From d0a85b75508a208c671412fe4d71e6a9a994c556 Mon Sep 17 00:00:00 2001 From: Nick Price Date: Thu, 25 Apr 2019 13:16:09 -0400 Subject: [PATCH] ja3: Mention LibNSS dependency for JA3 --- doc/userguide/rules/ja3-keywords.rst | 2 ++ src/app-layer-ssl.c | 2 +- src/util-ja3.c | 2 +- 3 files changed, 4 insertions(+), 2 deletions(-) diff --git a/doc/userguide/rules/ja3-keywords.rst b/doc/userguide/rules/ja3-keywords.rst index c77b9f3906..c80063f218 100644 --- a/doc/userguide/rules/ja3-keywords.rst +++ b/doc/userguide/rules/ja3-keywords.rst @@ -5,6 +5,8 @@ Suricata comes with a JA3 integration (https://github.com/salesforce/ja3). JA3 i JA3 must be enabled in the Suricata config file (set 'app-layer.protocols.tls.ja3-fingerprints' to 'yes'). +JA3 also requires Suricata to be built with LibNSS support. + ja3.hash -------- diff --git a/src/app-layer-ssl.c b/src/app-layer-ssl.c index 0adc077d86..3c5e7d4667 100644 --- a/src/app-layer-ssl.c +++ b/src/app-layer-ssl.c @@ -2943,7 +2943,7 @@ void RegisterSSLParsers(void) #ifndef HAVE_NSS if (ssl_config.enable_ja3) { SCLogWarning(SC_WARN_NO_JA3_SUPPORT, - "no MD5 calculation support built in, disabling JA3"); + "no MD5 calculation support built in (LibNSS), disabling JA3"); ssl_config.enable_ja3 = 0; } #else diff --git a/src/util-ja3.c b/src/util-ja3.c index eecf820245..2152b5f4bb 100644 --- a/src/util-ja3.c +++ b/src/util-ja3.c @@ -275,7 +275,7 @@ int Ja3IsDisabled(const char *type) #ifndef HAVE_NSS else { SCLogWarning(SC_WARN_NO_JA3_SUPPORT, - "no MD5 calculation support build in, skipping %s", + "no MD5 calculation support built in (LibNSS), skipping %s", type); return 1; } -- 2.47.2