tests: firewall default policy tests

diff --git a/tests/firewall/ruletype-firewall-68-config-default-policy-tls/firewall.rules b/tests/firewall/ruletype-firewall-68-config-default-policy-tls/firewall.rules
new file mode 100644 (file)
index 0000000..2fd6a30
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-68-config-default-policy-tls/firewall.rules
@@ -0,0 +1,18 @@
+# allow session setup
+accept:hook tcp:all $HOME_NET any <> $EXTERNAL_NET any (flow:not_established; sid:1021;)
+accept:hook tcp:all $HOME_NET any <> $EXTERNAL_NET 443 (flow:established; sid:1022;)
+
+drop:flow tls:client_hello_done $HOME_NET any -> $EXTERNAL_NET any (tls.version:1.0; msg:"TLS 1.0 not allowed"; sid:102;)
+accept:hook tls:client_hello_done $HOME_NET any -> $EXTERNAL_NET any (tls.sni; content:"www.google.com"; sid:103;)
+
+accept:hook tls:server_in_progress $EXTERNAL_NET any -> $HOME_NET any (sid:107;)
+accept:hook tls:server_hello $EXTERNAL_NET any -> $HOME_NET any (sid:109;)
+drop:flow tls:server_hello_done $EXTERNAL_NET any -> $HOME_NET any (tls.version:1.0; msg:"TLS 1.0 not allowed"; sid:108;)
+drop:flow tls:server_cert_done $EXTERNAL_NET any -> $HOME_NET any (tls.cert_chain_len:>2; sid:110; msg:"TLS certs chain length check"; alert;)
+accept:hook tls:server_hello_done $EXTERNAL_NET any -> $HOME_NET any (sid:111;)
+accept:hook tls:server_cert_done $EXTERNAL_NET any -> $HOME_NET any (sid:112;)
+accept:hook tls:server_handshake_done $EXTERNAL_NET any -> $HOME_NET any (sid:113;)
+accept:hook tls:server_finished $EXTERNAL_NET any -> $HOME_NET any (sid:114;)
+
+
+# Implicit drop all else

diff --git a/tests/firewall/ruletype-firewall-68-config-default-policy-tls/suricata.yaml b/tests/firewall/ruletype-firewall-68-config-default-policy-tls/suricata.yaml
new file mode 100644 (file)
index 0000000..266c41a
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-68-config-default-policy-tls/suricata.yaml
@@ -0,0 +1,46 @@
+%YAML 1.1
+---
+
+vars:
+  # more specific is better for alert accuracy and performance
+  address-groups:
+    HOME_NET: "[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]"
+
+    EXTERNAL_NET: "!$HOME_NET"
+
+
+# Global stats configuration
+stats:
+  enabled: yes
+  interval: 8
+
+# Configure the type of alert (and other) logging you would like.
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
+      filename: eve.json
+      types:
+          - stats
+          - flow
+          - alert:
+              verdict: yes
+          - tls:
+              extended: yes     # enable this for extended logging information
+          - drop:
+              alerts: yes      # log alerts that caused drops
+              flows: all       # start or all: 'start' logs only a single drop
+
+firewall:
+  policies:
+    tls:
+      client-in-progress:
+        - "accept:hook"
+      client-hello-done:
+        - "drop:flow"
+      client-cert-done:
+        - "accept:hook"
+      client-handshake-done:
+        - "accept:hook"
+      client-finished:
+        - "accept:hook"

diff --git a/tests/firewall/ruletype-firewall-68-config-default-policy-tls/test.yaml b/tests/firewall/ruletype-firewall-68-config-default-policy-tls/test.yaml
new file mode 100644 (file)
index 0000000..60a11b1
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-68-config-default-policy-tls/test.yaml
@@ -0,0 +1,37 @@
+requires:
+  min-version: 9
+
+pcap: ../../tls/tls-client-hello-frag-01/dump_mtu300.pcap
+
+args:
+  - --simulate-ips
+  - -k none
+
+checks:
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 110
+- filter:
+    count: 42
+    match:
+      event_type: drop
+      drop.reason: "flow drop"
+- filter:
+    count: 1
+    match:
+      event_type: flow
+      app_proto: tls
+      flow.action: drop
+- filter:
+    count: 1
+    match:
+      event_type: stats
+      stats.app_layer.flow.tls: 1
+      stats.flow.total: 1
+      stats.ips.accepted: 19
+      stats.ips.blocked: 43
+      stats.ips.drop_reason.flow_drop: 42
+      stats.ips.drop_reason.rules: 1
+      stats.decoder.pkts: 62

diff --git a/tests/firewall/ruletype-firewall-69-config-default-policy-tls-accept/firewall.rules b/tests/firewall/ruletype-firewall-69-config-default-policy-tls-accept/firewall.rules
new file mode 100644 (file)
index 0000000..3d25636
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-69-config-default-policy-tls-accept/firewall.rules
@@ -0,0 +1,16 @@
+# allow session setup
+accept:hook tcp:all $HOME_NET any <> $EXTERNAL_NET any (flow:not_established; sid:1021;)
+accept:hook tcp:all $HOME_NET any <> $EXTERNAL_NET 443 (flow:established; sid:1022;)
+
+drop:flow tls:client_hello_done $HOME_NET any -> $EXTERNAL_NET any (tls.version:1.0; msg:"TLS 1.0 not allowed"; sid:102;)
+
+accept:hook tls:server_in_progress $EXTERNAL_NET any -> $HOME_NET any (sid:107;)
+accept:hook tls:server_hello $EXTERNAL_NET any -> $HOME_NET any (sid:109;)
+drop:flow tls:server_hello_done $EXTERNAL_NET any -> $HOME_NET any (tls.version:1.0; msg:"TLS 1.0 not allowed"; sid:108;)
+drop:flow tls:server_cert_done $EXTERNAL_NET any -> $HOME_NET any (tls.cert_chain_len:>2; sid:110; msg:"TLS certs chain length check"; alert;)
+accept:hook tls:server_hello_done $EXTERNAL_NET any -> $HOME_NET any (sid:111;)
+accept:hook tls:server_cert_done $EXTERNAL_NET any -> $HOME_NET any (sid:112;)
+accept:hook tls:server_handshake_done $EXTERNAL_NET any -> $HOME_NET any (sid:113;)
+accept:hook tls:server_finished $EXTERNAL_NET any -> $HOME_NET any (sid:114;)
+
+# Implicit drop all else

