detect: add flow drop by firewall as drop reason

To track flow drops triggered by the firewall.
Add flow drop by firewall as drop reason.

As part of
Ticket #7699

etc/schema.json

@@ -7544,24 +7544,28 @@
                                 "default_app_policy": {
                                     "type": "integer",
                                     "description":
-                                            "Number of packets dropped due to firewall's mode default app policy"
+                                        "Count of packets dropped due to firewall's mode default app policy"
                                 },
                                 "default_packet_policy": {
                                     "type": "integer",
                                     "description":
-                                            "Number of packets dropped due to firewall's mode default packet policy"
+                                        "Count of packets dropped due to firewall's mode default packet policy"
+                                },
+                                "flow_drop": {
+                                    "type": "integer",
+                                    "description": "Count of packets dropped due to a firewall policy that led to flow drop"
                                 },
                                 "pre_flow_hook": {
                                     "type": "integer",
-                                    "description": "Number of packets dropped due to pre-flow hook"
+                                    "description": "Count of packets dropped due to pre-flow hook"
                                 },
                                 "pre_stream_hook": {
                                     "type": "integer",
-                                    "description": "Number of packets dropped due to pre-stream hook"
+                                    "description": "Count of packets dropped due to pre-stream hook"
                                 },
                                 "rules": {
                                     "type": "integer",
-                                    "description": "Number of packets dropped due to firewall rules"
+                                    "description": "Count of packets dropped due to firewall rules"
                                 }
                             }
                         },

src/decode.c

@@ -966,6 +966,8 @@ const char *PacketDropReasonToString(enum PacketDropReason r)
             return "firewall pre stream hook";
         case PKT_DROP_REASON_FW_FLOW_PRE_HOOK:
             return "firewall pre flow hook";
+        case PKT_DROP_REASON_FW_FLOW_DROP:
+            return "firewall flow drop";
         case PKT_DROP_REASON_NOT_SET:
         case PKT_DROP_REASON_MAX:
             return NULL;
@@ -1014,6 +1016,8 @@ static const char *PacketDropReasonToJsonString(enum PacketDropReason r)
             return "firewall.drop_reason.pre_stream_hook";
         case PKT_DROP_REASON_FW_FLOW_PRE_HOOK:
             return "firewall.drop_reason.pre_flow_hook";
+        case PKT_DROP_REASON_FW_FLOW_DROP:
+            return "firewall.drop_reason.flow_drop";
         case PKT_DROP_REASON_FW_DEFAULT_PACKET_POLICY:
             return "firewall.drop_reason.default_packet_policy";
         case PKT_DROP_REASON_FW_DEFAULT_APP_POLICY:
@@ -1056,6 +1060,7 @@ void CaptureStatsUpdate(ThreadVars *tv, const Packet *p)
         return;
 
     CaptureStats *s = &t_capture_stats;
+
     if (EngineModeIsFirewall()) {
         /** The firewall mode and its stats counters should work as when there are two different
          * devices for the firewall control and the IPS control.

src/decode.h

@@ -407,6 +407,7 @@ enum PacketDropReason {
     PKT_DROP_REASON_FW_DEFAULT_APP_POLICY,    /**< drop issued by default app policy */
     PKT_DROP_REASON_FW_STREAM_PRE_HOOK,       /**< drop issued in the pre_stream hook */
     PKT_DROP_REASON_FW_FLOW_PRE_HOOK,         /**< drop issued in the pre_flow hook */
+    PKT_DROP_REASON_FW_FLOW_DROP,
     PKT_DROP_REASON_MAX,
 };
 

src/detect-engine-alert.c

@@ -154,7 +154,7 @@ int PacketAlertCheck(Packet *p, uint32_t sid)
 }
 #endif
 
-static inline void RuleActionToFlow(const uint8_t action, Flow *f)
+static inline void RuleActionToFlow(const uint8_t action, Flow *f, const bool fw_rule)
 {
     if (action & ACTION_ACCEPT) {
         f->flags |= FLOW_ACTION_ACCEPT;
@@ -187,6 +187,10 @@ static inline void RuleActionToFlow(const uint8_t action, Flow *f)
             }
         }
     }
+
+    if (fw_rule) {
+        f->flags |= FLOW_ACTION_BY_FIREWALL;
+    }
 }
 
