diff --git a/tests/firewall/ruletype-firewall-141-allow-bypass-keyword-firewall-rule/README.md b/tests/firewall/ruletype-firewall-141-allow-bypass-keyword-firewall-rule/README.md new file mode 100644 index 0000000000..e79ecbecc7 --- /dev/null +++ b/tests/firewall/ruletype-firewall-141-allow-bypass-keyword-firewall-rule/README.md @@ -0,0 +1,13 @@ +# Test + +Updated test to ensure that the engine accepts the `bypass` keyword in a firewall +mode, in a firweall rule. + +The accepted firewall rule matches the decoded HTTP host +`www.testmyids.com`, then accepts and bypasses the flow at the +`http1:request_headers` hook. + +## Ticket + +Related to +https://redmine.openinfosecfoundation.org/issues/8459. diff --git a/tests/firewall/ruletype-firewall-141-ban-bypass-keyword-firewall-rule/firewall.rules b/tests/firewall/ruletype-firewall-141-allow-bypass-keyword-firewall-rule/firewall.rules similarity index 100% rename from tests/firewall/ruletype-firewall-141-ban-bypass-keyword-firewall-rule/firewall.rules rename to tests/firewall/ruletype-firewall-141-allow-bypass-keyword-firewall-rule/firewall.rules diff --git a/tests/firewall/ruletype-firewall-141-ban-bypass-keyword-firewall-rule/td.rules b/tests/firewall/ruletype-firewall-141-allow-bypass-keyword-firewall-rule/td.rules similarity index 100% rename from tests/firewall/ruletype-firewall-141-ban-bypass-keyword-firewall-rule/td.rules rename to tests/firewall/ruletype-firewall-141-allow-bypass-keyword-firewall-rule/td.rules diff --git a/tests/firewall/ruletype-firewall-141-ban-bypass-keyword-firewall-rule/test.yaml b/tests/firewall/ruletype-firewall-141-allow-bypass-keyword-firewall-rule/test.yaml similarity index 62% rename from tests/firewall/ruletype-firewall-141-ban-bypass-keyword-firewall-rule/test.yaml rename to tests/firewall/ruletype-firewall-141-allow-bypass-keyword-firewall-rule/test.yaml index 761b04d927..5519ea3d95 100644 --- a/tests/firewall/ruletype-firewall-141-ban-bypass-keyword-firewall-rule/test.yaml +++ b/tests/firewall/ruletype-firewall-141-allow-bypass-keyword-firewall-rule/test.yaml @@ -6,35 +6,35 @@ pcap: ../../flowbit-oring/input.pcap args: - --simulate-ips - -k none -exit-code: 1 checks: + # We're enabling bypass in firewall rules only, in firewall mode + - shell: + args: grep "keyword 'bypass' is not allowed in firewall mode" stderr | wc -l + expect: 0 - filter: - # Would be 1 if bypass were enabled in firewall rules. - count: 0 + # Expected 1 with bypass enabled in firewall rules. + count: 1 match: event_type: alert alert.signature_id: 2000001 http.hostname: www.testmyids.com - filter: - # Would remain 0 if bypass were enabled and suppressed TD inspection. + # Remains 0 if bypass is enabled and suppressed TD inspection. count: 0 match: event_type: alert alert.signature_id: 100001 - filter: - # Would be 1 if bypass were enabled in firewall rules. - count: 0 + # Should be 1 if bypass is enabled in firewall rules. + count: 1 match: event_type: flow flow.state: bypassed flow.bypass: local - filter: - # Would be 1 if bypass were enabled in firewall rules. - count: 0 + # Should be 1 if bypass is enabled in firewall rules. + count: 1 match: event_type: stats stats.flow_bypassed.local_pkts: 6 - - shell: - args: grep "keyword 'bypass' is not allowed in firewall mode" stderr | wc -l - expect: 1 diff --git a/tests/firewall/ruletype-firewall-141-ban-bypass-keyword-firewall-rule/README.md b/tests/firewall/ruletype-firewall-141-ban-bypass-keyword-firewall-rule/README.md deleted file mode 100644 index a0f30b6482..0000000000 --- a/tests/firewall/ruletype-firewall-141-ban-bypass-keyword-firewall-rule/README.md +++ /dev/null @@ -1,16 +0,0 @@ -# Test - -Ensure that the engine rejects the `bypass` keyword in a firewall rule. - -The rejected firewall rule would match the decoded HTTP host -`www.testmyids.com`, then accept and bypass the flow at the -`http1:request_headers` hook. The retained event checks document the behavior -expected if bypass support is enabled in the future. - -This ticket also contains valid checks for if the bypass were to be allowed in -firewall mode. - -## Ticket - -Related to -https://redmine.openinfosecfoundation.org/issues/8459. diff --git a/tests/firewall/ruletype-firewall-90-ban-replace-keyword/README.md b/tests/firewall/ruletype-firewall-142-ban-replace-keyword/README.md similarity index 100% rename from tests/firewall/ruletype-firewall-90-ban-replace-keyword/README.md rename to tests/firewall/ruletype-firewall-142-ban-replace-keyword/README.md diff --git a/tests/firewall/ruletype-firewall-90-ban-replace-keyword/firewall.rules b/tests/firewall/ruletype-firewall-142-ban-replace-keyword/firewall.rules similarity index 100% rename from tests/firewall/ruletype-firewall-90-ban-replace-keyword/firewall.rules rename to tests/firewall/ruletype-firewall-142-ban-replace-keyword/firewall.rules diff --git a/tests/firewall/ruletype-firewall-90-ban-replace-keyword/test.yaml b/tests/firewall/ruletype-firewall-142-ban-replace-keyword/test.yaml similarity index 100% rename from