diff --git a/tests/firewall/ruletype-firewall-69-config-default-policy-tls-accept/suricata.yaml b/tests/firewall/ruletype-firewall-69-config-default-policy-tls-accept/suricata.yaml
new file mode 100644 (file)
index 0000000..07b7c34
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-69-config-default-policy-tls-accept/suricata.yaml
@@ -0,0 +1,46 @@
+%YAML 1.1
+---
+
+vars:
+  # more specific is better for alert accuracy and performance
+  address-groups:
+    HOME_NET: "[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]"
+
+    EXTERNAL_NET: "!$HOME_NET"
+
+
+# Global stats configuration
+stats:
+  enabled: yes
+  interval: 8
+
+# Configure the type of alert (and other) logging you would like.
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
+      filename: eve.json
+      types:
+          - stats
+          - flow
+          - alert:
+              verdict: yes
+          - tls:
+              extended: yes     # enable this for extended logging information
+          - drop:
+              alerts: yes      # log alerts that caused drops
+              flows: all       # start or all: 'start' logs only a single drop
+
+firewall:
+  policies:
+    tls:
+      client-in-progress:
+        - "accept:hook"
+      client-hello-done:
+        - "accept:hook"
+      client-cert-done:
+        - "accept:hook"
+      client-handshake-done:
+        - "accept:hook"
+      client-finished:
+        - "accept:hook"

diff --git a/tests/firewall/ruletype-firewall-69-config-default-policy-tls-accept/test.yaml b/tests/firewall/ruletype-firewall-69-config-default-policy-tls-accept/test.yaml
new file mode 100644 (file)
index 0000000..60a11b1
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-69-config-default-policy-tls-accept/test.yaml
@@ -0,0 +1,37 @@
+requires:
+  min-version: 9
+
+pcap: ../../tls/tls-client-hello-frag-01/dump_mtu300.pcap
+
+args:
+  - --simulate-ips
+  - -k none
+
+checks:
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 110
+- filter:
+    count: 42
+    match:
+      event_type: drop
+      drop.reason: "flow drop"
+- filter:
+    count: 1
+    match:
+      event_type: flow
+      app_proto: tls
+      flow.action: drop
+- filter:
+    count: 1
+    match:
+      event_type: stats
+      stats.app_layer.flow.tls: 1
+      stats.flow.total: 1
+      stats.ips.accepted: 19
+      stats.ips.blocked: 43
+      stats.ips.drop_reason.flow_drop: 42
+      stats.ips.drop_reason.rules: 1
+      stats.decoder.pkts: 62

diff --git a/tests/firewall/ruletype-firewall-70-config-default-policy-http/firewall.rules b/tests/firewall/ruletype-firewall-70-config-default-policy-http/firewall.rules
new file mode 100644 (file)
index 0000000..c46fad0
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-70-config-default-policy-http/firewall.rules
@@ -0,0 +1,19 @@
+# Packet rules
+
+accept:hook tcp:all any any -> any any (sid:100;)
+# default drop
+
+
+accept:hook http1:request_started any any -> any any (alert; sid:101;)
+# default accept:hook for http1:request_line
+accept:hook http1:request_headers any any -> any any (alert; sid:103;)
+# default accept:hook for http1:request_body
+# default accept:hook for http1:request_trailer
+accept:hook http1:request_complete any any -> any any (alert; sid:106;)
+
+accept:hook http1:response_started any any -> any any (alert; sid:201;)
+accept:hook http1:response_line any any -> any any (alert; sid:202;)
+accept:hook http1:response_headers any any -> any any (alert; sid:203;)
+accept:hook http1:response_body any any -> any any (alert; sid:204;)
+accept:hook http1:response_trailer any any -> any any (alert; sid:205;)
+accept:hook http1:response_complete any any -> any any (alert; sid:206;)

diff --git a/tests/firewall/ruletype-firewall-70-config-default-policy-http/suricata.yaml b/tests/firewall/ruletype-firewall-70-config-default-policy-http/suricata.yaml
new file mode 100644 (file)
index 0000000..7a677ed
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-70-config-default-policy-http/suricata.yaml
@@ -0,0 +1,73 @@
+%YAML 1.1
+---
+
+vars:
+  # more specific is better for alert accuracy and performance
+  address-groups:
+    HOME_NET: "[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]"
+    #HOME_NET: "[192.168.0.0/16]"
+    #HOME_NET: "[10.0.0.0/8]"
+    #HOME_NET: "[172.16.0.0/12]"
+    #HOME_NET: "any"
+
+    EXTERNAL_NET: "!$HOME_NET"
+    #EXTERNAL_NET: "any"
+
+    HTTP_SERVERS: "$HOME_NET"
+    SMTP_SERVERS: "$HOME_NET"
+    SQL_SERVERS: "$HOME_NET"
+    DNS_SERVERS: "$HOME_NET"
+    TELNET_SERVERS: "$HOME_NET"
+    AIM_SERVERS: "$EXTERNAL_NET"
+    DC_SERVERS: "$HOME_NET"
+    DNP3_SERVER: "$HOME_NET"
+    DNP3_CLIENT: "$HOME_NET"
+    MODBUS_CLIENT: "$HOME_NET"
+    MODBUS_SERVER: "$HOME_NET"
+    ENIP_CLIENT: "$HOME_NET"
+    ENIP_SERVER: "$HOME_NET"
+
+  port-groups:
+    HTTP_PORTS: "80"
+    SHELLCODE_PORTS: "!80"
+    ORACLE_PORTS: 1521
+    SSH_PORTS: 22
+    DNP3_PORTS: 20000
+    MODBUS_PORTS: 502
+    FILE_DATA_PORTS: "[$HTTP_PORTS,110,143]"
+    FTP_PORTS: 21
+    GENEVE_PORTS: 6081
+    VXLAN_PORTS: 4789
+    TEREDO_PORTS: 3544
+    SIP_PORTS: "[5060, 5061]"
+
+# Global stats configuration
+stats:
+  enabled: yes
+  interval: 8
+
+# Configure the type of alert (and other) logging you would like.
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
+      filename: eve.json
+      types:
+        - stats
+        - flow
+        - alert
+        - tls:
+            extended: yes     # enable this for extended logging information
+        - drop:
+            alerts: yes      # log alerts that caused drops
+            flows: all       # start or all: 'start' logs only a single drop
+
+firewall:
+  policies:
+    http:
+      request-line:
+        - "accept:hook"
+      request-body:
+        - "accept:hook"
+      request-trailers:
+        - "accept:hook"

