<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
p.ox-5b4ed10b72-msonormal, li.ox-5b4ed10b72-msonormal, div.ox-5b4ed10b72-msonormal
{mso-style-name:ox-5b4ed10b72-msonormal;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
p.ox-5b4ed10b72-ox-335a999652-msonormal, li.ox-5b4ed10b72-ox-335a999652-msonormal, div.ox-5b4ed10b72-ox-335a999652-msonormal
{mso-style-name:ox-5b4ed10b72-ox-335a999652-msonormal;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle22
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 3.0cm 70.85pt 3.0cm;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="ES" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">I have found the problem: it is the rule:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">alert tcp any any -> any ![443,465,587] (msg:"SURICATA TLS on unusual port"; flow:to_server; app-layer-protocol:tls; threshold:type limit, track by_src, seconds 60, count 1; sid:2610003;
rev:1;)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">As you can see, TLS ports are hardcoded … Is it possible to change as a variable?<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span lang="EN-US">-- <o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">Regards,<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">C. L. Martinez</span><span lang="EN-US" style="mso-fareast-language:EN-US"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span style="font-size:12.0pt;color:black">From: </span></b><span style="font-size:12.0pt;color:black">Oisf-users <oisf-users-bounces@lists.openinfosecfoundation.org> on behalf of Carlos Lopez <clopmz@outlook.com><br>
<b>Date: </b>Sunday, 5 January 2020 at 14:23<br>
<b>To: </b>Konstantin Klinger <konstantinklinger@mailbox.org>, "oisf-users@lists.openinfosecfoundation.org" <oisf-users@lists.openinfosecfoundation.org><br>
<b>Subject: </b>Re: [Oisf-users] Monitoring DNS over TLS: SURICATA TLS on unusual port<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">Uhmmm … strange. Ok, I will check it to see If I have done some mistake with my suricata’s config.</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"> </span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">Many thanks for your help Konstantin.</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"> </span><o:p></o:p></p>
<div>
<p class="MsoNormal"><span lang="EN-US">-- </span><o:p></o:p></p>
<div>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">Regards,</span><o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">C. L. Martinez</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"> </span><o:p></o:p></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span style="font-size:12.0pt;color:black">From: </span></b><span style="font-size:12.0pt;color:black">Konstantin Klinger <konstantinklinger@mailbox.org><br>
<b>Date: </b>Sunday, 5 January 2020 at 14:19<br>
<b>To: </b>Carlos Lopez <clopmz@outlook.com>, "oisf-users@lists.openinfosecfoundation.org" <oisf-users@lists.openinfosecfoundation.org><br>
<b>Subject: </b>Re: [Oisf-users] Monitoring DNS over TLS: SURICATA TLS on unusual port</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Works for me as expected with Suricata 5.0. Suricata can parse TLS on that port as expected and parses it also. Eve json output and alert generation are working.
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">suricata.yaml: <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">tls: <br>
enabled: yes <br>
detection-ports: <br>
dp: 443, 853 <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">fast.log: <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">01/05/2020-13:47:29.304261 [**] [1:1:1] FOO TLS [**] [Classification: (null)] [Priority: 3] {TCP} 1.1.1.1:853 -> 172.22.54.6:16358
<br>
01/05/2020-13:47:29.304418 [**] [1:1:1] FOO TLS [**] [Classification: (null)] [Priority: 3] {TCP} 1.1.1.1:853 -> 172.22.54.6:16358
<br>
