diff --git a/src/app-layer-ssl.c b/src/app-layer-ssl.c index 3e759889c7..6df3ada261 100644 --- a/src/app-layer-ssl.c +++ b/src/app-layer-ssl.c @@ -46,20 +46,20 @@ static SCEnumCharMap tls_state_client_table[] = { { - "client_in_progress", - TLS_STATE_CLIENT_IN_PROGRESS, + "client_started", + TLS_STATE_CLIENT_STARTED, }, { - "client_hello_done", - TLS_STATE_CLIENT_HELLO_DONE, + "client_hello", + TLS_STATE_CLIENT_HELLO, }, { - "client_cert_done", - TLS_STATE_CLIENT_CERT_DONE, + "client_cert", + TLS_STATE_CLIENT_CERT, }, { - "client_handshake_done", - TLS_STATE_CLIENT_HANDSHAKE_DONE, + "client_data", + TLS_STATE_CLIENT_DATA, }, { "client_finished", @@ -1544,9 +1544,7 @@ static int TLSDecodeHandshakeHello(SSLState *ssl_state, ssl_state->curr_connp->ja3_hash = Ja3GenerateHash(ssl_state->curr_connp->ja3_str); } - if (ssl_state->curr_connp == &ssl_state->client_connp) { - UpdateClientState(ssl_state, TLS_STATE_CLIENT_HELLO_DONE); - } else { + if (ssl_state->curr_connp != &ssl_state->client_connp) { UpdateServerState(ssl_state, TLS_STATE_SERVER_HELLO); } end: @@ -1575,9 +1573,7 @@ static inline int SSLv3ParseHandshakeTypeCertificate(SSLState *ssl_state, SSLSta SSLParserHSReset(connp); /* fall through to still consume the cert bytes */ } - if (connp == &ssl_state->client_connp) { - UpdateClientState(ssl_state, TLS_STATE_CLIENT_CERT_DONE); - } else { + if (connp != &ssl_state->client_connp) { UpdateServerState(ssl_state, TLS_STATE_SERVER_CERT_DONE); } return input_len; @@ -1694,6 +1690,24 @@ static int SSLv3ParseHandshakeType(SSLState *ssl_state, const uint8_t *input, return input_len; } +/** + * \brief advance the phase state once a handshake message is fully parsed + * + * A handshake message may span several records: the started states stay + * in place until the final fragment completes the message, so the phase + * data (SNI, certificates) is available when its state is entered. + */ +static void SSLv3HandshakePhaseAdvance(SSLState *ssl_state) +{ + if (ssl_state->curr_connp == &ssl_state->client_connp) { + if (ssl_state->curr_connp->handshake_type == SSLV3_HS_CLIENT_HELLO) { + UpdateClientState(ssl_state, TLS_STATE_CLIENT_HELLO); + } else if (ssl_state->curr_connp->handshake_type == SSLV3_HS_CERTIFICATE) { + UpdateClientState(ssl_state, TLS_STATE_CLIENT_CERT); + } + } +} + static int SSLv3ParseHandshakeProtocol(SSLState *ssl_state, const uint8_t *input, uint32_t input_len, uint8_t direction) { @@ -1761,6 +1775,8 @@ static int SSLv3ParseHandshakeProtocol(SSLState *ssl_state, const uint8_t *input } SCLogDebug("retval %d", retval); + SSLv3HandshakePhaseAdvance(ssl_state); + /* data processed, reset buffer */ SCFree(ssl_state->curr_connp->hs_buffer); ssl_state->curr_connp->hs_buffer = NULL; @@ -1856,6 +1872,7 @@ static int SSLv3ParseHandshakeProtocol(SSLState *ssl_state, const uint8_t *input return (retval); } SCLogDebug("retval %d