diff --git a/tests/firewall/ruletype-firewall-70-config-default-policy-http/test.yaml b/tests/firewall/ruletype-firewall-70-config-default-policy-http/test.yaml
new file mode 100644 (file)
index 0000000..e220709
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-70-config-default-policy-http/test.yaml
@@ -0,0 +1,80 @@
+requires:
+  min-version: 9
+
+pcap: ../../flowbit-oring/input.pcap
+
+args:
+  - --simulate-ips
+  - -k none
+
+checks:
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 100
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 101
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 103
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 106
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 201
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 202
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 203
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 204
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 205
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 206
+- filter:
+    count: 0
+    match:
+      event_type: drop
+- filter:
+    count: 1
+    match:
+      event_type: flow
+      flow.pkts_toserver: 6
+      flow.pkts_toclient: 4
+      flow.state: "closed"
+      flow.alerted: true
+- filter:
+    count: 1
+    match:
+      event_type: stats
+      stats.ips.accepted: 10
+      stats.ips.blocked: 0
+      stats.ips.drop_reason.default_app_policy: 0
+      stats.ips.drop_reason.flow_drop: 0

diff --git a/tests/firewall/ruletype-firewall-71-reject-app-default-policy/firewall.rules b/tests/firewall/ruletype-firewall-71-reject-app-default-policy/firewall.rules
new file mode 100644 (file)
index 0000000..9789044
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-71-reject-app-default-policy/firewall.rules
@@ -0,0 +1,18 @@
+# Packet rules
+
+# allow session setup
+accept:hook tcp:all $HOME_NET any <> $EXTERNAL_NET 443 (flow:not_established; alert; sid:1021;)
+# allow rest of the flow to 
+accept:hook tcp:all $HOME_NET any <> $EXTERNAL_NET 443 (flow:established; alert; sid:1023;)
+
+# default drop
+
+
+# App-layer rules
+
+# accept sni to bing, not matching so call default reject policy
+accept:hook tls:client_hello_done $HOME_NET any -> $EXTERNAL_NET any (tls.sni; content:"bing"; sid:104; alert;)
+# allow tls before client hello is done.
+accept:hook tls:client_in_progress $HOME_NET any -> $EXTERNAL_NET any (alert; sid:105;)
+
+# default drop

diff --git a/tests/firewall/ruletype-firewall-71-reject-app-default-policy/suricata.yaml b/tests/firewall/ruletype-firewall-71-reject-app-default-policy/suricata.yaml
new file mode 100644 (file)
index 0000000..95bb631
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-71-reject-app-default-policy/suricata.yaml
@@ -0,0 +1,71 @@
+%YAML 1.1
+---
+
+vars:
+  # more specific is better for alert accuracy and performance
+  address-groups:
+    HOME_NET: "[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]"
+    #HOME_NET: "[192.168.0.0/16]"
+    #HOME_NET: "[10.0.0.0/8]"
+    #HOME_NET: "[172.16.0.0/12]"
+    #HOME_NET: "any"
+
+    EXTERNAL_NET: "!$HOME_NET"
+    #EXTERNAL_NET: "any"
+
+    HTTP_SERVERS: "$HOME_NET"
+    SMTP_SERVERS: "$HOME_NET"
+    SQL_SERVERS: "$HOME_NET"
+    DNS_SERVERS: "$HOME_NET"
+    TELNET_SERVERS: "$HOME_NET"
+    AIM_SERVERS: "$EXTERNAL_NET"
+    DC_SERVERS: "$HOME_NET"
+    DNP3_SERVER: "$HOME_NET"
+    DNP3_CLIENT: "$HOME_NET"
+    MODBUS_CLIENT: "$HOME_NET"
+    MODBUS_SERVER: "$HOME_NET"
+    ENIP_CLIENT: "$HOME_NET"
+    ENIP_SERVER: "$HOME_NET"
+
+  port-groups:
+    HTTP_PORTS: "80"
+    SHELLCODE_PORTS: "!80"
+    ORACLE_PORTS: 1521
+    SSH_PORTS: 22
+    DNP3_PORTS: 20000
+    MODBUS_PORTS: 502
+    FILE_DATA_PORTS: "[$HTTP_PORTS,110,143]"
+    FTP_PORTS: 21
+    GENEVE_PORTS: 6081
+    VXLAN_PORTS: 4789
+    TEREDO_PORTS: 3544
+    SIP_PORTS: "[5060, 5061]"
+
+# Global stats configuration
+stats:
+  enabled: yes
+  interval: 8
+
+# Configure the type of alert (and other) logging you would like.
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
+      filename: eve.json
+      types:
+        - stats
+        - flow
+        - alert:
+            verdict: true
+        - tls:
+            extended: yes     # enable this for extended logging information
+        - drop:
+            alerts: yes      # log alerts that caused drops
+            flows: all       # start or all: 'start' logs only a single drop
+            verdict: true
+
+firewall:
+  policies:
+    tls:
+      client-hello-done:
+        - "reject:flow"

