9 zL!mu*mj$0lNt|X-^5XUMTL>ia8pFEMIA~S9(a+G~x!dLWT`6MVt_`h5mlBW!R*)bp|OcNI@+DS+dd{FSH$86Z5g?}g2D#A6m7 zvQ6<0Mo7XDY=S3n$@a#3+oCQh@Csyj44S8}FFNkfeQYSs1qAPVsC9Nhw1EzCxPi zQ!2**3}3(n6#*i=vA!`B<;buHlRK1G2JKXfxpjEX%ZXeLu#VU-cz$k$j;c4_F7fCM za|VWHA&!jBaW}Gfs?W9?n|^fWa3EIx=*r6-o}{8b#BJ^H<~2bi@C?Q|odD3b1>(Te zA(zBcBc0_4iC0DGb(3p5?^W3O* z0AOAL5Wtf)@M$Xn6rzTl5yUfK%nz=i!UO0)290w?PhcY*4U0>SCUSOmP`4$uvVpB-+FfA&xMleK6k@Hsi=%Yq$+~ri_X*Ra*0<<^anM?{mL6^0 z!bt$PU&z$*KE&|dTk>vo`K>BlqZq~d6q-}$kQ%on6ro|iiJRDTx4NYsJq6Y!%nGMw zM#K0S`m-S}^%-^@iPXa`)CQlBw{(Qd>Lzf910+vrNPeBZ1Qa-G1X7$#H8dXwuS4Y@ z7qQ`9hS`aWI=3896894a92rcmZ+&Ih!uel87U&VkyB~Goe~(EKEvGOiexXkX8W~_~16d zJc1apcA#$=V$XnG$32#tRoM-Bvk+O_A^`?eZ^O!hZKU1mfT=(W$t?$)HW0D}D}jrE zEC49p_@O03xIk0b1ehyY$2O(~3aup{>4!!Os(oOOhY^W1+(7y;T$08Ow;bT`-U-y! z$BeO&%|f;vOn`tPV=$}1NHJ`Zi0SZMqz6O!Qlm)2i@M=tA&((7cCD zqJMI`--qg7-rs8Zr0(0GkQQ#FW&gK0M;W(^$wBYcN4t0IRgSCcWN?G{i5br=@MI=N z$xsJfjhK3HpD{!!I1R{!y>{G+6?=)rUCYLv*zjJ*e@~tM`lJ@6(rd6?>}O(CGmx>N zG{>bPncFc4WCO$i053eQD7I#3e%L#J#8=H_wS=~UXw-;y z5q!Bb^x+^TLU?wwL&ajl=`05eXse4257I9-4uTrADH6qDT*LWkh}Y6H664gtEL_|> zx);OkUf$Ac>B_>Ro!bx9+OW2<-+$)j_9N>v_io?gvoG%a8T@{@vt#Y`?szv=q_HDf>>XXrHHg?1un(P*iy`yrC6$bxD+*O`Tz4$ zB=ySP$-MyklR9GJp^!HMRCtJras8Rd8Ot$7;a3)h+&^>WrP$+ToL=~Nb?h-EUq9i^ zm4#0uGTQ7mrcv2-!p6+kuo3kn%7%8amj=ESkT_f%1hMOZStE#;7d)IjahSwWL$+=aH5lS!WFnjwm}h{!K`h3F>PSfe)c}HeaS0~QiRSo8 zA?J=d^wQ5cdN373usZ!~mBA763{d#MIbO3tB{HxpIbn(n>JD(0;J{=&D2Tu>T)#`1 zg@fRUOm5R4z^&ceOsTo5I#3BSqQibWXvD+a2(9d+> zKOcP#H34rN6ZH%LQ{WIka)uU21Cp;dq zhO;J4rI;874y#i;_lf!tr|B+F(^SV`GjW~J2XYg~cAhP25E;1xIG`g;HN{o*=2LM) zJdW-sI1oaD<#RI(t)7r@W=;+KZCLTCR}*l;eTpFYgc2uqj!iTd;q(y*wuyP_WB0(h z%h1V|A*BO^`YRN4q3Y3CB^ET4(yZ@6y2elufgKJz#2{?(IHMsvnF=#L_5f`ki1rY2 zrn*#NDt`y6(u-2ae&0hVWPkk^-WgZOF83}ZfaGVt@1Y4GasNi3kgY-?+bQH~l@9|* zrU$5eXl=tWBSjVF%Zw*Elb(C3l@0o+q*#zLU8)N!yZM!M+&Y;rL@Z>|e_`dD!