mirror of https://github.com/OISF/suricata
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
90 lines
1.8 KiB
ReStructuredText
90 lines
1.8 KiB
ReStructuredText
JA3
|
|
---
|
|
|
|
JA3 details are exposes to Lua scripts with the
|
|
``suricata.ja3`` library, For example::
|
|
|
|
local ja3 = require("suricata.ja3")
|
|
|
|
If you want to use ja3, you can either set suricata.yaml option
|
|
``app-layer.protocols.tls.ja3-fingerprints`` to true,
|
|
or specify it in the ``init`` function of your lua script
|
|
by calling ``ja3.enable_ja3()``::
|
|
|
|
function init (args)
|
|
ja3.enable_ja3()
|
|
return {}
|
|
end
|
|
|
|
``ja3.enable_ja3()`` will not enable ja3 if they are explicitly
|
|
disabled, so you should add ``requires: feature ja3;`` to your rule.
|
|
|
|
For use in rule matching, the rule may **hook** into a TLS or QUIC
|
|
transaction state if you want to match on only one of these protocols.
|
|
Or you should use need ``ja3`` or ``ja3s`` in your init script::
|
|
|
|
function init (args)
|
|
ja3.enable_ja3()
|
|
local needs = {}
|
|
needs["ja3s"] = true
|
|
return needs
|
|
end
|
|
|
|
Transaction
|
|
~~~~~~~~~~~
|
|
|
|
JA3 is transaction based, and the current transaction must be obtained before use::
|
|
|
|
local tx, err = ja3.get_tx()
|
|
if tx == err then
|
|
print(err)
|
|
end
|
|
|
|
All other functions are methods on the transaction (either a QUIC or a TLS one).
|
|
|
|
Transaction Methods
|
|
~~~~~~~~~~~~~~~~~~~
|
|
|
|
``ja3_get_hash()``
|
|
^^^^^^^^^^^^^^^^^^
|
|
|
|
Get the ja3 value as a hash.
|
|
|
|
Example::
|
|
|
|
local tx = ja3.get_tx()
|
|
local h = tx:ja3_get_hash();
|
|
print (h)
|
|
|
|
``ja3_get_string()``
|
|
^^^^^^^^^^^^^^^^^^^^
|
|
|
|
Get the ja3 value as a string.
|
|
|
|
Example::
|
|
|
|
local tx = ja3.get_tx()
|
|
local s = tx:ja3_get_string();
|
|
print (s)
|
|
|
|
``ja3s_get_hash()``
|
|
^^^^^^^^^^^^^^^^^^^
|
|
|
|
Get the ja3s value as a hash.
|
|
|
|
Example::
|
|
|
|
local tx = ja3.get_tx()
|
|
local h = tx:ja3s_get_hash();
|
|
print (h)
|
|
|
|
``ja3s_get_string()``
|
|
^^^^^^^^^^^^^^^^^^^^^
|
|
|
|
Get the ja3s value as a string.
|
|
|
|
Example::
|
|
|
|
local tx = ja3.get_tx()
|
|
local s = tx:ja3s_get_string();
|
|
print (s) |