Project

General

Profile

Actions

Bug #7256

closed

ja3: Error: ja3: Buffer should not be NULL

Added by Andre ten Bohmer 3 months ago. Updated 3 months ago.

Status:
Closed
Priority:
Normal
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

==> /var/log/messages <==
Sep 17 13:55:26 suricata[38083]: Error: ja3: Buffer should not be NULL [Ja3BufferAddValue:util-ja3.c:175]
Sep 17 13:55:26 suricata[38083]: Error: ja3: Buffer should not be NULL [Ja3BufferAddValue:util-ja3.c:175]
Sep 17 13:55:26 suricata[38083]: Error: ja3: Buffer should not be NULL [Ja3BufferAddValue:util-ja3.c:175]
Sep 17 13:55:27 suricata[38083]: Error: ja3: Buffer should not be NULL [Ja3BufferAddValue:util-ja3.c:175]

==> /var/log/suricata/suricata.log <==
[38359 - W#11-84:00.0] 2024-09-17 13:55:27 Error: ja3: Buffer should not be NULL
[38324 - W#08-10:00.0] 2024-09-17 13:55:27 Error: ja3: Buffer should not be NULL

~]# suricatasc -c version
{"message": "8.0.0-dev (d3eb6569d 2024-09-12)", "return": "OK"}

~]# lsb_release -a
LSB Version:    :core-4.1-amd64:core-4.1-noarch:cxx-4.1-amd64:cxx-4.1-noarch:desktop-4.1-amd64:desktop-4.1-noarch:languages-4.1-amd64:languages-4.1-noarch:printing-4.1-amd64:printing-4.1-noarch
Distributor ID:    RedHatEnterprise
Description:    Red Hat Enterprise Linux release 8.10 (Ootpa)
Release:    8.10
Codename:    Ootpa

~]# uname -a
Linux 4.18.0-553.16.1.el8_10.x86_64 #1 SMP Thu Aug 1 04:16:12 EDT 2024 x86_64 x86_64 x86_64 GNU/Linux

~]# dpdk-proc-info -v
EAL: RTE Version: 'DPDK 24.07.0'

Subtasks 1 (0 open1 closed)

Bug #7276: ja3: Error: ja3: Buffer should not be NULL (7.0.x backport)ClosedJuliana Fajardini ReichowActions

Related issues 1 (0 open1 closed)

Related to Suricata - Bug #6634: tls: Invalid ja3 due to double client helloClosedPhilippe AntoineActions
Actions #1

Updated by Juliana Fajardini Reichow 3 months ago

I think that https://github.com/OISF/suricata/pull/11813 fixes this, doesn't it?

Actions #2

Updated by Victor Julien 3 months ago

  • Description updated (diff)
Actions #3

Updated by Victor Julien 3 months ago

  • Subject changed from Error: ja3: Buffer should not be NULL to ja3: Error: ja3: Buffer should not be NULL
  • Status changed from New to Resolved
  • Target version changed from TBD to 8.0.0-beta1
  • Label Needs backport to 7.0 added
Actions #4

Updated by OISF Ticketbot 3 months ago

  • Subtask #7276 added
Actions #5

Updated by OISF Ticketbot 3 months ago

  • Label deleted (Needs backport to 7.0)
Actions #6

Updated by Juliana Fajardini Reichow 3 months ago

  • Assignee changed from OISF Dev to Philippe Antoine

Assigning to Philippe as he was the PR author.

Actions #7

Updated by Philippe Antoine 3 months ago

  • Label Needs backport to 7.0 added
Actions #8

Updated by OISF Ticketbot 3 months ago

  • Label deleted (Needs backport to 7.0)
Actions #9

Updated by Philippe Antoine 3 months ago

  • Related to Bug #6634: tls: Invalid ja3 due to double client hello added
Actions #10

Updated by Andre ten Bohmer 3 months ago

  1. suricatasc -c version {"message": "8.0.0-dev (45eb7e488 2024-09-24)", "return": "OK"}

Problem seems to be resolved, great, thanks!

Actions #11

Updated by Victor Julien 3 months ago

  • Status changed from Resolved to Closed
Actions

Also available in: Atom PDF