$Kyu z1*6`N+s0%MQ2KmjIN@(&+u(^7jNP9-XyY`rU&FqQ)N$Cf?z;43WGV}3eW*M61x$8#Wn`zvtinO)`u5l*^pIeHG)2bvS1;1{qrhKf@%z-lEzf}9o?7| zL})zQSFVGQ5*VxLHG^8^-oB}ez9FyTR+8}DR zdN{k|z)#0!g`W+LhKK4UuG>{3gd_urh^KH#j|C9{!Xr~{jkSIN@m)z(STSrkwL#Gb zy*OQDL+Xp-4B`?6A~@(mg#;Kyd4MjQwy#^Zpp-#|#og9>?|I!8HH0ETHQ?_9fyhWf zu_n+OxKR>UFe=>X)U^%OAUD%Q&zk&~2vYS4d4!!2&OWe~9#80&f2!e#3j#~F{ z)wMEbN$wKKA9vV-z^hL}&=L)xfaBNGmIK6M5@U4v;G9G25IcoZ2-+RQ_{d2~9RqpP zlSfXR)S+Le>B}%ZyVX!D2?;+n9~45@j8lZ^zFZ-X%t(O{|NT1cj!CI3!1-+)3w;Rz zSdaIa5FMNBm@4zZrMsur`kr3vdz!6fkfK>4N+%T{>cJ<>k(Nc(1pxfYVXm_7d- z5_Hba<#+R?^-^iQ9F5Et=yLgQ4hcFUtQmnPE=S*bsXk_Ba9K0lGa1Y%BfS{MwfTuC z;?8!qAnuD0Fh77pLw;>E;2TfQd1#Q6+y~($mMe`IyNpR2n>WnbjEA$I!eH1+a2vZF zHE9`#9H^PG?Q47M=cML^i}?s6Qc}m53`@B}K`k;Y5(2}~2oY&!2peO7QHcvPG2#nD zKO^HUrsO5#F9rDs$B5XVA@(r!A}rF8lgB>vl1#s-#H-Mr1_A2smu`k;FZ3Jww$bt| z;phtgMo51ozFMLh^(=)=QK{0B7YTesbUkD&TCO*6__7%Q(128DYtVIER3JOOsq#T4 zj>Y(NK#W2RqbmkNaivpkL|T;^jFATvYX-8DG|>vINniIgjKi+Nx%f5K1A~ky1VJ3M6Wt19l15; z0uRRjP`eo_jAh+H9YLu$_B7(4DK{k(REATOD$hBmJ5y{J@v;Htw4WI>27<_ttrWfs z;Z0W~%(LtSsUk3c!k3>E7Pj!7>3DI|MABr#Jk&P{P- z)W#EK`;Hw9KqGZ#lji9_P7aXoHBJ~MNlUn92l{UuKgO}kV2JPr1BqjY2}C0XvD+}} z!d~1TOtjHw>CF&tL)mWS_hW=Ap7KxZ>e|->l*eGy>Zfl$xPNEw&eq-As^VFi2we(3 zeS2r`?FTRz^WT}9fMUh3e){f%xAtyrDSP#qn}B-Kseby_=I*9xSBv0@4Gbf$)@|A^P&J)^=L(2--_jF`9nMug=v{$mR>BW#5 zvbzM8+5nsfekkIZ)^iU#P8J*rDQvRkwNklKUM&>!rQ%uB(xcRt{4M7J|mn@@l(3d>Xu@N4mqkqgLdMD z$8BJ#RHjb&aVn!YgbYS2av31QC7t!en+JZ(d@SD8HMq@T9JsR&*==#9i^A8b$_a*c zlwe7`D0}64<*T3g=!2j6^}t^F=MmmfWiL1TmoMeM^^*LI2atU9|D82}WW8bnNN%pj z?Ui!*#)sMLE;yT=QTcut`e*dzVgxwPacZh=Wh6sg+0K;^alKoBCun)SREb$70Z1`t zbSiS5(OU6I7S0@+E3mEd%6cIeZ>yZm6--;9{VitBgO=ojhyj#yak9!o6w~UcsSf@8 zZEOMaSUArxmk||5@oW)$v7PMHGxVq?LwS|l1OL1zF8#(Qz@^=v{o@;xlix2EU^qVp+am7#>efzS)nVC2)%+jbH2VpdmZ z=-p9P6{Y`>!nBRvW#J1~?L_n_HJX%KT|~%1B!f6Ms$THnqQ9SM4YIdkJm0(P!i}!m zfXQ^nx%=oX0!DdFpyUT$tD!