From 6c0740335d0a8550766a24b350fdcc81acec5fa1 Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Fri, 12 Jan 2024 14:38:57 +0100 Subject: [PATCH] tests: add test for alert-then-pass issue 5466 --- .../icmp_and_ssh.pcap | Bin 0 -> 57838 bytes .../suricata.yaml | 21 +++++++++++ .../issue-5466-alert-then-pass-01/test.rules | 2 ++ tests/issue-5466-alert-then-pass-01/test.yaml | 33 ++++++++++++++++++ 4 files changed, 56 insertions(+) create mode 100644 tests/issue-5466-alert-then-pass-01/icmp_and_ssh.pcap create mode 100644 tests/issue-5466-alert-then-pass-01/suricata.yaml create mode 100644 tests/issue-5466-alert-then-pass-01/test.rules create mode 100644 tests/issue-5466-alert-then-pass-01/test.yaml diff --git a/tests/issue-5466-alert-then-pass-01/icmp_and_ssh.pcap b/tests/issue-5466-alert-then-pass-01/icmp_and_ssh.pcap new file mode 100644 index 0000000000000000000000000000000000000000..7708ee4815a7fc2590dce74165a848a3eb23d7be GIT binary patch literal 57838 zcmeFZ2RPO5A3uD|?3GRSN{+p^q-5`e?7bRB6eU7tDti=3C?tD?5VFaPLss@)Wj~+K z>4zM?p6_#gujhKM>wi7x>b~Nf&;5Gcuh;v1zwi5ehR*7oBxDFG~i6o)I;9 zh>i&{1%3uw*hmSIhj7}1X=J@I42T>AqD7`44UtCD2>6@^p}_!Okg{$FG6V_i38Ehg93Q8*Kb2PMc^bCwl%q*;I=h-iCKsmX%d3gEw1q6k_en@PGjDNWP z@cv;0(VUT7IzTdz6#}XGPmD7FV-M~j;|Urcz%^&^y}{SN)d=>x zz<$X1Z#0_yC&pQT(Tn(y@wi5EN>HPE@u9}-T0kQT*b~&I3-ktG|5hW|kB#=eJ3)XC)&Ime4=_R* z4jE6-I1Sf0b*K@g5YUJQ_5`(|0KLK2ztsr#qnA8n{5Kl0{}bZ^z}R;Fkny-i3Msh8 z@I#GuS%5}#uqUW37U&JW{;fu^pMd-!|7NXpsqyZ%|&l=2m~1wEe{nL1FOUJ(l+=$5(*03gA|TKhmgK`+$oCv3qZ$AB-(w_X>^F3pwOxhq65h2pi9#L@ZvtS9NZ@$oARsb`xWtJCu>;V+b`0?bv;{;A96b?{96%H~Ktuu& zH8tg-yqw%n)ms*hz|Tg)oV>Sq=(J5;9GzXD{4VhSxjFf8u|R4?{zEaxY~qJ`g48er z1e<;XHt~89plt30{GkSDZvcXjK*USb*au>cA>M$2OC>st_e4Z;luc);1H@<$5mAf~ zrwAbCl7*>_i6fMU`+~WJDG#>`?;kN<0QD)6X@y4y8^K53PEj0sgvdw$f}%k&K8)Cq zJHWOFY=~k|&0!Bg#9sEJVsPl;_5fm%q7THx0%9Z}5L6B<;xo@Dc2R3T_kL%k{I;g8 z)&LxXZ02&u)q+<*fJX%CWNpGLAjom-9cgFhk9c`SPZ-K`n zyu~NXkNB1VFAs;gjisfH1=QNY-rfN)(CW@jms?N^H#2J!M=Ohc>XQ!Q5d=RK;Nd+H zf=Bq&Px((phJVTfq`tr%ClmOQP>|=~7f>A_916SvO4>hWUpdgx9vDCHkCz*I>!!Us z4nKt z>*_}hy0Q2sGe~9yAZ6)T1^YjwJ#yH=K>le}0+RjzUxEI4jrspqpo5*r!P@u# z{?bZ$;tB*`l7M_Y{nKL$5%31Ma(w4GT#FEQ!w`O$7r1i3t{>eE6R5Lu)ldRo7DktU z9PEZ)f~yCJ_(l-eUjyi1LtKj>=FkohF|g<8T2w>XDGID^t0`5J47dV0p(Ni@&f@{(} zL6ZWYX?i*7KvNQ+=@N*zaupkbjtqe}M3<0$!@NPnz85DVlA}zEeLFyW10n*yp<>Yj zgS7_Q*%OL1@HWO@dtn*Wgvyj;XM;!?Iscx%RbuUWozVpu-mq7Rli+=`eiG z)Hu;`oPRkB`GaBO^PqHS-W8#Tq%Ho-dbphmNFfGL<7NyS=;EbJxi`^WdP)*yJ}ewero z9;1xRt)F290ujXXRIFxMHn59~qFB4W#Rl0)-`eX_?-7VDr0tcQOVaioql%G|Wb3wS z)vQVlXp)Y}W5c;u0M80~g~L2Mmg)RZ@XX_}GaWSwouWh}z&>vIuYKHAAk*J~c_wR$ z4bcD$fj7i+CzqgI@VT>wFn9hSf^&!NVD6}bhyc(Le?f*~44i|#Ct@Z8^W6tNH*}6> zG7$+d-}S(`u^4)g$z4DutAdET0HPy61-4@@7(=_^W9~&5vmV?9aLnQdW4;HBxr+j| zf@|pPl^`26`f z2DR1a5=Y%1o=PP{Tf`b8=DWePzH*nsUAq8qdq9-s0P5yALq9mEHY*z7r4$aoFa?l$G6 z7JM2ayacz8%nZJ9qkQIrTVxV;7vhnuMt^S1JjM$)3lx#s72C39V53L7crU@wFtQ?4 z-6u=!K^r)#GI1OTSaQI2%w=nsAKYbH1eaxiJZ$g+TpoLW;PNOCHxGuZv?R~5@AkpC3pRf2# zX4h(X)JB$u1O5vG#vmS+dK0o}75^rrz7u3G|`6_FJU|J@qkfDZ6(rr=S1* z(#b#CcI(#dV#@Tj_1*hehCPqe_g31W5!KNjNfZo(0-0|nK43^NLHAder@PjOq+Cc- zH<+hrEp!g;)otZ$%g-^FXD-fP6RT9-|H7pQM?&68A zvHhJ`I><3RbGbfizQ5N#t-UAU={QRIaQ`|}{+Hcaz9tR>m?Eb9*So{lmJAG{f=UYB zfAmXT%;xSiqEWQ?szc@<=TFX%AiaQVJ1iZJM<$d~^7Fi!AIWdb5RAscGztgM6?JtS zNDJTy*pB7aXJ{YjN`Ujxc~@KBDSB1}o?Gz;xfKlL*0@I9;8RxJ+O_mmZMi{-Pu&=7 z-<5othbZhwF-SGAJ+>X zeq#0SldWYz0h7vIkyxL1XlOFY?_#BA=E$5kyxf({&8C4=dUk+?V2i8k5g9aCrR_S; zlFS(O59E!qv*9m_@Wdv9T^sJMSyH?7!