Project

General

Profile

Actions

Bug #5183

closed

TLS Handshake Fragments not Reassembled

Added by Gianni Tedesco about 2 years ago. Updated about 1 year ago.

Status:
Closed
Priority:
Normal
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:
Label:
Needs Suricata-Verify test, Needs backport to 6.0

Description

TLS handshakes can be sent in multiple TLS frames. This is because the handshakes can be larger than the max size of a single frame (24 bits length field, vs 16 bits length field).

Suricata appears not to combine such fragments which means that TLS app-layer rules can be evaded and TLS events can be hidden if suricata is configured to log TLS events.

Attached are two semantically equivalent pcaps which show the same client hello message in wireshark but which produce INVALID_SSL_RECORD and INVALID_HANDSHAKE_MESSAGE anomaly events in Suricata.


Files

tls.pcap (2 KB) tls.pcap Baseline Gianni Tedesco, 03/08/2022 12:54 AM
tlsfrag.pcap (2.08 KB) tlsfrag.pcap Fragmented, semantically equivalent to baseline Gianni Tedesco, 03/08/2022 12:54 AM
tls.pcap (2 KB) tls.pcap Fragmented, semantically equivalent to baseline - Out of window fixed Iñaki McKearney, 09/15/2022 09:48 AM
tlsfrag.pcap (2.08 KB) tlsfrag.pcap Baseline - Out of window fixed Iñaki McKearney, 09/15/2022 09:48 AM

Subtasks 1 (0 open1 closed)

Bug #5796: TLS Handshake Fragments not Reassembled (6.0.x backport)ClosedVictor JulienActions

Related issues 1 (0 open1 closed)

Related to Suricata - Optimization #5481: tls: support incomplete API to replace internal bufferingClosedVictor JulienActions
Actions

Also available in: Atom PDF