From a88b32ca033f90d02c99f105404d1a220790a138 Mon Sep 17 00:00:00 2001
From: Johanna Amann <johanna@icir.org>
Date: Tue, 19 Jan 2016 14:41:24 -0800
Subject: [PATCH] Add testcase for CVE-2015-3194

---
 .../ssl.log                                      |  10 ++++++++++
 testing/btest/Traces/tls/CVE-2015-3194.pcap      | Bin 0 -> 3289 bytes
 .../base/protocols/ssl/cve-2015-3194.test        |   6 ++++++
 3 files changed, 16 insertions(+)
 create mode 100644 testing/btest/Baseline/scripts.base.protocols.ssl.cve-2015-3194/ssl.log
 create mode 100644 testing/btest/Traces/tls/CVE-2015-3194.pcap
 create mode 100644 testing/btest/scripts/base/protocols/ssl/cve-2015-3194.test

diff --git a/testing/btest/Baseline/scripts.base.protocols.ssl.cve-2015-3194/ssl.log b/testing/btest/Baseline/scripts.base.protocols.ssl.cve-2015-3194/ssl.log
new file mode 100644
index 0000000000..d01b484a71
--- /dev/null
+++ b/testing/btest/Baseline/scripts.base.protocols.ssl.cve-2015-3194/ssl.log
@@ -0,0 +1,10 @@
+#separator \x09
+#set_separator	,
+#empty_field	(empty)
+#unset_field	-
+#path	ssl
+#open	2016-01-19-22-45-44
+#fields	ts	uid	id.orig_h	id.orig_p	id.resp_h	id.resp_p	version	cipher	curve	server_name	resumed	last_alert	next_protocol	established	cert_chain_fuids	client_cert_chain_fuids	subject	issuer	client_subject	client_issuer	validation_status
+#types	time	string	addr	port	addr	port	string	string	string	string	bool	string	string	bool	vector[string]	vector[string]	string	string	string	string	string
+1449265638.475275	CXWv6p3arKYeMETxOg	192.168.6.74	52122	104.236.167.107	4433	TLSv12	TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384	secp256r1	-	F	-	-	T	Fvv5qY2DMGQY2MYQ03	(empty)	CN=bro.org,L=Berkeley,ST=CA,C=US	CN=Visa eCommerce Root,OU=Visa International Service Association,O=VISA,C=US	-	-	certificate signature failure
+#close	2016-01-19-22-45-44
diff --git a/testing/btest/Traces/tls/CVE-2015-3194.pcap b/testing/btest/Traces/tls/CVE-2015-3194.pcap
new file mode 100644
index 0000000000000000000000000000000000000000..c4a69bcc91574d12736631903ee3cae052ac6456
GIT binary patch
literal 3289
zcmbW3dpuNY7suD$duEI=!!Wr`H&iOb3{x&Cmvo_e)hXSisHTWqCJ9AjUdg?VQc)yA
z_lrv5bk24ps-rqYy1tbUUDY|1r0_n^bUW1h&+GG9AM@<}%y+H*TfceMzFASUp9BVc
z`RnZkAkd;kb=f?z9}E74KH~u6_$MifaB=x1hu_&S8Nktv?+A`8{U!84mYeU(LjS9o
znzOYwZp_A;Pm;a8rRo4AgL#IaC?-L$IX0PuG7W?LMCT^4zzyxi@rnB>hmvlO5`ZNu
zM25*YgXZk3nVq$*^HGL<Ia(nGuRqfnB%8w=yeSdWQ6?6ydj%ppBPx#X>Xr;^#&tWS
z_p5s!qA!s1`P$L<kpiFU<zg}>j!0&~CL{}v{zM{Vy#Xe^81zG;9$$ORxxPdliXdzV
zAS4u(DGYc2&9EV|;Hjd;+OYWdm^;747{?aRo_%tjV~+i}xd6qqh&H1~(ZlHhGzan_
z5B9@8@Q2ml2fknnHee0oARe|r9Big7X>;0yHl{UbCS<_`7z?qq1#L=?q=(T0S``jJ
zF62NqtU~fSz(lYDOAvzyG9d$Y!!FcV7nlUjw3r@4kETb^>NErPf<0KkPH+MhT9a0x
zxikq(V9;7L8+1SbeBjYMngR}JgBEB27gV7a3FQH5z@UI2(Vamc1YOWa{|AB|`m6)$
zz(e=(UJeXHs`9`9hOh`0$wGEvl1z$0Fh~YP5fn*LBteoSh1djv+i|AkTZ6x|jwJ0S
zw$6k6e%4u_wK3|RoKG|)eQq#nZZfhB7ZZ~lRY1xFW%MU9=cm<U;_a9p67`6N`}|K0
