Project

General

Profile

Actions

Feature #8480

closed
VJ VJ

firewall: allow specifying multiple actions

Feature #8480: firewall: allow specifying multiple actions

Added by Victor Julien 2 months ago. Updated 4 days ago.

Status:
Closed
Priority:
Normal
Assignee:
Target version:
Effort:
Difficulty:
Label:

Description

Currently a rule that should accept and log, should do something like

accept:packet ... (alert; ...)

It would be clearer if the actions are grouped together in the "action" field.

E.g. something like

accept,log:packet

Some other options:
{accept,log}:packet
accept:flow,log:packet
(accept|alert):packet

Not sure which syntax makes most sense. One thing to consider is if an action like accept is applied to the flow, should alert (or log) also be applied to the flow? Or just trigger once?


Subtasks 1 (0 open1 closed)

Feature #8572: firewall: allow specifying multiple actions (8.0.x backport)ClosedVictor JulienActions

Related issues 3 (1 open2 closed)

Related to Suricata - Feature #8479: eve/firewall: dedicated log record typeFeedbackOISF DevActions
Related to Suricata - Feature #7701: firewall: configurable default policiesClosedVictor JulienActions
Related to Suricata - Bug #8444: firewall: accept:flow at app-layer hook bypasses app:td (IDS/IPS) evaluationClosedVictor JulienActions
Actions

Also available in: PDF Atom