Suricata

Related issue: https://redmine.openinfosecfoundation.org/issues/2513

Suricata should apply application layer protocol parsers to protocols being tunneled through SOCKS.

Currently, an HTTP request being proxied through a SOCKS tunnel does not get recognized by the HTTP application layer parser. In my opinion, an HTTP request through a tunnel is still an HTTP request and should match against http.* keywords.

Likely there will need to be some keyword(s) to control this behaviour, eg. such that a signature writer could bypass the tunnel decapsulation and match traffic that pretends to be SOCKS but is not.

Ideally, this feature could be expanded in the future to apply to other types of tunneling protocols.