tests/firewall/ruletype-firewall-90-ban-replace-keyword/test.yaml rename to tests/firewall/ruletype-firewall-142-ban-replace-keyword/test.yaml diff --git a/tests/firewall/ruletype-firewall-92-ban-bypass-keyword/README.md b/tests/firewall/ruletype-firewall-143-ban-bypass-keyword/README.md similarity index 75% rename from tests/firewall/ruletype-firewall-92-ban-bypass-keyword/README.md rename to tests/firewall/ruletype-firewall-143-ban-bypass-keyword/README.md index a514642236..4473f62f0f 100644 --- a/tests/firewall/ruletype-firewall-92-ban-bypass-keyword/README.md +++ b/tests/firewall/ruletype-firewall-143-ban-bypass-keyword/README.md @@ -1,7 +1,7 @@ # Test Ensure that the engine throws an error if the `bypass` keyword is used -in threat detection rules, as it's banned in firewall mode. +in threat detection rules, as it's banned in firewall mode, for those. ## Ticket diff --git a/tests/firewall/ruletype-firewall-92-ban-bypass-keyword/firewall.rules b/tests/firewall/ruletype-firewall-143-ban-bypass-keyword/firewall.rules similarity index 100% rename from tests/firewall/ruletype-firewall-92-ban-bypass-keyword/firewall.rules rename to tests/firewall/ruletype-firewall-143-ban-bypass-keyword/firewall.rules diff --git a/tests/firewall/ruletype-firewall-92-ban-bypass-keyword/td.rules b/tests/firewall/ruletype-firewall-143-ban-bypass-keyword/td.rules similarity index 100% rename from tests/firewall/ruletype-firewall-92-ban-bypass-keyword/td.rules rename to tests/firewall/ruletype-firewall-143-ban-bypass-keyword/td.rules diff --git a/tests/firewall/ruletype-firewall-92-ban-bypass-keyword/test.yaml b/tests/firewall/ruletype-firewall-143-ban-bypass-keyword/test.yaml similarity index 57% rename from tests/firewall/ruletype-firewall-92-ban-bypass-keyword/test.yaml rename to tests/firewall/ruletype-firewall-143-ban-bypass-keyword/test.yaml index 47ebe9c623..24db351675 100644 --- a/tests/firewall/ruletype-firewall-92-ban-bypass-keyword/test.yaml +++ b/tests/firewall/ruletype-firewall-143-ban-bypass-keyword/test.yaml @@ -10,6 +10,6 @@ exit-code: 1 checks: - shell: - args: grep "keyword 'bypass' is not allowed in firewall mode" stderr | wc -l + args: grep "keyword 'bypass' is not allowed in threat detection rules with firewall mode" stderr | wc -l expect: 1 diff --git a/tests/firewall/ruletype-firewall-144-bypass-keyword-drop/README.md b/tests/firewall/ruletype-firewall-144-bypass-keyword-drop/README.md new file mode 100644 index 0000000000..af58f2eaf1 --- /dev/null +++ b/tests/firewall/ruletype-firewall-144-bypass-keyword-drop/README.md @@ -0,0 +1,14 @@ +Test that the engine properly errors out when an invalid rule action + bypass +keyword is used. + +`bypass` cannot be used with `drop`, `reject`, `accept:packet`, `accept:hook`, `accept:tx`. + +PCAP +==== + +Reused from test tls-random + +Ticket +====== + +https://redmine.openinfosecfoundation.org/issues/8459 diff --git a/tests/firewall/ruletype-firewall-144-bypass-keyword-drop/firewall.rules b/tests/firewall/ruletype-firewall-144-bypass-keyword-drop/firewall.rules new file mode 100644 index 0000000000..d1f93158fc --- /dev/null +++ b/tests/firewall/ruletype-firewall-144-bypass-keyword-drop/firewall.rules @@ -0,0 +1,3 @@ +drop:packet tcp:all any any -> any any (alert; bypass; sid:99;) +accept:flow tcp:flow_start any any -> any 443 (alert; flow:to_server; sid:1;) +drop:flow tcp:flow_start any any -> any any (sid:2;) diff --git a/tests/firewall/ruletype-firewall-144-bypass-keyword-drop/suricata.yaml b/tests/firewall/ruletype-firewall-144-bypass-keyword-drop/suricata.yaml new file mode 100644 index 0000000000..fa1ce7da18 --- /dev/null +++ b/tests/firewall/ruletype-firewall-144-bypass-keyword-drop/suricata.yaml @@ -0,0 +1,23 @@ +%YAML 1.1 +--- + +# Global stats configuration +stats: + enabled: yes + interval: 8 + +# Configure the type of alert (and other) logging you would like. +outputs: + - eve-log: + enabled: yes + filetype: regular #regular|syslog|unix_dgram|unix_stream|redis + filename: eve.json + types: + - stats + - flow + - alert + - tls: + extended: yes # enable this for extended logging information + - drop: + alerts: yes # log alerts that caused drops + flows: all # start or all: 'start' logs only a single drop diff --git a/tests/firewall/ruletype-firewall-144-bypass-keyword-drop/test.yaml b/tests/firewall/ruletype-firewall-144-bypass-keyword-drop/test.yaml new file mode 100644 index 0000000000..0b5519513c --- /dev/null +++ b/tests/firewall/ruletype-firewall-144-bypass-keyword-drop/test.yaml @@ -0,0 +1,15 @@ +requires: + min-version: 9 + +pcap: ../../tls/tls-random/input.pcap + +# the invalid combination rules should make the engine error out +exit-code: 1 + +args: + - --simulate-ips + +checks: +- shell: + args: grep "keyword 'bypass' cannot be used in combination with 'drop' action" stderr | wc -l + expect: 1 diff --git a/tests/firewall/ruletype-firewall-145-bypass-keyword-reject/README.md b/tests/firewall/ruletype-firewall-145-bypass-keyword-reject/README.md new file mode 100644 index 