_DH3A(BrxXNlA?D7yjY9*@12J6=^F_gdfmNtZFo{b= z-r_6Z#LS!)LnRJ@E{(XeXn;_a1A12M74oZ467oz0I$$&(uGp*Lnj;#OAd><4rl_ro z%Ei3Zl)m_;vIgT{K*ls&sd_N_w)UYq;RPAflWk5ic;yP&TRS)R%E+d%mxH7GOSS99 zJG12yp~_11GA1=;nD8z&T!EbzI0)^$B}UfiRV~*s$$jaOG=YNexss`Hvy0**1|q`D z&VJ9)Sc@=cALrL(%=6@Z8*NVv$H+uA!E*co%GnPo!);YatP<%OBw^1b)JG zF4K;ztU-H-a#X8IUy=i*q{#;^3zJ7hr^Z7YH4hyRQMD?;OU=c#WJ({QQ;LZ>+T5KM z92_Oil#a-(uUO;!=3`Kg0Z-YAO)gr+D^>Ewgh-P;rE()1pL_G>$7UlFy zmJ?Lqu}`#ah`FLF1AhX|EZ7}ffkit4_9vI=;LaVStrJT>uTQA;hXZ=w)!?5TOnIJ!Rt<}^gFVmg^>LReE$L<~X$zqvP$TfD%3*OTwjbUk(t>%~Rem#!PR3k& z)>|!%um>OByIyzSOIvq`b;o)O>KR7MKsO}L2`&=IU_*dAk^?7oo{B}8AiE1Lc0o)W zVmyI41pHkUwfm_j;}1`h$i4odYwHK&+6q>3CP8hE6J&w;(h*Att9&URKlK%|XUUh& z^duKMohluXmO_^t-&Y&-e>W z;rD1bn}AF_PQl80#!NhHYz%$U)ETkHhRk+jra{^<`;6L!FGxdh`udD$1qx@=3Y>c4 z8dU_mj6?HEn2;NmSX?8VUqQI#h512aMr@VO_T`^N!84}bw6-PZuOhUIOmaUZc}^If zWy~Zvu|niixnsn@iwi*E4G}*{(=!qlVBTMv;nk-!B;%e!iG~v~T0ALWUuRAhKU`eA ziYJRR^XGP8Sd}}0LSfFj{l(i5(p02BZ9@>yDbuMeIlM2G(Pls-Lu+7vf%DFiDzXrV=$yIxQc^TE5rtPn0yy{vNmg;ROw|By`$bmHPEB9;DCZ^T zM3DsaSUP$T_ha)$Swu<_*uv+OsDg64D%#{Bgpr%*l`YG4zlQuHHbejkGUyK8l_Z~wPw-b) zTztayV!rJWd#tBTs+>jT=Ye@t@wz(1mY}X>%7R9QRXRsJ6A6V$f>gP39Mi!l)H>{^ z06iG-=NM>#!Ni_8gJ%IL%lmCiM&$6M|xe1^1ZG zdrQ)K;{&9aC+yq@q$vsc#y-I0@WOf-T+d4uxZh(Bl*`-0 z?F=QA?_mS6>)=QLOs3mhy~Ei8LFvvoWe|pd57Z+d$ne9N1nO8p*3D>X0tR*?plwoq z(YG9PM+VI`nKVsUDl!y^aLAdHeq`TL*S3S?K;|44)7@hj9cLex(qqf@TWr}ZLP#^9 zAnK=tpk;9=t){FGSyZY3*`!?g%)OATPoa-1u}hs_u-R~hKt>`L7ScTi8Pn5J1QpAZ zEPI3(ono=OS_Jq||Mg+m$~QyU$~g~iXH|xk?0g<~Xh|C60x}^-lwkr%Zq2wr%;Zi{ zvGb+fd@jkIqLR)3dzw<&sD`4h6*$YkJOz{5eaxv`6gg^Bxi~e>*~n~uoz6KF34z8( z`F#97B+iSHYxmlaYk%M`-wov2A2o9Aw|{Km(m%U;Nq)xV+N(c4t6aO+Ha;JJ?MDK+ zwgI1yA1ziIP5KVY@Lq-%tBjjC;;tXau6I5ymN+1V9v*?tGJJ%SBBEFaxDFS$>@wdT zL<9{4(0EG4sTPGuL8YgvVwL%0<;YJjq6m4%h-1v< z2#LIzOa<9hz)E}|Dx{r@NK8EmS)kC)*dgd%4zmk^12wyICJT;SJtrxfvS58~5 z#%K6;y2qK`K`(m`3h%vb1cRqGOfl($QW%0lp%Wc3dZSI_B{C`f5XVWoCNrJl6vra~ zAE}6czJZZ)7ee~J2XPNCi64v!LNQd_5+f?