diff --git a/tests/firewall/ruletype-firewall-71-reject-app-default-policy/test.yaml b/tests/firewall/ruletype-firewall-71-reject-app-default-policy/test.yaml
new file mode 100644 (file)
index 0000000..ad657a4
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-71-reject-app-default-policy/test.yaml
@@ -0,0 +1,86 @@
+requires:
+  min-version: 9
+  features:
+    - LIBNET1.1
+
+pcap: ../../tls/tls-client-hello-frag-01/dump_mtu300.pcap
+
+args:
+  - --simulate-ips
+  - -k none
+
+checks:
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 1023
+      alert.action: allowed
+      pcap_cnt: 6
+      verdict.action: drop
+- filter:
+    count: 2
+    match:
+      event_type: alert
+      pcap_cnt: 6
+      verdict.action: drop
+- filter:
+    count: 3
+    match:
+      event_type: alert
+      alert.signature_id: 1021
+      verdict.action: accept
+- filter:
+    count: 3
+    match:
+      event_type: alert
+      alert.signature_id: 1023
+# packet rule accepted, also accepted at app layer
+- filter:
+    count: 2
+    match:
+      event_type: alert
+      alert.signature_id: 1023
+      verdict.action: accept
+# packet rule accepted, dropped at app layer
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 1023
+      verdict.action: drop
+# count all records with verdict field
+- filter:
+    count: 6
+    match:
+      verdict.action: accept
+# count all records with verdict field
+- filter:
+    count: 59
+    match:
+      verdict.action: drop
+- filter:
+    count: 3
+    match:
+      verdict.action: drop
+      verdict.reject_target: to_client
+      verdict.reject[0]: tcp-reset
+- filter:
+    count: 1
+    match:
+      event_type: flow
+      flow.pkts_toserver: 32
+      flow.pkts_toclient: 30
+      flow.state: "established"
+      flow.alerted: true
+      flow.action: drop
+- filter:
+    count: 1
+    match:
+      event_type: stats
+      stats.ips.accepted: 5
+      stats.ips.rejected: 1
+      stats.ips.blocked: 56
+      stats.ips.drop_reason.default_app_policy: 1
+      stats.ips.drop_reason.rules: 0
+      stats.ips.drop_reason.flow_drop: 56

diff --git a/tests/firewall/ruletype-firewall-72-config-default-policy-http/firewall.rules b/tests/firewall/ruletype-firewall-72-config-default-policy-http/firewall.rules
new file mode 100644 (file)
index 0000000..3f44c18
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-72-config-default-policy-http/firewall.rules
@@ -0,0 +1,19 @@
+# Packet rules
+
+accept:hook tcp:all any any -> any any (sid:100;)
+# default drop
+
+
+#accept:hook http1:request_started any any -> any any (alert; sid:101;)
+accept:hook http1:request_line any any -> any any (alert; sid:102;)
+accept:hook http1:request_headers any any -> any any (alert; sid:103;)
+accept:hook http1:request_body any any -> any any (alert; sid:104;)
+#accept:hook http1:request_trailers any any -> any any (alert; sid:105;)
+#accept:hook http1:request_complete any any -> any any (alert; sid:106;)
+
+accept:hook http1:response_started any any -> any any (alert; sid:201;)
+accept:hook http1:response_line any any -> any any (alert; sid:202;)
+accept:hook http1:response_headers any any -> any any (alert; sid:203;)
+accept:hook http1:response_body any any -> any any (alert; sid:204;)
+accept:hook http1:response_trailer any any -> any any (alert; sid:205;)
+accept:hook http1:response_complete any any -> any any (alert; sid:206;)

diff --git a/tests/firewall/ruletype-firewall-72-config-default-policy-http/suricata.yaml b/tests/firewall/ruletype-firewall-72-config-default-policy-http/suricata.yaml
new file mode 100644 (file)
index 0000000..f9ae185
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-72-config-default-policy-http/suricata.yaml
@@ -0,0 +1,73 @@
+%YAML 1.1
+---
+
+vars:
+  # more specific is better for alert accuracy and performance
+  address-groups:
+    HOME_NET: "[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]"
+    #HOME_NET: "[192.168.0.0/16]"
+    #HOME_NET: "[10.0.0.0/8]"
+    #HOME_NET: "[172.16.0.0/12]"
+    #HOME_NET: "any"
+
+    EXTERNAL_NET: "!$HOME_NET"
+    #EXTERNAL_NET: "any"
+
+    HTTP_SERVERS: "$HOME_NET"
+    SMTP_SERVERS: "$HOME_NET"
+    SQL_SERVERS: "$HOME_NET"
+    DNS_SERVERS: "$HOME_NET"
+    TELNET_SERVERS: "$HOME_NET"
+    AIM_SERVERS: "$EXTERNAL_NET"
+    DC_SERVERS: "$HOME_NET"
+    DNP3_SERVER: "$HOME_NET"
+    DNP3_CLIENT: "$HOME_NET"
+    MODBUS_CLIENT: "$HOME_NET"
+    MODBUS_SERVER: "$HOME_NET"
+    ENIP_CLIENT: "$HOME_NET"
+    ENIP_SERVER: "$HOME_NET"
+
+  port-groups:
+    HTTP_PORTS: "80"
+    SHELLCODE_PORTS: "!80"
+    ORACLE_PORTS: 1521
+    SSH_PORTS: 22
+    DNP3_PORTS: 20000
+    MODBUS_PORTS: 502
+    FILE_DATA_PORTS: "[$HTTP_PORTS,110,143]"
+    FTP_PORTS: 21
+    GENEVE_PORTS: 6081
+    VXLAN_PORTS: 4789
+    TEREDO_PORTS: 3544
+    SIP_PORTS: "[5060, 5061]"
+
+# Global stats configuration
+stats:
+  enabled: yes
+  interval: 8
+
+# Configure the type of alert (and other) logging you would like.
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
+      filename: eve.json
+      types:
+        - stats
+        - flow
+        - alert
+        - tls:
+            extended: yes     # enable this for extended logging information
+        - drop:
+            alerts: yes      # log alerts that caused drops
+            flows: all       # start or all: 'start' logs only a single drop
+
+firewall:
+  policies:
+    http:
+      request-started:
+        - "accept:hook"
+      request-trailer:
+        - "accept:hook"
+      request-complete:
+        - "accept:hook"