 /** \brief Apply action(s) and Set 'drop' sig info,
@@ -223,7 +227,7 @@ static void PacketApplySignatureActions(Packet *p, const Signature *s, const Pac
             p->alerts.drop.s = (Signature *)s;
         }
         if ((p->flow != NULL) && (pa->flags & PACKET_ALERT_FLAG_APPLY_ACTION_TO_FLOW)) {
-            RuleActionToFlow(pa->action, p->flow);
+            RuleActionToFlow(pa->action, p->flow, is_fw_rule);
         }
 
         DEBUG_VALIDATE_BUG_ON(!PacketCheckAction(p, ACTION_DROP));
@@ -248,7 +252,7 @@ static void PacketApplySignatureActions(Packet *p, const Signature *s, const Pac
 
         if ((pa->action & (ACTION_PASS | ACTION_ACCEPT)) && (p->flow != NULL) &&
                 (pa->flags & PACKET_ALERT_FLAG_APPLY_ACTION_TO_FLOW)) {
-            RuleActionToFlow(pa->action, p->flow);
+            RuleActionToFlow(pa->action, p->flow, is_fw_rule);
         }
     }
 }

src/detect.c

@@ -1659,6 +1659,7 @@ static const struct DetectFirewallPolicy *DetectFirewallApplyDefaultAppPolicy(
         if (policy->action_scope == ACTION_SCOPE_FLOW) {
             SCLogDebug("dropping flow");
             p->flow->flags |= FLOW_ACTION_DROP;
+            p->flow->flags |= FLOW_ACTION_BY_FIREWALL;
         }
     } else if (policy->action & ACTION_ACCEPT) {
         if (policy->action_scope == ACTION_SCOPE_FLOW) {
@@ -2341,6 +2342,7 @@ static void DetectRunTx(ThreadVars *tv,
                         if (s->action_scope == ACTION_SCOPE_FLOW) {
                             SCLogDebug("drop flow because of rule with drop action");
                             f->flags |= FLOW_ACTION_DROP;
+                            f->flags |= FLOW_ACTION_BY_FIREWALL;
                         }
                     }
                 }

src/flow-worker.c

@@ -427,8 +427,12 @@ static inline void FlowWorkerStreamTCPUpdate(ThreadVars *tv, FlowWorkerThreadDat
     }
     if (FlowChangeProto(p->flow) && p->flow->flags & FLOW_ACTION_DROP) {
         // in case f->flags & FLOW_ACTION_DROP was set by one of the dequeued packets
+        if (p->flow->flags & FLOW_ACTION_BY_FIREWALL) {
+            PacketDrop(p, ACTION_DROP, PKT_DROP_REASON_FW_FLOW_DROP);
+        } else {
             PacketDrop(p, ACTION_DROP, PKT_DROP_REASON_FLOW_DROP);
         }
+    }
 }
 
 static void FlowWorkerFlowTimeout(

src/flow.c

@@ -535,8 +535,12 @@ void FlowHandlePacketUpdate(Flow *f, Packet *p, ThreadVars *tv, DecodeThreadVars
     }
 
     if (f->flags & FLOW_ACTION_DROP) {
+        if (f->flags & FLOW_ACTION_BY_FIREWALL) {
+            PacketDrop(p, ACTION_DROP, PKT_DROP_REASON_FW_FLOW_DROP);
+        } else {
             PacketDrop(p, ACTION_DROP, PKT_DROP_REASON_FLOW_DROP);
         }
+    }
 
     if (f->flags & FLOW_NOPAYLOAD_INSPECTION) {
         SCLogDebug("setting FLOW_NOPAYLOAD_INSPECTION flag on flow %p", f);