>2N8ud35glxl0%MTl>VfghEVj4banaey&~4s2%iQ2HMdXE;(PDM7T>M!Sr#EZ zAI(Ts zXh#%gc&oo9@0${j4^<2O9iz$)+O{rYUV?3V%Qa`u4G#`JS1TeNj=%NzYBSQLnn^xK z{<7@TwBdU1RHu_I^V}BqM@iL`7@w7kyhC-z<~&iJC&2XClL6e9Hc@G$Yh` zi2ZmsNx7^6*}QtbhMS2hDYu>UeK5LLLvSF5K*_MuOF*`&P#j1OzyvnLT!OrT z_QUJc)1$fc71$S?)rRk>y$*6I9>}F%IT|hT@4lv>e#;)XAG6@WAz4ugDa6*bRT;Z6 z+e4d(`%wgyA(Mg0;FlJ?B2@onWGkCg57~wKu9}9esb>a+A~Eli+)_QHGM4WcybXGD zKc+Ufd|7X!U5LH?Ar+k_%cp9bwSk;nWs2R^b@lj!HDOReqBQPl`;Gv(Uup<`X#;+h zfa~;(`o3Rn%z$6~av~xS0qXh#L>3Uyu~$bmXk|%x z_vKI~LpO~p-x-Eq4%uG?RNwvFC~0_Dj?bL@x^7LB0llV@D#T+E# z?E)>$$B%=3G`=%&iKIi^Dqc@V+2eHDrOtGhD)VcGf8+_FDp8uaTtm<_IYWK@CM&r+ zZ_Omm=V0{6xAx^{;?Mo?C5vK9O3;M~O`9f7U6@+Kv94j=aP+;XjPyYI{kG`Mbm$vr zT8|L6tzRQX)-h{^`NU;s?F5r;6T1ePUa{PKjKMEG`bN^1@y=t^l!npvFL$1|m*^Tj z9vm_)alA2cdnJhZt;2L-8YWo^lQ0f-UFC%+H?$l*%@)jZ-wi{QIKPmUkoPl7uehAT zly#|PJ}N$?r+D-sYXO_`+Rqw&qX3d$)@-6}F;x$9a8$k+x1sjD@vv}vEx~h>_nVk) z(mYm32Ws0Bq~56=wJpajPJ9La$hw;^Etb4Z%T%jl@MnKZ3jcU9)_f)v!=?5Tqu}@) z8by)qyzY6q%p!{S!Jl5QZKA&5uZwC{egF0)k^?bT<7h(xH)~mH$s+}37qzk!Yw3o<-)|7KFV*zk`GBIhgrwvw(B1Pp)SaV{?-?;y zd_VaYE>U^vBI`s^di?&+Dl$#Wd($k~k*-RZrrkusm-_Wr9dydi<0_ZGWB$V8O*d6W zNzY05nqWrzrbHLbnTxxY^6sc?S@iq66?F+NG+FLTCe1< z`tFr6mnHZ6VQ9ScLff_(nV87f*`58Tf`vA(QdJE_f3BH z8SS^gn&615f58{&(q+cYioAjwg|)Z0I`n=QeDD={SoK3-yZH;X&o@yO@6FF~R!f%G z?(?}>-oF?sO2_2wV@x>6BRgQ`8W^$NkkOdZEhnyH`Aj+SH76>ev4YiWqQ(ck(@x?~ zyn`?>*?&LAyPKf+vF=uAnAybe7FoK@-J7#y4SR(_$#*aNvt7ANE?%1Z;Oe(bGX=|E zxuiV4t9GlF=xQO7S}x-wmoDE!33dU+d-`2)erKNR)o3P1-JQ+0zSTxvUnK z9@RN8XTyf(<4o@eA^$2{iuz7AD(jl}-tg^hDYwGTr|g}?ShTM1g<`HedC^q5P!>Xa zljPZVYiFV+9pf9ueYZq|tLx0jQx%feB&*Kx%XyKtO8OSxlPY{>uC!KZUK=@d69aP2 zN%7GF^-Zv{u#X+qs$EB+48zt z<7j`8Sz`C-f%beSAB!UY_L5Dhp4>ELYW?$po!Dn8F8E=mtDfiJZ8b4lyGHrZpmq>d z{!T5q+{dOMA=|C-Hfc|`wy&85<5W0dWIYcFONU`}kMNq6@SnEIuwzoJw|#Y$BBa0A zG?L?LuQp)`BLW?{2RL%dHIMbr4Z|1{V?ttOa00h#CQ^ z2Xqib^m}t6BCwbD(>+)t;fR#}d^C|1ZKPan*vsr37X{s*!e8C`8p7B#-IY>yJEKQr z&55S{&^S7UKRWFCMZbU9sn{htuW5q8!7!0>K}3-%Jc;ntQ@)WpcR%uQ9$jul$!U~Y zF)_7p?%SfPo3(N@rPM^EQJJ5_OuzTMW|gd#0nR-YXXmeq4Wux}^h-f(b$?ov#>3ciuCBRgrP+{u<34?8$}UPN)h2rsrE(7vX*PbCjiB5vDROl;p{Lk~ zMq>NEcRfl8+Q#_u=3hjvPP1-an#UL@wq07l@R^=q@YN=*xPFUvq1S2b%1u8F)m*kn z4BBGpS}!tgRsVib@%-uzBKNTo8hyo@@uZR#aH3QBmZylvd^ur@85^+%_r;P%j4);M z`~_N|)Xff(oyqLm&MLheca-SKA5l3o8<5*x$9%wO^~y>1^N&f=_nhZ;;>`{HNgm7w zybyZBwQcA+kZZ=K*?0z<{H;>UJ?Se_(+21>;bJyP6>Sw82Gb@NwV4;EC!fnaSpRj4 zIS;kWjB%q7T03lDm-I60sZ+fdt|OIk-NTLNE`GsJl3-Pzoj=_R&cBd8V=J4~ZWm;m z^u9||zu~I+z4m8r)Q-k)RIZVavvl29A`aXgsfvn;AinU1J4Me7X>i;eqlkMwX)}By zHLlsfG9-Q-FZIiAvs@te$num=)J?HV4?Dy0Ec$03+I4sjcSK*immDTjxc4 zoQUjGq*d_ED=j~7(mTMG*)q!f9jf;Sy#9EO=MHyFS9eo8*TZREaYq$4bfnTpCr{}< zQXaOHF!auAH$PV`5S)&}n2bgxX6nh{*IC}CfM!S~WB?A_Aj5X0R>D$d(dj-);)*Ge5Z1aRk2 z3RT`jOR??*ZNwxBeAxC0o^NQPb+UJF{Gj-*l4!}hsgYwo0b3@}46IBwi-)!DSoPG9cKoch&)xgoHcp_b$Xe)y8q~htkZGS;5h-0i*wi+D`!ChyH-q{+Xkdx*54slsw?*`g$3-H>%A5M65k` zsvn_nKUxv|2!J~b_;CxoUkA8<3qUgj{TO}dI$&wLxtmImygWnKO6`4?jaK_xQ}B8I z7grQMeWWcRui0}Q ze-dX8?c}&=hK)}5H-fBzw5RGAhUt$*Ar6xlBg;tWj7bK2czjYb-QxF7049R&dE zDfu}9*D-lK9uyM)qys{KYJNTg5&N4EbV%&$z)JjE$7Q4_7G~GPK9j*xNf|vns2z{> zIJK;9|5>7U7xs!$l+GG6y%^^}{#D!j`rOLgbhC~eF*S2yDa0niV3VDzW>F$(u% z;sig^|H%&=wo~K!93I!R2!5pR`_TjJqW_nlMjft~k+v6G;~3|$`fc(_{ct@L<0zzV zgk}-kGg3sYjOs+g9?KluOaOJf16bbzGXiYKW<@mY1w0A}_m5IE@3YqWA7wRo`r1DG zdy0I#Yg-*bh#mP803CPm>-7NBsd9^(pR; z!QCG}!Tn|g_tAh^WdtHZ&Yz0-6OQ=vI3gv_KOqhQh+wS&+c9T#Vd3z25+02wCC|RI zuMW@dz~ea@R_9RaMUIK$vK)2wEZsBiJJn2RQEoApWoYZAy$F^U+2!HaentS+NPrP+ z$5@}hBH-~HLSO~XDgCJqM2G7toVA0gP&P~NrhC|6=Hm;Cl485B2tN9^W}#BMf~EvW}h38U<&?Lts6~^|!M}Syv;LKPJ4?dXRKQ+(6LYR7AA)Q;5+WG0WR4 zKiXa;n_|i;RLFv?KLJ*7c7g3!M51BQ@Q5@curBRKBxCP@)fkx9$mLU?ay|_#hd(UR z!n9oMcKf^oi#s!)*AUZrCG2*HuVj~ALE_3)zWgBX64M3gOtTh-1`5JgFH5ds43#jZ z+l(iuWKAl4+-?6=Pa6Ss>SrQaMS7(-9gg>lU)}JhaUPih+BDb9B^H z2YE!keq_`rYZBEVQ@Fi$1Z;C<y}PCqlgulpyqILJB)u=)W$ zf$f-AZm?LmSKuz_uPc{S?)zTNrXFRbo$8-e_4wi?*WNgEr-tbQdkguK8<%XUti;ag zYH^GTRSm1hzW(JJhCjEQk-E%cl7^nco3_uAPfSQ@!8h%h7k`It~NMOxitqoi5JcDB^%ooKk7W!BGT`0i*cq$pvu# zLJeNe|LfZ8W%T_@D|g}4x|jfW6MUlWFE^=4_H})sKdS4udm`o=QC8;8&Tk)XUids3 ztNMc$HUAF2NC@NmdPTYFJ!x-dP{$R3^(7ELupNtG80;n7O@!SrHE?a>PhF%-Jj(jk z##+GXn;yGMT$=GG?vzkHltgK~mS^Nv$h*^M;g4JOO>ZliKf`}6rH8q+SXMe}*`C;) zNFHo~WoMP=`UIyA8{G;03hHwy-)XOoyBSxjrhZ(zgY;SK6^=_oE;w5G(>;0x_Xr)q zqlo>{PRt!0tt0Iow>+u4!