Project

General

Profile

Actions
Copy link

Bug #5656

open

rules: engine analysis gives false positive warning

Added by Victor Julien about 2 years ago. Updated about 2 years ago.

Status:
New
Priority:
Normal
Assignee:
OISF Dev
Target version:
TBD
Affected Versions:
Effort:
Difficulty:
Label:

Description

alert tls any any -> any any (tls.sni; content:"suricata.io"; sid:1;)
    App layer protocol is tls.
    Rule contains 1 content options, 0 http content options, 0 pcre options, and 0 pcre options with http modifiers.
    Fast Pattern "suricata.io" on "TLS Server Name Indication (SNI) extension (tls.sni)" buffer.
    Warning: TCP rule without a flow or flags option.
             -Consider adding flow or flags to improve performance of this rule.

The TCP rule warning shouldn't be issued, flow:to_server,established is implied.
Actions
Copy link
 #1

Updated by peter russel about 2 years ago

same problem here:

rule:
reject dns $HOME_NET any -> $EXTERNAL_NET 53 (msg:"(o)DoH Query for dns9.quad9.net"; dns.query; content:"dns9.quad9.net"; nocase; fast_pattern; classtype:bad-unknown; sid:27995003; flow:to_server; rev:1; metadata:affected_product Any, attack_target Client_Endpoint, database_domainlist_id(s) 2, updated_at 2022_11_12;)

analysis result:
Sid: 27995003
reject dns $HOME_NET any -> $EXTERNAL_NET 53 (msg:"(o)DoH Query for dns9.quad9.net"; dns.query; content:"dns9.quad9.net"; nocase; fast_pattern; classtype:bad-unknown; sid:27995003; flow:to_server; rev:1; metadata:affected_product Any, attack_target Client_Endpoint, database_domainlist_id(s) 2, updated_at 2022_11_12;)
App layer protocol is dns.
Rule contains 1 content options, 0 http content options, 0 pcre options, and 0 pcre options with http modifiers.
Fast Pattern "dns9.quad9.net" on "dns request query (dns_query)" buffer.
Warning: TCP rule without a flow or flags option.
-Consider adding flow or flags to improve performance of this rule.

Actions
Copy link

Also available in: Atom PDF