Conversation
Last packet from the TLS TCP session moves TCP state to CLOSED.
This flags the app-layer with APP_LAYER_PARSER_EOF_TS or
APP_LAYER_PARSER_EOF_TC depending on the direction of the final packet.
This flag will just have been set in a single direction.
This leads to the last packet updating the inspect id in that packets
direction.
At the end of the TLS session a pseudo packet is created, because:
- flow has ended
- inspected tx id == 0, for at least one direction
- total txs is 1
Then a packet rule matches:
```
alert tcp any any -> any 443 (flow: to_server; \
flowbits:isset,tls_error; \
sid:09901033; rev:1; \
msg:"Allow TLS error handling (outgoing packet)"; )
```
The `SIG_MASK_REQUIRE_REAL_PKT` is not preventing the match, as the
`flowbits` keyword doesn't set it.
To avoid this match. This patch skips signatures of the `SIG_TYPE_PKT`
for flow end packets.
Ticket: OISF#7318.
SIG_TYPE_APPLAYER are mostly the same as SIG_TYPE_PKT, except that a rule match will apply a drop/pass to the flow. Example of a SIG_TYPE_APPLAYER rule. ``` alert http any any -> any any (sid: 1;) ```
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## master #12169 +/- ##
==========================================
+ Coverage 49.81% 49.83% +0.02%
==========================================
Files 909 909
Lines 257904 257906 +2
==========================================
+ Hits 128467 128539 +72
+ Misses 129437 129367 -70
Flags with carried forward coverage won't be shown. Click here to find out more. |
|
Information: QA ran without warnings. Pipeline 23613 |
|
I rather feel #12095 |
Why is that? |
|
Because I think app-layer detection may happen at the pseudo packet |
Right, ya. It's a bit inconsistent either way, it feels. The whole |
|
And #12095 is a minimal behavior change responding to initial demand |
|
I think this should get closed in favor of the other PR |
|
replaced by #12258 |
3 participants
As #12095, but now also includes
SIG_TYPE_APPLAYER. Still not sure if this is the correct approach.SV_BRANCH=OISF/suricata-verify#2148
The above SV PR shows the effects on the existing tests.