0000000000..af58f2eaf1 --- /dev/null +++ b/tests/firewall/ruletype-firewall-145-bypass-keyword-reject/README.md @@ -0,0 +1,14 @@ +Test that the engine properly errors out when an invalid rule action + bypass +keyword is used. + +`bypass` cannot be used with `drop`, `reject`, `accept:packet`, `accept:hook`, `accept:tx`. + +PCAP +==== + +Reused from test tls-random + +Ticket +====== + +https://redmine.openinfosecfoundation.org/issues/8459 diff --git a/tests/firewall/ruletype-firewall-145-bypass-keyword-reject/firewall.rules b/tests/firewall/ruletype-firewall-145-bypass-keyword-reject/firewall.rules new file mode 100644 index 0000000000..79265d57e7 --- /dev/null +++ b/tests/firewall/ruletype-firewall-145-bypass-keyword-reject/firewall.rules @@ -0,0 +1,3 @@ +reject:packet tcp:all any any -> any any (alert; bypass; sid:99;) +accept:flow tcp:flow_start any any -> any 443 (alert; flow:to_server; sid:1;) +reject:flow tcp:flow_start any any -> any any (sid:2;) diff --git a/tests/firewall/ruletype-firewall-145-bypass-keyword-reject/suricata.yaml b/tests/firewall/ruletype-firewall-145-bypass-keyword-reject/suricata.yaml new file mode 100644 index 0000000000..fa1ce7da18 --- /dev/null +++ b/tests/firewall/ruletype-firewall-145-bypass-keyword-reject/suricata.yaml @@ -0,0 +1,23 @@ +%YAML 1.1 +--- + +# Global stats configuration +stats: + enabled: yes + interval: 8 + +# Configure the type of alert (and other) logging you would like. +outputs: + - eve-log: + enabled: yes + filetype: regular #regular|syslog|unix_dgram|unix_stream|redis + filename: eve.json + types: + - stats + - flow + - alert + - tls: + extended: yes # enable this for extended logging information + - drop: + alerts: yes # log alerts that caused drops + flows: all # start or all: 'start' logs only a single drop diff --git a/tests/firewall/ruletype-firewall-145-bypass-keyword-reject/test.yaml b/tests/firewall/ruletype-firewall-145-bypass-keyword-reject/test.yaml new file mode 100644 index 0000000000..6af756f493 --- /dev/null +++ b/tests/firewall/ruletype-firewall-145-bypass-keyword-reject/test.yaml @@ -0,0 +1,17 @@ +requires: + min-version: 9 + features: + - LIBNET1.1 + +pcap: ../../tls/tls-random/input.pcap + +# the invalid combination rules should make the engine error out +exit-code: 1 + +args: + - --simulate-ips + +checks: +- shell: + args: grep "keyword 'bypass' cannot be used in combination with 'reject' action" stderr | wc -l + expect: 1 diff --git a/tests/firewall/ruletype-firewall-146-bypass-keyword-accept-packet/README.md b/tests/firewall/ruletype-firewall-146-bypass-keyword-accept-packet/README.md new file mode 100644 index 0000000000..af58f2eaf1 --- /dev/null +++ b/tests/firewall/ruletype-firewall-146-bypass-keyword-accept-packet/README.md @@ -0,0 +1,14 @@ +Test that the engine properly errors out when an invalid rule action + bypass +keyword is used. + +`bypass` cannot be used with `drop`, `reject`, `accept:packet`, `accept:hook`, `accept:tx`. + +PCAP +==== + +Reused from test tls-random + +Ticket +====== + +https://redmine.openinfosecfoundation.org/issues/8459 diff --git a/tests/firewall/ruletype-firewall-146-bypass-keyword-accept-packet/firewall.rules b/tests/firewall/ruletype-firewall-146-bypass-keyword-accept-packet/firewall.rules new file mode 100644 index 0000000000..ea71756fec --- /dev/null +++ b/tests/firewall/ruletype-firewall-146-bypass-keyword-accept-packet/firewall.rules @@ -0,0 +1,3 @@ +accept:packet tcp:all any any -> any any (alert; bypass; sid:99;) +accept:flow tcp:flow_start any any -> any 443 (alert; flow:to_server; sid:1;) +accept:flow tcp:flow_start any any -> any any (sid:2;) diff --git a/tests/firewall/ruletype-firewall-146-bypass-keyword-accept-packet/suricata.yaml b/tests/firewall/ruletype-firewall-146-bypass-keyword-accept-packet/suricata.yaml new file mode 100644 index 0000000000..fa1ce7da18 --- /dev/null +++ b/tests/firewall/ruletype-firewall-146-bypass-keyword-accept-packet/suricata.yaml @@ -0,0 +1,23 @@ +%YAML 1.1 +--- + +# Global stats configuration +stats: + enabled: yes + interval: 8 + +# Configure the type of alert (and other) logging you would like. +outputs: + - eve-log: + enabled: yes + filetype: regular #regular|syslog|unix_dgram|unix_stream|redis + filename: eve.json + types: + - stats + - flow + - alert + - tls: + extended: yes # enable this for extended logging information + - drop: + alerts: yes # log alerts that caused drops + flows: all # start or all: 'start' logs only a single drop diff --git a/tests/firewall/ruletype-firewall-146-bypass-keyword-accept-packet/test.yaml b/tests/firewall/ruletype-firewall-146-bypass-keyword-accept-packet/test.yaml new file mode 100644 index 0000000000..5faa00a1df --- /dev/null +++ b/tests/firewall/ruletype-firewall-146-bypass-keyword-accept-packet/test.yaml @@ -0,0 +1,15 @@ +requires: + min-version: 9 + +pcap: ../../tls/tls-random/input.pcap + +# the invalid combination rules should make the engine error out +exit-code: 1 + +args: + - --simulate-ips + +checks: +- shell: + args: grep "keyword 'bypass' cannot