*tu1pi!0xn^>ZvGp2R(X-&;l?zxl>;`05-S3uTffc2DE zPrzf1@O%b5*2O2p+5|)toyCKM0*-_2nCo7!M7Zk%2s(=Qbp(1H=y(C-FnUuiBkTb; zQir#cO_aVIdYW>;xf>`>RWG$K+O28wO6TWm&!`TrX?^s4FN7>`Wfr-AB5zQ=cjiuI zz6#GQ`^N827ie4ZT5wk{3+BN0aA|X=>Yaq^9XX!c=g<)J3IVzOVhPa8BX;;?(FxBo zf%OYXRRlx?pW4KLV8lU?AsAp!z#zz$C?@#dzkZep?DyjOA>$v1|M33PGol3liE$ZV zL@P%**w-MQQ-tV3r{J!Yo#+~P?*#v!n0B}-vV*SSht(smW$PBrdrXx~n?ww;XY)xq zW$AujM2h8^`XHN9$KU7xvbujgWIdKiy09dW6^42=lg^<5nZyEq>zNnW&!ny=ATy`v zl}-}+pUKa$toPgc{5K&4V{j_YEg(H@nhT^*_^jtm-dbqKO$PTV7$O=VM)DVI-P^J1eOWg&d0xTHf_cjNNi!Rmac zwtImfD}fsNY1uLd*9umFs|kz51)v}}0;BKChr&=Iq*L+O7{ z%mHXzpbqDp$35R(;yP2{1w9%?xhVKcoW~}h&CP=MJ=ZNQ0=?FFSgr7$Q#V@8*LE^8 zeBo!6O%B76{ZA}-7bMRz*>ZOO63S1yR8b>A@jU4(I67uvbf?UYdAMHK33`8?pqC3o z%#=Q?X21qJ(s-Z*6ZH}y08KQXQV zjDkalmF$H2xd3+!{=6#~*Z-Xn0<+{N{Jw>Q`l(6<#uY!WtGtOGcdc6~bYWRJ4~xKq zhrId{664(qs(6=*K~{T!^^^=*glp|X$PmX) zQ5wvn8KO#;pz!@Zh{*B_^|X4j1V_w25%EYpQ8fb*1=GG7a9k^B`F1blGVcd&*e~qg z8yeasPQ5LgSAQk8G$P-|uLoIukXpRLgs;cp8@yG z7@Lg}B+uabsVHQg5p*tB@W@N>3&NZfX-3Y*Z$Xy1ag_zb7Gx~~SWj_p8Lk!KF4E@b zfO}8`_bdRdpFzarurmibPRP9#IASh>dw&p*xTl5-BC5;$YGAUwfBskd7b|)eqRF>K6WmLMy9Zu7{@Xn$;9ddfUjD&uw$HZ1RSkDc zo5uHfzHR2awVU(&rUmMHRSI}tKlyY*g-XWdf{V(suzXQK);)mr6!%u)TDuXn769&n zPn7-j%|#7AL7@*GkHAlW4kX}vAkYwXAnC%=K*T=q`t092fae1K=*XSf&w@T@KnFf~ zmE;SPUsDQna!ouU8UmrD>iBW6vPjlTw==)s8_ZZo38T{4>?yuS$7X91c_Zd^KbXmo zN`Z3X*H5vZ;eEjvtYJD8vTGz+7n?EYugZx#YlO7j8V-JXhu?yL?s9EB)t$8AX9|g9 zPo|$xcqDkP2`WAh%(^Ob&Y^nGrYyFeFq4g+g03&|iCRX%fRRC8z{FFVq^G6?LeS3~ z(A0>;dh<{!`?<$BJ>>S2SQSzcrDtDpn3=h9QkAKzdiU?4k%YhdabHOcV?@37!;cNr zE0tnVQg$?R)6~wiP5l!L&IOQhg`IxhjtS>G1xpmY4&1IXh96b+^xAKbMeNFJ#E#~l zP3e|SY`m{&l*v+Q_s!6vV`U?b%k06zAa>xiO5RWOitp{_U>t)1*H8Hlkq*zE&ZDl= zf@?WEdwLGepZsxs!!|4VB_C=GjG~Li)>W0LvC^WPUO~H507c18)XY~;M?q7qjmU(f z2P3a-n8U{9p;J^3kN>V-32CXj>$Hh=8$_naZ{zMS_ezgFaC8m8=uXM9HF%bF9nUga zaL2TAc+Fmo9LO?f5OLyk#C13#sQ2$(1dzA1mH&iz;mY9}cfzU)I*6nKKHdGlRdp{I zf(*d|#{#aV$UtxK^>0^Iu%EHnA>*H!a{9NDGa>(laTQ=(ay;Deolx0+!Cm`sqH9Mg zo925k4p$n_6A9mVv(x#(Z7T~8HL*}>Yx^Dfmzpy2`bp1;X5Plals6#jgS&^Uh!p{% z3wsB$_HO~Ke^mt9N+37;z{&%uG-i!~_x9vkoit3GQvc z5i?IjJnG&yh}b``oWGbw==$8_iT+D17u##ARw|l9wq+3A(x=;#b7uwa@$Z7HyM>3W zC%E?>?%pPXd*GgA7j&=Te}7>DVAKQL+pc;nxBfDOl>RoxX0H4Vc0pq?)NfIyL26$; zJyP2uzBxC2qr3^S@)n&sV>jVi!Ry3-ySLjZN{6r~(cA->LBt1~n5V6(TX4kpCn6qk zPs<2IG_%6tEn}4QbpOTL!LIa4v8MZ*`i~V3_h+hiUtTt4$fc3J{~2Um6Fy`;!MzN) zdkE(T>3}^+3j^q$q1ygxG+5T*s%1pNqq68OF>hEiF5r7U(<~6@GO&_Ak6wAXp{_1t zvPZ}qSoRQPWfQ?XE%&zJT3e24ZD9c1L)epOnF3nNKtw#1!&-5?I#CA$h)BxdJ*)q# zP87ZnWC%9c6Rb)T%Ky)*6WA}?{*dwCR44lX%t*+9by|k(z+Fo}(Y2!)k^s84L0enL z{34%}V)-^lBE8w~-;TY(pO+pz4DBu1I2Xga#JtyM1L|Z3{({RX=dCkA*8blB>tEH0 z4%m0KTm~~FUiKhEwtx&th!)DTyQ4@R_z?|P-Ddj*Eu^)KTW?85 z&w{Ks{`v35fOj(N!nK0eb^n@QEti1|LD+X`B?4NvK*SUloC6&vRHr>SV(N*AN8Hn< z2N6?>x>@G=U-R@xSC3xdGJid_feCTdE*>lsE?W+r`zoHP()|i#MHfC~Jz;)j!QK0X z;2yBsYq160+r{2@@5iGKS8e)=NUya?9R}`jOY}s!XPIc77h_w#5IJnJVw4GGK!^nW zE>R$ZtRevGKi76n2wZCef>v9=J%lqb+AIkQKOTXI%S||^T@m~M*HMe01K2vh4GJHtr=P_D#ANVsK& zJ>sC}c`=+3?)npS z*B{-jYbyb|Q$fU80MQYs5MVnNKVw)nT=yJ;?)rV*9ia!h(?H#&3#zY+C&;!?>XXBY zJ@S8!Xdty~^)bJHJ(yMZUc2D|L;H%CcdUhUkg7~D$d21`svcyxp06k9Svx^b8i-ia z{*OPq6f~1{>e{~^ZUAnxB*?t>o;FD)(q-lhAW;860e(3<*egMgXn8W z5>0KpL**nZ5(dr`AWgb2@ftD7wOG5T-M?2YoIP@##1f~8B0*d^8uv$H12`%rU{t5* zM1|`FXU*SL448-X4hZqCW$1`&gP0@w3^Z;oI?%ts_^ST2az2VQOXD}MA2`#N=F z4|MW?I=NnUO>ACU(0|IZ_CC%u&L+BGSXCas7&w=YoDiS~{Mm*!HsyNHt_Mf?RiN(sz$LiLN`YN zYS%GheLaCb^VQV=Uv~;I;}M)s7+95ZMoBZq?|A&#n3}n|^oQw6>tOa(?q1&ZB5ymx zCpmTHxLLE$y+9ifoOHoeX$aAhPL-l93(NVKK_BP_%jkD0YUU}m+_L<_gZeI{uj%2N z2US15YsanNNf5n&)(wRZ(~yMN!iHoRoNVo$V_VgeWNmO`)6MaG(69b>(M9`FOwFCD zxpjQvyUYm)lQBQ$Xrn_z>u^b1uB)JQ4pCFeE4LM+Mq;HSzLe-SAM+E z=|Ma`WO4g(r1u30m8lPxk?