Suricata

Description¶

In firewall mode, a firewall rule without a fast pattern (for example only http.host; pcre:"/good\.example/";) decides on incomplete data of the transaction's current state.

While the transaction is at the rule's hook and that state is not complete yet, for instance HTTP/1 request headers spread over several TCP segments, the rule's buffer is missing or partial. Its miss is treated as final:

• an allow-list rule misses, and the hook's default policy drops a benign request;
• a drop rule followed by a contentless accept:flow rule at the same hook is bypassed: the accept decides when the transaction enters the hook, before the drop rule can see its data.

Rules with a fast pattern are not affected in this way: a miss while the fast pattern's state is still in progress is not final.

The verdict depends on how the sender segments the request.

Steps to reproduce¶

Firewall rules, plus accept:hook rules for the other request and response states:

accept:hook,alert http1:request_headers any any -> any any (http.host; pcre:"/good\.example/"; sid:102;)

Send GET /ok HTTP/1.1 with Host: good.example, with the request headers split across two TCP segments inside the Host header.

Expected behaviour¶

The request is accepted, as it is when the headers arrive in one segment.

Actual behaviour¶

The flow is dropped by the request_headers default policy.

With drop:flow on http.host; pcre:"/evil\.example/"; followed by a contentless accept:flow at request_headers, a split request for evil.example is accepted.

Seen on 8.0.7 and the main branch.