input_len %u", retval, input_len); + SSLv3HandshakePhaseAdvance(ssl_state); input += retval; input_len -= retval; @@ -2281,7 +2298,7 @@ static struct SSLDecoderResult SSLv2Decode(uint8_t direction, SSLState *ssl_stat ssl_state->current_flags = SSL_AL_FLAG_STATE_CLIENT_HELLO; ssl_state->current_flags |= SSL_AL_FLAG_SSL_CLIENT_HS; - UpdateClientState(ssl_state, TLS_STATE_CLIENT_HELLO_DONE); + UpdateClientState(ssl_state, TLS_STATE_CLIENT_HELLO); const uint16_t version = (uint16_t)(input[0] << 8) | input[1]; SCLogDebug("SSLv2: version %04x", version); @@ -2542,7 +2559,7 @@ static struct SSLDecoderResult SSLv3Decode(uint8_t direction, SSLState *ssl_stat ssl_state->flags |= SSL_AL_FLAG_CLIENT_CHANGE_CIPHER_SPEC; // TODO TLS 1.3 - UpdateClientState(ssl_state, TLS_STATE_CLIENT_HANDSHAKE_DONE); + UpdateClientState(ssl_state, TLS_STATE_CLIENT_DATA); } break; @@ -2569,7 +2586,7 @@ static struct SSLDecoderResult SSLv3Decode(uint8_t direction, SSLState *ssl_stat /* if we see (encrypted) application data, then this means the handshake must be done */ if (ssl_state->curr_connp == &ssl_state->client_connp) { - UpdateClientState(ssl_state, TLS_STATE_CLIENT_HANDSHAKE_DONE); + UpdateClientState(ssl_state, TLS_STATE_CLIENT_DATA); } else { UpdateServerState(ssl_state, TLS_STATE_SERVER_HANDSHAKE_DONE); } @@ -2808,12 +2825,12 @@ static AppLayerResult SSLDecode(Flow *f, uint8_t direction, void *alstate, if ((ssl_state->flags & SSL_AL_FLAG_NEED_CLIENT_CERT) && ssl_state->client_connp.cert0_subject && ssl_state->client_connp.cert0_issuerdn) { /* update both sides to keep existing behavior */ - UpdateClientState(ssl_state, TLS_STATE_CLIENT_HANDSHAKE_DONE); + UpdateClientState(ssl_state, TLS_STATE_CLIENT_DATA); UpdateServerState(ssl_state, TLS_STATE_SERVER_HANDSHAKE_DONE); } else if ((ssl_state->flags & SSL_AL_FLAG_NEED_CLIENT_CERT) == 0 && ssl_state->server_connp.cert0_subject && ssl_state->server_connp.cert0_issuerdn) { /* update both sides to keep existing behavior */ - UpdateClientState(ssl_state, TLS_STATE_CLIENT_HANDSHAKE_DONE); + UpdateClientState(ssl_state, TLS_STATE_CLIENT_DATA); UpdateServerState(ssl_state, TLS_STATE_SERVER_HANDSHAKE_DONE); } diff --git a/src/app-layer-ssl.h b/src/app-layer-ssl.h index f58c6d6a23..c2f81e015e 100644 --- a/src/app-layer-ssl.h +++ b/src/app-layer-ssl.h @@ -77,10 +77,10 @@ enum { }; enum TlsStateClient { - TLS_STATE_CLIENT_IN_PROGRESS = 0, - TLS_STATE_CLIENT_HELLO_DONE, - TLS_STATE_CLIENT_CERT_DONE, - TLS_STATE_CLIENT_HANDSHAKE_DONE, + TLS_STATE_CLIENT_STARTED = 0, + TLS_STATE_CLIENT_HELLO, + TLS_STATE_CLIENT_CERT, + TLS_STATE_CLIENT_DATA, TLS_STATE_CLIENT_FINISHED, }; diff --git a/src/detect-ja4-hash.c b/src/detect-ja4-hash.c index 133bf87ea0..806e5a726f 100644 --- a/src/detect-ja4-hash.c +++ b/src/detect-ja4-hash.c @@ -83,10 +83,10 @@ void DetectJa4HashRegister(void) #ifdef HAVE_JA4 