<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">Hi,<br>
<br>
I can confirm this behaviour on a debian stretch and debian buster
installation.<br>
Both were updated to suricata 5.0 but the problem persists.<br>
<br>
On one machine, I'm using oinkmaster and the other is using py
update, but was not able to tear down the reason for this
behaviour.<br>
<br>
regards,<br>
Karl<br>
<br>
Am 21.10.19 um 00:18 schrieb Nuno Oliveira:<br>
</div>
<blockquote type="cite" cite="mid:20191020221859.GA31980@eq.uc.pt">Hi,
<br>
<br>
This happens with suricata 4.1.5 on Linux debian testing /
unstable, working in inline (IPS) mode. I've used the official
binary package available.
<br>
<br>
I've started with the default suricata.yaml and
suricata-oinkmaster.conf files, which seem to be the default
upstream files (attached); in suricata.yaml, I've just changed the
external interface name, and specified host-mode: router, for
inline (nfqueue) mode.
<br>
<br>
In suricata-oinkmaster.conf, I've also added <br>
modifysid emerging-trojan.rules "^alert" | "drop"
<br>
<br>
and started suricata. There are no error / warning messages in the
log during the startup phase.
<br>
<br>
After the above modifysid change is introduced, certain https
sites hang during the TLS negotiation phase. These are a bit rare,
but a few of them are:
<br>
<br>
<a class="moz-txt-link-freetext" href="https://microbiotec19.net/en/">https://microbiotec19.net/en/</a>
<br>
<a class="moz-txt-link-freetext" href="https://www.geekrar.com">https://www.geekrar.com</a>
<br>
<a class="moz-txt-link-freetext" href="https://www.asbeiras.pt/">https://www.asbeiras.pt/</a>
<br>
<a class="moz-txt-link-freetext" href="https://www.runningwonders.com/meiamaratonacoimbra/">https://www.runningwonders.com/meiamaratonacoimbra/</a>
<br>
<br>
All of these pages load normally when the modifysid line is
commented. Since I get no logs of the emerging-trojan rules being
activated, this seems unrelated, and should not occur.
<br>
<br>
So far I've obtained the same behavior on 2 different systems. Can
anyone else try to reproduce this?
<br>
<br>
Thanks,
<br>
<br>
Nuno.
<br>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<pre class="moz-quote-pre" wrap="">_______________________________________________
Suricata IDS Users mailing list: <a class="moz-txt-link-abbreviated" href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@openinfosecfoundation.org</a>
Site: <a class="moz-txt-link-freetext" href="http://suricata-ids.org">http://suricata-ids.org</a> | Support: <a class="moz-txt-link-freetext" href="http://suricata-ids.org/support/">http://suricata-ids.org/support/</a>
List: <a class="moz-txt-link-freetext" href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a>
Conference: <a class="moz-txt-link-freetext" href="https://suricon.net">https://suricon.net</a>
Trainings: <a class="moz-txt-link-freetext" href="https://suricata-ids.org/training/">https://suricata-ids.org/training/</a></pre>
</blockquote>
<br>
</body>
</html>