&7^ox4BL%o%->`gs{9q**WP)Qj@)RWZu1O2luEt_LOio|@ychau_ccUWz3_V9p+lcyu1!x6t6M`X+g5SI?WXKQ!wBL+>K zdS6C9JQK2yW&&gWekN=iAI$`4D&{n7lCoXmjzI{m{0HQr4XaD+H(oco;;t}}@RW=4 zxnK=o%#L>$H%#S<>~N(Kump4<`{3)}Z(Z{WK)t~2LPOr@s>;hmrk0$cu7q~xhjoX> zw?=1ElZf1RSE^L29!zJ+f<6QTqb>keG_WD&FC-0C03Y?MqoZb`*dO&s)WN8E!74I4 zW+U_{Fhssmvc?|cMn-2xwgp)PA1tw)q3>lzC*I5RBc;(ynrlD&4Il6J5@p@5F%M!P z)=B7HQY2X)x!ld^L%4YTwggs=L(9h^cZ&`$^Bdp3PuXACh?LhT{6J=JxmUuL7hC$? z(YoKA0~w#T^w|yvDX5|XP;p9roPkHP`gk;%z`G*}AcKG>U_0hZ8>|rS ziz|XJA^X0#+&bz@z=u&S8m*2#oZuA8l-f?pT5P1P$8Q3PXGrxW%aP>V_y zUmGOHS=_)RAi>bYl&QY@R~EF4Iv)!rA=9$vKGFMW2R=FKy~)vGrH8ycg^!Jdsa!?N*Cjv-mx)} zjZ4=^e1YUJYoo$2bs4@(#01oq14_YmOl>x-2(C8bs9NTOHPf;3h}teEo0U>nLe8jL zuH}b8NQz
~~1$Y(Ts;vsj!iD9bX4?<$$d+F%lr0IO9>$u9Ew@QB&FZ?GY5EW+^c;sPcYLPl5E}2T-7}B2aUQ>U z6ThnSQq2$5cw0UKj~vVfB|yz7*?HfIO2o_(P*{W;)k*U`dbUZu-AvlvdOO$nn&jq>6h}(TFSjW^)rM(0 zQjN@_T&B>?UGj>!ySu}Ko-RU?&6%JX@td`C;bK{BCOn&30k;eRr@(g1Ej3sP=vLp# zQMXtg?Yniw>mZx>K(}~laC=%mA-6Ggb&|YgnkKaAFB+-|)_yd%WKe@*XB-bZuuiZfxT74an6?xqFJB zpS%4$Ml>Koi`dQGgL8xuiEN|{b?>G0Xs-URU)On)?Ksb1;{{L4!R~Trp6%&l+x+Ev z@mJNo+J%NSqBrC!K5ZfMNI2t=*=iVYGooo7b<_Xl&GZYMzn><)n^;jLQE~}&Saz#qB|OM3P+P!;m=TagSSft|XdKN5 z)`b0xz-c&=5#1l(QJqsxWJtJ;N{xzUwSA*T#T2t6-#enw!+6?>&vbXz+(GzWb86X) z%Z-blDJV6`p|@XcBv1|_eVrD)x|e(@D( zE-Fg3T!qic^iKTq7Mes2?KZkJ>+$<#Nrz?1z_z)ZS< z##=P44{8(NgEx>$@5>(IZ+fBkQ-$&QxyL3A=NF!Y%PtTVY=@!@FZF3&(QIv?;VcRf zv`mr1=oDi!oQ%;@DsZ4JA-L+q9jfkDsh=)qN0P77^t31e$0?b7PWu-OeF-8v@e6dL z5^&>`{KbZ6TgCBgJ5Pd;ZQp@v4bQgVl~c2=4DPSmQGd^q?EA}yd(_|78U<6M)eL_l zDIHb*kkF3lp{WJ+zO!LxVjHYz{C%#{E4K#j!7`SYe|T@E;+6}awJofqSC8mnZ+&`k zih{WPd3x7eds8b*)t!h@X0aQq%pV#S31b`DE5qmdCT_{&T3{}sxjRRs2PjfqmzN}O zv)|66_A@Sm@C1bGi)OincQFeo?@~IvGaZ{2cg+tRWS1?`f0#No^f4_a46V;uR{v*- zS{RNky0PE8G)We_BIf%c1Tz2?DEtyCHeh z4fcb59e?#vH&UH)ykSWm<+JQ`>l%3?YcpZ$4^3jOAV;HdX=(7_2nT{BWRXsJe--gZSAvhyiRz8{xyXRf=*7&5~i|Gld%ME&o>5$Vwx7> z(GJdgq?waoWA{{_*?}^#gs3U)7>dX^^kZkL%vR#%siNBA+{4x-Iiol5V%9HE-M8qH zZd0-%P9JNg#IAZ?gs{4BaQ9RgoAHB^M^*$@z42|~fux`0-f)L{2*0U(-J?4klUyJK|E+uSmI|9POqp{y@%!9CfOo z0Y=)dgr5v{%y>iYo|o%?WWx2+B_w;7mWn?~>k^!!kCza9+}WRV8YM@4EHX7!56O6A zMjK1ZVjiMpuQK}k3Uid~$GOo+uI<7*Y`O`wwr}DeTkB||h2OmWLS2WMjAB`Pb{hF! zzMYl5-Amdbu^E(lVsbn)r^McvZT-~f3Vd5a%j+vCJ{0HKLMnKkxIQT0;# z(VGw=C!|g|@cT!t@yvivx?@g~I}eJO>cv&>8QJfYAtG+*a(>3biz$#x(@b1C_PM^d zsWZJj&ybEy(m1)`QtohTzDk!GI;Td>KF2g?KS#I~z{>=`Qbu#SD^+k;WRJSS0bJeu zb7tK&%&E9NqB=7uQVot`F^<*oqlBxIdThLbg zW@!pvGiqeH%WXo*+ z0R|*`K3P7-+nX*JbD_`hGX+9kP`Y1>)vdhx*af;>>=KKANj%zk{r2q4z0rtfw87iw zsn0fz-?oqZXdSNqx-8gyiGX=I6u~plhTXr^W#f9*0lIs{p6X z32_hr5!W~IAd)}~z;-MS+^{e3IA9))1E*^C0ZtA2MwKgWRMD~x-2;S?Tv7FQ5JK@zni}^Z zqHewPXO~>9kmzn*SQ~V=X1t_Zh;hq>lQYtG&sVClkiXx#gz=lxE5Yi^d85YPbak8Y+zIKh(&q*V zxFn@M5Wd|$`Ic^9(ksx$06lAkr`8^N)}b$w7VFw6KsN)nPK^&fJU*qz@h7a3XLbg>Ys&7B?82_~L{fn2hbMqUki>8^&99e#) z++q?_yFmM60mpS?R2nOxSM20vz^;y-_7ly12+YM z>i#{+G4(sMSzBzxlvbEmj6-c|7m^=@E9#0h83$)=!OSG56)P29m0rvX^-kJ_rLxQZ5WvR^3;reAnK`hslDK2?yGT5&GY3_q}6MmIPp>O zJLtHUBS*~4N(Y8V?FSrRDUVuK(I}cm=j(M5M&ZY2-ldd(XY$-jZ`6P2{ug9IV$_(@ zNuI!GdCpT-nlr_{ZvxIxs)+tz;c0t~Rn(1?F)N{T|7v=dZHHmS6epjWOgtWAeXnOl zc8YP%w3ud4aCG^_C^VgKkA9n8%HM6Ji6(5JR?_-?1M(bnj~{T46mSk~$K1n!)xq84 zJn9~g^1gex&PUz58I~=k%OxmvE+_w9s?Vk_&d1w-U4RMF%H6-#z%AV&*m-AR@>_&=JQZz`&i6Bx({J+b74jO zR?Z#9q>D)$D_?iozV-6Mcdxt(&mh&Q!BQTPGiu%3-y=M$6!sW@W1w4$rZu%Xjtuvg zQJ}iFUVR*?h*>_f=qSlalncMFNZ|Aw`wDjn;aPQF`hAxsXpg$Y{J*I4vE25{f_;aM{+by zVdD2Pk;>IeLz@Z6Wd*(OJZ-!#?}}xF*7#^d1WHz|>elgell|e(Ini_8t-s_kjj+6p zsPUxHL_;SyqThDAV5ay#z~yvAt>iahmV?}+~XEq!OCH;r%4JK3zhrxT0l z;f2yB7WkLAUMvb}3tPa%lRW3)*Te+@_h^9p0^6}1BY@Sz-D5hMV|=*#?gfP$b#J`5 zQzI(P&c;3tublP1&)KrU?RU~0>1f{kukveH8noUSu6{=vS;E(2-;`KAD)$M9#3bbTQj>DM(4HHI?k`o_hmn&xx0` zFEW-h#P`}>6k6VMhJZ729B}KDeHj7hRv^NYCg8q|Zwg_(f$gt1(GdL8zI!