zM#P<%s6$cUOae@#DBDr{ui3Vc3-eoZR+R17<I>I=U^wWk&g_}tVriSBiXG4*039S3
z66}jySPuNC2t#dD11cP-bwJ5P3Mx>fAT3E%c>GKKhCAw&K_W3r)g*3O+&dmYa74p%
zcp^2Hs(0KpLP{}6V!v|v<vu%?L6Y!5<S$kesj?^!21`JC%n{=~Xu%OM=DE&s5?hGI
z;H8?tc%I){9|PCGP^m1?C)6(}&?mrPj#L)rw_IxAw03RKazEu&@gR{9e}NJRlwXie
z3R<&9Dnpxo3JMAp4bkO^$BHdQ60xns+ETm-Ev?bQ`twrc(6^Y+m9e?xBqy<^NCT5q
zxNK*s%wHNHjS%xi>dItXm1VLZ^B~zOk%BN1@xF;bFo9AK8i1~INCiQ_1)l}Uhdksd
zE1r373-PXL>#n>R+A+oW>BD&Y_Q_LoM%z@zCw&-vT{1dqf?axGmE_n>`J2r#RXKl5
zHE0TM&(AA7*HT>Y(O5sqA@Ei0qXR45dQIeELxUUJG9Pvf);{rElQUU8*Pu=BY{KK-
zk<*)2CI~NEO*Lv-UKu5E-nApt!Kb5hD)XuFq+loA8C$(SO!2=kftGq*sBe40t)KBO
zBh_lqtx(T*)&p!}7A)O0wp#b6J<TZ^3BR=ZB$-xC`{Phvv*N&<*B7|LfQs<a@oMgd
z^Ivdgl=W0(+oqpem4Eh1MP%~6Mo*KG(!W(E$&C^R*4&ASc<o-~*X43}M$ZKmGcS@t
z*7`qef>b2nS|NK@#>MFcM~19<A7-SL)6KN=n||&5iWRhc*4()9?@gHxv#$KrUO4u?
z{#|SR+)<`Ub^!^Cmo>jyDARX~e(W-$%V*-{^0HL56HERs8#KN=wIby%XNw|VxGq5b
zY2)sTU1~!@QkEZTJyO0l|GBBb@XaRYou=4uM_siDR}*^ll-8Fe6&2e&v0d3)9(n5V
z^f>$AxL{l9_^gDwokhoZ=O*tgsr#kLGH8@`=Arrt>-S3c2v<$KTlJ)7tK8gzG_2dP
z_w=M4!Dmu-r3(!eW@{X3R%BNS?roPnhorH+9T^N5V|*odpX}a$*h|d!*50uz`n9v;
zD$g?FO@o3nt&(*#7X1K;nOq=TDbRIdbS;i4ea727@Y<ofuHB}oNq;`jm976nga7Lb
z#-l5@^XBd0rj)FHvp8Ur`?mGTuAa3ktEX;Tdo&?b;F~5ta>Lq!g%mXy=lxbQ<M0Bf
zSf8e0S`YPC9W(LW#?Jkj%{E>cpjec6X-Hjcr-M=5+1S|ZiHV8LfzWee=Ix)Sl`bs5
zc)Ei(_vVJfX9C})5+82tpKm9>SXuSj+ahCRnx2MVYRThe+<LP|G1}WX7lpUY&uV#{
zuRhFrG>qoGbr|@ewM8LY^W0{~!K4qazN-4we|0sAZREc1n%0+=v^u`=EnRy2<DH1|
zOM&XE1;iWY5t;DZR?mKBp4Xp43mAXZ6qsaZSv!_8i^q(Rxn9?a;yZlUr5~%yQd}zw
zk5AxUI#^=VJ#F<;sdl%=ma)ub7LvlaXP1oKT;-RK+NtNgHrg6cwK_}fs5w3v8EAAX
z-!E>VLl@6z9Q~&%ND52vR4t?XPSvP;owaQn<a~{n;cLE5Ra<=UD(AGj3eX6K<2zyz
z(;5@KDt}1S<3rWquS9!H#KlfQN4v8VBg|}J^YPgl>u#hy`IxfDchy4O^W!p3v8=qV
z>qezSr&{#BoKsOybK+E@=SP>lmW$F3_}qQeo$7kZ+hF8YbCoW7075AbbQrb#MtRg}
z%D?el$4d`~M02&#(bT;#?jcq0U2JKRpmpiL*HtUr-$css^UU@CrcnQ}1d_A{<)F*!
zJC@ouXl;yMga_Sb{4R&yWYDu@ps{3+iF<-nU^tpJIQkO_owQq+c%S|u5e>THkiJB$
z&|&meSAZ^?K~7?KQAllJ=aLDr)mm2Zg_fRIBn9bqV_bHx?Jlm?EsE)Szm6AqLo|G+
zeb0C+Moqa+VO8f|mwk#8ZLP0lo>saHVNTe4U%T}tjQo^mlQ$hVi!h!wS5xnFuPL=<
ze9N;2w<g}ecJ{<H@r5f^@o^)4dy=EA3lug<*EI?wJhQqYr;sN-D~^`s)=l_3xzqpF
z&}@U^ZNBN;bE6@0e%1Du{C{*|R-MV)?4vJFQQ9$vm!E*-Uf7N^O#|NwHZQia%jOO{
zUN@hyZB|fE3)YMk{H+V$xk^H?v8$HJ`noE5QD<$t7xHOmSo>F3x!_JbK}2CX8+?#O
zaePOd)BFq*qe6a2L_Y0$_=U)nVWKwbg7CAgZVMQ@-5T#idxeebaH^7)2{&fqgjZ3*
z|NT>AU&09&o#~e_Liq@qe2``JO^At+W~yI_{f&gI*{HPU{=P<P_d?c;lxq?Vn@)Tp
sG6%~~+GH|in0VwL#P39r448*&bRXWY#z<7-5+rkPi1*hTcVp^*0fFt1CIA2c

literal 0
HcmV?d00001

diff --git a/testing/btest/scripts/base/protocols/ssl/cve-2015-3194.test b/testing/btest/scripts/base/protocols/ssl/cve-2015-3194.test
new file mode 100644
index 0000000000..d2aa7b536f
--- /dev/null
+++ b/testing/btest/scripts/base/protocols/ssl/cve-2015-3194.test
@@ -0,0 +1,6 @@
+# This tests if Bro does not crash when exposed to CVE-2015-3194
+
+# @TEST-EXEC: bro -r $TRACES/tls/CVE-2015-3194.pcap %INPUT
+# @TEST-EXEC: btest-diff ssl.log
+
+@load protocols/ssl/validate-certs.bro