Project

General

Profile

Actions
Copy link

Bug #7284

open

rules: pass/drop <app proto> rules actions no longer apply to flow

Added by Victor Julien 3 months ago. Updated about 2 months ago.

Status:
New
Priority:
Normal
Assignee:
Victor Julien
Target version:
TBD
Affected Versions:
Effort:
Difficulty:
Label:

Description

A rule like pass tls any any -> any any no longer applies the pass to the flow in Suricata 7 and up. While the new behavior seems more correct, this is not documented.

Actions
Copy link
 #1

Updated by Victor Julien 3 months ago

  • Description updated (diff)
  • Assignee changed from OISF Dev to Victor Julien
Actions
Copy link
 #2

Updated by Juliana Fajardini Reichow about 2 months ago

flow:established is important to replicate this behavior.

Actions
Copy link

Also available in: Atom PDF