7 Commits (49aefe7093a8d553ddc480f6d1733c377eeded9d)

Author	SHA1	Message	Date
Victor Julien	bf167418bf	detect: reject the '<' hook form for non-firewall rules ... The '<' lower bound hook form is a firewall policy construct: the rule covers its own hook and every prior one. For a threat detection rule the form has no such meaning, and the flag it sets leaked into the firewall policy walk, where the rule could influence the per-state decisions. Reject the form at load for rules without SIG_FLAG_FIREWALL. Ticket: #8944.	3 weeks ago
Victor Julien	fa695d3563	doc/userguide: TLS firewall state phase rename ... The firewall userguide pages still described the old TLS completion milestones, and an upgrade from the old state names had no guidance. Update the firewall design and example pages to the phase names, list the migration page in the firewall index, and add the migration page itself: the old/new state name mapping, the load-time validation of rules and config keys, monitoring of ts_progress, and the semantic changes - the fragmented hello decision, the removed flight-completion state, one decision per state, the new ja3/ja3s event timing, and the SSLv2 track behaviour. The 9.0.0 upgrade guide gains Major Changes (a rule with an old state name fails to load and is not enforced; config keys renamed) and Logging Changes (ts_progress/tc_progress values) entries, both linking the migration page. Ticket: #9047.	3 weeks ago
Lukas Sismis	b82b4496af	detect/firewall: group policies under packet and app nodes ... The policy config was a flat map mixing packet hooks and app-layer protocols: `packet-filter` next to `dns`. There was no node that meant "the packet hooks" or "the app-layer hooks", so a setting could not be scoped to one group. Move each group under its own node: packet-filter -> packet.filter packet-pre-flow -> packet.pre-flow packet-pre-stream -> packet.pre-stream <proto>.<hook> -> app.<proto>.<hook> Ticket: 8712	2 months ago
Lukas Sismis	04c9fd9e22	detect/firewall: address HTTP/1 policies as http1 ... AppProtoToString(ALPROTO_HTTP1) returns "http", so an HTTP/1 policy had to be written as `http:` while its rule hooks were already spelled `http1:`. Use the same name in both places. Ticket: 8712	2 months ago
Juliana Fajardini	04cfd33c59	doc/firewall: update hooks & configuration examples	5 months ago
Victor Julien	0a84015214	doc/userguide: add new constructs to firewall examples	5 months ago
Victor Julien	5c7173c6df	doc/firewall: start of documentation	2 years ago