20 Commits (8e95600253013e4275e0c69aca0aa2ed72d3bb99)

Author	SHA1	Message	Date
Lukas Sismis	3f0d99d9c2	fw: document config action in FW mode	2 months ago
Lukas Sismis	092ae272e2	firewall: validate action scope against the hook class ... Validate the resolved scope against the class of hook it is being applied to and fail at startup if it does not fit. Ticket: 8712	2 months ago
Lukas Sismis	0aaa80d4f3	firewall: add default-policy to policy config ... Every hook has a built-in default policy, but expressing anything other than the built-in meant naming each hook explicitly. This commit adds a `default-policy` setting that covers all hooks below it. For any hook the most specific setting present wins. DoParseAppSubStatePolicy() collapses into DoParseAppPolicy() as a sub state hook only differs by an extra path segment. Ticket: 8712	2 months ago
Lukas Sismis	b82b4496af	detect/firewall: group policies under packet and app nodes ... The policy config was a flat map mixing packet hooks and app-layer protocols: `packet-filter` next to `dns`. There was no node that meant "the packet hooks" or "the app-layer hooks", so a setting could not be scoped to one group. Move each group under its own node: packet-filter -> packet.filter packet-pre-flow -> packet.pre-flow packet-pre-stream -> packet.pre-stream <proto>.<hook> -> app.<proto>.<hook> Ticket: 8712	2 months ago
Lukas Sismis	04c9fd9e22	detect/firewall: address HTTP/1 policies as http1 ... AppProtoToString(ALPROTO_HTTP1) returns "http", so an HTTP/1 policy had to be written as `http:` while its rule hooks were already spelled `http1:`. Use the same name in both places. Ticket: 8712	2 months ago
Juliana Fajardini	04cfd33c59	doc/firewall: update hooks & configuration examples	5 months ago
Victor Julien	0a84015214	doc/userguide: add new constructs to firewall examples	5 months ago
Victor Julien	8728f9ffc0	doc/userguide: document firewall lte rule support	5 months ago
Victor Julien	ac59883c26	doc/userguide: fix default policies for pre_* hooks ... Minor other cleanups.	5 months ago
Victor Julien	da6af0879e	doc: update firewall design ... Bring in line with recent changes.	5 months ago
Victor Julien	90a837cef3	detect/firewall: update discarded logic ... Only count alert queue overflow here, not alerts in the queue after a drop.	5 months ago
Juliana Fajardini	234172a93c	docs: add firewall stats doc ... Related to Ticket #7699	5 months ago
Victor Julien	e6381a3c22	doc/userguide: add note on rule reloads ... Cannot be combined with --firewall-rules-exclusive	7 months ago
Victor Julien	f99b86beab	doc/userguide: document L2 firewall handling of ARP	7 months ago
Victor Julien	e62eb00459	doc/userguide: add ips chapter; add concept ... Move setup guides into the new chapter as well. Explain `stream.inline` logic. Ticket: #5513. Ticket: #6284.	1 year ago
Shivani Bhardwaj	9ed5ac7669	doc: make firewall table names consistent	1 year ago
Shivani Bhardwaj	7fec1883cd	doc: add more info to firewall design ... Add information about: - available tables, default policies and rule ordering - Packet layer and applayer tables and hooks - engine analysis output - commandline options available - how to load firewall rules Also, reorganize sections and content to assist the definitions.	1 year ago
Jason Ish	7535b5aa1d	doc/lua-functions: update lua-function documentation ... - cleanup usage and documentation around needs - mentiond that rule hooks are used instead of "needs" keywords with link with rule hooks (which is still in the firewall-design doc)	1 year ago
Philippe Antoine	daabab7381	doc/ssh: document hooks ... Ticket: 7607	2 years ago
Victor Julien	5c7173c6df	doc/firewall: start of documentation	2 years ago