Project

General

Profile

Bug #2432

engine-analysis does not print out the tls buffers

Added by Peter Manev about 1 year ago. Updated 22 days ago.

Status:
Closed
Priority:
Normal
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

Using -

This is Suricata version 4.1.0-dev (rev d2121945)
Features: PCAP_SET_BUFF AF_PACKET HAVE_PACKET_FANOUT LIBCAP_NG LIBNET1.1 HAVE_HTP_URI_NORMALIZE_HOOK PCRE_JIT HAVE_NSS HAVE_LUA HAVE_LUAJIT HAVE_LIBJANSSON TLS MAGIC 
SIMD support: SSE_4_2 SSE_4_1 SSE_3 
Atomic intrisics: 1 2 4 8 16 byte(s)
64-bits, Little-endian architecture
GCC version 6.3.0 20170516, C version 199901
compiled with _FORTIFY_SOURCE=0
L1 cache line size (CLS)=64
thread local storage method: __thread
compiled with LibHTP v0.5.25, linked against LibHTP v0.5.25

Suricata Configuration:
  AF_PACKET support:                       yes
  PF_RING support:                         no
  NFQueue support:                         no
  NFLOG support:                           no
  IPFW support:                            no
  Netmap support:                          no
  DAG enabled:                             no
  Napatech enabled:                        no

  Unix socket enabled:                     yes
  Detection enabled:                       yes

  Libmagic support:                        yes
  libnss support:                          yes
  libnspr support:                         yes
  libjansson support:                      yes
  liblzma support:                         no
  hiredis support:                         no
  hiredis async with libevent:             no
  Prelude support:                         no
  PCRE jit:                                yes
  LUA support:                             yes, through luajit
  libluajit:                               yes
  libgeoip:                                yes
  Non-bundled htp:                         no
  Old barnyard2 support:                   no
  Hyperscan support:                       no
  Libnet support:                          yes

  Rust support (experimental):             no
  Experimental Rust parsers:               no
  Rust strict mode:                        no
  Rust debug mode:                         no

  Suricatasc install:                      yes

  Profiling enabled:                       no
  Profiling locks enabled:                 no

Development settings:
  Coccinelle / spatch:                     yes
  Unit tests enabled:                      no
  Debug output enabled:                    no
  Debug validation enabled:                no

Generic build parameters:
  Installation prefix:                     /usr
  Configuration directory:                 /etc/suricata/
  Log directory:                           /var/log/suricata/

  --prefix                                 /usr
  --sysconfdir                             /etc
  --localstatedir                          /var

  Host:                                    x86_64-pc-linux-gnu
  Compiler:                                gcc (exec name) / gcc (real)
  GCC Protect enabled:                     no
  GCC march native enabled:                yes
  GCC Profile enabled:                     no
  Position Independent Executable enabled: no
  CFLAGS                                   -ggdb -O0 -march=native
  PCAP_CFLAGS                               -I/usr/include
  SECCFLAGS                               
sudo suricata -S tls-only.rules -l log/ --engine-analysis
...
grep 'on "" buffer'  log/rules_analysis.txt 
    Fast Pattern "cn=*.onion." on "" buffer.
    Fast Pattern "O=Let's Encrypt" on "" buffer.
    Fast Pattern ".gq" on "" buffer.
    Fast Pattern ".ga" on "" buffer.
    Fast Pattern ".ml" on "" buffer.
    Fast Pattern ".cf" on "" buffer.
    Fast Pattern ".gdn" on "" buffer.
    Fast Pattern "Let's Encrypt" on "" buffer.
    Fast Pattern "Let's Encrypt" on "" buffer.
    Fast Pattern "Let's Encrypt" on "" buffer.
    Fast Pattern "Let's Encrypt" on "" buffer.
    Fast Pattern "Let's Encrypt" on "" buffer.
    Fast Pattern "Let's Encrypt" on "" buffer.
    Fast Pattern "O=Internet Widgits Pty Ltd" on "" buffer.
    Fast Pattern "check.torproject.org" on "" buffer.
    Fast Pattern "CN=api.ipify.org" on "" buffer.
    Fast Pattern "LogMeIn, Inc." on "" buffer.
    Fast Pattern "0A:E1:E6:BD:51:FB:3D:8F:06:BE:0D:B5:5E:BD:E9:DF" on "" buffer.
    Fast Pattern "00:E7:F9:B6:DE:A6:57:93:E2:44:6A:3B:95:C6:B3:EC:DF" on "" buffer.
    Fast Pattern "l2.io" on "" buffer.
    Fast Pattern ".localtunnel.me" on "" buffer.
    Fast Pattern "O=MyCompany Ltd." on "" buffer.
    Fast Pattern "cn=processamentos.com.br" on "" buffer.
    Fast Pattern "cn=robervalmotores.com.br" on "" buffer.
    Fast Pattern "C=AU, ST=f2tee4, L=gf23et65adt, O=tg4r6tds, OU=rst, CN=rvgvtfdf" on "" buffer.
    Fast Pattern "89:BF:80:13:42:0A:2E:F5" on "" buffer.
    Fast Pattern "cryptoclipper.ru" on "" buffer.
    Fast Pattern "70:FE:E3:2F" on "" buffer.
    Fast Pattern "projectevrial.ru" on "" buffer.

seems not to print the buffers it is referring to - aka tls_cert_subject, tls_sni...etc

History

#1

Updated by Andreas Herz about 1 year ago

  • Assignee set to OISF Dev
  • Target version set to TBD
#2

Updated by Victor Julien 30 days ago

  • Status changed from New to Assigned
  • Assignee changed from OISF Dev to Jeff Lucovsky
  • Target version changed from TBD to 5.0beta1
#3

Updated by Victor Julien 30 days ago

  • Description updated (diff)
#4

Updated by Peter Manev 22 days ago

  • Status changed from Assigned to Closed

I can not reproduce this anymore with the current master -

5.0.0-dev (rev 2bd23bc1)

and it works as expected.

Also available in: Atom PDF