DetectAppLayerInspectEngineRegister("ja4.hash", ALPROTO_TLS, SIG_FLAG_TOSERVER, - TLS_STATE_CLIENT_HELLO_DONE, DetectEngineInspectBufferGeneric, GetData); + TLS_STATE_CLIENT_HELLO, DetectEngineInspectBufferGeneric, GetData); DetectAppLayerMpmRegister("ja4.hash", SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister, - GetData, ALPROTO_TLS, TLS_STATE_CLIENT_HELLO_DONE); + GetData, ALPROTO_TLS, TLS_STATE_CLIENT_HELLO); DetectAppLayerMpmRegister("ja4.hash", SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister, Ja4DetectGetHash, ALPROTO_QUIC, 1); diff --git a/src/detect-lua.c b/src/detect-lua.c index 2afe8b2752..e52d48940b 100644 --- a/src/detect-lua.c +++ b/src/detect-lua.c @@ -95,7 +95,7 @@ void DetectLuaRegister(void) g_lua_ja3_list_id = DetectBufferTypeRegister("ja3.lua"); DetectAppLayerInspectEngineRegister("ja3.lua", ALPROTO_TLS, SIG_FLAG_TOSERVER, - TLS_STATE_CLIENT_HELLO_DONE, DetectEngineInspectGenericList, NULL); + TLS_STATE_CLIENT_HELLO, DetectEngineInspectGenericList, NULL); DetectAppLayerInspectEngineRegister( "ja3.lua", ALPROTO_QUIC, SIG_FLAG_TOSERVER, 1, DetectEngineInspectGenericList, NULL); diff --git a/src/detect-tls-alpn.c b/src/detect-tls-alpn.c index 8f9942711d..a045a50bdd 100644 --- a/src/detect-tls-alpn.c +++ b/src/detect-tls-alpn.c @@ -92,8 +92,8 @@ void DetectTlsAlpnRegister(void) sigmatch_table[DETECT_TLS_ALPN].flags |= SIGMATCH_INFO_STICKY_BUFFER | SIGMATCH_INFO_MULTI_BUFFER; - DetectAppLayerMultiRegister("tls.alpn", ALPROTO_TLS, SIG_FLAG_TOSERVER, - TLS_STATE_CLIENT_HELLO_DONE, TlsAlpnGetData, 2); + DetectAppLayerMultiRegister( + "tls.alpn", ALPROTO_TLS, SIG_FLAG_TOSERVER, TLS_STATE_CLIENT_HELLO, TlsAlpnGetData, 2); DetectAppLayerMultiRegister( "tls.alpn", ALPROTO_TLS, SIG_FLAG_TOCLIENT, TLS_STATE_SERVER_HELLO, TlsAlpnGetData, 2); diff --git a/src/detect-tls-cert-fingerprint.c b/src/detect-tls-cert-fingerprint.c index 0a555eee64..e1374755ef 100644 --- a/src/detect-tls-cert-fingerprint.c +++ b/src/detect-tls-cert-fingerprint.c @@ -89,10 +89,10 @@ void DetectTlsFingerprintRegister(void) PrefilterGenericMpmRegister, GetData, ALPROTO_TLS, TLS_STATE_SERVER_CERT_DONE); DetectAppLayerInspectEngineRegister("tls.cert_fingerprint", ALPROTO_TLS, SIG_FLAG_TOSERVER, - TLS_STATE_CLIENT_CERT_DONE, DetectEngineInspectBufferGeneric, GetData); + TLS_STATE_CLIENT_CERT, DetectEngineInspectBufferGeneric, GetData); DetectAppLayerMpmRegister("tls.cert_fingerprint", SIG_FLAG_TOSERVER, 2, - PrefilterGenericMpmRegister, GetData, ALPROTO_TLS, TLS_STATE_CLIENT_CERT_DONE); + PrefilterGenericMpmRegister, GetData, ALPROTO_TLS, TLS_STATE_CLIENT_CERT); DetectBufferTypeSetDescriptionByName("tls.cert_fingerprint", "TLS certificate fingerprint"); diff --git a/src/detect-tls-cert-issuer.c b/src/detect-tls-cert-issuer.c index ba51526064..02c7f0bb38 100644 --- a/src/detect-tls-cert-issuer.c +++ b/src/detect-tls-cert-issuer.c @@ -81,10 +81,10 @@ void