diff --git a/tests/firewall/ruletype-firewall-72-config-default-policy-http/test.yaml b/tests/firewall/ruletype-firewall-72-config-default-policy-http/test.yaml
new file mode 100644 (file)
index 0000000..ceaa694
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-72-config-default-policy-http/test.yaml
@@ -0,0 +1,95 @@
+requires:
+  min-version: 9
+
+pcap: ../../flowbit-oring/input.pcap
+
+args:
+  - --simulate-ips
+  - -k none
+
+checks:
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 100
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 101
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 102
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 103
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 104
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 105
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 106
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 201
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 202
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 203
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 204
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 205
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 206
+- filter:
+    count: 0
+    match:
+      event_type: drop
+- filter:
+    count: 1
+    match:
+      event_type: flow
+      flow.pkts_toserver: 6
+      flow.pkts_toclient: 4
+      flow.state: "closed"
+      flow.alerted: true
+- filter:
+    count: 1
+    match:
+      event_type: stats
+      stats.ips.accepted: 10
+      stats.ips.blocked: 0
+      stats.ips.drop_reason.default_app_policy: 0
+      stats.ips.drop_reason.flow_drop: 0

diff --git a/tests/firewall/ruletype-firewall-73-config-default-policy-http/firewall.rules b/tests/firewall/ruletype-firewall-73-config-default-policy-http/firewall.rules
new file mode 100644 (file)
index 0000000..276e683
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-73-config-default-policy-http/firewall.rules
@@ -0,0 +1,19 @@
+# Packet rules
+
+accept:hook tcp:all any any -> any any (sid:100;)
+# default drop
+
+
+#accept:hook http1:request_started any any -> any any (alert; sid:101;)
+#accept:hook http1:request_line any any -> any any (alert; sid:102;)
+#accept:hook http1:request_headers any any -> any any (alert; sid:103;)
+#accept:hook http1:request_body any any -> any any (alert; sid:104;)
+#accept:hook http1:request_trailers any any -> any any (alert; sid:105;)
+accept:hook http1:request_complete any any -> any any (alert; sid:106;)
+
+accept:hook http1:response_started any any -> any any (alert; sid:201;)
+accept:hook http1:response_line any any -> any any (alert; sid:202;)
+accept:hook http1:response_headers any any -> any any (alert; sid:203;)
+accept:hook http1:response_body any any -> any any (alert; sid:204;)
+accept:hook http1:response_trailer any any -> any any (alert; sid:205;)
+accept:hook http1:response_complete any any -> any any (alert; sid:206;)

diff --git a/tests/firewall/ruletype-firewall-73-config-default-policy-http/suricata.yaml b/tests/firewall/ruletype-firewall-73-config-default-policy-http/suricata.yaml
new file mode 100644 (file)
index 0000000..ece373c
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-73-config-default-policy-http/suricata.yaml
@@ -0,0 +1,77 @@
+%YAML 1.1
+---
+
+vars:
+  # more specific is better for alert accuracy and performance
+  address-groups:
+    HOME_NET: "[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]"
+    #HOME_NET: "[192.168.0.0/16]"
+    #HOME_NET: "[10.0.0.0/8]"
+    #HOME_NET: "[172.16.0.0/12]"
+    #HOME_NET: "any"
+
+    EXTERNAL_NET: "!$HOME_NET"
+    #EXTERNAL_NET: "any"
+
+    HTTP_SERVERS: "$HOME_NET"
+    SMTP_SERVERS: "$HOME_NET"
+    SQL_SERVERS: "$HOME_NET"
+    DNS_SERVERS: "$HOME_NET"
+    TELNET_SERVERS: "$HOME_NET"
+    AIM_SERVERS: "$EXTERNAL_NET"
+    DC_SERVERS: "$HOME_NET"
+    DNP3_SERVER: "$HOME_NET"
+    DNP3_CLIENT: "$HOME_NET"
+    MODBUS_CLIENT: "$HOME_NET"
+    MODBUS_SERVER: "$HOME_NET"
+    ENIP_CLIENT: "$HOME_NET"
+    ENIP_SERVER: "$HOME_NET"
+
+  port-groups:
+    HTTP_PORTS: "80"
+    SHELLCODE_PORTS: "!80"
+    ORACLE_PORTS: 1521
+    SSH_PORTS: 22
+    DNP3_PORTS: 20000
+    MODBUS_PORTS: 502
+    FILE_DATA_PORTS: "[$HTTP_PORTS,110,143]"
+    FTP_PORTS: 21
+    GENEVE_PORTS: 6081
+    VXLAN_PORTS: 4789
+    TEREDO_PORTS: 3544
+    SIP_PORTS: "[5060, 5061]"
+
+# Global stats configuration
+stats:
+  enabled: yes
+  interval: 8
+
+# Configure the type of alert (and other) logging you would like.
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
+      filename: eve.json
+      types:
+        - stats
+        - flow
+        - alert
+        - tls:
+            extended: yes     # enable this for extended logging information
+        - drop:
+            alerts: yes      # log alerts that caused drops
+            flows: all       # start or all: 'start' logs only a single drop
+
+firewall:
+  policies:
+    http:
+      request-started:
+        - "accept:hook"
+      request-line:
+        - "accept:hook"
+      request-headers:
+        - "accept:hook"
+      request-body:
+        - "accept:hook"
+      request-trailer:
+        - "accept:hook"