&t$23hjKZtmajbyNk3t+Y|LXKgf#1EEH{N+cFTQbK+sbwaFUd;S4pAZ=V2+lKKDDc^h_ zqG!XmX*!@2gzq2Np)V*7E~lr2ZWaE|Q%O@yoHX6yLU*RR)rxU#78jR!(Y?b6 z?;*23mYRsVFfkb?92llCBeXP{i(qMfRSp1w@fI1sLxaUcO4kl3Xrmg}UK11??C0R^AO1UpN9a=rHSZER+84?!;oG>y5lwf6q93xyJ zJMI7;V5TUw{e(EMK5U6yL@t&U7XmT7h=Tzw5|T{MOck$=HQ6TYu8GTTwjCUAk?9u} z;#L!Bn#BP_j3??Wi!&`?#r zJO=FdHbcy7pkdrUd3b2qEz9m$58%jxH5QFb-^B{zg-f`ETmTBlveAGQ97~Rd$F`Wn z!nG==a2LjMVu1usyo5Q1Y0{33K#jN66UcZ~v;N0f)KEUR!pG({t!GxNcUam3a$&wU z&tEX|+I)cvJ8U&LAj1DaY@LzzO&Lj3DV-nCs1+#;GcnR>3{G&zbUAlDY&EC}pndjk zeO3dC2k`nCcwijX05>M!CIMRFtOl{3U&E~kl~vx1u#OavxQ5d-1eo!^@jAfr+>|3L zqLbm*AWNq|ghLSNPp@4%od;RPiE&*ZxDHHn1~7!s2FR5%eSs@Z7UO8#!=_h^ZdFM$ z4CvSpZ`#9c4{XnjZem4KAUgalne|)ha(e65!w1_23k9pu z_j=(RsTBfUzKA;jf(t4_E`Pk3MTi&8;NZ)21`Zb~9W0}%EY8fgrXPQVqlF;FnOTpn zamtwQKrY1M$C4x?BEzB~T{M20dnxHq2}>>N>Ll_<_PGyu?HOJSje8(SblrVyb%+sy zTO07LZe-;Ct(*-s$CWYSQVWw7DBu%j*H^oI$HmsE5F&-e*#X&eB_UPY(}gn@{T_iM zP&>3M3~&}DN*cY8(Nj`omD;#(Uh|xH2HojJC^=uMPsrG~=NT^Q1Yx=c zf6|UQArosCsK1>=`R7yBPSlE=s+FbJ@)dY@T$B&VSAPpWBwuR&&w&rgPr-+z!Csco z%Rj~S;QSf)A^D!aHmeWGSAWa+MxT5t@F8*OLvj_@fZ|?2`c>#0PqvLP@hpNsTJ^TO zaf1b}(dWaycFp3ug&X>v96jrU@Emvr>b!AEIT(mW~sixSWnE zp!K5UEe0QCt`P9MIrN86fVQitP)n^2;p-4JMFWWl9j$?+Hbs*E@#q+8Al1^lF!eRG z45vm;K?oM56g;9ODuf4XC_EtokEsbpLf(~zwUA{X2s9eD4-FB*51>JXZ*}{`hddY` z8AyTmWx_?^J?(of{wFG|MItSleS}lsCRgAE;-To>jB7gso9J2)$@HmD6~i`2zTMgw zijXKCBoyr<1$BM|4It%go?8&$gIZG6sMkcvCAm@%hLX^L*BnTiTCKH?G~gdlerGyd z%EJgHK{5h*Xw!GQgG4dXQ&vFjZM+Eu3FKM|(WZo$Fqp(aKc{GHD20l3<8-YNgsKp5 zL;r^b_)jAi3d%?Njzdt^!DiZ*rjtRE08iqJlx~_6qro*N0EQs&#xV(>8k_rw@)#*x z#PvJ-tOea~YD4~zYQ^mXXB&o7?5i8iJj7D)LNy#ZfQ4G$%5E$m$%V>SD~AZYM_>%J zI!ISQjf1a3+aen6$f#<=7A_KjXTNvU4b_yV0V@ZK)-x|_K0q7Bvj!d!3RS>fALb6Fab|2Evb^9@Km1mh zh|G+f6%E^Ph9C*KCs3TZB-BAd1c6Q*R8_CiuBaKsMPJtq=}^vW0a@_?