Project

General

Profile

Actions
Copy link

Feature #8712

open
VJ LS

firewall: add default app policy options

Feature #8712: firewall: add default app policy options

Added by Victor Julien 20 days ago. Updated 8 days ago.

Status:
Assigned
Priority:
Normal
Assignee:
Lukas Sismis
Target version:
9.0.0-beta1
Effort:
Difficulty:
Label:

Description

Add options to specific a default policy for policies that aren't specified.

firewall:
  policies:
    default-policy:
      - "accept:hook" 

    http:
      default-policy:
        - "accept:hook" 

      request-started:
        - "accept:hook" 
      request-trailer:
        - "accept:hook" 
      request-complete:
        - "accept:hook" 
      # implied request-body uses firewall.policies.http.default-policy

   # implied tls uses firewall.policies.default-policy

Related issues 2 (1 open — 1 closed)

Related to Suricata - Feature #7701: firewall: configurable default policiesClosedVictor JulienActions
Related to Suricata - Bug #8389: firewall: Add monitor/observe mode to preview firewall policy without enforcing dropsNewActions

VJ Updated by Victor Julien 20 days ago Actions
Copy link
 #1

  • Related to Feature #7701: firewall: configurable default policies added
  • Related to Bug #8389: firewall: Add monitor/observe mode to preview firewall policy without enforcing drops added

VJ Updated by Victor Julien 20 days ago Actions
Copy link
 #2

  • Subject changed from firewall: add default app policy to firewall: add default app policy options

LS Updated by Lukas Sismis 19 days ago Actions
Copy link
 #3

  • Status changed from New to Assigned
  • Assignee set to Lukas Sismis
  • Target version changed from TBD to 9.0.0-beta1

LS Updated by Lukas Sismis 13 days ago Actions
Copy link
 #4

Would it be ok to redefine the policy section of the configuration file to a format like this?
The current format as is in: https://github.com/OISF/suricata/blob/43bc2db41e4f7356f6cadb3247750d66e27ea8fe/suricata.yaml.in#L2396
Feels ambiguous, especially since it doesn't allow defining policies to packet-related tables only (hence adding a "packet" node).
The same would be for defining global app policy option (hence adding "app" configuration node)

firewall:
  policies:
    default-policy: ["accept:hook"]     # global fallback (all hooks)
    packet:
      default-policy: ["drop:packet"]   # fallback for packet hooks
      filter:     ["drop:packet"]
      pre-flow:   ["accept:hook"]
      pre-stream: ["accept:hook"]
    app:
      default-policy: ["drop:flow"]     # fallback for all app hooks
      dns:
        default-policy: ["drop:flow"]   # fallback for dns hooks
        request-started: ["accept:hook"]
        request-complete: ["drop:flow", "alert"]
        response-started: ["accept:tx"]

VJ Updated by Victor Julien 13 days ago Actions
Copy link
 #5

I think it makes sense. @Yash Datre any opinions?

LS Updated by Lukas Sismis 13 days ago Actions
Copy link
 #6

Not particularly related to this ticket, but I would like to propose the change of the app layer policy from "http" to "http1" to be in line with FW rules.

YD Updated by Yash Datre 8 days ago Actions
Copy link
 #7

Yes, this should solve the use-case.

Actions
Copy link

Also available in: PDF Atom