&n{pUmQ ze`??VNFZu|p4Ax=0xD!56+aW5(|XDo?r*N@4kYvl!=km-bqYqCC#T4mmmMs z66_0eG@7zaL4Z-9+WhYtv5Avvu7C>N7Rk;v6?;Szwmw9-QBJ*>L16@NwFUz zuC-?oLV0CUd1KY~^%VCe=ywd@4mzL_Y>3$jd}nHeyCZtk9sYysXT*<=xQ%?zsHu8j@IgUh8DAb5bRxsj9=yx$q$dad|!Q+<{raN zCI~(ImV?1{AA9i@T*@SWEde0skkz1(n!6fvKH=gmvlt6Y4}*}jl%cDcuAH(iG{Idtf7BHL z_x+qf%{b}`>hNMleFhnZVdY9(9b``DTzCC$bWPbuw7bFEY3-RjvCA*TDQP|X*=c&- zp?e!x-+32%M%`yV_fhNA<)ZuB;_IJ2iHCn&8fi(!QjRfO%Y{Zr&|dr5YbL*m_j{ct zR@^HrPD-5csp2sAEvC-Vhe7^!?4#01>!a+!7!=hhB_WWzU%#QEM7s{s*yng~)+668 z-o8y%`z-6;4#(g<*yQZu?{0}aU9ZNy;@cZIeiBrW^&rnzm8!Z_(u6K#iVeiFp7oYL zam*ts{I74m-n->W!JB6Zx)gW1OU-bX*p9j+c(8g#njLlN>JOe*ovKTBY5ed<2o*Ly zU+bm0<25;sR!-|gXd|ms%=V-z16HMNz52M(l|JqJ6TKXJEyFUC zANk3XrWIza*sa1d>l5$No$w-@&Ye}0O?Y0NE3y z0tR(Di}DK?tEM3tB=*m%bvU z(dK$YXcUN5lD-d2B&#Nk-?BD-I*)Gxx)g&!kZlf9`+-k2Jkej7|j#c*p>VMMMW@b%nY{XHmd)^PqWnOjTL;Z{>u z9fX)JhWWUBZ(a76XC}T|AvR55xjksJs2Eh!Dr*?(ZNBQuJCSOXJ^K5iAibgjBZTU+ zB9v(D_4V#yJQVj$$%QaymcRnM_^OeJ->bEGlolQvtZc@?SCqYnd>PTI^M2vH)W|L; zfaT8{QE`4!_4LLnwrEnqcuNJklM1-A4xDcU+p)So32TG9BX=|_g%8dO#Y-P`N6Pa- zvhy=dQ{2+(kHG}rcd`nVxUk+nA&JIsM~cLI!JL_!aHH|M)?@5ZenE>QH?GlsRP9g+ zbBTbITpUzM>1LvPZOTTXKyvf=8Q1UWf=eeR5YOeF6CYD6{ z8M5pR!&d|^4=!-+RE)$gq7vJ-W^_w1cHgq%GkTQGP|<8OHAq9RDno|(iFeKT#oHNv zuFI(z^Ch5QeM^T@%}wN9*^_qx$f(_p4UCjeO~8w6W8S{t1F7{t(31HpFdB)XJY_e;75j= zI(#T~ul`J(z%7{7#yF6=DN$9Oxjm4tTBm&#xOF^pT>G{A0QUA#{3blY`lN>+ zf}~2gDOwetm5?V&$dP62#*@E1cj@k1X*^vUZY7#6=KJi@DXjf1I9xONTLtLdy1$90=Cyz-p&EfYgt@QQg0b-f(A$# zB~g}UFM3irRBfPUu}0EUCM__fyKZF|d%e|YGB&+j&FEUkI9sMAh16$>LCkVx70;=Z zdJt6K45){*W+i}91oJH@xMme>hDp)Haf+I-;riJJ`KbWoXY+B22vtt`IY#30l-sj* zMExS-blEp-1g-I*E6u#Y;mnIv&5>r$s)aa$Npt7 zU3$B8kqN)E6M1_zd=}HIr((S^iED9w;T00UB>RPxC387!f1Jb6fpYoM28R{@QKg(` z4l>BKQSEN%syW3j7aSTxSQqtbu0*{e$hRrDp2?e=*%U-cPRMwZtLDNB``-QtPp_vj z{Nw@b1=m(C+zn3jhWrH7!x@|UA@$;?)n9cvR<9a(TK$dbvN;dVhuW$9C{1KC9OyT{ za1qQWqowSKnd(w>QhuYx_ilAQK;OVHNPFOX_-_5pL5Oq?*?=iqIoZYbvrg_Zx*NTE zBoqZ4hg!aaV)Uq(BF#M4HPIy~d?;z}E=y>t+Gx3Q*4?>=j{eYzm`2u}%(z`-An~;r z?R=TR|-F3^se1=zo-n|CQO4s`10+II_1W zVbgp8Mnj9P(0+0Y;6e+~pTO&nKJ{vB0CK_kv-&`)zKuGJ>ZaVbk;+X{AX zKa;VVe46RD<0DzpheAl}JC#9Se7Wi@VR3=?BTMS+@W%xsE?2hds!;Fs>Mu zeGOBh;NaNuRZZP)sdH2+ypelhI_ZrGE`j~ga)SjWR+U?g(=^9z@pI>B z$>whs1d*sTblEDF9Ju2mA*ed? z1)v&cO((noGcHa7KBE zJZB@MzayNfNJYalg!o9~Vz?DalusiSpN$35_NS`UMDfb;8Z0LBOHIqyyPh@}@V7{9 zKXq%r;r`haJMnU zCN0}?oPn6fEsuG8lLC)e`J8Gni?+;j`%jMZEbgFMUHEE0LTWWnr$v%(`LLzZArut8<46c3D{IGw3XXz4# zSR>~(uo0}rml5yG{Ap~?;#rp;&2wTS(NfChtsnQgkXhXnFJGO1{^N3VOMtk@?bUY{ z6cJQ`L3yBBJwPomJpOA%KMJXZ*~t+-Su^ONomM+7x1Pl%-Bp9ke}OAcEbGR{O|zq} zeyJdQ`j;x`mi(rh4>!#xvt%;43^tFNzhB_xwwew*)3H4JioS9X_?^+$Hgz#mA%$d-gnO8SjvRA zD8fWAOh6Y502koQvg42oa;IGoXFX2-9{%Ypm}F@uF4gBy=j=G>b8H*zF$~%&=`kGf zuN>&_8>1Js(m2VH(Wf|YbQIfVlL}~?M$VPI?rLHX<{@M0k)LZM=`}xSZ&J+|>@QCw zLw|BFc%*{TlQtzb_z{xceTtd9N)D1Ei@(Z4yZjtf$ML3PG4Vm$X<-Ip@)ZRk{0~ zT_%l|a%VJj+#jPq)o5X1vZ2?_dq)2jTcrfzod-jG;#I(BGN?+~5e-&NKMs}fe7{d@ zDOM{-Iw@j|`e279ET37m_+qyPs$K$A!c>=ZD|LbHS=3EcF2 zf_#)Y?W4rWGwj#V6CZ_uadSd)p!QRZmlWElftT>bBtGRF_JITaaD-N$#_K$VZL)=G z)OL4ONZ!ooB_O6L6S*>k-4$Se-*yHa^GBUs!kql#mu&5iS@&Ndo%`Hv{0%!+Jh`u^ z=w6)AGXD2x)8ersb644Oh5FujqegcxQJSdv8yi$g8+3gfi^o)R6t6J~e$@NXl+brg zFX_A2#Dh|?o9DtQ2JPJmm{ig~c;U7mp%h{)R8WIHTESO638{wJ5s^H3h8+k$t(t$K z?hZY#qkxu4a;@FVyuBFam-hBm!Z+wU0t1x@9_g&f=C~+9n?Y&OQJzM58 z?Ldauyizc0V6<=HYwu>q#o0^Z$cn19OL19Ut?Hpx!i#e;N^6*jIjCzxhx_G-3Y-b* zaq-x$3Pcr|b(^o#a>yw^BlY^Pxa3nV-}#vFH8*ChN&O0OJ!0Rg`(f}5-#|dq3QOJS z<*@M7n&(MxLDklPY8_zjAG~1Kse{sAhZszT=v8x28eouVp=?dHsl<&WdX+!rXC}UK$aNkgm*-3P$1;fXi^+vP?tSqB-rd)XB)i#0=wdd)lF#A*Th4CLWqC z|5Z2pfG=uqCKH!zsUN1lqibw(-REkg!