Project

General

Profile

Actions
Copy link

Feature #2269

open
BF CT

tls: tls.version: allow negation or comparison

Feature #2269: tls: tls.version: allow negation or comparison

Added by B F over 8 years ago. Updated 4 months ago.

Status:
New
Priority:
Normal
Assignee:
Community Ticket
Target version:
TBD
Effort:
low
Difficulty:
low
Label:

Description

According to the documentation it is possible to match on “1.0”, “1.1”, “1.2” with tls.version (http://suricata.readthedocs.io/en/latest/rules/tls-keywords.html).

I propose to
a) allow negation for this keyword, i.e. alert on all version that are NOT 1.2 for example
or
b) allow some kind of comparison with >, <, <=, >= (with would probably need some ordered table with the versions, as the version can also be SSL.

Also (at least in the case of b)) there should be a solution to cover tls.version "UNDETERMINED"

Related issues 2 (1 open — 1 closed)

Related to Suricata - Bug #3220: tls: ssl_version keyword negation (!) not workingClosedPhilippe AntoineActions
Related to Suricata - Bug #7250: tls version match can have incorrect behaviourNewVictor JulienActions

AH Updated by Andreas Herz over 8 years ago Actions
Copy link
 #1

  • Assignee set to Anonymous
  • Target version set to TBD

VJ Updated by Victor Julien over 7 years ago Actions
Copy link
 #2

  • Effort set to low
  • Difficulty set to low

AH Updated by Andreas Herz about 7 years ago Actions
Copy link
 #3

  • Assignee set to Community Ticket

PA Updated by Philippe Antoine about 5 years ago Actions
Copy link
 #4

  • Status changed from New to In Review

PA Updated by Philippe Antoine almost 5 years ago Actions
Copy link
 #5

  • Target version changed from TBD to 7.0.0-beta1

VJ Updated by Victor Julien over 3 years ago Actions
Copy link
 #6

  • Target version changed from 7.0.0-beta1 to 7.0.0-rc1

VJ Updated by Victor Julien over 3 years ago Actions
Copy link
 #7

I feel the version tracking needs review first. Version is currently not a single thing. E.g. we can have a connection starting with sslv2 upgrade to tls1. TLS 1.3 records look like TLS 1.2 initially iirc. The version field is also often updated. So I think a review of how it works is in order.

VJ Updated by Victor Julien over 3 years ago Actions
Copy link
 #8

  • Status changed from In Review to New
  • Target version changed from 7.0.0-rc1 to TBD

PA Updated by Philippe Antoine over 2 years ago Actions
Copy link
 #9

  • Related to Bug #3220: tls: ssl_version keyword negation (!) not working added

PA Updated by Philippe Antoine 7 months ago Actions
Copy link
 #10

  • Related to Bug #7250: tls version match can have incorrect behaviour added

VJ Updated by Victor Julien 4 months ago Actions
Copy link
 #11

  • Subject changed from TLS: tls.version: allow negation or comparison to tls: tls.version: allow negation or comparison
Actions
Copy link

Also available in: PDF Atom