Actions
Feature #8714
open
VJ
OD
firewall: clamp protocol to flow
Feature #8714:
firewall: clamp protocol to flow
Effort:
Difficulty:
Label:
Description
The idea here is that some rulesets will want to force a protocol on a flow, and do not want to wait for the full protocol detection to complete. The protocol detection can take a minimum of input bytes to come to a final judgement, and this can leave a (small) window for packets to pass while the flow's alproto remains "unknown".
Something like:
accept:hook tcp:all ... 443 (app-layer-protocol:unknown,tls,*clamp*; ..
This would then have to force the protocol detection of just that protocol on that flow, or alternatively, just assume the flow and call the parser? @Philippe Antoine any ideas on what a good mechanism would be?
LS Updated by Lukas Sismis about 2 months ago
- Status changed from New to Feedback
- Assignee set to OISF Dev
- Target version changed from TBD to 9.0.0-beta1
PA Updated by Philippe Antoine 21 days ago
Looks like I missed the notification about this.
We have f->probing_parser_toserver_alproto_masks
So maybe, we can know already even if protocol detection is incomplete that it will not be TLS
And we could use a syntax like the one used for exact : https://docs.suricata.io/en/latest/rules/app-layer.html#protocol-equivalences-and-the-exact-option
PA Updated by Philippe Antoine 20 days ago
- Related to Feature #2858: app-layer-protocol:failed; doesn't match traffic with ALPROTO_UNKNOWN added
Actions