Running master branch and seeing ssl/tls errors "not present in ssl's enum map table"

Help
1

Running the latest master branch with ETPRO ruleset and seeing the following in the suricata.log:

24977] 25/3/2020 – 23:21:49 - (app-layer-ssl.c:2642) (SSLStateGetEventInfo) – [ERRCODE: SC_ERR_INVALID_ENUM_MAP(15)] - event “certificate_missing_element” not present in ssl’s enum map table.
[24977] 25/3/2020 – 23:21:49 - (detect-app-layer-event.c:207) (DetectAppLayerEventParseAppP2) – [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - app-layer-event keyword’s protocol “tls” doesn’t have event “certificate_missing_element” registered
[24977] 25/3/2020 – 23:21:49 - (app-layer-ssl.c:2642) (SSLStateGetEventInfo) – [ERRCODE: SC_ERR_INVALID_ENUM_MAP(15)] - event “certificate_unknown_element” not present in ssl’s enum map table.
[24977] 25/3/2020 – 23:21:49 - (detect-app-layer-event.c:207) (DetectAppLayerEventParseAppP2) – [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - app-layer-event keyword’s protocol “tls” doesn’t have event “certificate_unknown_element” registered
[24977] 25/3/2020 – 23:21:49 - (app-layer-ssl.c:2642) (SSLStateGetEventInfo) – [ERRCODE: SC_ERR_INVALID_ENUM_MAP(15)] - event “certificate_invalid_string” not present in ssl’s enum map table.
[24977] 25/3/2020 – 23:21:49 - (detect-app-layer-event.c:207) (DetectAppLayerEventParseAppP2) – [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - app-layer-event keyword’s protocol “tls” doesn’t have event “certificate_invalid_string” registered

I rebuilt against a clean clone to make sure I didn’t have anything old laying around as well. I am not sure how to further troubleshoot this one. Thanks in advance!

JT

2

Hi JT, this is a side effect of the merge into master of this work by @pollux: https://github.com/OISF/suricata/pull/4721

It replaces the built-in DER parser written in C, by a new Rust parser. The new parser doesn’t expose exactly the same events, so these older events are no longer supported.

I notice that in the rules/tls-events.rules in our tree we still have these events, will make sure they are removed there.

1 Like