mirror of
https://github.com/OISF/suricata.git
synced 2026-10-12 02:07:10 +00:00
Victor Julien
31d048ed4b
Config:
Firewall rules are like normal rule, with some key differences.
They are loaded separate, and first, from:
```yaml
firewall-rule-path: /etc/suricata/firewall/
firewall-rule-files:
- fw.rules
```
Can also be loaded with --firewall-rules-exclusive: Mostly for QA purposes.
Allow -S with --firewall-rules-exclusive, so that firewall and threat detection
rules can be tested together.
Rules:
Differences with regular "threat detection" rules:
1. these rules are evaluated before threat detection rules
2. these rules are evaluated in the order as they appear in the rule file
3. currently only rules specifying an explicit hook at supported
a. as a consequence, no rules will be treated as (like) IP-only, PD-only or
DE-only
Require explicit action scope for firewall rules. Default policy is
drop for the firewall tables.
Actions:
New action "accept" is added to allow traffic in the filter tables.
New scope "accept:tx" is added to allow accepting a transaction.
Tables:
Rulesets are per table.
Table processing order: `packet:filter` -> `packet:td` -> `app:*:*` -> `app:td`.
Each of the tables has some unique properties:
`packet:filter`:
- default policy is `drop:packet`
- rules are process in order
- action scopes are explicit
- `drop` or `accept` is immediate
- `accept:hook` continues to `packet:td`
`packet:td`:
- default policy is `accept:hook`
- rules are ordered by IDS/IPS ordering logic
- action scopes are implicit
- actions are queued
- continues to `app:*:*` or `alert/action finalize`
`app:*:*`:
- default policy is `drop:flow`
- rules are process in order
- action scopes are explicit
- `drop` is immediate
- `accept` is conditional on possible `drop` from `packet:td`
- `accept:hook` continues to `app:td`, `accept:packet` or `accept:flow`
continues to `alert/action finalize`
`app:td`:
- default policy is `accept:hook`
- rules are ordered by IDS/IPS ordering logic
- action scopes are implicit
- actions are queued
- continues to `alert/action finalize`
Implementation:
During sigorder, split into packet:filter, app:*:* and general td.
Allow fw rules to work when in pass:flow mode. When firewall mode is enabled,
`pass:flow` will not skip the detection engine anymore, but instead
process the firewall rules and then apply the pass before inspecting threat
detect rules.
51 lines
1.7 KiB
C
51 lines
1.7 KiB
C
/* Copyright (C) 2007-2010 Open Information Security Foundation
|
|
*
|
|
* You can copy, redistribute or modify this Program under the terms of
|
|
* the GNU General Public License version 2 as published by the Free
|
|
* Software Foundation.
|
|
*
|
|
* This program is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License
|
|
* version 2 along with this program; if not, write to the Free Software
|
|
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
|
* 02110-1301, USA.
|
|
*/
|
|
|
|
/**
|
|
* \file
|
|
*
|
|
* \author Victor Julien <[email protected]>
|
|
*/
|
|
|
|
#ifndef SURICATA_ACTION_GLOBALS_H
|
|
#define SURICATA_ACTION_GLOBALS_H
|
|
|
|
/* Changing them as flags, so later we can have alerts
|
|
* and drop simultaneously */
|
|
#define ACTION_ALERT 0x01
|
|
#define ACTION_DROP 0x02
|
|
#define ACTION_REJECT 0x04
|
|
#define ACTION_REJECT_DST 0x08
|
|
#define ACTION_REJECT_BOTH 0x10
|
|
#define ACTION_PASS 0x20
|
|
#define ACTION_CONFIG 0x40
|
|
#define ACTION_ACCEPT 0x80 /**< firewall 'accept' rule */
|
|
|
|
#define ACTION_REJECT_ANY (ACTION_REJECT|ACTION_REJECT_DST|ACTION_REJECT_BOTH)
|
|
|
|
#define ACTION_DROP_REJECT (ACTION_REJECT_ANY | ACTION_DROP)
|
|
|
|
enum ActionScope {
|
|
ACTION_SCOPE_AUTO = 0,
|
|
ACTION_SCOPE_PACKET, /**< apply action to packet */
|
|
ACTION_SCOPE_FLOW, /**< apply drop/pass/accept action to flow */
|
|
ACTION_SCOPE_HOOK, /**< apply action to current hook */
|
|
ACTION_SCOPE_TX, /**< apply action to current tx */
|
|
};
|
|
|
|
#endif /* SURICATA_ACTION_GLOBALS_H */
|