$BO`Aj3BuI zLRp@;bdGsCK}3!YPU}Wv)-t$+oHy9R-)96St^P{mW>VT*NVW}JbgQO$Bo-gt9-Z;LSSb|p zC`zwoY%d*YiJZ&MRqR5AKFV-2$dxlIYiq@PB^6QLioQePf=q?zXZ#P&$Go2$;TY&a zG4Q))>yq1HXC^_imFwmvR4%wbN@4yU#SOf}!tXw!p-O zy+Db)$xz56M@4jKUIE=kmyxFA2B<*&vALU>_5z9J<1Lo^L*C%0>~UlQIsiq&MR@-s z=wLYTpc&yEl^A)=Bi`=X&q$RN%=nNs82t`#?px6v_3nmyauzGSepqy-j(~%a{ zNoT~~h=okkW?)uh*sYKmIB-C@N=FlvA#>+?5R~{M{G6N4);5(wL>%c><1Sp3SYgW8 zi9l7Da5YOCYY0u4NYEQ@XG7T(Ze;OMQmsSfs~~_;0{N?fTJ(jUiR+P#7iKOogJlAV zN(^184S6bT7o-sIu^l9W;cR0ca5x;swiphtXokyDS-M8{&j3f*hM>Y%yZ6}003z@l z?tC=-%5VU_5VW!MXw)ei9zYDM1ZOkrK5im5IivD01rr7k=n>+`<9N4BUWV5fL&UUcA(Y^_f;%vgipO=%)50gA#Er_6*!&->Ps~o z{a%}j7=pCk!eWHMNs=_7t1cCAU^p-(5JNt~o1paLv~!fwvJ?#GEIg$}f z)|?a=AwG`4us~5o(;gN9#H13l>`i2=y8ZCMqus6hZ_xtHincAI`YR>=C?w@vY%QHZzCi3?VG!3YT(&~z!#I887;QL9d$RdKWs+= z_G2bhAYV&14$i}z5N1;_XEDWI`YJFU`4R!Ml19z=naP@uX!Q;#oO4jl zl{?@e2oyc=1~wY4lSrOMY(4L}HW*!N*oh`AEEZDMTnP)$K9YHo4$jsK@nlts6EYD3J>ea8 z@@4c6yG^WJn%H9Q06w+_kgcp%uxJvn2*-vPjn(<(6J@cu`bSNa03m@WA98J8Fg+p# z(95F7kwLs9depOJRSIj#cPdV&$2W1Cw>kh(oncasz(wEyn?F(yAmNMhgOkgAz-XPW z*FEVlx+ipBQ~r}TJ(Kk#IJ3Z1$$LP#`RfyTa1D{sc1ZFBSp9IdkKXbiiRjhQflzQ{ zv}#-(D*7KwXiJvMGyKLrgY^PqsN9gwYXi_5PHwm^M@cwZ6{!_c9MOo%YT$Woohm|w zAHH^hs^cHqf$BK(1sxa&g)UXcE>*`HKeuq{yT9v_{EVxPKk>iJsyhC$9TR?7{Eq|G z@ei@5;%bvAr*C8%twW_J){0~vU2r;A+TzPMKD;~N!@C1s{zc}pzbaAo46eG6ZeyzU zIqasQ1VVgBDZieJ-fS)a6)I=4o1!fQ(3cr&QXX$Bh+COtTKi*VH$96U|fbZ4bk)@$G)MEJ!=H_+3joRGa2i%v=JLZp;4U&p&5$r|AwMM;yQ1n{^c88 z=g`Ew<711SXgHAfkQaxFK(DJa<+mMVU#q6Jaae`xdOTJhS=w-TL|{AP>vaZkDTt%B zX%TW(L8@VckMtM6r$ln{Lk)y02ywUr3~q2};}^S&%yG14=pvX_+SW~T@Yr%}4kr;F z)Hm5walftD;r$IBt1ssZiO zK_Dg(YFW^RR?kraA>PCO0dbsJ?!j)577&@I0;1uo8mtMpxdAE^sh7efU~LyE@e$*s zVmnwtpg?