You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
suricata/doc/userguide/firewall
Victor Julien bf167418bf detect: reject the '<' hook form for non-firewall rules
The '<' lower bound hook form is a firewall policy construct: the rule
covers its own hook and every prior one. For a threat detection rule the
form has no such meaning, and the flag it sets leaked into the firewall
policy walk, where the rule could influence the per-state decisions.

Reject the form at load for rules without SIG_FLAG_FIREWALL.

Ticket: #8944.
3 weeks ago
..
firewall-design.rst detect: log the hook for sub-state firewall rules 3 weeks ago
firewall-example.rst detect: reject the '<' hook form for non-firewall rules 3 weeks ago
firewall-stats.rst detect/firewall: update discarded logic 5 months ago
fw-pipeline.png doc/firewall: start of documentation 2 years ago
index.rst doc: update the SSH docs for the reworked state machine 3 weeks ago
ssh-state-migration.rst doc: update the SSH docs for the reworked state machine 3 weeks ago
tls-state-migration.rst doc/userguide: TLS firewall state phase rename 3 weeks ago