diff --git a/tests/firewall/ruletype-firewall-73-config-default-policy-http/test.yaml b/tests/firewall/ruletype-firewall-73-config-default-policy-http/test.yaml
new file mode 100644 (file)
index 0000000..58ab467
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-73-config-default-policy-http/test.yaml
@@ -0,0 +1,95 @@
+requires:
+  min-version: 9
+
+pcap: ../../flowbit-oring/input.pcap
+
+args:
+  - --simulate-ips
+  - -k none
+
+checks:
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 100
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 101
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 102
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 103
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 104
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 105
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 106
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 201
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 202
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 203
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 204
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 205
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 206
+- filter:
+    count: 0
+    match:
+      event_type: drop
+- filter:
+    count: 1
+    match:
+      event_type: flow
+      flow.pkts_toserver: 6
+      flow.pkts_toclient: 4
+      flow.state: "closed"
+      flow.alerted: true
+- filter:
+    count: 1
+    match:
+      event_type: stats
+      stats.ips.accepted: 10
+      stats.ips.blocked: 0
+      stats.ips.drop_reason.default_app_policy: 0
+      stats.ips.drop_reason.flow_drop: 0

diff --git a/tests/firewall/ruletype-firewall-74-config-default-policy-dns/firewall.rules b/tests/firewall/ruletype-firewall-74-config-default-policy-dns/firewall.rules
new file mode 100644 (file)
index 0000000..fb940ed
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-74-config-default-policy-dns/firewall.rules
@@ -0,0 +1,10 @@
+# Packet rules
+
+accept:hook udp:all any any -> any any (sid:100;)
+# default drop
+
+# dns:request_started uses default policy
+accept:hook dns:request_complete any any -> any any (dns.query; content:"dropbox"; alert; sid:102;)
+
+accept:hook dns:response_started any any -> any any (alert; sid:201;)
+accept:hook dns:response_complete any any -> any any (dns.response.rrname; content:"dropbox"; alert; sid:202;)

diff --git a/tests/firewall/ruletype-firewall-74-config-default-policy-dns/suricata.yaml b/tests/firewall/ruletype-firewall-74-config-default-policy-dns/suricata.yaml
new file mode 100644 (file)
index 0000000..42eb54c
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-74-config-default-policy-dns/suricata.yaml
@@ -0,0 +1,75 @@
+%YAML 1.1
+---
+
+vars:
+  # more specific is better for alert accuracy and performance
+  address-groups:
+    HOME_NET: "[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]"
+    #HOME_NET: "[192.168.0.0/16]"
+    #HOME_NET: "[10.0.0.0/8]"
+    #HOME_NET: "[172.16.0.0/12]"
+    #HOME_NET: "any"
+
+    EXTERNAL_NET: "!$HOME_NET"
+    #EXTERNAL_NET: "any"
+
+    HTTP_SERVERS: "$HOME_NET"
+    SMTP_SERVERS: "$HOME_NET"
+    SQL_SERVERS: "$HOME_NET"
+    DNS_SERVERS: "$HOME_NET"
+    TELNET_SERVERS: "$HOME_NET"
+    AIM_SERVERS: "$EXTERNAL_NET"
+    DC_SERVERS: "$HOME_NET"
+    DNP3_SERVER: "$HOME_NET"
+    DNP3_CLIENT: "$HOME_NET"
+    MODBUS_CLIENT: "$HOME_NET"
+    MODBUS_SERVER: "$HOME_NET"
+    ENIP_CLIENT: "$HOME_NET"
+    ENIP_SERVER: "$HOME_NET"
+
+  port-groups:
+    HTTP_PORTS: "80"
+    SHELLCODE_PORTS: "!80"
+    ORACLE_PORTS: 1521
+    SSH_PORTS: 22
+    DNP3_PORTS: 20000
+    MODBUS_PORTS: 502
+    FILE_DATA_PORTS: "[$HTTP_PORTS,110,143]"
+    FTP_PORTS: 21
+    GENEVE_PORTS: 6081
+    VXLAN_PORTS: 4789
+    TEREDO_PORTS: 3544
+    SIP_PORTS: "[5060, 5061]"
+
+# Global stats configuration
+stats:
+  enabled: yes
+  interval: 8
+
+# Configure the type of alert (and other) logging you would like.
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
+      filename: eve.json
+      types:
+        - stats
+        - flow
+        - alert
+        - tls:
+            extended: yes     # enable this for extended logging information
+        - drop:
+            alerts: yes      # log alerts that caused drops
+            flows: all       # start or all: 'start' logs only a single drop
+
+firewall:
+  policies:
+    dns:
+      request-started:
+        - "accept:hook"
+      request-complete:
+        - "drop:flow"
+      response-started:
+        - "accept:hook"
+      response-complete:
+        - "drop:flow"

diff --git a/tests/firewall/ruletype-firewall-74-config-default-policy-dns/test.yaml b/tests/firewall/ruletype-firewall-74-config-default-policy-dns/test.yaml
new file mode 100644 (file)
index 0000000..5986c40
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-74-config-default-policy-dns/test.yaml
@@ -0,0 +1,63 @@
+requires:
+  min-version: 9
+
+pcap: ../../dns/dns-eve/input.pcap
+
+args:
+  - --simulate-ips
+  - -k none
+
+checks:
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 100
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 101
+- filter:
+    count: 3
+    match:
+      event_type: alert
+      alert.signature_id: 102
+- filter:
+    count: 3
+    match:
+      event_type: alert
+      alert.signature_id: 201
+- filter:
+    count: 3
+    match:
+      event_type: alert
+      alert.signature_id: 202
+- filter:
+    count: 2
+    match:
+      event_type: drop
+- filter:
+    count: 3
+    match:
+      event_type: flow
+      flow.pkts_toserver: 1
+      flow.pkts_toclient: 1
+      flow.alerted: true
+      not-has-key: flow.action
+- filter:
+    count: 1
+    match:
+      event_type: flow
+      flow.pkts_toserver: 1
+      flow.pkts_toclient: 1
+      flow.alerted: false
+      flow.action: drop
+- filter:
+    count: 1
+    match:
+      event_type: stats
+      stats.ips.accepted: 6
+      stats.ips.blocked: 2
+      stats.ips.drop_reason.default_app_policy: 1
+      stats.ips.drop_reason.flow_drop: 1

