Project

General

Profile

Actions
Copy link

Bug #1151

closed

tls.store not working when a TLS filter keyword is used

Added by Eric Leblond over 10 years ago. Updated over 10 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Eric Leblond
Target version:
2.0
Affected Versions:
Effort:
Difficulty:
Label:

Description

Pierre Chifflier pointed out that a rule like:

alert tls any any -> any any (msg:"TLS store"; tls.issuerdn:!"C=FR"; tls.store;)

was alerting but not storing the certificate. If the filter is removed:
alert tls any any -> any any (msg:"TLS store"; tls.store;)

then tls.store is working as expected.

Actions
Copy link
 #1

Updated by Victor Julien over 10 years ago

  • Priority changed from High to Normal
  • Target version set to 2.0.1rc1
Actions
Copy link
 #2

Updated by Victor Julien over 10 years ago

  • Status changed from Assigned to Closed
  • Target version changed from 2.0.1rc1 to 2.0
  • % Done changed from 0 to 100
Actions
Copy link

Also available in: Atom PDF