01/05/2020-13:47:29.304421 [**] [1:1:1] FOO TLS [**] [Classification: (null)] [Priority: 3] {TCP} 1.1.1.1:853 -> 172.22.54.6:16358
<br>
01/05/2020-13:47:29.304422 [**] [1:1:1] FOO TLS [**] [Classification: (null)] [Priority: 3] {TCP} 172.22.54.6:16358 -> 1.1.1.1:853
<br>
01/05/2020-13:47:29.311176 [**] [1:1:1] FOO TLS [**] [Classification: (null)] [Priority: 3] {TCP} 172.22.54.6:16358 -> 1.1.1.1:853
<br>
01/05/2020-13:47:29.331169 [**] [1:1:1] FOO TLS [**] [Classification: (null)] [Priority: 3] {TCP} 1.1.1.1:853 -> 172.22.54.6:16358
<br>
01/05/2020-13:47:29.331457 [**] [1:1:1] FOO TLS [**] [Classification: (null)] [Priority: 3] {TCP} 1.1.1.1:853 -> 172.22.54.6:16358
<br>
01/05/2020-13:47:29.331842 [**] [1:1:1] FOO TLS [**] [Classification: (null)] [Priority: 3] {TCP} 172.22.54.6:16358 -> 1.1.1.1:853
<br>
01/05/2020-13:47:29.351653 [**] [1:1:1] FOO TLS [**] [Classification: (null)] [Priority: 3] {TCP} 1.1.1.1:853 -> 172.22.54.6:16358
<br>
01/05/2020-13:47:29.419592 [**] [1:1:1] FOO TLS [**] [Classification: (null)] [Priority: 3] {TCP} 1.1.1.1:853 -> 172.22.54.6:16358
<br>
01/05/2020-13:47:29.419935 [**] [1:1:1] FOO TLS [**] [Classification: (null)] [Priority: 3] {TCP} 172.22.54.6:16358 -> 1.1.1.1:853
<br>
01/05/2020-13:47:29.420171 [**] [1:1:1] FOO TLS [**] [Classification: (null)] [Priority: 3] {TCP} 172.22.54.6:16358 -> 1.1.1.1:853
<br>
01/05/2020-13:47:29.439981 [**] [1:1:1] FOO TLS [**] [Classification: (null)] [Priority: 3] {TCP} 1.1.1.1:853 -> 172.22.54.6:16358
<br>
01/05/2020-13:47:29.440178 [**] [1:1:1] FOO TLS [**] [Classification: (null)] [Priority: 3] {TCP} 1.1.1.1:853 -> 172.22.54.6:16358
<br>
01/05/2020-13:47:29.440363 [**] [1:1:1] FOO TLS [**] [Classification: (null)] [Priority: 3] {TCP} 172.22.54.6:16358 -> 1.1.1.1:853
<br>
01/05/2020-13:47:29.440363 [**] [1:1:1] FOO TLS [**] [Classification: (null)] [Priority: 3] {TCP} 172.22.54.6:16358 -> 1.1.1.1:853
<br>
01/05/2020-13:47:29.440363 [**] [1:1:1] FOO TLS [**] [Classification: (null)] [Priority: 3] {TCP} 1.1.1.1:853 -> 172.22.54.6:16358
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Rule: <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">alert tls any any -> any any (msg:"FOO TLS"; sid:1; rev:1;) <o:p>
</o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Example eve json output entry: <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">{ <br>
"timestamp": "2020-01-05T13:47:29.304422+0100", <br>
"flow_id": 84670362485565, <br>
"pcap_cnt": 8, <br>
"event_type": "tls", <br>
"src_ip": "172.22.54.6", <br>
"src_port": 16358, <br>
"dest_ip": "1.1.1.1", <br>
"dest_port": 853, <br>
"proto": "TCP", <br>
"tls": { <br>
"subject": "C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=cloudflare-dns.com",
<br>
"issuerdn": "C=US, O=DigiCert Inc, CN=DigiCert ECC Secure Server CA", <br>
"serial": "01:CC:E3:18:DE:9F:56:7F:AB:2B:24:90:1F:AD:A7:1D", <br>
"fingerprint": "66:56:84:01:72:b4:fb:bc:d6:d0:a4:a1:03:49:1e:93:00:4d:19:5f", <br>
"version": "TLS 1.2", <br>
"notbefore": "2019-01-28T00:00:00", <br>
"notafter": "2021-02-01T12:00:00", <br>
"ja3": {}, <br>
"ja3s": {} <br>
} <br>
} <o:p></o:p></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal" style="margin-bottom:12.0pt">On January 5, 2020 at 1:50 PM Carlos Lopez <clopmz@outlook.com> wrote:
<o:p></o:p></p>
<div>
<p class="ox-5b4ed10b72-msonormal">Hi Konstatin,<o:p></o:p></p>
<p class="ox-5b4ed10b72-msonormal"> <o:p></o:p></p>
<p class="ox-5b4ed10b72-msonormal">Pcap attached. I am using default config from Suricata install from source … The only option I have changed is dp …<o:p></o:p></p>
<p class="ox-5b4ed10b72-msonormal"> <o:p></o:p></p>
<p class="ox-5b4ed10b72-msonormal">Many thanks for your help.<o:p></o:p></p>
<p class="ox-5b4ed10b72-msonormal"> <o:p></o:p></p>
<div>
<p class="ox-5b4ed10b72-msonormal">-- <o:p></o:p></p>
<div>
<p class="ox-5b4ed10b72-msonormal">Regards,<o:p></o:p></p>
</div>
</div>