%v#S66u)3th>o2wwL;}4D~rjW`e6G4TtED zI^8_&tnZ!oHw-jFL@(MgF^T$oLBP8q=o@_<R{DIA@rd(ME7{M~7>W2>)dvXmvVpmFn-77alp$0N3RG?S;ibd?qR`jbY+WBE}#V^9%WO`CXwe2-jPw z!xi7&9zMIb>8y{M6R}JsDLeK$+L8xHP%Mu|Qxow%m-vf;W!yr4dIB}iIX)Zwjo3#Q zBdVwNRcEdi;wTCpkSoMl0xKQv)wiDx$Ul^Sy0>u~-Dg7ECS2Cpx|`O=Us}7P?Urja z`2>l6+4;VkuXDXMUds?ulvB+6ftj!c)H@*oUp505Y|le79h(K!kAOSgzs*)M;>YR{ z=ugxO1EcID?PV)APpNc=9T7Z_!7x-IN9m5~fH&8kY`<_#;mYDR&%S^AN#zkXoy0vB(W9ZNJvQwS4 z&PV5XI6v3?ag;oVp3`H#EUd!!*hMCB+bINN}4Kd zts6qvZcij;hRzxoQaFWK-{p~$5`J#-wJnz~hrG(X_I{lbS@(!-O>^wVnksH~u~noP ze(0IV(V==YB0Za>q1muXQ7Y?J%?n*PXDR2_@Qj9+wxru-+{2#K&j+|yeO9uY9#brJ z!-;Pe*eIn$eA53ZR5I+5@JuFV5r%TmCBp|iPNu|IHn_dGXTRCwCphXwAE?=Pmm<86 z=QdKu^T13x++=2p3eCJoztyy2!#VljRl0gJgVCUUnr-TH#@eZyGnUsjLyauEx>%xg z;^z!8`!6v{yA|)F5S3p+B6D2oO848Comi!F+4UoQ=IECJ>>7~y+Fhd;bt>bq*h@Z3 z7lV#`&NAUJf_yt_HQwf$_K{ATwfF<7YCBY6+KqVb_mt9dPif_4Wo45Oq_t!53QIpD z3N$>WmOns?kRm7^&Hfrlw}B$~<_2bKG`nATJXxDsU&liyHY*M_Yy{)ORMPVEQd?c~ zVEV>@^ubv*kbvontN_vnvucoo{W5wQSTzW31Bj8Dzs}?M%LyRh9x$RZB8d3&)W2ds z1SAA3@J`^N1wjM28~ppP=M#bV-MRUz#h*P0{`o|e|5J-QK#TT`sPIm6o&#MQh56c4 z&hfa<+5!50&X)76K%bqSZLsCT&3$N(qIoAzG}4rfoZiqLC1{UgKXwo&$U%7_LH6|! zjlYFSo=`OI>obGicJ?z1Ad6gp1)SQELbZGLm)e2f<^FainqhCc!aOU8IMjrS;0Le+ zFW9jN!Fg;R(gmK)@!MD=mwl|u^<)+BQFXTa54clz_Du56)!Y=!|g?f?_;`h(5&G3W&2 z(GnOo--UUTIb3duTa1Sr-sk=g#Z10#VvAb zbrrkDbM0NMiVr+=t|&LVW9NUC|63k1qc!5+%TwKHUC2N?}nSp709WFFixF3 zRXplHaSAx`R(qQ1c@4k6UtiFHiaG^dn#Fq6WVA!O?d!xUBC8G@MlwV$<|Ca-`nrqE zL!yIzgxo$?lADOP4;na;1av97pOx+X^VO$1IQQ_nF{<2x9)^J?^!Um+2u?kNw8Kpz`c9)xX4WGF0v2>mEz& zG{N67VcI0^a!@=#VT?&9%#gMgQPUzIuJoxaH?P;>w9~Pj-ukfa%(L~HNp!PJj&KGo218S%9wv2*=zEwwQ1>cx9;o=C z*v-$~$kuLR`naMUVGP&zh4mv9hh24S!sHBz_w9z-3r+X8EMGP>RKz#?9p$*nEvPtk zi#dte*?dN=lb_ff1MBk&a1+k+%^H+9_S1P&JlTI{3_5WWI1|UPufv(NYHYJdT(B!Y zrKPu!)#j}3Ln7hFq;^(m3tGDElw1nkeZQJOa(Km5(Eni* z+4Eo-gZFiqf!>6@aVFZVb}NC^GLJ`4w$}CUmXqrhuh%)=+V-9Z@v!dnFz>79rxCmu zb2~XcFI~v?h`i(aimA~vZZ-thA&Mw8A@fB#h@c;AuNuNMD{ zM#ulD#a*C9Hs7DC#eb|A*8z=ZNAqBM+Q9M1PThLk(^jc~o;EmilZz|KgP8bv<4EH- znO)!O%PN;Y>+C-0TMb+Y<2_Q@e<~CaaW8j$P;=TT)l7Wk(p=;%kcA<@0#4$oK^Bn( zf96vO{qzWL)|{@eN(CY+0}FCEE8#DYuH4hQl+cfL<%OK+x&-Qa9M(9YRAq?B(xkj* z9!zKXjn*&J#xnkK;dB-fss8yz#`_m@i)2+s2(YDZnyO>4?*tA6f-H0Z7I1XYK)S%E z1DKghNf<^~3!v)~h)5CebItmXbt`oK_hv6f=>9OqGS8Re%*7owSfnFh#IBVa{|gJJCr9jNx$Vw+YoR2S#VWu}(Vc6P?sx{Rj;i?Tcx- z318|*vFCHmg!TyGEq7|l)f?TGKvh}WcOw5TH5VPZBCA$wKuA7vU>84_;{06dM0$9Ltmkx3l%rdOIl`tu41yV!}BJ#pVq=yh6{{<1|TLH5Z z#1Npz0Ac^vbMO}A)B_l&mX4iTEI;kkoBsPXMwet)t++DwE8ec6eh64}+Ooh6uJ5Ih z6RlOv*ZIK}B5_1QbTqL|5~KHI$QEXO~g!H5_?v>YwG6(7Z8cJMGJxzCYv`Dee39%P{M0i2<<#yVBq7Y!m6i88yicNI0vxM&z(db4+h91b_}K5KTL)ba^gbOK!n16+W!YTtoefZ3Z+ z9yzW_)&6N0h@`dBN}oP(@`(@HSmmj{#6f&p<$^GQL`-tsD+ja3gxVaL=gyA@Jjv_S$DX&Bo_J2v=Wf=Lo6nhxSm2V9I>~hTkLk(ay}&vHTDN<8py#)M*5P>04C%@GiylrGJ#D~9K?5RISpHg({ACT4 z3?L#Z34w?|*Fa8o2uKL$z&nAihY$_i4gUStH4u1Tdho9n|H~T4{eNn44`>m~9SvU1 zcA=WVtQAx^k8Ad3@VI811VGK&u*dnj?}pVjyeUB&8Q$P5DN)>$QzFhDKwpROqe~TLx5cIk$Rnf+I}mOXen7h7PA5V2WcNty;b~p6CYNk8oYPl3 z1X(IuWRu7i6J)M2+*qP=_Y-?PWiw>JanHEiu!}k;>ydK<3XjVVw6N1&ucC)s23Ww!BRk}B>R()jc`~qh zeeAL=d_)ci5ljzk-CSVuc!DTl_iH5n%htT@lTDEVA>HCp|$l-jf6&kMm+FNP}{uo|DQ(i zzQCwoE&dmc6#r9;-+>lgsS)8N{t(c3b~G6#@h->XN{r5N;&+ky+-+Wad}dkW#nr>P zYa3kqW-iLpD=Id`vG6mJ_cT}1n-|v+=CM$jKMV!D=BfK&*NDX`%%_yS2eQZlSing< zC&(fad_sWDXYT2IIu@iW>>`1P5j2SKW|$*LS2T>S++$srBu{jm0d)z`TpbeoRFxBO zyU?~SW@9-n8qvsAUSnKSM>C?NCw7PBtm7qSq=lEf<@mAMrI`34xyVav1&vANFQ0dV zZ0Z3vaP)CO`oM7oR^QZL^qm0_FEGHX+c*NG59X9p)v05BC@0?r?Lzv}6D`nF@F=@_ z@FR6qypf-do^6Py?YdrWG|<)&V%(!({mSOqft6uFb16fc4EWq7{ zzwbDVBSI{KPrIx}bj-rJ<+RH?gy*Tx33-)$#%)B#{X7_w8pdrk zA{e)y0BM5U_J)th10g2;1yTQBh_@Nx<#QYfa_%mSbNa{5ox6V8ImvXsml9Oho_R3J zu`b1UbMpjfUMBFj3vSMMd-D>iy8lq!J(&UhV%z+ky=>ou!`aUh5sI-C9x>FnxIcQjx zRd&Wn=4rf!Gxno$H=T=}+)8Pm@u(TCT7WD(;j=)7Sir0W)ZQJl5IA{HvJ0`$9o%or z6Ij=0o#`U5Q;(xBI9uOCmHrT`0Po-^QInrX+p{TC(o;Bupo!CNzs9fUQEO=x$if>w z3lxY&EQ}Wi$1M0x_6I-~js>4+Gd;=bo&8hAlzNttQ5sk@=C(LhIi^xO}Y4Kv@YZJ21aylQ#;tjw8PKJ3w7Lj28hRtx|zY;eIACV721a}8v5#Rj< z5gFvT3LlXlLIhXwu!sl$LfnIocm+ZPa|nZ|4)cua2=-ivV>c_@5$Y_6IO-1|{`S11 ze)9Y#3zXpJif$JLtR}j;{?OSrg^%KrrR}e5*v1WMUN7aLxn1N%+PyYaixF3>pxb$2 z54w`2^NX|4Op{#>qFT!