DetectTlsIssuerRegister(void) sigmatch_table[DETECT_TLS_CERT_ISSUER].flags |= SIGMATCH_INFO_STICKY_BUFFER; DetectAppLayerInspectEngineRegister("tls.cert_issuer", ALPROTO_TLS, SIG_FLAG_TOSERVER, - TLS_STATE_CLIENT_CERT_DONE, DetectEngineInspectBufferGeneric, GetData); + TLS_STATE_CLIENT_CERT, DetectEngineInspectBufferGeneric, GetData); DetectAppLayerMpmRegister("tls.cert_issuer", SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister, - GetData, ALPROTO_TLS, TLS_STATE_CLIENT_CERT_DONE); + GetData, ALPROTO_TLS, TLS_STATE_CLIENT_CERT); DetectAppLayerInspectEngineRegister("tls.cert_issuer", ALPROTO_TLS, SIG_FLAG_TOCLIENT, TLS_STATE_SERVER_CERT_DONE, DetectEngineInspectBufferGeneric, GetData); diff --git a/src/detect-tls-cert-serial.c b/src/detect-tls-cert-serial.c index b35c08508a..0fd9467989 100644 --- a/src/detect-tls-cert-serial.c +++ b/src/detect-tls-cert-serial.c @@ -91,10 +91,10 @@ void DetectTlsSerialRegister(void) GetData, ALPROTO_TLS, TLS_STATE_SERVER_CERT_DONE); DetectAppLayerInspectEngineRegister("tls.cert_serial", ALPROTO_TLS, SIG_FLAG_TOSERVER, - TLS_STATE_CLIENT_CERT_DONE, DetectEngineInspectBufferGeneric, GetData); + TLS_STATE_CLIENT_CERT, DetectEngineInspectBufferGeneric, GetData); DetectAppLayerMpmRegister("tls.cert_serial", SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister, - GetData, ALPROTO_TLS, TLS_STATE_CLIENT_CERT_DONE); + GetData, ALPROTO_TLS, TLS_STATE_CLIENT_CERT); DetectBufferTypeSetDescriptionByName("tls.cert_serial", "TLS certificate serial number"); diff --git a/src/detect-tls-cert-subject.c b/src/detect-tls-cert-subject.c index 78063e93c7..6d9335c94f 100644 --- a/src/detect-tls-cert-subject.c +++ b/src/detect-tls-cert-subject.c @@ -81,10 +81,10 @@ void DetectTlsSubjectRegister(void) sigmatch_table[DETECT_TLS_CERT_SUBJECT].flags |= SIGMATCH_INFO_STICKY_BUFFER; DetectAppLayerInspectEngineRegister("tls.cert_subject", ALPROTO_TLS, SIG_FLAG_TOSERVER, - TLS_STATE_CLIENT_CERT_DONE, DetectEngineInspectBufferGeneric, GetData); + TLS_STATE_CLIENT_CERT, DetectEngineInspectBufferGeneric, GetData); DetectAppLayerMpmRegister("tls.cert_subject", SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister, - GetData, ALPROTO_TLS, TLS_STATE_CLIENT_CERT_DONE); + GetData, ALPROTO_TLS, TLS_STATE_CLIENT_CERT); DetectAppLayerInspectEngineRegister("tls.cert_subject", ALPROTO_TLS, SIG_FLAG_TOCLIENT, TLS_STATE_SERVER_CERT_DONE, DetectEngineInspectBufferGeneric, GetData); diff --git a/src/detect-tls-certs.c b/src/detect-tls-certs.c index ed4e6265fd..3e8bdc4b52 100644 --- a/src/detect-tls-certs.c +++ b/src/detect-tls-certs.c @@ -116,8 +116,8 @@ void DetectTlsCertsRegister(void) DetectAppLayerMultiRegister("tls.certs", ALPROTO_TLS, SIG_FLAG_TOCLIENT, TLS_STATE_SERVER_CERT_DONE, TlsCertsGetData, 2); - DetectAppLayerMultiRegister("tls.certs", ALPROTO_TLS, SIG_FLAG_TOSERVER, - TLS_STATE_CLIENT_CERT_DONE, TlsCertsGetData, 