Feature #1231: ssl_state negation support - Suricata - Open Information Security Foundation

Actions

Copy link

Feature #1231

closed

ssl_state negation support

Added by Victor Julien over 10 years ago. Updated over 8 years ago.

Status:

Closed

Priority:

Normal

Assignee:

Jason Ish

Target version:

3.2beta1

Effort:

Difficulty:

Label:

Description

This doesn't currently work:

ssl_state:!client_hello;

Actions

Copy link

Updated by Victor Julien over 10 years ago

Assignee changed from Victor Julien to Jason Ish
Target version changed from 3.0RC2 to 2.0.5

Actions

Copy link

Updated by Jason Ish over 10 years ago

There is an incompatibility in the SSL app layer that prevents negation from working properly. The Suricata SSL states flags is an accumulation of states seen. So if we go from CLIENT_HELLO to SERVER_HELLO, both flags are set in the state. This prevents ssl_state:!client_hello from matching while in SERVER_HELLO.

It appears that Snort does not accumulate the states like Suricata does, so a rule with ssl_state:client_hello will not match while SERVER_HELLO, but it will match in Suricata.

Actions

Copy link