What does match-by-protocol-signature do?

[Bob_Zimmerman]

While building a framework to translate data between Check Point's API and another tool I'm working on, I noticed the "match-by-protocol-signature" property of TCP and UDP services is always false. This is the case even for objects with the protocol inspection set to a non-null value:

[Expert@LabSC1]# mgmt_cli -r true show services-tcp limit 500 details-level full --format json | jq -c '.objects[]|{name:.name,matchProtocol:."match-by-protocol-signature"}' | grep -v false | wc -l
0
[Expert@LabSC1]# mgmt_cli -r true show services-tcp limit 500 details-level full --format json | jq -c '.objects[]|{name:.name,matchProtocol:."match-by-protocol-signature",protocol:.protocol}'
...
{"name":"Freak2k","matchProtocol":false,"protocol":null}
{"name":"ftp","matchProtocol":false,"protocol":"FTP"}
{"name":"ftp-bidir","matchProtocol":false,"protocol":"FTP-BIDIR"}
{"name":"ftp-pasv","matchProtocol":false,"protocol":"FTP-PASV"}
{"name":"ftp-port","matchProtocol":false,"protocol":"FTP-PORT"}
{"name":"FW1","matchProtocol":false,"protocol":null}
...

This property does not appear to be related to protocol inspection, so what does it actually do?

I'm on R80.40 with API v1.6.1, but the property dates back to API v1.1.

[Chris_Atkinson]

Protocol Signature - A unique signature created by Check Point for each protocol and stored on the gateway. The signature identifies the protocol as genuine. Select this option to limit the port to the specified protocol.

Refer also: https://community.checkpoint.com/t5/General-Topics/Protocol-Signatures/td-p/54945

[Bob_Zimmerman]

So it's entirely separate from the Protocol option for the service?

What protocol signatures can be matched? Where do we tell the firewall which protocol signature we want to match for a given service object?

[Timothy_Hall]

Please see my lengthy post here which should answer all your questions about Protocol Signatures:

https://community.checkpoint.com/t5/Management/Enable-Protocol-Signature-by-default/m-p/139285/highl...

[Bob_Zimmerman]

That does answer most of them. One big one remains, though:

How do we tell which service objects have protocol signatures which can be matched? And what happens if the "Match by protocol signature option" is enabled on a service which doesn't have a protocol signature? It looks like all services—even ones created by the user—have this flag in their object definitions, but it sounds like the protocol signatures only actually exist for included objects.

Just did a little experimenting to find out:

[Expert@DallasSA]# mgmt_cli -f json -s session.txt add service-tcp name "TCP_23" port 23 match-by-protocol-signature true
{
  "code" : "generic_err_invalid_parameter",
  "message" : "Invalid parameter for [match-by-protocol-signature]. Matching by protocol signature is not possible without assigning a protocol to the service."
}
[Expert@DallasSA]# mgmt_cli -f json -s session.txt add service-tcp name "TCP_2323" port 2323 protocol telnet match-by-protocol-signature true
{
  "uid" : "db65f535-b0d0-4d97-9906-16a630951559",
  "name" : "TCP_2323",
  "type" : "service-tcp",
  "domain" : {...},
  "port" : "2323",
  "protocol" : "TELNET",
  "match-by-protocol-signature" : true,
...

So this says to me the "Match by protocol signature" field is like extra enforcement of the "protocol" field. Interesting.

[Timothy_Hall]

Doesn't seem to be any way in the SmartConsole to find/filter services that have Protocol/Protocol Signature set without manually opening each of them and looking.  Probably going to have to be done through the API to get a list of them.