Feature #234
closed
add option disable/enable individual app layer protocol inspection modules
Added by Victor Julien over 13 years ago.
Updated over 10 years ago.
Description
Not everyone is interested in having all app layer parsing/inspection modules enabled all the time. In the suricata.yaml configuration file we should give the user the option to disable individual parsers.
Ideas for how this should be done in the configuration file are welcome.
how about
app-layer-modules:
-http
-ftp
-ssh
those module not in this list would not be enabled.
I think I would prefer something like:
app-layer-parsers:
- http
enabled: yes
- ftp
enabled: no
This would allow us to add other options to them...
Thoughts?
Victor Julien wrote:
I think I would prefer something like:
app-layer-parsers:
- http
enabled: yes
- ftp
enabled: no
This would allow us to add other options to them...
Thoughts?
Sounds good to me!
- Assignee changed from Victor Julien to Anonymous
This would be fairly easy to implement as we can just disable the parser registration for the disabled protocols.
Victor Julien wrote:
This would be fairly easy to implement as we can just disable the parser registration for the disabled protocols.
I will take this.
- Status changed from New to Assigned
- Assignee changed from Anonymous to delta yeh
- Target version set to 1.2
- Target version changed from 1.2 to TBD
Have you been able to look into this?
- Assignee changed from delta yeh to Anoop Saldanha
- Target version changed from TBD to 1.4beta2
- Target version changed from 1.4beta2 to 1.4beta3
- Priority changed from Normal to Low
- Target version changed from 1.4beta3 to 1.4rc1
- Target version changed from 1.4rc1 to 2.0rc2
https://github.com/inliniac/suricata/pull/279
The above PR does a lot more than provide a feature to enable/disable app layer modules.
We have an update PP proto detection engine, feature to enable proto detection/parser both of which are now separate options in the conf file, ability to specify detection ports in conf file, sig port validation.
- Priority changed from Low to Normal
- Target version changed from 2.0rc2 to 2.0beta2
- Status changed from Assigned to Closed
Also available in: Atom
PDF