+A8X;NwOxx^xuPuox#NaEgFv-8jVw7gd!0m}n8w`+b%+P2a0(f)IGldOX$1 zb-60fU-$XC8@l6<0MqZt>bAmCvmSj9<#}?((w>N@xnCv%^$`MWGJyFHy#9Dzh#g0V z*jU1_**<1tWpbJgZ5#d$&3jHG{YuF`TYGe|aGug|zR9XvH*-e1<2@NadL~GwXv)!) zu2wH<(n~KQ*%8%KWR@Cg2#?`s?8QxGAUvtfU2LH|#6iiyJveW2)=Qc^RmPiXER4Xw z0c1-Au>Alq1+PEY){SF8Y`IUf)lffX+x-26?OC8NJn4|BrCV0=k18m={6P*o%W(w> ztyZtWK|X!F2w7Q2T+r5Rz9*5)sN=l``~B~YMa`0j6PBWNtH{d;M5;x`NoK7@RiweO z)C%=;gtkJ75yb@U-z9LopS< zXjU4Whu)`JLxQM9X;l1ZvR@NaM+~TgGlyY9>LOv(jUTJ~q1I1V8UnH1zB(dEa3E^t00TW z7=Q(A;;mA0nLJ$d6-#h#z-he5^e7(Rur{k9T~Zcn8Op^ycU4 zA#dd^7+vU{yk(mvTjAl5Mqi&09(RNL%iZ#u!PHl!9u%RNi??iXCEps{|E@Roj+D;g z8RG1S@_o!8mE8O^Q{B09YQ&ez47u;&zw)mcmWdd>*7Ca8-685ww%~P4c`@n|ryh#M zJh^S}rfYoK)}2d{rlVMm99`376b~!|S*-@+`w0&>4!)rdh*f=MSX;4h%Hgs=I`ZFQ z(nGpOk7H`LbaOu2nR!W&gI_-W&;nhpo~zo=I)J~`5%k#{a0QOfVvx_^SOMd+mM7rz z=CA*l;t2eg$e%r+nI93(uTsWwpuCB&ij; zeeq&%t5B>h|8%0s_nem*L9r&z3YBjK6Dty~9TFrtI}OqAOjB1Mo{166dHhhJSM<$| zZs_@_1yB!6_5V08ar_*VvJa=#YoEMRJ0EbO9u=HfxWA!m$-aHT>b$w2dfQxY-c>AC zLg1bK=Ni_?n!T@X$r)}>3e+`gYeV}xZ-wPVhAOLk?eQd$=tzn2po{837WtMJFLM}w zeMG}Ry_>V~gV64!uT(k_<`ei|k??aL#d_1Jep;+Db=H^Q(2Vjhttc?-SvczQJ!)*6 z-ur|wHs0cH&ZGZDze=se1P48gq$y&llSpKDTVv<--gzd3kBa3{BcZL1!x}%PkcmZ} zB4A~NeMJ&PD%TT|jdl!P%9K=lf2f5guTCF_xsQytRKn*Y=u)G|FSjQ=DVVe=Rl1v0 z(wROQkX|Hr1Cb9}MYO_q4;ON;^R#<9Cu7|c!1w=KqeAYH(!H2>DQPyo!DO#m*cY+1 zF5bxYwK3PlzKfBUtgaySd}Q~RcV^eNW2T>H$iE&8p$q=zuO6ebTlTQ9 zUR*21jmli0?R(UK975%tUj5nG+qmpoG4x9h`R@*{nLh0+E82TrD!*2Mz9Hlsn_<1S zLZDU9yWcua_KI0h%F^|faHr?KiB;}G+_}Dqu*h>MdUltRHqVIb4th%U=f3@DqW$Fw z&6gdar8iQ~HTr)H4EgL$Jl-M`q-IoUHZbtXS0mMNBNB` znk!}OW!brAcl43v-Lq@k!M@xExcBd`fX1OSjy`U|xOeirmX&+jJ)w*)N$(~5T=bNh zco|_2WZLEPAoQ7nmG)tZ!|H{lkrEnV$ec3Sb) z%q3fXoF9)DN_$~Cq%D$S%I^*PcQuxqm)|uENEBYbcU73tIdWo3X--%NVJgVqY4y9< zi{26z0h6`-3;Ehl4wQ_6@2Sjq_TI@Y3J-N{u;hhJy(|4L>mMi;S3qX@?R)T0y&Qdn z*?9RgY&}du6GopRn!FdS5?S-! zhIbA9N`V-{V3T&=7WFGsTXq@s`^_0L9tMXxo+gjadn8uGl{pGAiVH5ZDQnQ@s+}{t zfW_ogZ)DkGdQcyJkAqqHfjh2V-5Z|UTZvkr>i2+ZCqOZH{h``)oB&b{vj)_&I#wNh zUrLp^cZd6Rzq@&vq~2_ZcJr>m$JcdSSC+gePo`Iv>I*J)R^saAE{W6aW0YZ94eu;|yz)~KoSkT~xI*PA}W z+{+Ize89r+XOIh!7nE7AWD5Jo z&gWHqRTU%TPROrcOFv{bp<@;v!h4WmbXdO1T;lPnd7VXE_s4B!>@B~YgDzK8gB%Py6GEpAK42w9ScE#wGY@x?*BT8{J_W`bvrH+jH5y zuaL>@>BHVF5$R6ur*Xz8hyn>F=c&&O({r--5c%N}?$(WLl}LeZeFxma0mfwTg3TZz z!Z-O|rKc8fCVv|F|dl^6^>sEWbo^|mF6<0;L<5`CjqwZvolah-W65oEe^ zS+e!FUl?2pqwtADQz0ohOwGm1NT&_!jxNvGw3;zKOOKPd{*2b^Rf+NWx4bsViXq;q zU5;h*&BkBM>@=zx2{TK*322^P;xWqSYY68G8m=~7$jtqeba*4^l{3~>&rl{;GP_#b z6p7xZ(Jcwhxyapza%wHfn2n3;N)hF%>t;r4=hb&fHT2a!B$T?Cj_~0myHP64-7nN_ zm)heWx|qyN>}+Z*EoyZCF6d6#Rk(db0_r2-fA$drm@lLpOMsOZ8i*(g97#?Lcnw~E z_>DGB0{K00+HZrCuZPTfPy7b{&$#2$fdj6P;1SNnQXx|I-N#8)gBng{y7qVZX)y*P zFyxt54rcI&6SB`O6=QIVA#aepXi?u)G~(e2cSW1X96I|>M5YMq%R4n;zsO|=Elhrv zK1)7iglfBpO+ZC#(51p6SX8B+mPi!Igph&!0H9S2)zDaRWMElu>yZV^4rK_ z7;?<&-0bPv;ngzVCYR2?jXB>)x4@tlP01lB>dSf#W$de!rmGUw02A(wo>%Hfgo}1` zQY-WCatE!r%}Jkbr`B5aukf;#Tv+Z)r^jmIujECQnZ6RNa;W^HVm0ehN+#Yg$^_P? z-^?0M0l$9gz1HcHf@l)e4AD=W_sT&P5`YRnKmmCDp~86_`T}Xx6-LG0v5Ji=r&V-S zOv@yHHn@5qA=%V|t%qAeEahgjVo#u~f3p@9)ll9UM^Sr9pq4<*czm$MAkx;3DXqM! z!=JZu=IH{+23Hhr50iv?SQx+tW)?Eyg_(s)fgXkqBKiY}aAwu>P?Z8t>oej#)|a4q zTA%e*=DRQUhwjoC5ZNC1E^%X~Bn4fg*Sf8l;_WY zDM(M~U-X#$OAmq+A_6loT7Va9y$~tJDL}-J%`ke*j`eJNp6I~@MvS75#qyWzD7&ma z3dbuoc9e%7yv?DN7qL8C=!wr5!G4JwR+IFVReVh3=rNl9rJIF!zvAIy=}Q^br##kS z9Esf^FRXOp{kCvrcOO~pR$%VPSYMUc`7tfD9JbKWK9-%mpjvlnz9WXYn`-yEgxrxS z*D{uuv-+5}`<)7>lNm&Cgf6MeCNF9{kj%85znh#lVyF84QLk<)5>B6e+mfppMR2@` zsv~~34jYviZ#U<hHt^qL|n#SM>$ z^nKEe(P^MzhA)snROb2V>j!?Y76yQGaGsl`p;~~uuQ1s%mWQcD8IUbZ5HZ%{*BkG@ zykmC+5D^uvLByZ$*t0bekPz^}JAuxIpaA+KehM+XfgE?