Project

General

Profile

Actions
Copy link

Feature #7705

open
VJ YD

firewall: allow single rule to accept protocol detection in progress and the final protocol

Feature #7705: firewall: allow single rule to accept protocol detection in progress and the final protocol

Added by Victor Julien over 1 year ago. Updated about 1 month ago.

Status:
Resolved
Priority:
Normal
Assignee:
Yash Datre
Target version:
9.0.0-beta1
Effort:
Difficulty:
Label:

Description

Currently 2 rules are needed to accept packet rules that enforce that a protocol is running on a port.

e.g.

# allow all packets while protocol detection is running
accept:hook tcp:all any any <> any 22 (app-layer-protocol:unknown; alert; sid:1000;)
# then when detected a protocol, only allow ssh
accept:hook tcp:all any any <> any 22 (app-layer-protocol:ssh; alert; sid:1001;)

It would be good to be able to express this in a single rule.

e.g. something like:

accept:hook tcp:all any any <> any 22 (app-layer-protocol:unknown,ssh; alert; sid:1000;)

Subtasks 1 (1 open — 0 closed)

Feature #8729: firewall: allow single rule to accept protocol detection in progress and the final protocol (8.0.x backport)In ReviewYash DatreActions

Related issues 2 (2 open — 0 closed)

Related to Suricata - Feature #7704: firewall: allow single packet rule to accept tcp connectionIn ReviewYash DatreActions
Blocks Suricata - Story #7583: 9.0.0: usecase: improve firewall usecaseAssignedVictor JulienActions

VJ Updated by Victor Julien over 1 year ago Actions
Copy link
 #1

  • Related to Feature #7704: firewall: allow single packet rule to accept tcp connection added

VJ Updated by Victor Julien about 1 year ago Actions
Copy link
 #2

  • Blocks Story #7583: 9.0.0: usecase: improve firewall usecase added

PA Updated by Philippe Antoine about 2 months ago Actions
Copy link
 #4

  • Status changed from Feedback to In Review
  • Target version changed from TBD to 9.0.0-beta1

VJ Updated by Victor Julien about 1 month ago Actions
Copy link
 #6

  • Assignee changed from Victor Julien to Yash Datre

VJ Updated by Victor Julien about 1 month ago Actions
Copy link
 #7

  • Status changed from In Review to Resolved
  • Label Needs backport to 8.0 added

OT Updated by OISF Ticketbot about 1 month ago Actions
Copy link
 #8

  • Subtask #8729 added

OT Updated by OISF Ticketbot about 1 month ago Actions
Copy link
 #9

  • Label deleted (Needs backport to 8.0)
Actions
Copy link

Also available in: PDF Atom