Suricata

Description¶

In firewall mode, a contentless "accept the hook and the states before it" rule (accept:hook proto:<hook without content) only accepts its hook for the update in which it matches. Its match is not kept: when a later update moves the transaction past the hook, the rule no longer counts, and the hook's own default policy decides.

With accept:hook tls:<client_hello_done this drops every benign TLS 1.2 and 1.3 session: the ClientHello is accepted, then the client's next flight moves the client past client_hello_done, and the client_hello_done default policy (for example drop:flow) drops the flow.

HTTP/1 is affected the same way: accept:hook http1:<request_headers drops requests whose headers span two TCP segments.

Steps to reproduce¶

Firewall rules:

accept:hook,alert tls:<client_hello_done any any -> any any (sid:100;)

plus accept:hook rules for every later client and server state, and a TLS app default policy of drop:flow. Replay any complete TLS handshake in --simulate-ips mode.

Expected behaviour¶

sid 100 accepts client_hello_done and the states before it; the session passes.

Actual behaviour¶

sid 100 alerts on the ClientHello. On the client's next packet, the default policy alert (sid 2201001, firewall.hook: tls:client_hello_done) fires and the flow is dropped.

Seen on 8.0.7, and on the main branch with tls:<client_hello. Workaround: add an exact accept:hook tls:client_hello_done rule.