@L$vcT=0U;8^ZPR3!rPG9;fqWEPtH0D>KJ=JJtK*sDU6T$lMCd^H z>UIdSXaiWlshtc|JMdjCZ0&qc*UmL9UEyE{L_A9aR~IFu>o$xo-(y{2L#K7oBHmQ_ zZcis%6j)!;d%ORo`y(`mccdxb2lk6X&~d%;UU%EOYF*6_G~B+;Tv>?EFJF&z24ukt zuz;gW7Sa{;7hUE5(q&7Fjt~vh3cUWP*PZc;kgjVmy2_7rF>#*g`UciZvVO18q{fP! z^9|>N+ayRNK1nkEQQRJ>SG$@Ox7l|Wb7pdvTouCTP#9^LP>93@BtD!833^(jR_QKA z;;6dLjC-4chDK~zV~b%_9Mo$Eu!EB(Du~@J7I=;t}cSys(TL(W&=Af%AA`w8H7M0LDlkShgi%7N;cn)M?53qnU=UswWfZxCT zHgjL&Joac<<}{1vW{V0-Qh3e+n9tC6tClDmJMfCmd>|D&&$w%GVE2^$Zp8E5tGm^H z)Xmu_L3}m_lF8F=KWmSoW@s$zgKRPZHgGZ^2W0@9pyB$DE8k?Q(>2f!)f)e}asT2O zvVhSa5qi5d`U7Vjs8Ka-r3U?bCb1s~3n0YW`WHP9iucYRQNoXS!u$jWbV?0A3mS;U zO_(H{JntBGoMzGdVuq|z+-AawK7(|bG8nxF8xecEXO5pH!H7ZQIg7}{yL83`&s4H$ zIa_Dn1%Bmg>US^%S*Qan;N+1OVqpuzV&FKBmgOfbcELXTF8p$&6v+hZb|PDXPi@ad zvKNn^Wf;;J;Cp&t#KAdKg-%%A3XKF;H<8^Sa{Ss<*Dk5J;0`-UIz8pGu zV>}NkUcZkB|A_JadA4_(JW2h~midAyV;knhnD|gRWlwhz0A;-oKB5wY==T@Ifqx-> zf{&;SA^QG_Xac@r`fYE;738=Js$PbVr~)DS`~?xVKV}{yjq z6p=e!bv$7izS#VzEQKs1!>;|(^NDPU!iIv%0p1xAC>MIVuT*qdqTPOEm|+-iGz9AT z1hh_$gaBQznM1-FX8>Ctc@OCMZA3PCaNGkFnoe5Z>vMNa8_d>li7HeuDz;Wvwz+VA zb~})%*PZodPqAgdf+oH*;)O58dVIudrApK^qp|{Mm=me?L)_bS%6FHw!w(mM4-;a7 zg2H7yabx+fw|Z)k=&s+8anCDR4hdmvS&~BzD!3KYT}c z2IW230bZ;c`3xnAh1L7X29>@a1F!UM%00468ZE_j886F5&$-&2=Rc)O{aAP4-n{sG z*~cHA4Mp3RD&`ET@du5jdYm659sh)H=DmxN_HLC6tr`u@lPq)Z#!JmyFSjRJmz%27 zE59Z`F6v9Pc-_j3VRw&sF?aq;bm$YGtTrUsY>!8`Rx@!fvL21oa(BjM27Y@x+hL{A zao+56U0Un;LRQb@c(J%GcMLuR>-yP3gPelyoIQe9V+MVqxq@eMriGA;_@WfQdr3{u zMa{acN>NBoCVxn2-;MByetc`GFo-yBMD$*n=S|}HmTNfpMRH%LWhO&(O&dIp+>jEU zz4W_>`nDm0F#<8bG?CiMjleO}u=HtNWq?oxJCk5r#SP3Nsqc~i%+M`TDE9II#vAyflaIO}ew#ZiQvhK<& zc~XAUKQaZ^I}76M(lQQexgYpltSojZqu0#Fe1GRCl$GC}%OvPcJw-%ISZ=O(i$>!$jmYqPjzBlb;B-`A4la5Qs82=ykaDz1f6huTTgULx_6=LoZ+ z)V}f2PAT5=RbUgtQ9q^LE81D)OtLpya{7Zl7fJAX`n|5xHa;MDZp0Pug|fBHmQlrN;CoJ~C-Ym9VPd&0l`VdR)yNJce!miTZOFJQ1 z+5$7R#K$*{-TM@=mdu0k)bZl&a=ca*7aEqfIaJuxxCgF1udjZJnw?Mk0mv=;YuhUh zRJf^`J`8zTEv6vL8Gt36mGWhXr3MVklbvC5y3;IGjeBl##T?QfKI{*rtDkbVp9@Ui z`Cue{=@sd)#f+T&5F0@o^0(2(`ps`~)x6@>95@jx^|#kBD0Gvz3cac3&0<$(bp+0v zA`E34f$YfG;LdBRAiGFtGz1ww4n`mbtJp7S@&IPeI2qwZ;3KL*h+Y61%uH$K0wDhO z-q;mH+yglpz(-Vv5Iz4yG#3UCH-5c|{)KoGKB5MM2tIAXa5M)w{uR*&KB6Xs2+nJ; zh~P>5u!zulJq$jg7KG^jC!z&7oBtK@Ie-W!i7X)Es5*f7+w5m?vf^?OIGse|kCR!W zEyH(_c-IYb5M$}j_!B17Vy-BUbyE0=Wt5~Ny}z$sz}!F%K4wQp$OFa( z@cLtXNEv5^^j?9{YkWLP5oVs&YbmhJu$`2~YI4U~fhtQv(qH$>2-nlG=kGqhrSPh} zE;3FXexr8ws@oM3qbvf;PvX02=N#x5V+Y$my>V)CdBN1@P-S79V7V-@PRC}W^df9U zAe72%>7lc#(&DF=0VCn>=HR+>7H4{m?)q5fY!eB(xkx33L;qj7dr7siMB zV;{N+PWy1fQ>d|Ky6SCn4Xv9Vt{J`YV?lYw!KDjNh8cMWlMG~3M*Zt=rH?1m&D^`l zX)I;X`SnNgqtB)&*MhTY1u>M?Z_q80f;x8rR&eGJ=nI}v>(i_(QI1)?(>TrQ)fc5C zyVrp<8D>(nk$?C3VyQz?6DxdkM8ncJCn}S@U;Y6EnCsSAmQ9%~* zJaFCCh1>?84`EVgDFEYk)^X~(uc9NA0Eq*yKT?-9&H=g23ZqNlSl5Q{iLUS9tVG^` z`c{EKX_~NlElHq(u0?%_C(LU(FC7yTseM;15+QnIDYQCVZ82!vCu%hJQYE;3 zJUp7ZRifUz$n1Q(f4laUblIGvG38YsV?u%-3bN;Mwu|~#P0-JjAnuG^+2^?v9qh6+lE(0N;TA-=40TA_5Wu0eB}6D}(~zZt(BF?&*T}<){8?@n any 22 (alert; sid:2; gid:10000003; msg:"PASS SSH";) +drop tcp any any -> any any (noalert; sid:1; rev:1; msg:"DROP all TCP";) diff --git a/tests/issue-5466-alert-then-pass-01/test.yaml b/tests/issue-5466-alert-then-pass-01/test.yaml new file mode 100644 index 000000000..7c29856e6 --- /dev/null +++ b/tests/issue-5466-alert-then-pass-01/test.yaml @@ -0,0 +1,33 @@ +requires: + min-version: 8 + +args: + - --simulate-ips + - -k none + +checks: + - filter: + count: 0 + match: + event_type: alert + alert.signature_id: 1 + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 2 + alert.signature: "PASS SSH" + - filter: + count: 0 + match: + event_type: drop + - filter: + count: 2 + match: + event_type: flow + - filter: + min-version: 7 + count: 1 + match: + event_type: flow + flow.action: pass