Bug #5183: TLS Handshake Fragments not Reassembled - Suricata - Open Information Security Foundation

Actions

Copy link

Bug #5183

closed

TLS Handshake Fragments not Reassembled

Added by Gianni Tedesco about 3 years ago. Updated over 2 years ago.

Status:

Closed

Priority:

Normal

Assignee:

Victor Julien

Target version:

7.0.0-beta1

Affected Versions:

6.0.5, 7.0.0-beta1

Effort:

Difficulty:

Label:

Needs Suricata-Verify test, Needs backport to 6.0

Description

TLS handshakes can be sent in multiple TLS frames. This is because the handshakes can be larger than the max size of a single frame (24 bits length field, vs 16 bits length field).

Suricata appears not to combine such fragments which means that TLS app-layer rules can be evaded and TLS events can be hidden if suricata is configured to log TLS events.

Attached are two semantically equivalent pcaps which show the same client hello message in wireshark but which produce INVALID_SSL_RECORD and INVALID_HANDSHAKE_MESSAGE anomaly events in Suricata.

Files

Download all files

tls.pcap (2 KB) tls.pcap	Baseline	Gianni Tedesco, 03/08/2022 12:54 AM
tlsfrag.pcap (2.08 KB) tlsfrag.pcap	Fragmented, semantically equivalent to baseline	Gianni Tedesco, 03/08/2022 12:54 AM
tls.pcap (2 KB) tls.pcap	Fragmented, semantically equivalent to baseline - Out of window fixed	Iñaki McKearney, 09/15/2022 09:48 AM
tlsfrag.pcap (2.08 KB) tlsfrag.pcap	Baseline - Out of window fixed	Iñaki McKearney, 09/15/2022 09:48 AM