be used in combination with 'packet' scope" stderr | wc -l + expect: 1 diff --git a/tests/firewall/ruletype-firewall-147-bypass-keyword-config/README.md b/tests/firewall/ruletype-firewall-147-bypass-keyword-config/README.md new file mode 100644 index 0000000000..af58f2eaf1 --- /dev/null +++ b/tests/firewall/ruletype-firewall-147-bypass-keyword-config/README.md @@ -0,0 +1,14 @@ +Test that the engine properly errors out when an invalid rule action + bypass +keyword is used. + +`bypass` cannot be used with `drop`, `reject`, `accept:packet`, `accept:hook`, `accept:tx`. + +PCAP +==== + +Reused from test tls-random + +Ticket +====== + +https://redmine.openinfosecfoundation.org/issues/8459 diff --git a/tests/firewall/ruletype-firewall-147-bypass-keyword-config/firewall.rules b/tests/firewall/ruletype-firewall-147-bypass-keyword-config/firewall.rules new file mode 100644 index 0000000000..fdb9b73839 --- /dev/null +++ b/tests/firewall/ruletype-firewall-147-bypass-keyword-config/firewall.rules @@ -0,0 +1,3 @@ +config:packet tcp:all any any -> any any (alert; bypass; sid:99;) +accept:flow tcp:flow_start any any -> any 443 (alert; flow:to_server; sid:1;) +drop:flow tcp:flow_start any any -> any any (sid:2;) diff --git a/tests/firewall/ruletype-firewall-147-bypass-keyword-config/suricata.yaml b/tests/firewall/ruletype-firewall-147-bypass-keyword-config/suricata.yaml new file mode 100644 index 0000000000..fa1ce7da18 --- /dev/null +++ b/tests/firewall/ruletype-firewall-147-bypass-keyword-config/suricata.yaml @@ -0,0 +1,23 @@ +%YAML 1.1 +--- + +# Global stats configuration +stats: + enabled: yes + interval: 8 + +# Configure the type of alert (and other) logging you would like. +outputs: + - eve-log: + enabled: yes + filetype: regular #regular|syslog|unix_dgram|unix_stream|redis + filename: eve.json + types: + - stats + - flow + - alert + - tls: + extended: yes # enable this for extended logging information + - drop: + alerts: yes # log alerts that caused drops + flows: all # start or all: 'start' logs only a single drop diff --git a/tests/firewall/ruletype-firewall-147-bypass-keyword-config/test.yaml b/tests/firewall/ruletype-firewall-147-bypass-keyword-config/test.yaml new file mode 100644 index 0000000000..35bc773cab --- /dev/null +++ b/tests/firewall/ruletype-firewall-147-bypass-keyword-config/test.yaml @@ -0,0 +1,15 @@ +requires: + min-version: 9 + +pcap: ../../tls/tls-random/input.pcap + +# the invalid combination rules should make the engine error out +exit-code: 1 + +args: + - --simulate-ips + +checks: +- shell: + args: grep "keyword 'bypass' cannot be used in combination with 'config' action" stderr | wc -l + expect: 1 diff --git a/tests/firewall/ruletype-firewall-148-bypass-keyword-accept-hook/README.md b/tests/firewall/ruletype-firewall-148-bypass-keyword-accept-hook/README.md new file mode 100644 index 0000000000..af58f2eaf1 --- /dev/null +++ b/tests/firewall/ruletype-firewall-148-bypass-keyword-accept-hook/README.md @@ -0,0 +1,14 @@ +Test that the engine properly errors out when an invalid rule action + bypass +keyword is used. + +`bypass` cannot be used with `drop`, `reject`, `accept:packet`, `accept:hook`, `accept:tx`. + +PCAP +==== + +Reused from test tls-random + +Ticket +====== + +https://redmine.openinfosecfoundation.org/issues/8459 diff --git a/tests/firewall/ruletype-firewall-148-bypass-keyword-accept-hook/firewall.rules b/tests/firewall/ruletype-firewall-148-bypass-keyword-accept-hook/firewall.rules new file mode 100644 index 0000000000..fca1fe73ca --- /dev/null +++ b/tests/firewall/ruletype-firewall-148-bypass-keyword-accept-hook/firewall.rules @@ -0,0 +1,3 @@ +accept:hook tcp:all any any -> any any (alert; bypass; sid:99;) +accept:flow tcp:flow_start any any -> any 443 (alert; flow:to_server; sid:1;) +accept:flow tcp:flow_start any any -> any any (sid:2;) diff --git a/tests/firewall/ruletype-firewall-148-bypass-keyword-accept-hook/suricata.yaml b/tests/firewall/ruletype-firewall-148-bypass-keyword-accept-hook/suricata.yaml new file mode 100644 index 0000000000..fa1ce7da18 --- /dev/null +++ b/tests/firewall/ruletype-firewall-148-bypass-keyword-accept-hook/suricata.yaml @@ -0,0 +1,23 @@ +%YAML 1.1 +--- + +# Global stats configuration +stats: + enabled: yes + interval: 8 + +# Configure the type of alert (and other) logging you would like. +outputs: + - eve-log: + enabled: yes + filetype: regular #regular|syslog|unix_dgram|unix_stream|redis + filename: eve.json + types: + - stats + - flow + - alert + - tls: + extended: yes # enable this for extended logging information + - drop: + alerts: yes # log alerts that caused drops + flows: all # start or all: 'start' logs only a single drop diff --git a/tests/firewall/ruletype-firewall-148-bypass-keyword-accept-hook/test.yaml b/tests/firewall/ruletype-firewall-148-bypass-keyword-accept-hook/test.yaml new file mode 100644 index 0000000000..c803f64f6f --- /dev/null +++ b/tests/firewall/ruletype-firewall-148-bypass-keyword-accept-hook/test.yaml @@ -0,0 +1,15 @@ +requires: + min-version: 9 + +pcap: ../../tls/tls-random/input.pcap + +# the invalid combination rules should make the engine error out +exit-code: 1 + +args: + - --simulate-ips + +checks: +- shell: + args: grep "keyword 'bypass' cannot be used in combination with 'hook' scope" stderr | wc -l + expect: 1 diff --git a/tests/firewall/ruletype-firewall-149-bypass-keyword-accept-tx/README.md b/tests/firewall/ruletype-firewall-149-bypass-keyword-accept-tx/README.md new file mode 100644 index 0000000000..af58f2eaf1 --- /dev/null +++ b/tests/firewall/ruletype-firewall-149-bypass-keyword-accept-tx/README.md @@ -0,0 +1,14 @@ +Test that the engine properly errors out when an invalid rule action + bypass +keyword is used. + +`bypass` cannot be used with `drop`, `reject`, `accept:packet`, `accept:hook`, `accept:tx`. + +PCAP +==== + +Reused from test tls-random + +Ticket +====== + +https://redmine.openinfosecfoundation.org/issues/8459 diff --git a/tests/firewall/ruletype-firewall-149-bypass-keyword-accept-tx/firewall.rules b/tests/firewall/ruletype-firewall-149-bypass-keyword-accept-tx/firewall.rules new file mode 100644 index 0000000000..bdbb7b9de6 --- /dev/null +++ b/tests/firewall/ruletype-firewall-149-bypass-keyword-accept-tx/firewall.rules @@ -0,0 +1,3 @@ +accept:tx tcp:all any any -> any any (alert; bypass; sid:99;) +accept:flow tcp:flow_start any any -> any 443 (alert; flow:to_server; sid:1;) +accept:flow tcp:flow_start any any -> any any (sid:2;) diff --git a/tests/firewall/ruletype-firewall-149-bypass-keyword-accept-tx/suricata.yaml b/tests/firewall/ruletype-firewall-149-bypass-keyword-accept-tx/suricata.yaml new file mode 100644 index 0000000000..fa1ce7da18 --- /dev/null +++ b/tests/firewall/ruletype-firewall-149-bypass-keyword-accept-tx/suricata.yaml @@ -0,0 +1,23 @@ +%YAML 1.1 +--- + +# Global stats configuration +stats: + enabled: yes + interval: 8 + +# Configure the type of alert (and other) logging you would like. +outputs: + - eve-log: + enabled: yes + filetype: regular #regular|syslog|unix_dgram|unix_stream|redis + filename: eve.json + types: + - stats + - flow + - alert + - tls: + extended: yes # enable this for extended logging information + - drop: + alerts: yes # log alerts that caused drops + flows: all # start or all: 'start' logs only a single drop diff --git a/tests/firewall/ruletype-firewall-149-bypass-keyword-accept-tx/test.yaml b/tests/firewall/ruletype-firewall-149-bypass-keyword-accept-tx/test.yaml new file mode 100644 index 0000000000..d67bc76d75 --- /dev/null +++ b/tests/firewall/ruletype-firewall-149-bypass-keyword-accept-tx/test.yaml @@ -0,0 +1,15 @@ +requires: + min-version: 9 + +pcap: ../../tls/tls-random/input.pcap + +# the invalid combination rules should make the engine error out +exit-code: 1 + +args: + - --simulate-ips + +checks: +- shell: + args: grep "keyword 'bypass' cannot be used in combination with 'tx' scope" stderr | wc -l + expect: 1 diff --git a/tests/firewall/ruletype-firewall-150-bypass-keyword-accept-flow-td-drop-rule/README.md b/tests/firewall/ruletype-firewall-150-bypass-keyword-accept-flow-td-drop-rule/README.md new file mode 100644 index 0000000000..767eb14c6f --- /dev/null +++ b/tests/firewall/ruletype-firewall-150-bypass-keyword-accept-flow-td-drop-rule/README.md @@ -0,0 +1,24 @@ +Expectation +----------- + +Test that the engine maintains "the "firewall" and "IPS" work as two distinct +devices" premise in a scenario where the same flow packet triggers an +`accept:flow+bypass` firewall rule and a `drop packet` threat detection rule. + +As the firewall rule would be evaluated and processed first in the scenario of a +separate device, the td rule shouldn't drop the packet -- as it wouldn't even +"see" that packet, as a separate device. + +This test mirrors `ruletype-firewall-141` but adds the TD `drop` rule to check +for this corner case. + +Pcap +---- + +Reused from `flowbit-oring` test. + +Ticket +------ + +Related to https://redmine.openinfosecfoundation.org/issues/8459. + diff --git a/tests/firewall/ruletype-firewall-150-bypass-keyword-accept-flow-td-drop-rule/firewall.rules b/tests/firewall/ruletype-firewall-150-bypass-keyword-accept-flow-td-drop-rule/firewall.rules new file mode 100644 index 0000000000..d5f6152184 --- /dev/null +++ b/tests/firewall/ruletype-firewall-150-bypass-keyword-accept-flow-td-drop-rule/firewall.rules @@ -0,0 +1,24 @@ +# Packet rules + +accept:hook tcp:all any any -> any any (sid:100;) + +# default drop + +# App-layer rules + +accept:hook http1:request_started any any -> any any (sid:101;) +accept:hook http1:request_line any any -> any any (sid:102;) + +accept:flow,alert http1:request_headers any any -> any any (msg:"Firewall accept flow with bypass for testmyids"; http.host; content:"www.testmyids.com"; bypass; sid:103;) + +accept:hook http1:request_body any any -> any any (sid:104;) +accept:hook http1:request_trailer any any -> any any (sid:105;) +accept:hook http1:request_complete any any -> any any (sid:106;) + +accept:hook http1:response_started any any -> any any (sid:201;) +accept:hook