Bug #2432
Updated by Victor Julien about 5 years ago
Using - <pre> This is Suricata version 4.1.0-dev (rev d2121945) Features: PCAP_SET_BUFF AF_PACKET HAVE_PACKET_FANOUT LIBCAP_NG LIBNET1.1 HAVE_HTP_URI_NORMALIZE_HOOK PCRE_JIT HAVE_NSS HAVE_LUA HAVE_LUAJIT HAVE_LIBJANSSON TLS MAGIC SIMD support: SSE_4_2 SSE_4_1 SSE_3 Atomic intrisics: 1 2 4 8 16 byte(s) 64-bits, Little-endian architecture GCC version 6.3.0 20170516, C version 199901 compiled with _FORTIFY_SOURCE=0 L1 cache line size (CLS)=64 thread local storage method: __thread compiled with LibHTP v0.5.25, linked against LibHTP v0.5.25 Suricata Configuration: AF_PACKET support: yes PF_RING support: no NFQueue support: no NFLOG support: no IPFW support: no Netmap support: no DAG enabled: no Napatech enabled: no Unix socket enabled: yes Detection enabled: yes Libmagic support: yes libnss support: yes libnspr support: yes libjansson support: yes liblzma support: no hiredis support: no hiredis async with libevent: no Prelude support: no PCRE jit: yes LUA support: yes, through luajit libluajit: yes libgeoip: yes Non-bundled htp: no Old barnyard2 support: no Hyperscan support: no Libnet support: yes Rust support (experimental): no Experimental Rust parsers: no Rust strict mode: no Rust debug mode: no Suricatasc install: yes Profiling enabled: no Profiling locks enabled: no Development settings: Coccinelle / spatch: yes Unit tests enabled: no Debug output enabled: no Debug validation enabled: no Generic build parameters: Installation prefix: /usr Configuration directory: /etc/suricata/ Log directory: /var/log/suricata/ --prefix /usr --sysconfdir /etc --localstatedir /var Host: x86_64-pc-linux-gnu Compiler: gcc (exec name) / gcc (real) GCC Protect enabled: no GCC march native enabled: yes GCC Profile enabled: no Position Independent Executable enabled: no CFLAGS -ggdb -O0 -march=native PCAP_CFLAGS -I/usr/include SECCFLAGS </pre> <pre> sudo suricata -S tls-only.rules -l log/ --engine-analysis ... grep 'on "" buffer' log/rules_analysis.txt Fast Pattern "cn=*.onion." on "" buffer. Fast Pattern "O=Let's Encrypt" on "" buffer. Fast Pattern ".gq" on "" buffer. Fast Pattern ".ga" on "" buffer. Fast Pattern ".ml" on "" buffer. Fast Pattern ".cf" on "" buffer. Fast Pattern ".gdn" on "" buffer. Fast Pattern "Let's Encrypt" on "" buffer. Fast Pattern "Let's Encrypt" on "" buffer. Fast Pattern "Let's Encrypt" on "" buffer. Fast Pattern "Let's Encrypt" on "" buffer. Fast Pattern "Let's Encrypt" on "" buffer. Fast Pattern "Let's Encrypt" on "" buffer. Fast Pattern "O=Internet Widgits Pty Ltd" on "" buffer. Fast Pattern "check.torproject.org" on "" buffer. Fast Pattern "CN=api.ipify.org" on "" buffer. Fast Pattern "LogMeIn, Inc." on "" buffer. Fast Pattern "0A:E1:E6:BD:51:FB:3D:8F:06:BE:0D:B5:5E:BD:E9:DF" on "" buffer. Fast Pattern "00:E7:F9:B6:DE:A6:57:93:E2:44:6A:3B:95:C6:B3:EC:DF" on "" buffer. Fast Pattern "l2.io" on "" buffer. Fast Pattern ".localtunnel.me" on "" buffer. Fast Pattern "O=MyCompany Ltd." on "" buffer. Fast Pattern "cn=processamentos.com.br" on "" buffer. Fast Pattern "cn=robervalmotores.com.br" on "" buffer. Fast Pattern "C=AU, ST=f2tee4, L=gf23et65adt, O=tg4r6tds, OU=rst, CN=rvgvtfdf" on "" buffer. Fast Pattern "89:BF:80:13:42:0A:2E:F5" on "" buffer. Fast Pattern "cryptoclipper.ru" on "" buffer. Fast Pattern "70:FE:E3:2F" on "" buffer. Fast Pattern "projectevrial.ru" on "" buffer. </pre> seems not to print the buffers it is referring to - aka tls_cert_subject, tls_sni...etc