aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

detect: add flow drop by firewall as drop reason

Browse Source 
To track flow drops triggered by the firewall.
Add flow drop by firewall as drop reason.

As part of
Ticket #7699
pull/15475/head
Juliana Fajardini 4 months ago committed by Victor Julien
parent 0acb136b40
commit 312967f291
7 changed files with 34 additions and 10 deletions
Show Stats Download Patch File Download Diff File

14
etc/schema.json
Unescape Escape View File

@ -7544,24 +7544,28 @@
"default_app_policy": {
"type": "integer",
"description":
"Number of packets dropped due to firewall's mode default app policy"
"Count of packets dropped due to firewall's mode default app policy"
},
"default_packet_policy": {
"type": "integer",
"description":
"Number of packets dropped due to firewall's mode default packet policy"
"Count of packets dropped due to firewall's mode default packet policy"
},
"flow_drop": {
"type": "integer",
"description": "Count of packets dropped due to a firewall policy that led to flow drop"
},
"pre_flow_hook": {
"type": "integer",
"description": "Number of packets dropped due to pre-flow hook"
"description": "Count of packets dropped due to pre-flow hook"
},
"pre_stream_hook": {
"type": "integer",
"description": "Number of packets dropped due to pre-stream hook"
"description": "Count of packets dropped due to pre-stream hook"
},
"rules": {
"type": "integer",
"description": "Number of packets dropped due to firewall rules"
"description": "Count of packets dropped due to firewall rules"
}
}
},

5
src/decode.c
Unescape Escape View File

@ -966,6 +966,8 @@ const char *PacketDropReasonToString(enum PacketDropReason r)
return "firewall pre stream hook";
case PKT_DROP_REASON_FW_FLOW_PRE_HOOK:
return "firewall pre flow hook";
case PKT_DROP_REASON_FW_FLOW_DROP:
return "firewall flow drop";
case PKT_DROP_REASON_NOT_SET:
case PKT_DROP_REASON_MAX:
return NULL;
@ -1014,6 +1016,8 @@ static const char *PacketDropReasonToJsonString(enum PacketDropReason r)
return "firewall.drop_reason.pre_stream_hook";
case PKT_DROP_REASON_FW_FLOW_PRE_HOOK:
return "firewall.drop_reason.pre_flow_hook";
case PKT_DROP_REASON_FW_FLOW_DROP:
return "firewall.drop_reason.flow_drop";
case PKT_DROP_REASON_FW_DEFAULT_PACKET_POLICY:
return "firewall.drop_reason.default_packet_policy";
case PKT_DROP_REASON_FW_DEFAULT_APP_POLICY:
@ -1056,6 +1060,7 @@ void CaptureStatsUpdate(ThreadVars *tv, const Packet *p)
return;
CaptureStats *s = &t_capture_stats;
if (EngineModeIsFirewall()) {
/** The firewall mode and its stats counters should work as when there are two different
* devices for the firewall control and the IPS control.

1
src/decode.h
Unescape Escape View File

@ -407,6 +407,7 @@ enum PacketDropReason {
PKT_DROP_REASON_FW_DEFAULT_APP_POLICY, /**< drop issued by default app policy */
PKT_DROP_REASON_FW_STREAM_PRE_HOOK, /**< drop issued in the pre_stream hook */
PKT_DROP_REASON_FW_FLOW_PRE_HOOK, /**< drop issued in the pre_flow hook */
PKT_DROP_REASON_FW_FLOW_DROP,
PKT_DROP_REASON_MAX,
};