http1:response_line any any -> any any (sid:202;) +accept:hook http1:response_headers any any -> any any (sid:203;) +accept:hook http1:response_body any any -> any any (sid:204;) +accept:hook http1:response_trailer any any -> any any (sid:205;) +accept:hook http1:response_complete any any -> any any (sid:206;) + diff --git a/tests/firewall/ruletype-firewall-150-bypass-keyword-accept-flow-td-drop-rule/suricata.yaml b/tests/firewall/ruletype-firewall-150-bypass-keyword-accept-flow-td-drop-rule/suricata.yaml new file mode 100644 index 0000000000..398a898e23 --- /dev/null +++ b/tests/firewall/ruletype-firewall-150-bypass-keyword-accept-flow-td-drop-rule/suricata.yaml @@ -0,0 +1,22 @@ +%YAML 1.1 +--- + +stats: + enabled: yes + interval: 8 + +outputs: + - eve-log: + enabled: yes + filetype: regular + filename: eve.json + types: + - stats + - alert: + verdict: true + - drop: + alerts: yes + flows: all + verdict: true + - flow + - http diff --git a/tests/firewall/ruletype-firewall-150-bypass-keyword-accept-flow-td-drop-rule/td.rules b/tests/firewall/ruletype-firewall-150-bypass-keyword-accept-flow-td-drop-rule/td.rules new file mode 100644 index 0000000000..5975d0c763 --- /dev/null +++ b/tests/firewall/ruletype-firewall-150-bypass-keyword-accept-flow-td-drop-rule/td.rules @@ -0,0 +1,3 @@ +drop:packet http any any -> any any (msg:"TD packet drop on HTTP host"; flow:to_server, established; http.host; content:"www.testmyids.com"; sid:100002;) + +alert http any any -> any any (msg:"Response body inspected after bypass"; flow:to_client,established; http.response_body; content:"uid=0|28|root|29|"; sid:100001;) diff --git a/tests/firewall/ruletype-firewall-150-bypass-keyword-accept-flow-td-drop-rule/test.yaml b/tests/firewall/ruletype-firewall-150-bypass-keyword-accept-flow-td-drop-rule/test.yaml new file mode 100644 index 0000000000..379c207afd --- /dev/null +++ b/tests/firewall/ruletype-firewall-150-bypass-keyword-accept-flow-td-drop-rule/test.yaml @@ -0,0 +1,54 @@ +requires: + min-version: 9 + +pcap: ../../flowbit-oring/input.pcap + +args: + - --simulate-ips + - -k none + +checks: +- filter: + count: 1 + match: + event_type: alert + alert.signature_id: 103 + pcap_cnt: 4 + verdict.action: accept +- filter: + count: 0 + match: + event_type: alert + alert.signature_id: 100002 +- filter: + count: 0 + match: + event_type: drop + alert.signature_id: 100002 +- filter: + count: 0 + match: + event_type: alert + alert.signature_id: 100001 +- filter: + count: 1 + match: + event_type: flow + flow.state: bypassed + flow.bypass: local + flow.alerted: true + flow.action: accept + flow.pkts_toserver: 6 + flow.pkts_toclient: 4 +- filter: + count: 1 + match: + event_type: stats + stats.ips.blocked: 0 + stats.ips.accepted: 3 + stats.ips.drop_reason.rules: 0 + stats.flow.end.state.local_bypassed: 1 + stats.flow_bypassed.local_pkts: 6 + stats.detect.alert: 1 + stats.firewall.accepted: 4 + stats.firewall.blocked: 0 diff --git a/tests/firewall/ruletype-firewall-151-bypass-keyword-accept-flow-td-pkt-drop-rule/README.md b/tests/firewall/ruletype-firewall-151-bypass-keyword-accept-flow-td-pkt-drop-rule/README.md new file mode 100644 index 0000000000..cb345749a2 --- /dev/null +++ b/tests/firewall/ruletype-firewall-151-bypass-keyword-accept-flow-td-pkt-drop-rule/README.md @@ -0,0 +1,36 @@ +Expectation +----------- + +Test that `bypass` on a firewall `accept:flow` rule is terminal, especially when +the competing TD rule is a *packet* rule. + +Firewall rule sid:103 accepts and bypasses the flow at the +`http1:request_headers` hook. The threat detection rule sid:100003 would match +against the same packet and could drop it, but shouldn't, just as it would happen +with the firewall in a separate device. The IPS rules cannot act on an unseen +packet. + +Difference from ruletype-firewall-150 +------------------------------------- + +Test 150 uses an `http` TD rule, which lands in the *app* detect table and is +inspected inside `DetectRunTx`, after the firewall rule on the same transaction. +The bypass therefore suppresses it and 150 passes. + +This test uses `tcp-pkt`, forcing the TD rule into the *packet* detect +table. This explores the scenario with Packet rules, which are inspected in `DetectRulePacketRules`, which runs before +`DetectRunTx`. We're then checking that a TD alert that would be queued before +the firewall rule matched and the bypass applied won't affect the firewall's bypass. + +sid:100001 would alert on the HTTP response body if the flow were still being +inspected, and must not alert: the flow left inspection at the request headers. + +Pcap +---- + +Reused from the `flowbit-oring` test. + +Ticket +------ + +Related to https://redmine.openinfosecfoundation.org/issues/8459. diff --git a/tests/firewall/ruletype-firewall-151-bypass-keyword-accept-flow-td-pkt-drop-rule/firewall.rules b/tests/firewall/ruletype-firewall-151-bypass-keyword-accept-flow-td-pkt-drop-rule/firewall.rules new file mode 100644 index 0000000000..c913fb7dcc --- /dev/null +++ b/tests/firewall/ruletype-firewall-151-bypass-keyword-accept-flow-td-pkt-drop-rule/firewall.rules @@ -0,0 +1,23 @@ +# Packet rules + +accept:hook tcp:all any any -> any any (sid:100;) + +# default drop + +# App-layer rules + +accept:hook http1:request_started any any -> any any (sid:101;) +accept:hook http1:request_line any any -> any any (sid:102;) + +accept:flow,alert http1:request_headers any any -> any any (msg:"Firewall accept flow with bypass for testmyids"; http.host; content:"www.testmyids.com"; bypass; sid:103;) + +accept:hook http1:request_body any any -> any any (sid:104;) +accept:hook http1:request_trailer any any -> any any (sid:105;) +accept:hook http1:request_complete any any -> any any (sid:106;) + +accept:hook http1:response_started any any -> any any (sid:201;) +accept:hook http1:response_line any any -> any any (sid:202;) +accept:hook http1:response_headers any any -> any any (sid:203;) +accept:hook http1:response_body any any -> any any (sid:204;) +accept:hook http1:response_trailer any any -> any any (sid:205;) +accept:hook http1:response_complete any any -> any any (sid:206;) diff --git a/tests/firewall/ruletype-firewall-151-bypass-keyword-accept-flow-td-pkt-drop-rule/suricata.yaml b/tests/firewall/ruletype-firewall-151-bypass-keyword-accept-flow-td-pkt-drop-rule/suricata.yaml new file mode 100644 index 0000000000..398a898e23 --- /dev/null +++ b/tests/firewall/ruletype-firewall-151-bypass-keyword-accept-flow-td-pkt-drop-rule/suricata.yaml @@ -0,0 +1,22 @@ +%YAML 1.1 +--- + +stats: + enabled: yes + interval: 8 + +outputs: + - eve-log: + enabled: yes + filetype: regular + filename: eve.json + types: + - stats + - alert: + verdict: true + - drop: + alerts: yes + flows: all + verdict: true + - flow + - http diff --git a/tests/firewall/ruletype-firewall-151-bypass-keyword-accept-flow-td-pkt-drop-rule/td.rules b/tests/firewall/ruletype-firewall-151-bypass-keyword-accept-flow-td-pkt-drop-rule/td.rules new file mode 100644 index 0000000000..e79e92b46c --- /dev/null +++ b/tests/firewall/ruletype-firewall-151-bypass-keyword-accept-flow-td-pkt-drop-rule/td.rules @@ -0,0 +1,9 @@ +# Packet-scope threat detection drop on the very packet that firewall sid:103 +# accepts and bypasses. `tcp-pkt` forces this into the packet detect table, so +# unlike the app-layer TD rule in test 150 it is evaluated before the firewall +# rule is reached in the alert queue. +drop:packet tcp-pkt any any -> any any (msg:"TD packet drop on raw HTTP host"; flow:to_server,established; content:"www.testmyids.com"; sid:100003;) + +# Would alert on the response body if the flow were still being inspected. +# Must not alert: the flow was bypassed at the request headers. +alert http any any -> any any (msg:"Response body inspected after bypass"; flow:to_client,established; http.response_body; content:"uid=0|28|root|29|"; sid:100001;) diff --git a/tests/firewall/ruletype-firewall-151-bypass-keyword-accept-flow-td-pkt-drop-rule/test.yaml b/tests/firewall/ruletype-firewall-151-bypass-keyword-accept-flow-td-pkt-drop-rule/test.yaml new file mode 100644 index 0000000000..e680664b86 --- /dev/null +++ b/tests/firewall/ruletype-firewall-151-bypass-keyword-accept-flow-td-pkt-drop-rule/test.yaml @@ -0,0 +1,61 @@ +requires: + min-version: 9 + +pcap: ../../flowbit-oring/input.pcap + +args: + - --simulate-ips + - -k none + +checks: +# The firewall rule must and its bypass be applied, so the rule and its accept must be visible. +- filter: + count: 1 + match: + event_type: alert + alert.signature_id: 103 + pcap_cnt: 4 + alert.action: allowed + verdict.action: accept + +# Threat detection must not be consulted for the bypassed packet. +- filter: + count: 0 + match: + event_type: alert + alert.signature_id: 100003 + +# The rest of the flow is not inspected after the bypass. +- filter: + count: 0 + match: + event_type: alert + alert.signature_id: 100001 + +# No alert may carry a blocking verdict. +- filter: + count: 0 + match: + event_type: drop + +# If these fail, the test is not reproducing the intended corner case +- filter: + count: 1 + match: + event_type: flow + flow.state: bypassed + flow.bypass: local + flow.action: accept + flow.pkts_toserver: 6 + flow.pkts_toclient: 4 + +- filter: + count: 1 + match: + event_type: stats + stats.ips.blocked: 0 + stats.ips.accepted: 3 + stats.ips.drop_reason.rules: 0 + stats.firewall.accepted: 4 + stats.flow.end.state.local_bypassed: 1 + stats.flow_bypassed.local_pkts: 6 diff --git a/tests/firewall/ruletype-firewall-154-fw-rule-suppress-still-alerts/README.md b/tests/firewall/ruletype-firewall-154-fw-rule-suppress-still-alerts/README.md new file mode 100644 index 0000000000..05abb83320 --- /dev/null +++ b/tests/firewall/ruletype-firewall-154-fw-rule-suppress-still-alerts/README.md @@ -0,0 +1,9 @@ +Test that a `suppress` entry covering a firewall rule withholds its alert, and +that the rule's accept still takes effect. A scoped suppress means "suppressed, +but still apply the actions", so the alert must go and the accept must stay. + +Twin threat detection