diff --git a/tests/firewall/ruletype-firewall-75-config-default-policy-http-accept-tx/firewall.rules b/tests/firewall/ruletype-firewall-75-config-default-policy-http-accept-tx/firewall.rules
new file mode 100644 (file)
index 0000000..276e683
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-75-config-default-policy-http-accept-tx/firewall.rules
@@ -0,0 +1,19 @@
+# Packet rules
+
+accept:hook tcp:all any any -> any any (sid:100;)
+# default drop
+
+
+#accept:hook http1:request_started any any -> any any (alert; sid:101;)
+#accept:hook http1:request_line any any -> any any (alert; sid:102;)
+#accept:hook http1:request_headers any any -> any any (alert; sid:103;)
+#accept:hook http1:request_body any any -> any any (alert; sid:104;)
+#accept:hook http1:request_trailers any any -> any any (alert; sid:105;)
+accept:hook http1:request_complete any any -> any any (alert; sid:106;)
+
+accept:hook http1:response_started any any -> any any (alert; sid:201;)
+accept:hook http1:response_line any any -> any any (alert; sid:202;)
+accept:hook http1:response_headers any any -> any any (alert; sid:203;)
+accept:hook http1:response_body any any -> any any (alert; sid:204;)
+accept:hook http1:response_trailer any any -> any any (alert; sid:205;)
+accept:hook http1:response_complete any any -> any any (alert; sid:206;)

diff --git a/tests/firewall/ruletype-firewall-75-config-default-policy-http-accept-tx/suricata.yaml b/tests/firewall/ruletype-firewall-75-config-default-policy-http-accept-tx/suricata.yaml
new file mode 100644 (file)
index 0000000..fae680c
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-75-config-default-policy-http-accept-tx/suricata.yaml
@@ -0,0 +1,69 @@
+%YAML 1.1
+---
+
+vars:
+  # more specific is better for alert accuracy and performance
+  address-groups:
+    HOME_NET: "[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]"
+    #HOME_NET: "[192.168.0.0/16]"
+    #HOME_NET: "[10.0.0.0/8]"
+    #HOME_NET: "[172.16.0.0/12]"
+    #HOME_NET: "any"
+
+    EXTERNAL_NET: "!$HOME_NET"
+    #EXTERNAL_NET: "any"
+
+    HTTP_SERVERS: "$HOME_NET"
+    SMTP_SERVERS: "$HOME_NET"
+    SQL_SERVERS: "$HOME_NET"
+    DNS_SERVERS: "$HOME_NET"
+    TELNET_SERVERS: "$HOME_NET"
+    AIM_SERVERS: "$EXTERNAL_NET"
+    DC_SERVERS: "$HOME_NET"
+    DNP3_SERVER: "$HOME_NET"
+    DNP3_CLIENT: "$HOME_NET"
+    MODBUS_CLIENT: "$HOME_NET"
+    MODBUS_SERVER: "$HOME_NET"
+    ENIP_CLIENT: "$HOME_NET"
+    ENIP_SERVER: "$HOME_NET"
+
+  port-groups:
+    HTTP_PORTS: "80"
+    SHELLCODE_PORTS: "!80"
+    ORACLE_PORTS: 1521
+    SSH_PORTS: 22
+    DNP3_PORTS: 20000
+    MODBUS_PORTS: 502
+    FILE_DATA_PORTS: "[$HTTP_PORTS,110,143]"
+    FTP_PORTS: 21
+    GENEVE_PORTS: 6081
+    VXLAN_PORTS: 4789
+    TEREDO_PORTS: 3544
+    SIP_PORTS: "[5060, 5061]"
+
+# Global stats configuration
+stats:
+  enabled: yes
+  interval: 8
+
+# Configure the type of alert (and other) logging you would like.
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
+      filename: eve.json
+      types:
+        - stats
+        - flow
+        - alert
+        - tls:
+            extended: yes     # enable this for extended logging information
+        - drop:
+            alerts: yes      # log alerts that caused drops
+            flows: all       # start or all: 'start' logs only a single drop
+
+firewall:
+  policies:
+    http:
+      request-started:
+        - "accept:tx"

diff --git a/tests/firewall/ruletype-firewall-75-config-default-policy-http-accept-tx/test.yaml b/tests/firewall/ruletype-firewall-75-config-default-policy-http-accept-tx/test.yaml
new file mode 100644 (file)
index 0000000..d0fc8ca
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-75-config-default-policy-http-accept-tx/test.yaml
@@ -0,0 +1,96 @@
+requires:
+  min-version: 9
+
+pcap: ../../flowbit-oring/input.pcap
+
+args:
+  - --simulate-ips
+  - -k none
+
+checks:
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 100
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 101
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 102
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 103
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 104
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 105
+# no match due to accept:tx policy
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 106
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 201
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 202
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 203
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 204
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 205
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 206
+- filter:
+    count: 0
+    match:
+      event_type: drop
+- filter:
+    count: 1
+    match:
+      event_type: flow
+      flow.pkts_toserver: 6
+      flow.pkts_toclient: 4
+      flow.state: "closed"
+      flow.alerted: false
+- filter:
+    count: 1
+    match:
+      event_type: stats
+      stats.ips.accepted: 10
+      stats.ips.blocked: 0
+      stats.ips.drop_reason.default_app_policy: 0
+      stats.ips.drop_reason.flow_drop: 0