<p class="ox-5b4ed10b72-msonormal">C. L. Martinez<o:p></o:p></p>
<p class="ox-5b4ed10b72-msonormal"> <o:p></o:p></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="ox-5b4ed10b72-msonormal"><strong><span style="font-size:12.0pt;font-family:"Calibri",sans-serif;color:black">From:
</span></strong><span style="font-size:12.0pt;color:black">Konstantin Klinger <konstantinklinger@mailbox.org><br>
<strong><span style="font-family:"Calibri",sans-serif">Date: </span></strong>Sunday, 5 January 2020 at 13:35<br>
<strong><span style="font-family:"Calibri",sans-serif">To: </span></strong>Carlos Lopez <clopmz@outlook.com>, "oisf-users@lists.openinfosecfoundation.org" <oisf-users@lists.openinfosecfoundation.org><br>
<strong><span style="font-family:"Calibri",sans-serif">Subject: </span></strong>Re: [Oisf-users] Monitoring DNS over TLS: SURICATA TLS on unusual port
</span><o:p></o:p></p>
</div>
<div>
<p class="ox-5b4ed10b72-msonormal"> <o:p></o:p></p>
</div>
<div>
<p class="ox-5b4ed10b72-msonormal">Hi Carlos,<o:p></o:p></p>
</div>
<div>
<p class="ox-5b4ed10b72-msonormal"> <o:p></o:p></p>
</div>
<div>
<p class="ox-5b4ed10b72-msonormal">could you please share your suricata.yaml and additional a sample pcap of your dns over tls traffic via port 853 if it is possible? If you would not like to share it publicly, but with with, I've attached my PGP key.<o:p></o:p></p>
</div>
<div>
<p class="ox-5b4ed10b72-msonormal"> <o:p></o:p></p>
</div>
<div>
<p class="ox-5b4ed10b72-msonormal">Thanks,<o:p></o:p></p>
</div>
<div>
<p class="ox-5b4ed10b72-msonormal"> <o:p></o:p></p>
</div>
<div>
<p class="ox-5b4ed10b72-msonormal">Konstantin<o:p></o:p></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="ox-5b4ed10b72-msonormal" style="margin-bottom:12.0pt">On January 5, 2020 at 1:08 PM Carlos Lopez <clopmz@outlook.com> wrote:<o:p></o:p></p>
<div>
<p class="ox-5b4ed10b72-ox-335a999652-msonormal"><span style="color:black">Hi all,</span><o:p></o:p></p>
<p class="ox-5b4ed10b72-ox-335a999652-msonormal"><span style="color:black"> </span><o:p></o:p></p>
<p class="ox-5b4ed10b72-ox-335a999652-msonormal"><span style="color:black">I have a DNS cache server based in unbound redirecting all external queries to CloudFlare’s DNS servers via DNS over TLS and as I indicated in the subject, a lot of alerts are triggered
as “SURICATA TLS on unusual port”.</span><o:p></o:p></p>
<p class="ox-5b4ed10b72-ox-335a999652-msonormal"><span style="color:black"> </span><o:p></o:p></p>
<p class="ox-5b4ed10b72-ox-335a999652-msonormal"><span style="color:black">I have tried to inform to our Suricata sensors via “app-layer,tls,dp” port 853 is a valid TLS port without luck … I have checked any TLS variable for Suricata without result.</span><o:p></o:p></p>
<p class="ox-5b4ed10b72-ox-335a999652-msonormal"><span style="color:black"> </span><o:p></o:p></p>
<p class="ox-5b4ed10b72-ox-335a999652-msonormal"><span style="color:black">Then how to inform Suricata port 853 as a valid port TLS?</span><o:p></o:p></p>
<p class="ox-5b4ed10b72-ox-335a999652-msonormal"> <o:p></o:p></p>
<p class="ox-5b4ed10b72-ox-335a999652-msonormal"> <o:p></o:p></p>
<p class="ox-5b4ed10b72-ox-335a999652-msonormal">-- <o:p></o:p></p>
<div>
<p class="ox-5b4ed10b72-ox-335a999652-msonormal">Regards,<o:p></o:p></p>
<p class="ox-5b4ed10b72-ox-335a999652-msonormal">C. L. Martinez<o:p></o:p></p>
</div>
</div>
<p class="ox-5b4ed10b72-msonormal">_______________________________________________
<br>
Suricata IDS Users mailing list: oisf-users@openinfosecfoundation.org <br>
Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/ <br>
List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users <br>
<br>
Conference: https://suricon.net <br>
Trainings: https://suricata-ids.org/training/<o:p></o:p></p>
</blockquote>
<div>
<p class="ox-5b4ed10b72-msonormal"><br>
<o:p></o:p></p>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"><br>
<o:p></o:p></p>
</div>
</div>
</body>
</html>