Bug #5361: IPS: ip only rules, but with negated addresses not treated like pure ip-only rules in IPS context - Suricata - Open Information Security Foundation

Actions

Copy link

Bug #5361

closed

JI JI

IPS: ip only rules, but with negated addresses not treated like pure ip-only rules in IPS context

Bug #5361: IPS: ip only rules, but with negated addresses not treated like pure ip-only rules in IPS context

Added by Jason Ish almost 4 years ago. Updated almost 4 years ago.

Status:

Closed

Priority:

Normal

Assignee:

Jason Ish

Target version:

7.0.0-beta1

Affected Versions:

6.0.5

Effort:

Difficulty:

Label:

Needs backport to 6.0

Description

Given 2 rules:

pass tcp $HOME_NET any -> $EXTERNAL_NET 80 (sid:1;)
drop ip any any -> any any (msg:"Drop everything else"; sid:2;)

the response packets to the HTTP flow are getting dropped by the drop rule, and not being allowed as expected. However, the return packets are passed as expected with the following rule:

pass tcp $HOME_NET any -> any 80 (sid:1;)

The different here is that $EXTERNAL_NET contains a negation, "!any" which means the rule as not processed as a pure IP only rule. Pure IP only rules have are setup such that the pass is applied to the flow. While this should happen for the IP-only-rule-with-negation, this logic is missing for this case.

Related issues 1 (0 open — 1 closed)