`0eYV9x`gSpBNwuIG+LN~+fG}Nz?m_2^*k)}*@t1GV&WeS48D`-qz3pM7 z9feMQvT+02bVemvsBGBEAeca@Umsw0HznUb?PvO#!m>6epVno0Mfw*=_MkZ4gY~?P z5RC40K!RPu#x0@|4<~EM?Jg_2LE1uDs^vBj zJOx+fhH{>zf=&$Z1^WOoTR4vqO}xP*EW^XsBkYci0<7FpCPdpbAoFJhGJqIx&?;*H zB@nTlRhbK>^+x2)|avicbiD%ICO>cz(^2G z<(@nSg>c?b&L_s@Z=o>9r+)jhxsA)^6EcYxb$O7m*i($53}^;S@keK z^>O3E_lKpp9tQS{j5wHxSvNpm-K*DI`?v`jh`eb&hqF12T_FOfIGyT(-nz{q?~dZ1 zGxU+mouv(2Nw?CK254nh5pV&;(ykWl;p32~h^1TJy>J7aF{$ z8(?h?I&gMWUqduaqvzsEdHRebbS}%N3(4MvgDg%;2N0y)qgsoTCCf_QiGLamE9%`D zz$(lI6^!QN;JgI~0ovf_fumBH3l2%=CL4_3f~T5;gbUE9!3EED>Z|1(a0GE>cr1I% zj+C(8(Iu?SnLi>aD1+|=Z;-H?ZU^d32vT(E$*G;E z0v-!+#8U?k94I3v5K3&&Eg=!+ghL1m;G{V55ONQRsPCQlZX0$Hnj!RgB(n7#d&kHj z4G|beqBcZxx~;}U19#*v#u_baB z35PRABS0>9EKs@=CjSV~sNZlg@x}{-zl_>QSqWZJg3_>ynK1?%zq$WT^aJK}KMi9z zr^q#M@D84DO~C^PQ+NaqP$42@X@JvlUnTH{eu8?oF^byO4)O0WgTJOL>n^TEfI19k z$Tv@DaJF#cfqMjJ8(&)`@ql6Rv`21ZvDTp)8Ku0NP8aLp9ROp&=|i+rp>NzMH(-ej zPs^G1FdOExxQje=*S?6%-(G+3b3?jb?SbX&MehP#-`hQK_n?x6r`ui~P6T`OGue|X z9a0-_t0t#Gz@-RGVV5*nG==1#fB;~{Acn|3f~nOG?;gYk0)2@*G~S*NNyZR8vLrtr zOSnnUL>)F6IamkC&yS;RQ=o!hFxD&*izA=R!JyNA1M^VFwXSkC>Ui&paR5p1r(jz9 zAy}W-w2en8LjWxI&FwoDSVm)fB0&`B-a@zGT1Z-M!jW)?{m8oI_yYc=7Zv-b08mjh zr&qOUAgc5+&!(X%V5W%Gt_zw-Qgl_M_qed)ED~zK7fn9zAuyOX{@|SK@4?f5&quEK z7C-J$h2S0oxid`V&d%=E&1u9%PK0|i8VDaJOqqVC-Oe!TBD;AAg$W#NNpye`9~!RR zwzqEW*jw8>wlPJ#fqB`lQg>#az#+kUc<=7rk*=q4C>S{Q>TPe>n5cjZN}RI)?;;0` zv?5IEMnvz9+VTRG!*eipW<0m$#iCM@F484XtL)-}LBh_C%2^4BsCkfw3}+3R6h*&8 zOp(3Xl~VW_L0*y))~1uo;Dq~U6S_^CzFF&5-tAmRo*#xROIYB4XRQS zRCEQK09DZRTws}9WIDErs|nb`YMlgExI@hW7&3qy`mO0e74iu{;ePK)K;7EB^~D`X zp)>$cH9hkLLZ$yq(sN9Qshk88t}31cQ_%E0V7axH1J(C5qN)@V@Kl)$(=BOtE`WlI z{-#5OoWj!ImWJnp$eRJ6auO@2I3%z+u!H<=mFd6~6LE72@7~%zgp<~pcQ|#XnGR1miD}cbeG>7gGt3+i zG4A?!27uO*i02eeeHZP1X&!i}`I`<;C2@6~!kq82-Fe{gaBmdu%A|i$4TqQMpcRrp zgB^F`+}$-@Sa+q1`JjZ>N*uzpremT!o=)2O%>Y-@nu8H}B3#>H>+`^ds6qJ9Ov6?