How can I add a firewall rule in iptables such that I allow packets only for a particular SSL connection.
I currently allow/deny ssl packets based on content type, for example, the following rule will block all application data packets for TLS. It allows other type of ssl handshake/alert packets to go through but will block the application data packets.
iptables -I FORWARD 1 -p tcp -m state --state NEW,ESTABLISHED -m u32 --u32 "0>>22&0x3C@ 12>>26&0x3C@ 0 & 0xFF000000=0x17000000" -j DROP
If at a given point in the future, I want the end points to communicate, How do I allow packets only for a single ssl connection.
As far as I know, the following considerations apply in place -
1.There can be only one ssl session in one tcp connection.
2.There can be multiple tcp connections between two endpoints and hence multiple ssl connections for a src and dst ip address.
3.I can obtain handshake value of the ssl connections as unique identifiers.
4.In case of session re-assumption, a new tcp connection will be used.
I want to allow packet specific to a ssl connection. Is it possible to use the conntrack/state module to allow packets only for a single tcp session. ?