Actions
Bug #8951
open
LS
LS
engine-analysis: packet:filter policy is hardcoded to drop:packet
Bug #8951:
engine-analysis: packet:filter policy is hardcoded to drop:packet
Affected Versions:
Effort:
Difficulty:
Label:
Description
FirewallAnalyzer() writes a fixed "drop:packet" for the packet:filter table instead of the policy that was actually resolved from the config.
The runtime uses fw_policies->pkt[DETECT_FIREWALL_POLICY_PACKET_FILTER] (detect.c, DetectRunSetup), which DetectFirewallLoadPacketPolicy() fills in from firewall.policies.packet.filter, packet.default-policy or the global default-policy.
The app tables are fine, AddPolicy() renders the real value for those. Only the packet table is hardcoded.
Actions