Actions
Bug #7653
openips: deconflict pass flow and drop packet rules
Affected Versions:
Effort:
Difficulty:
Label:
Description
drop tcp [10.0.0.0/16] any -> any any (flow: to_server, established; sid:1;) pass tls any any -> any any (ssl_state:client_hello; tls.sni; content:"google.com"; dotprefix; nocase; flow: to_server, established; sid:2;)
If on the client hello packet both rules match, the drop action is applied to the packet. However since the match of sid 1 isn't terminating, the flow action from sid 2 is also applied.
I broadly see 2 options:
- just stop after the first drop match
- deconflict, so if a drop rule matched first, ignore pass rules
Actions