&iEB!r z-30B*Hrt&Sp8dYlJ23N{?Ab<{LUg~>G8E=jLhI)$Sr-G6eXITY^|4^lpzQ>L-dLelPBIz>zu zZy?qB9C#bFXW>(F(_CThd`6`5V$38b9XPom-;mRvXs9yILvf;swG7&7UgIQ+ zKgMOW8Sqn0fhTHK-*XxW^T9!bK|X^9=CZMYz$E<%Hhlf57aJvsSpB^SC9zoVb}Sv?|j&KUiF>?bs>bN z5JFQ3kx&SGF9f|y(9gh=*&qpP@FYw&c@TvVutEr!+~KCsQVanpDnMibU;^84uVGja z94{i18J)mzVA+A8fUGRL4GFT7;5HLRXRaNkXP!h=bzt#6@B`|IE?q=P=>Vlju-ixh zI3l_z74z3gFw*0&y^_tXz+dszw)2&tcin=!j^g4fA`Z(v9+?&)(!>&@aBwgoUF#|; z(n|;TCv#E>-ox&!5gqqo*b9m4sVOMF_yBjML@KRq!vBE2hF-O~q_Y zZKUbC^jE))xSkfAcKG$oZJ2n~tZwY4j$a*VO&ms(93P-FYtW0v*G_ov;QO}u9)(8j z)FkU*BJfe7=z<756*ZU9L2Y5U9V>A=ltjK6iPVD|P9#4=kf1@fFbH@!DmZ9b5F3RSyvUd z47E#d2s0cB3LU|>86vZJAjnLOcSOODvvg+f+lYuJ{FNhasf^?1v}3m`_wsf)Ki?E`*juj3WunXxH~R( zHQ(Irkis&HWTD*wlItE15CNQh>SulAUsam%rdNl%EN-L04N-5vYq|>NQ^~C&tEFPx z(VBKbHTx;Oo8gm1U>PxcD%2#n7%)fx%!+8m#t8f19}C&ntQ%L~y?JYMck^BAwd}$n zLPJpskUx~rWoAXSs@C(Adkjw7NUiG+mV_@NWo&ntN>d1GJGcrAug%A3ffv`=&yyz` z>|ti`&xiEpuq&afegxI4`2tmur{E=q-K^TOz((P!xPhClaEp`@=Q9wrFG`&M)rS!0 z|KfN4Mj+1rPY~z7#?YpZ{L>5V<-0!m1K;^;K`*~zdim7<74|ZIXt-p}dT997hbEED z#~Z<+;U{ru_$7|zZ~guS_VR_Ve%C9%^YO<)FMk`o{0e*d&m+C8e)}h{Jo)=-M1Sem zzI^%36^!Mxuf6go7Cx5wg)is7=l1c+Z~wao)+?L8cxmBx|H>ux@0A}}xU`LNeBn2K W_E(wu=Lf#?zX~w+uYj??{r>^-=7~}O literal 0 HcmV?d00001 diff --git a/tests/file-match-crossed/test.rules b/tests/file-match-crossed/test.rules new file mode 100644 index 000000000..bf09ea390 --- /dev/null +++ b/tests/file-match-crossed/test.rules @@ -0,0 +1,13 @@ +# matching ones +alert http any any -> any any (msg:"test"; file.data; content:"bateau"; file.name; content:"titi.txt"; sid:1;) +alert http any any -> any any (msg:"test"; file.data; content:"bateau"; file.name; content:"toto.txt"; sid:2;) +alert http any any -> any any (msg:"test"; file.data; content:"Titi"; sid:3;) +alert