Feature #6063: exception-policy: stream async policy - Suricata - Open Information Security Foundation

Actions

Copy link

Feature #6063

open

exception-policy: stream async policy

Added by Victor Julien about 2 years ago. Updated about 2 months ago.

Status:

Assigned

Priority:

Normal

Assignee:

OISF Dev

Target version:

9.0.0-beta1

Effort:

Difficulty:

Label:

Description

For streams that are using async routing, allow applying a separate exception policy.

Async detection would match the logic the async-oneside option uses today:

Client -> Server: SYN followed by ACK matching the 3whs. SEQ of this packet would be ISN+1. If no SYN/ACK has been seen we’d be in async mode.
Server -> Client: SYN/ACK as first packet.

In both cases we'd apply a new exception policy.

Suggested defaults:
- IDS: ignore
- IPS, async-oneside disabled: drop-packet (not drop flow as otherwise an injected packet might trigger a flow drop?)
- IPS, async-oneside enabled: ignore

Subtasks 2 (1 open — 1 closed)

Actions

Copy link

Updated by Victor Julien almost 2 years ago

Label Needs backport to 6.0 added

Actions

Copy link

Updated by OISF Ticketbot almost 2 years ago

Subtask #6083 added

Actions

Copy link

Updated by OISF Ticketbot almost 2 years ago

Label deleted (~~Needs backport to 6.0~~)

Actions

Copy link

Updated by Victor Julien almost 2 years ago

Target version changed from 7.0.0-rc2 to 7.0.1

Actions

Copy link

Updated by Jamie Lavigne almost 2 years ago

I am curious about this one, could you provide some additional context on how this feature works?

I assume this is related to asymmetrically routed connections (not asynchronous) but I'm interested in how suricata would distinguish those and whether this would support matching connections where the client-to-server side of the connection is seen by suricata but the server-to-client side is not (i.e. what load balancers call "DSR", direct server return).

Today the existing midstream-policy matches on connections that are asymmetrically routed in the opposite way (where suricata doesn't see the SYN) but not this one, so I'm curious if this feature is related to adding support for both directions or if it's something different.

Actions

Copy link

Updated by Juliana Fajardini Reichow over 1 year ago

Target version changed from 7.0.1 to 7.0.2

Actions

Copy link

Updated by Victor Julien over 1 year ago

Description updated (diff)

Actions

Copy link

Updated by Jason Ish over 1 year ago

Target version changed from 7.0.2 to 7.0.3

Actions

Copy link

Updated by Victor Julien over 1 year ago

Target version changed from 7.0.3 to 7.0.4

Actions

Copy link

#10

Updated by Victor Julien about 1 year ago

Target version changed from 7.0.4 to 7.0.5

Actions

Copy link

#11

Updated by Victor Julien about 1 year ago

Target version changed from 7.0.5 to 7.0.6

Actions

Copy link

#12

Updated by Victor Julien 12 months ago

Target version changed from 7.0.6 to 7.0.7

Actions

Copy link

#13

Updated by Jamie Lavigne 12 months ago

It's important for this feature to include flow logs (or similar) visibility so that users can use the source & dest IPs to track down asymmetric routes in their network when this policy is triggered. Without that visibility it will be a difficult experience to find and fix the routes.

Actions

Copy link

#14