Actions
Feature #7705
openfirewall: allow single rule to accept protocol detection in progress and the final protocol
Effort:
Difficulty:
Label:
Description
Currently 2 rules are needed to accept packet rules that enforce that a protocol is running on a port.
e.g.
# allow all packets while protocol detection is running accept:hook tcp:all any any <> any 22 (app-layer-protocol:unknown; alert; sid:1000;) # then when detected a protocol, only allow ssh accept:hook tcp:all any any <> any 22 (app-layer-protocol:ssh; alert; sid:1001;)
It would be good to be able to express this in a single rule.
e.g. something like:
accept:hook tcp:all any any <> any 22 (app-layer-protocol:unknown,ssh; alert; sid:1000;)
Actions