suricata icon indicating copy to clipboard operation
suricata copied to clipboard

ssl: detect duplicate client handshake

Open regit opened this issue 1 year ago • 6 comments

Some invalid implementation of TLS have been seen where the client is sending two handshake messages at start. The result was a problem of JA3 generation.

As it is invalid if we follow the RFC, let's ignore the second message.

Make sure these boxes are signed before submitting your Pull Request -- thank you.

  • [x] I have read the contributing guide lines at https://docs.suricata.io/en/latest/devguide/codebase/contributing/contribution-process.html
  • [x] I have signed the Open Information Security Foundation contribution agreement at https://suricata.io/about/contribution-agreement/ (note: this is only required once)
  • [ ] I have updated the user guide (in doc/userguide/) to reflect the changes made (if applicable)

Link to redmine ticket: https://redmine.openinfosecfoundation.org/issues/6634

Describe changes:

  • handle the case where 2 hello message are sent by client

regit avatar Dec 14 '23 21:12 regit

Codecov Report

Merging #10059 (2edb102) into master (7d95c4c) will decrease coverage by 0.10%. The diff coverage is 57.14%.

Additional details and impacted files
@@            Coverage Diff             @@
##           master   #10059      +/-   ##
==========================================
- Coverage   82.45%   82.35%   -0.10%     
==========================================
  Files         972      972              
  Lines      271461   271475      +14     
==========================================
- Hits       223822   223565     -257     
- Misses      47639    47910     +271     
Flag Coverage Δ
fuzzcorpus 64.12% <57.14%> (-0.20%) :arrow_down:
suricata-verify 61.36% <14.28%> (-0.02%) :arrow_down:
unittests 62.82% <14.28%> (-0.01%) :arrow_down:

Flags with carried forward coverage won't be shown. Click here to find out more.

codecov[bot] avatar Dec 14 '23 21:12 codecov[bot]

Is there a SV test ?

catenacyber avatar Dec 14 '23 21:12 catenacyber

Information: QA ran without warnings.

Pipeline 17098

suricata-qa avatar Dec 15 '23 05:12 suricata-qa

Information: QA ran without warnings.

Pipeline 17098

suricata-qa avatar Apr 21 '24 23:04 suricata-qa

Is the PCAP in https://redmine.openinfosecfoundation.org/issues/7016 useful for a test @regit ?

victorjulien avatar May 07 '24 20:05 victorjulien

@regit are you planning to revisit this soon?

victorjulien avatar Jun 20 '24 07:06 victorjulien