inliniac/suricata — pull request #947 by wmetcalf (2014-04-22 16:20:25+00:00)
Title: Updates for HeartBleed Detection @chifflier

1. Looks for mismatched encrypted heartbeat request/responses.
2. Continues to parse protocol after handshake while still ignoring payload inspection.
3. Looks for multiple in-flight heartbeat requests as OpenSSL seems to honor and reject multiples per RFC.
4. For mismatched heartbeat requests/responses set tls event dataleak_heartbeat_mismatch as this indicates an actual bleed vs an attempt.

alert tls any any -> any any (msg:"SURICATA TLS overflow heartbeat encountered, possible exploit attempt (heartbleed)"; flow:established; app-layer-event:tls.dataleak_heartbeat_mismatch; flowint:tls.anomaly.count,+,1; classtype:protocol-command-decode; reference:cve,2014-0160; sid:2230010; rev:1;)