tls/ja3: try to enable ja3 if rule keywords need it

pull/4289/head
Victor Julien 7 years ago
parent 29dcd98ed1
commit ca5226f0c7

@ -123,6 +123,9 @@ static int DetectTlsJa3HashSetup(DetectEngineCtx *de_ctx, Signature *s, const ch
if (DetectSignatureSetAppProto(s, ALPROTO_TLS) < 0)
return -1;
/* try to enable JA3 */
SSLEnableJA3();
/* Check if JA3 is disabled */
if (!RunmodeIsUnittests() && Ja3IsDisabled("rule"))
return -1;

@ -113,6 +113,9 @@ static int DetectTlsJa3StringSetup(DetectEngineCtx *de_ctx, Signature *s, const
if (DetectSignatureSetAppProto(s, ALPROTO_TLS) < 0)
return -1;
/* try to enable JA3 */
SSLEnableJA3();
/* Check if JA3 is disabled */
if (!RunmodeIsUnittests() && Ja3IsDisabled("rule"))
return -1;

@ -122,6 +122,9 @@ static int DetectTlsJa3SHashSetup(DetectEngineCtx *de_ctx, Signature *s, const c
if (DetectSignatureSetAppProto(s, ALPROTO_TLS) < 0)
return -1;
/* try to enable JA3 */
SSLEnableJA3();
/* Check if JA3 is disabled */
if (!RunmodeIsUnittests() && Ja3IsDisabled("rule"))
return -1;

@ -112,6 +112,9 @@ static int DetectTlsJa3SStringSetup(DetectEngineCtx *de_ctx, Signature *s, const
if (DetectSignatureSetAppProto(s, ALPROTO_TLS) < 0)
return -1;
/* try to enable JA3 */
SSLEnableJA3();
/* Check if JA3 is disabled */
if (!RunmodeIsUnittests() && Ja3IsDisabled("rule"))
return -1;

@ -24,6 +24,7 @@
*/
#include "suricata-common.h"
#include "app-layer-ssl.h"
#include "util-validate.h"
#include "util-ja3.h"
@ -261,11 +262,7 @@ char *Ja3GenerateHash(JA3Buffer *buffer)
*/
int Ja3IsDisabled(const char *type)
{
int is_enabled = 0;
/* Check if JA3 is enabled */
ConfGetBool("app-layer.protocols.tls.ja3-fingerprints", &is_enabled);
bool is_enabled = SSLJA3IsEnabled();
if (is_enabled == 0) {
SCLogWarning(SC_WARN_JA3_DISABLED, "JA3 is disabled, skipping %s",
type);

Loading…
Cancel
Save