Project

General

Profile

Actions
Copy link

Bug #7274

open
VJ OD

ssl_state:unknown not implemented

Bug #7274: ssl_state:unknown not implemented

Added by Victor Julien about 2 years ago. Updated over 1 year ago.

Status:
New
Priority:
Normal
Assignee:
OISF Dev
Target version:
TBD
Affected Versions:
8.0.0
Effort:
Difficulty:
Label:

Description

The keyword supports the "unknown" option, but it is not implemented. The keyword checks a flag in the state "SSL_AL_FLAG_STATE_UNKNOWN", but this flag is never set.

Related issues 1 (1 open — 0 closed)

Related to Suricata - Bug #3218: detect: wrong matches with ssl_stateTriagedOISF DevActions

VJ Updated by Victor Julien about 2 years ago Actions
Copy link
 #1

  • Related to Bug #3218: detect: wrong matches with ssl_state added

JL Updated by Jeff Lucovsky about 2 years ago Actions
Copy link
 #2

In src/detect-ssl-state.c, the bit DETECT_SSL_STATE_UNKNOWN is set when the unknown keyword is used

That flag is defined here

src/detect-ssl-state.h:32:#define DETECT_SSL_STATE_UNKNOWN      SSL_AL_FLAG_STATE_UNKNOWN

VJ Updated by Victor Julien about 2 years ago Actions
Copy link
 #3

Yes, but SSL_AL_FLAG_STATE_UNKNOWN isn't, so it can't ever match.

JL Updated by Jeff Lucovsky about 2 years ago Actions
Copy link
 #4

I've found that the unknown state occurs following a handshake failure; are there other conditions leaving the state unknown?

VJ Updated by Victor Julien about 2 years ago Actions
Copy link
 #5

Where is the flag set? I don't see it.

PA Updated by Philippe Antoine over 1 year ago Actions
Copy link
 #6

  • Affected Versions 8.0.0 added
Actions
Copy link

Also available in: PDF Atom