rules (100001 suppressed, 100002 not) confirm the suppress +config loaded, so a firewall alert appearing cannot be mistaken for an unread +config file. + +Pcap: `flowbit-oring/input.pcap`, HTTP request to www.testmyids.com. diff --git a/tests/firewall/ruletype-firewall-154-fw-rule-suppress-still-alerts/firewall.rules b/tests/firewall/ruletype-firewall-154-fw-rule-suppress-still-alerts/firewall.rules new file mode 100644 index 0000000000..9f2b9226e2 --- /dev/null +++ b/tests/firewall/ruletype-firewall-154-fw-rule-suppress-still-alerts/firewall.rules @@ -0,0 +1,28 @@ +# Packet rules + +accept:hook tcp:all any any -> any any (sid:100;) + +# default drop + +# App-layer rules + +accept:hook http1:request_started any any -> any any (sid:101;) +accept:hook http1:request_line any any -> any any (sid:102;) + +# Rule under test. A `suppress` entry in threshold.config covers this sid, so +# the alert must be withheld. A scoped suppress returns "suppressed, but still +# apply the rule's actions", so the accept itself must still take effect -- +# which is what separates this from the thresholded-accept cases. +accept:flow,alert http1:request_headers any any -> any any (msg:"FW accept flow, alert suppressed"; http.host; content:"www.testmyids.com"; sid:103;) + +accept:hook http1:request_body any any -> any any (sid:104;) +accept:hook http1:request_trailer any any -> any any (sid:105;) +accept:hook http1:request_complete any any -> any any (sid:106;) + +# Response side accepted so the test does not depend on the default app policy. +accept:hook http1:response_started any any -> any any (sid:201;) +accept:hook http1:response_line any any -> any any (sid:202;) +accept:hook http1:response_headers any any -> any any (sid:203;) +accept:hook http1:response_body any any -> any any (sid:204;) +accept:hook http1:response_trailer any any -> any any (sid:205;) +accept:hook http1:response_complete any any -> any any (sid:206;) diff --git a/tests/firewall/ruletype-firewall-154-fw-rule-suppress-still-alerts/td.rules b/tests/firewall/ruletype-firewall-154-fw-rule-suppress-still-alerts/td.rules new file mode 100644 index 0000000000..c2d5c6ce2c --- /dev/null +++ b/tests/firewall/ruletype-firewall-154-fw-rule-suppress-still-alerts/td.rules @@ -0,0 +1,6 @@ +# Twin rules, identical apart from the sid: 100001 is covered by a suppress +# entry, 100002 is not. If 100002 alerts and 100001 does not, the suppress +# config loaded and works on the threat detection path -- without that, a +# firewall alert appearing could equally mean the config was never read. +alert http any any -> any any (msg:"TD suppressed"; flow:to_server,established; http.host; content:"www.testmyids.com"; sid:100001;) +alert http any any -> any any (msg:"TD control, not suppressed"; flow:to_server,established; http.host; content:"www.testmyids.com"; sid:100002;) diff --git a/tests/firewall/ruletype-firewall-154-fw-rule-suppress-still-alerts/test.yaml b/tests/firewall/ruletype-firewall-154-fw-rule-suppress-still-alerts/test.yaml new file mode 100644 index 0000000000..fe1f887608 --- /dev/null +++ b/tests/firewall/ruletype-firewall-154-fw-rule-suppress-still-alerts/test.yaml @@ -0,0 +1,50 @@ +requires: + min-version: 9 + +pcap: ../../flowbit-oring/input.pcap + +args: + - --simulate-ips + - -k none + - --set threshold-file=threshold.config + +checks: +# Control: the rules do match this traffic. +- filter: + count: 1 + match: + event_type: alert + alert.signature_id: 100002 + +# Control: the suppress config loaded, and suppress works on the threat +# detection path. +- filter: + count: 0 + match: + event_type: alert + alert.signature_id: 100001 + +# The point: the same suppress must withhold the firewall rule's alert too. +- filter: + count: 0 + match: + event_type: alert + alert.signature_id: 103 + +# A scoped suppress still applies the rule's actions, so the accept stands. +- filter: + count: 1 + match: + event_type: flow + flow.action: accept + +- filter: + count: 1 + match: + event_type: stats + stats.firewall.blocked: 0 + stats.firewall.drop_reason.default_packet_policy: 0 + stats.firewall.drop_reason.default_app_policy: 0 + stats.firewall.drop_reason.flow_drop: 0 + stats.ips.blocked: 0 + stats.detect.alerts_suppressed: 2 diff --git a/tests/firewall/ruletype-firewall-154-fw-rule-suppress-still-alerts/threshold.config b/tests/firewall/ruletype-firewall-154-fw-rule-suppress-still-alerts/threshold.config new file mode 100644 index 0000000000..1ff07f5686 --- /dev/null +++ b/tests/firewall/ruletype-firewall-154-fw-rule-suppress-still-alerts/threshold.config @@ -0,0 +1,7 @@ +# track and ip are both required to reach the runtime suppress path. A bare +# `suppress gen_id 1, sig_id N` parses as track by_rule and is applied at setup +# time instead, which would not exercise this at all. +# 10.16.1.11 is the client in flowbit-oring/input.pcap; both rules match +# to_server, so by_src covers them. +suppress gen_id 1, sig_id 103, track by_src, ip 10.16.1.11 +suppress gen_id 1, sig_id 100001, track by_src, ip 10.16.1.11