http any any -> any any (msg:"test"; file.data; content:"minet"; sid:4;) +alert http any any -> any any (msg:"test"; file.data; content:"Titi"; file.data; content:"minet"; sid:5;) +alert http any any -> any any (msg:"test"; file.data; content:"minet"; fast_pattern; sid:6;) + +# matching as different file.data have each content +alert http any any -> any any (msg:"test"; file.data; content:"bateau"; file.data; content:"minet"; sid:7;) +# not matching as not the same file.data has both contents +alert http any any -> any any (msg:"test"; file.data; content:"bateau"; content:"minet"; sid:8;) + diff --git a/tests/file-match-crossed/test.yaml b/tests/file-match-crossed/test.yaml new file mode 100644 index 000000000..95d4dfe0c --- /dev/null +++ b/tests/file-match-crossed/test.yaml @@ -0,0 +1,47 @@ +requires: + min-version: 8 + +args: + - -k none + +checks: + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 1 + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 2 + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 3 + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 4 + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 5 + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 6 + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 7 + - filter: + count: 0 + match: + event_type: alert + alert.signature_id: 8 diff --git a/tests/file-match-crossed/titi.txt b/tests/file-match-crossed/titi.txt new file mode 100644 index 000000000..bc8b1199d --- /dev/null +++ b/tests/file-match-crossed/titi.txt @@ -0,0 +1 @@ +Titi a vu un gros minet. diff --git a/tests/file-match-crossed/toto.txt b/tests/file-match-crossed/toto.txt new file mode 100644 index 000000000..a10ca640a --- /dev/null +++ b/tests/file-match-crossed/toto.txt @@ -0,0 +1 @@ +toto est dans un bateau