Actions
Feature #4965
openSuricata should detect application layer protocol underneath SOCKS
Status:
New
Priority:
Normal
Assignee:
-
Target version:
-
Effort:
Difficulty:
Label:
Protocol
Description
Related issue: https://redmine.openinfosecfoundation.org/issues/2513
Suricata should apply application layer protocol parsers to protocols being tunneled through SOCKS.
Currently, an HTTP request being proxied through a SOCKS tunnel does not get recognized by the HTTP application layer parser. In my opinion, an HTTP request through a tunnel is still an HTTP request and should match against http.* keywords.
Likely there will need to be some keyword(s) to control this behaviour, eg. such that a signature writer could bypass the tunnel decapsulation and match traffic that pretends to be SOCKS but is not.
Ideally, this feature could be expanded in the future to apply to other types of tunneling protocols.
Files
Actions