Feature #1983: tls: events are directionless and trigger twice per flow direction - Suricata - Open Information Security Foundation

{
  "timestamp": "2019-10-17T08:34:15.307866+0200",
  "flow_id": 276078541517555,
  "pcap_cnt": 12,
  "event_type": "tls",
  "src_ip": "192.168.0.43",
  "src_port": 58217,
  "dest_ip": "52.221.74.15",
  "dest_port": 443,
  "proto": "TCP",
  "tls": {
    "subject": "OU=vd, CN=fkp.samsungcloudsolution.com",
    "issuerdn": "C=KR, ST=Kyunggido, L=Suwon, O=Samsung Electronics, OU=SW2 SISC, CN=ROOT CA SISC FKP2_PLUS",
    "serial": "32",
    "fingerprint": "71:cd:fe:08:7f:3d:2a:18:32:69:38:fa:bd:64:7b:c6:cf:cc:44:8e",
    "sni": "fkp.samsungcloudsolution.com",
    "version": "TLSv1",
    "ja3": {},
    "ja3s": {}
  }
}

With a plain default suricata.yaml

Actions

Copy link

Updated by Andreas Herz about 5 years ago

Status changed from New to Assigned

Actions

Copy link

#10

Updated by Victor Julien about 5 years ago

Run it against rules/tls-events.rules and check the alerts. You will see alerts for both sides for the same event.

Actions

Copy link

#11

Updated by Andreas Herz almost 5 years ago

File dump.pcapng dump.pcapng added

I can reproduce it with that pcap from the wireshark list, is that the case you see as well? I would convert it to pcap and create a SV for it.

Actions

Copy link

#12

Updated by Victor Julien over 4 years ago

Can you create the SV test? I don't see a reason for me to first confirm it.

Actions

Copy link

#13

Updated by Andreas Herz over 4 years ago

https://github.com/OISF/suricata-verify/pull/223

Actions

Copy link

#14

Updated by Victor Julien over 4 years ago

Target version changed from 6.0.0beta1 to 7.0.0-beta1

Actions

Copy link

#15

Updated by Andreas Herz about 4 years ago

Assignee changed from Andreas Herz to OISF Dev

Actions

Copy link

#16

Updated by Philippe Antoine over 2 years ago

Having looked at this :
Indeed events are directionless
It would be a good thing to match on the direction, but it should be optional

So implementing this would be :
- either have 2 stores for events (client and server), or using one bit of u8 to have the direction.
- Making all events addition setting the direction (that is the hard part)
- Have detect-app-layer-event.c parse an optimal direction and match on it if needed

Actions

Copy link

#17