Project

General

Profile

Actions
Copy link

Bug #4917

open
VJ OD

tls: leading GAP in toserver direction leads to various issues

Bug #4917: tls: leading GAP in toserver direction leads to various issues

Added by Victor Julien over 4 years ago. Updated 9 months ago.

Status:
New
Priority:
Normal
Assignee:
OISF Dev
Target version:
9.0.0-beta1
Affected Versions:
8.0.0
Effort:
Difficulty:
Label:

Description

Attached is a pcap from https://github.com/OISF/suricata-verify/tree/master/tests/tls-ja3s, but with the first data segment to the server (the client hello) removed.

This leads to various issues:
  • flow logging app_proto as "failed", even if app_proto_tc is "tls".
  • no TLS logging or inspection
  • no GAP detected
  • app-layer event applayer_wrong_direction_first_data triggering

The parser does not support GAPs or first data into the toclient direction. Since the leading GAP isn't detected (in time), the first data sent to the parser is in the toclient direction. This is then rejected and leads to the event and failure state for the flow.

Files

tls-ja3s-sv-test-1st-segment-missing.pcap (9.59 KB) tls-ja3s-sv-test-1st-segment-missing.pcap Victor Julien, 12/19/2021 09:05 AM

Related issues 3 (2 open — 1 closed)

Related to Suricata - Task #3560: ssl/tls: support GAP recoveryNewOISF DevActions
Related to Suricata - Task #3553: Tracking: enable GAP recovery for all TCP app-layer protocolsNewOISF DevActions
Related to Suricata - Bug #7238: app-layer: protocol flows are miscounted in case of errorClosedShivani BhardwajActions

VJ Updated by Victor Julien over 4 years ago Actions
Copy link
 #1

  • Related to Task #3560: ssl/tls: support GAP recovery added

VJ Updated by Victor Julien over 4 years ago Actions
Copy link
 #2

  • Related to Task #3553: Tracking: enable GAP recovery for all TCP app-layer protocols added

PA Updated by Philippe Antoine almost 3 years ago Actions
Copy link
 #3

  • Target version set to 8.0.0-beta1

PA Updated by Philippe Antoine almost 3 years ago Actions
Copy link
 #4

  • Assignee set to OISF Dev

VJ Updated by Victor Julien over 1 year ago Actions
Copy link
 #5

  • Related to Bug #7238: app-layer: protocol flows are miscounted in case of error added

VJ Updated by Victor Julien about 1 year ago Actions
Copy link
 #6

  • Target version changed from 8.0.0-beta1 to 9.0.0-beta1

PA Updated by Philippe Antoine 9 months ago Actions
Copy link
 #7

  • Affected Versions 8.0.0 added
Actions
Copy link

Also available in: PDF Atom