10
src/detect-engine-alert.c
Unescape Escape View File

@ -154,7 +154,7 @@ int PacketAlertCheck(Packet *p, uint32_t sid)
}
#endif
static inline void RuleActionToFlow(const uint8_t action, Flow *f)
static inline void RuleActionToFlow(const uint8_t action, Flow *f, const bool fw_rule)
{
if (action & ACTION_ACCEPT) {
f->flags |= FLOW_ACTION_ACCEPT;
@ -187,6 +187,10 @@ static inline void RuleActionToFlow(const uint8_t action, Flow *f)
}
}
}
if (fw_rule) {
f->flags |= FLOW_ACTION_BY_FIREWALL;
}
}
/** \brief Apply action(s) and Set 'drop' sig info,
@ -223,7 +227,7 @@ static void PacketApplySignatureActions(Packet *p, const Signature *s, const Pac
p->alerts.drop.s = (Signature *)s;
}
if ((p->flow != NULL) && (pa->flags & PACKET_ALERT_FLAG_APPLY_ACTION_TO_FLOW)) {
RuleActionToFlow(pa->action, p->flow);
RuleActionToFlow(pa->action, p->flow, is_fw_rule);
}
DEBUG_VALIDATE_BUG_ON(!PacketCheckAction(p, ACTION_DROP));
@ -248,7 +252,7 @@ static void PacketApplySignatureActions(Packet *p, const Signature *s, const Pac
if ((pa->action & (ACTION_PASS | ACTION_ACCEPT)) && (p->flow != NULL) &&
(pa->flags & PACKET_ALERT_FLAG_APPLY_ACTION_TO_FLOW)) {
RuleActionToFlow(pa->action, p->flow);
RuleActionToFlow(pa->action, p->flow, is_fw_rule);
}
}
}

2
src/detect.c
Unescape Escape View File

@ -1659,6 +1659,7 @@ static const struct DetectFirewallPolicy *DetectFirewallApplyDefaultAppPolicy(
if (policy->action_scope == ACTION_SCOPE_FLOW) {
SCLogDebug("dropping flow");
p->flow->flags |= FLOW_ACTION_DROP;
p->flow->flags |= FLOW_ACTION_BY_FIREWALL;
}
} else if (policy->action & ACTION_ACCEPT) {
if (policy->action_scope == ACTION_SCOPE_FLOW) {
@ -2341,6 +2342,7 @@ static void DetectRunTx(ThreadVars *tv,
if (s->action_scope == ACTION_SCOPE_FLOW) {
SCLogDebug("drop flow because of rule with drop action");
f->flags |= FLOW_ACTION_DROP;
f->flags |= FLOW_ACTION_BY_FIREWALL;
}
}
}

6
src/flow-worker.c
Unescape Escape View File

@ -427,7 +427,11 @@ static inline void FlowWorkerStreamTCPUpdate(ThreadVars *tv, FlowWorkerThreadDat
}
if (FlowChangeProto(p->flow) && p->flow->flags & FLOW_ACTION_DROP) {
// in case f->flags & FLOW_ACTION_DROP was set by one of the dequeued packets
PacketDrop(p, ACTION_DROP, PKT_DROP_REASON_FLOW_DROP);
if (p->flow->flags & FLOW_ACTION_BY_FIREWALL) {
PacketDrop(p, ACTION_DROP, PKT_DROP_REASON_FW_FLOW_DROP);
} else {
PacketDrop(p, ACTION_DROP, PKT_DROP_REASON_FLOW_DROP);
}
}
}

6
src/flow.c
Unescape Escape View File

@ -535,7 +535,11 @@ void FlowHandlePacketUpdate(Flow *f, Packet *p, ThreadVars *tv, DecodeThreadVars
}
if (f->flags & FLOW_ACTION_DROP) {
PacketDrop(p, ACTION_DROP, PKT_DROP_REASON_FLOW_DROP);
if (f->flags & FLOW_ACTION_BY_FIREWALL) {
PacketDrop(p, ACTION_DROP, PKT_DROP_REASON_FW_FLOW_DROP);
} else {
PacketDrop(p, ACTION_DROP, PKT_DROP_REASON_FLOW_DROP);
}
}
if (f->flags & FLOW_NOPAYLOAD_INSPECTION) {

Write Preview
Loading…
Cancel
Save