<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">I believe this rule was running under 3.2.0 but after upgrading to 3.2.1, suricata is throwing errors on startup. Not sure if the upgrade is just coincidence or not.<div class=""><br class=""><div class="">The rule is from the web page - <a href="https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Protocol_Anomalies_Detection" class="">https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Protocol_Anomalies_Detection</a></div><div class=""><br class=""></div><div class="">alert http any any -> any 443 (msg:"SURICATA HTTP clear text on port 443"; flow:to_server; app-layer-protocol:http; sid:2271019; rev:1;)</div><div class=""><br class=""></div><div class="">and the errors are</div><div class=""><div class="">21/2/2017 -- 10:33:11 - <Info> - Running suricata under test mode</div><div class="">21/2/2017 -- 10:33:11 - <Notice> - This is Suricata version 3.2.1 RELEASE</div><div class="">21/2/2017 -- 10:33:11 - <Error> - [ERRCODE: SC_ERR_CONFLICTING_RULE_KEYWORDS(141)] - Either we already have the rule match on an app layer protocol set through other keywords that match on this protocol, or have already seen a non-negated app-layer-protocol.</div><div class="">21/2/2017 -- 10:33:11 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert http any any -> any 443 (msg:"SURICATA HTTP clear text on port 443"; flow:to_server; app-layer-protocol:http; sid:2271019; rev:1;)" from file /etc/suricata/rules/dpd.rules at line 5</div><div class="">21/2/2017 -- 10:33:18 - <Error> - [ERRCODE: SC_ERR_NO_RULES_LOADED(43)] - Loading signatures failed.</div></div><div class=""><br class=""></div><div class="">I’ve grepped through my rules files to try to find anything else with</div><div class=""><br class=""></div><div class="">app-layer-protocol:http</div><div class=""><br class=""></div><div class="">but I’ve come up with no matching rules.</div><div class=""><br class=""></div><div class="">For the time being I’ve just commented the rule out, but I’d like to get it working again if possible. Anyone have any ideas or is using a similar rule without problems?</div><div class=""><br class=""><div class="">
<div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Jeffrey Collyer<br class="">Information Security Engineer<br class="">University of Virginia<br class=""><br class=""><br class=""></div>
</div>
<br class=""></div></div></body></html>