Feature #2269
open
TLS: tls.version: allow negation or comparison
Added by B F over 6 years ago.
Updated over 1 year ago.
Description
According to the documentation it is possible to match on “1.0”, “1.1”, “1.2” with tls.version (http://suricata.readthedocs.io/en/latest/rules/tls-keywords.html).
I propose to
a) allow negation for this keyword, i.e. alert on all version that are NOT 1.2 for example
or
b) allow some kind of comparison with >, <, <=, >= (with would probably need some ordered table with the versions, as the version can also be SSL.
Also (at least in the case of b)) there should be a solution to cover tls.version "UNDETERMINED"
Related issues
1 (1 open — 0 closed)
- Assignee set to Anonymous
- Target version set to TBD
- Effort set to low
- Difficulty set to low
- Assignee set to Community Ticket
- Status changed from New to In Review
- Target version changed from TBD to 7.0.0-beta1
- Target version changed from 7.0.0-beta1 to 7.0.0-rc1
I feel the version tracking needs review first. Version is currently not a single thing. E.g. we can have a connection starting with sslv2 upgrade to tls1. TLS 1.3 records look like TLS 1.2 initially iirc. The version field is also often updated. So I think a review of how it works is in order.
- Status changed from In Review to New
- Target version changed from 7.0.0-rc1 to TBD
- Related to Bug #3220: ssl_version keyword negation (!) not working added
Also available in: Atom
PDF