2); + DetectAppLayerMultiRegister( + "tls.certs", ALPROTO_TLS, SIG_FLAG_TOSERVER, TLS_STATE_CLIENT_CERT, TlsCertsGetData, 2); DetectBufferTypeSetDescriptionByName("tls.certs", "TLS certificate"); diff --git a/src/detect-tls-ja3-hash.c b/src/detect-tls-ja3-hash.c index 3f0544ad61..f554351a88 100644 --- a/src/detect-tls-ja3-hash.c +++ b/src/detect-tls-ja3-hash.c @@ -92,10 +92,10 @@ void DetectTlsJa3HashRegister(void) #ifdef HAVE_JA3 DetectAppLayerInspectEngineRegister("ja3.hash", ALPROTO_TLS, SIG_FLAG_TOSERVER, - TLS_STATE_CLIENT_HELLO_DONE, DetectEngineInspectBufferGeneric, GetData); + TLS_STATE_CLIENT_HELLO, DetectEngineInspectBufferGeneric, GetData); DetectAppLayerMpmRegister("ja3.hash", SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister, - GetData, ALPROTO_TLS, TLS_STATE_CLIENT_HELLO_DONE); + GetData, ALPROTO_TLS, TLS_STATE_CLIENT_HELLO); DetectAppLayerMpmRegister("ja3.hash", SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister, Ja3DetectGetHash, ALPROTO_QUIC, 1); diff --git a/src/detect-tls-ja3-string.c b/src/detect-tls-ja3-string.c index c18da75733..2c7e2605ce 100644 --- a/src/detect-tls-ja3-string.c +++ b/src/detect-tls-ja3-string.c @@ -93,10 +93,10 @@ void DetectTlsJa3StringRegister(void) #ifdef HAVE_JA3 DetectAppLayerInspectEngineRegister("ja3.string", ALPROTO_TLS, SIG_FLAG_TOSERVER, - TLS_STATE_CLIENT_HELLO_DONE, DetectEngineInspectBufferGeneric, GetData); + TLS_STATE_CLIENT_HELLO, DetectEngineInspectBufferGeneric, GetData); DetectAppLayerMpmRegister("ja3.string", SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister, - GetData, ALPROTO_TLS, TLS_STATE_CLIENT_HELLO_DONE); + GetData, ALPROTO_TLS, TLS_STATE_CLIENT_HELLO); DetectAppLayerMpmRegister("ja3.string", SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister, Ja3DetectGetString, ALPROTO_QUIC, 1); diff --git a/src/detect-tls-random.c b/src/detect-tls-random.c index 0d3d86f800..941795253c 100644 --- a/src/detect-tls-random.c +++ b/src/detect-tls-random.c @@ -64,9 +64,9 @@ void DetectTlsRandomTimeRegister(void) /* Register engine for Server random */ DetectAppLayerInspectEngineRegister("tls.random_time", ALPROTO_TLS, SIG_FLAG_TOSERVER, - TLS_STATE_CLIENT_HELLO_DONE, DetectEngineInspectBufferGeneric, GetRandomTimeData); + TLS_STATE_CLIENT_HELLO, DetectEngineInspectBufferGeneric, GetRandomTimeData); DetectAppLayerMpmRegister("tls.random_time", SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister, - GetRandomTimeData, ALPROTO_TLS, TLS_STATE_CLIENT_HELLO_DONE); + GetRandomTimeData, ALPROTO_TLS, TLS_STATE_CLIENT_HELLO); /* Register engine for Client random */ DetectAppLayerInspectEngineRegister("tls.random_time", ALPROTO_TLS, SIG_FLAG_TOCLIENT, @@ -91,9 +91,9 @@ void DetectTlsRandomBytesRegister(void) /* Register engine for Server random */ DetectAppLayerInspectEngineRegister("tls.random_bytes", ALPROTO_TLS, SIG_FLAG_TOSERVER, - TLS_STATE_CLIENT_HELLO_DONE, DetectEngineInspectBufferGeneric, GetRandomBytesData); + TLS_STATE_CLIENT_HELLO, DetectEngineInspectBufferGeneric, GetRandomBytesData); DetectAppLayerMpmRegister("tls.random_bytes", SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister, - GetRandomBytesData, ALPROTO_TLS, TLS_STATE_CLIENT_HELLO_DONE); + GetRandomBytesData, ALPROTO_TLS, TLS_STATE_CLIENT_HELLO); /* Register engine for Client random */ DetectAppLayerInspectEngineRegister("tls.random_bytes", ALPROTO_TLS, SIG_FLAG_TOCLIENT, diff --git a/src/detect-tls-sni.c b/src/detect-tls-sni.c index 398f22c793..281ea66630 100644 --- a/src/detect-tls-sni.c +++ b/src/detect-tls-sni.c @@ -75,10 +75,10 @@ void DetectTlsSniRegister(void) sigmatch_table[DETECT_TLS_SNI].flags |= SIGMATCH_INFO_STICKY_BUFFER; DetectAppLayerInspectEngineRegister("tls.sni", ALPROTO_TLS, SIG_FLAG_TOSERVER, - TLS_STATE_CLIENT_HELLO_DONE, DetectEngineInspectBufferGeneric, GetData); + TLS_STATE_CLIENT_HELLO, DetectEngineInspectBufferGeneric, GetData); DetectAppLayerMpmRegister("tls.sni", SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister, GetData, - ALPROTO_TLS, TLS_STATE_CLIENT_HELLO_DONE); + ALPROTO_TLS, TLS_STATE_CLIENT_HELLO); DetectBufferTypeSetDescriptionByName("tls.sni", "TLS Server Name Indication (SNI) extension"); diff --git a/src/detect-tls.c b/src/detect-tls.c index a3808d2f36..6a4dd567fa 100644 --- a/src/detect-tls.c +++ b/src/detect-tls.c @@ -147,7 +147,7 @@ void DetectTlsRegister (void) TLS_STATE_SERVER_CERT_DONE, DetectEngineInspectGenericList, NULL); DetectAppLayerInspectEngineRegister("tls_cert", ALPROTO_TLS, SIG_FLAG_TOSERVER, - TLS_STATE_CLIENT_CERT_DONE, DetectEngineInspectGenericList, NULL); + TLS_STATE_CLIENT_CERT, DetectEngineInspectGenericList, NULL); } /** diff --git a/src/output-json-tls.c b/src/output-json-tls.c index 4ec0eff2c3..2f92eccad2 100644 --- a/src/output-json-tls.c +++ b/src/output-json-tls.c @@ -734,5 +734,5 @@ void JsonTlsLogRegister (void) /* register as child of eve-log */ OutputRegisterTxSubModuleWithProgress(LOGGER_JSON_TX, "eve-log", "JsonTlsLog", "eve-log.tls", OutputTlsLogInitSub, ALPROTO_TLS, JsonTlsLogger, TLS_STATE_SERVER_HANDSHAKE_DONE, - TLS_STATE_CLIENT_HANDSHAKE_DONE, JsonTlsLogThreadInit, JsonTlsLogThreadDeinit); + TLS_STATE_CLIENT_DATA, JsonTlsLogThreadInit, JsonTlsLogThreadDeinit); } diff --git a/src/output-lua.c b/src/output-lua.c index 472c10d6a8..93506e1ecc 100644 --- a/src/output-lua.c +++ b/src/output-lua.c @@ -794,7 +794,7 @@ static OutputInitResult OutputLuaLogInit(SCConfNode *conf) om->TxLogFunc = LuaTxLogger; om->alproto = ALPROTO_TLS; om->tc_log_progress = TLS_STATE_SERVER_HANDSHAKE_DONE; - om->ts_log_progress = TLS_STATE_CLIENT_HANDSHAKE_DONE; + om->ts_log_progress = TLS_STATE_CLIENT_DATA; SCAppLayerParserRegisterLogger(IPPROTO_TCP, ALPROTO_TLS); } else if (opts.alproto == ALPROTO_DNS) { om->TxLogFunc = LuaTxLogger;