tls/ja3: try to enable ja3 if rule keywords need it

pull/4289/head
Victor Julien 7 years ago
parent 29dcd98ed1
commit ca5226f0c7

@ -123,6 +123,9 @@ static int DetectTlsJa3HashSetup(DetectEngineCtx *de_ctx, Signature *s, const ch
if (DetectSignatureSetAppProto(s, ALPROTO_TLS) < 0) if (DetectSignatureSetAppProto(s, ALPROTO_TLS) < 0)
return -1; return -1;
/* try to enable JA3 */
SSLEnableJA3();
/* Check if JA3 is disabled */ /* Check if JA3 is disabled */
if (!RunmodeIsUnittests() && Ja3IsDisabled("rule")) if (!RunmodeIsUnittests() && Ja3IsDisabled("rule"))
return -1; return -1;

@ -113,6 +113,9 @@ static int DetectTlsJa3StringSetup(DetectEngineCtx *de_ctx, Signature *s, const
if (DetectSignatureSetAppProto(s, ALPROTO_TLS) < 0) if (DetectSignatureSetAppProto(s, ALPROTO_TLS) < 0)
return -1; return -1;
/* try to enable JA3 */
SSLEnableJA3();
/* Check if JA3 is disabled */ /* Check if JA3 is disabled */
if (!RunmodeIsUnittests() && Ja3IsDisabled("rule")) if (!RunmodeIsUnittests() && Ja3IsDisabled("rule"))
return -1; return -1;

@ -122,6 +122,9 @@ static int DetectTlsJa3SHashSetup(DetectEngineCtx *de_ctx, Signature *s, const c
if (DetectSignatureSetAppProto(s, ALPROTO_TLS) < 0) if (DetectSignatureSetAppProto(s, ALPROTO_TLS) < 0)
return -1; return -1;
/* try to enable JA3 */
SSLEnableJA3();
/* Check if JA3 is disabled */ /* Check if JA3 is disabled */
if (!RunmodeIsUnittests() && Ja3IsDisabled("rule")) if (!RunmodeIsUnittests() && Ja3IsDisabled("rule"))
return -1; return -1;

@ -112,6 +112,9 @@ static int DetectTlsJa3SStringSetup(DetectEngineCtx *de_ctx, Signature *s, const
if (DetectSignatureSetAppProto(s, ALPROTO_TLS) < 0) if (DetectSignatureSetAppProto(s, ALPROTO_TLS) < 0)
return -1; return -1;
/* try to enable JA3 */
SSLEnableJA3();
/* Check if JA3 is disabled */ /* Check if JA3 is disabled */
if (!RunmodeIsUnittests() && Ja3IsDisabled("rule")) if (!RunmodeIsUnittests() && Ja3IsDisabled("rule"))
return -1; return -1;

@ -24,6 +24,7 @@
*/ */
#include "suricata-common.h" #include "suricata-common.h"
#include "app-layer-ssl.h"
#include "util-validate.h" #include "util-validate.h"
#include "util-ja3.h" #include "util-ja3.h"
@ -261,11 +262,7 @@ char *Ja3GenerateHash(JA3Buffer *buffer)
*/ */
int Ja3IsDisabled(const char *type) int Ja3IsDisabled(const char *type)
{ {
int is_enabled = 0; bool is_enabled = SSLJA3IsEnabled();
/* Check if JA3 is enabled */
ConfGetBool("app-layer.protocols.tls.ja3-fingerprints", &is_enabled);
if (is_enabled == 0) { if (is_enabled == 0) {
SCLogWarning(SC_WARN_JA3_DISABLED, "JA3 is disabled, skipping %s", SCLogWarning(SC_WARN_JA3_DISABLED, "JA3 is disabled, skipping %s",
type); type);

Loading…
Cancel
Save