From ffd30f161ae5351aca755af89755545175a1b22e Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Thu, 1 Oct 2026 17:05:53 +0000 Subject: [PATCH] tls: fix SSLv2 hello tls.version matching tls.version requires the connp's hello to have decoded (hello_decoded), which only TLSDecodeHandshakeHello() set. The SSLv2 hello path sets the client version without the flag, so an SSLv2-compatible ClientHello no longer matched tls.version: on main it matched, so a firewall accept rule using the keyword never accepted. Set the flag in the SSLv2 client and server hello cases. Ticket: #9047. --- src/app-layer-ssl.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/app-layer-ssl.c b/src/app-layer-ssl.c index e98a00793f..287be4a051 100644 --- a/src/app-layer-ssl.c +++ b/src/app-layer-ssl.c @@ -2431,6 +2431,7 @@ static struct SSLDecoderResult SSLv2Decode(uint8_t direction, SSLState *ssl_stat const uint16_t version = (uint16_t)(input[0] << 8) | input[1]; SCLogDebug("SSLv2: version %04x", version); ssl_state->curr_connp->version = version; + ssl_state->curr_connp->hello_decoded = true; uint16_t session_id_length = (input[5]) | (uint16_t)(input[4] << 8); input += 6; input_len -= 6; @@ -2511,6 +2512,7 @@ static struct SSLDecoderResult SSLv2Decode(uint8_t direction, SSLState *ssl_stat case SSLV2_MT_SERVER_HELLO: ssl_state->current_flags = SSL_AL_FLAG_STATE_SERVER_HELLO; ssl_state->current_flags |= SSL_AL_FLAG_SSL_SERVER_HS; + ssl_state->curr_connp->hello_decoded = true; UpdateServerState(ssl_state, TLS_STATE_SERVER_HELLO); break;