diff --git a/tests/firewall/ruletype-firewall-76-config-default-policy-http-accept-tx-td/firewall.rules b/tests/firewall/ruletype-firewall-76-config-default-policy-http-accept-tx-td/firewall.rules
new file mode 100644 (file)
index 0000000..276e683
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-76-config-default-policy-http-accept-tx-td/firewall.rules
@@ -0,0 +1,19 @@
+# Packet rules
+
+accept:hook tcp:all any any -> any any (sid:100;)
+# default drop
+
+
+#accept:hook http1:request_started any any -> any any (alert; sid:101;)
+#accept:hook http1:request_line any any -> any any (alert; sid:102;)
+#accept:hook http1:request_headers any any -> any any (alert; sid:103;)
+#accept:hook http1:request_body any any -> any any (alert; sid:104;)
+#accept:hook http1:request_trailers any any -> any any (alert; sid:105;)
+accept:hook http1:request_complete any any -> any any (alert; sid:106;)
+
+accept:hook http1:response_started any any -> any any (alert; sid:201;)
+accept:hook http1:response_line any any -> any any (alert; sid:202;)
+accept:hook http1:response_headers any any -> any any (alert; sid:203;)
+accept:hook http1:response_body any any -> any any (alert; sid:204;)
+accept:hook http1:response_trailer any any -> any any (alert; sid:205;)
+accept:hook http1:response_complete any any -> any any (alert; sid:206;)

diff --git a/tests/firewall/ruletype-firewall-76-config-default-policy-http-accept-tx-td/suricata.yaml b/tests/firewall/ruletype-firewall-76-config-default-policy-http-accept-tx-td/suricata.yaml
new file mode 100644 (file)
index 0000000..fae680c
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-76-config-default-policy-http-accept-tx-td/suricata.yaml
@@ -0,0 +1,69 @@
+%YAML 1.1
+---
+
+vars:
+  # more specific is better for alert accuracy and performance
+  address-groups:
+    HOME_NET: "[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]"
+    #HOME_NET: "[192.168.0.0/16]"
+    #HOME_NET: "[10.0.0.0/8]"
+    #HOME_NET: "[172.16.0.0/12]"
+    #HOME_NET: "any"
+
+    EXTERNAL_NET: "!$HOME_NET"
+    #EXTERNAL_NET: "any"
+
+    HTTP_SERVERS: "$HOME_NET"
+    SMTP_SERVERS: "$HOME_NET"
+    SQL_SERVERS: "$HOME_NET"
+    DNS_SERVERS: "$HOME_NET"
+    TELNET_SERVERS: "$HOME_NET"
+    AIM_SERVERS: "$EXTERNAL_NET"
+    DC_SERVERS: "$HOME_NET"
+    DNP3_SERVER: "$HOME_NET"
+    DNP3_CLIENT: "$HOME_NET"
+    MODBUS_CLIENT: "$HOME_NET"
+    MODBUS_SERVER: "$HOME_NET"
+    ENIP_CLIENT: "$HOME_NET"
+    ENIP_SERVER: "$HOME_NET"
+
+  port-groups:
+    HTTP_PORTS: "80"
+    SHELLCODE_PORTS: "!80"
+    ORACLE_PORTS: 1521
+    SSH_PORTS: 22
+    DNP3_PORTS: 20000
+    MODBUS_PORTS: 502
+    FILE_DATA_PORTS: "[$HTTP_PORTS,110,143]"
+    FTP_PORTS: 21
+    GENEVE_PORTS: 6081
+    VXLAN_PORTS: 4789
+    TEREDO_PORTS: 3544
+    SIP_PORTS: "[5060, 5061]"
+
+# Global stats configuration
+stats:
+  enabled: yes
+  interval: 8
+
+# Configure the type of alert (and other) logging you would like.
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
+      filename: eve.json
+      types:
+        - stats
+        - flow
+        - alert
+        - tls:
+            extended: yes     # enable this for extended logging information
+        - drop:
+            alerts: yes      # log alerts that caused drops
+            flows: all       # start or all: 'start' logs only a single drop
+
+firewall:
+  policies:
+    http:
+      request-started:
+        - "accept:tx"

diff --git a/tests/firewall/ruletype-firewall-76-config-default-policy-http-accept-tx-td/td.rules b/tests/firewall/ruletype-firewall-76-config-default-policy-http-accept-tx-td/td.rules
new file mode 100644 (file)
index 0000000..218746e
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-76-config-default-policy-http-accept-tx-td/td.rules
@@ -0,0 +1,2 @@
+alert http any any -> any any (http.host; content:"testmyids"; sid:5000;)
+alert http any any -> any any (msg:"GPL ATTACK_RESPONSE id check returned root"; http.response_body; content:"uid=0|28|root|29|"; sid:2100498; rev:7;)

diff --git a/tests/firewall/ruletype-firewall-76-config-default-policy-http-accept-tx-td/test.yaml b/tests/firewall/ruletype-firewall-76-config-default-policy-http-accept-tx-td/test.yaml
new file mode 100644 (file)
index 0000000..ea4ab42
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-76-config-default-policy-http-accept-tx-td/test.yaml
@@ -0,0 +1,106 @@
+requires:
+  min-version: 9
+
+pcap: ../../flowbit-oring/input.pcap
+
+args:
+  - --simulate-ips
+  - -k none
+
+checks:
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 100
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 101
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 102
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 103
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 104
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 105
+# no match due to accept:tx policy
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 106
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 201
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 202
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 203
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 204
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 205
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 206
+- filter:
+    count: 0
+    match:
+      event_type: drop
+- filter:
+    count: 1
+    match:
+      event_type: flow
+      flow.pkts_toserver: 6
+      flow.pkts_toclient: 4
+      flow.state: "closed"
+      flow.alerted: true
+- filter:
+    count: 1
+    match:
+      event_type: stats
+      stats.ips.accepted: 10
+      stats.ips.blocked: 0
+      stats.ips.drop_reason.default_app_policy: 0
+      stats.ips.drop_reason.flow_drop: 0
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 5000
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 2100498

diff --git a/tests/firewall/ruletype-firewall-77-ruleset-default-packet-policy/firewall.rules b/tests/firewall/ruletype-firewall-77-ruleset-default-packet-policy/firewall.rules
new file mode 100644 (file)
index 0000000..52c1b11
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-77-ruleset-default-packet-policy/firewall.rules
@@ -0,0 +1,10 @@
+# Packet rules
+
+# accept outgoing ping and the returning pongs
+accept:flow icmp:flow_start $HOME_NET any -> $HOME_NET any (itype:8; msg:"Ping!"; alert; sid:1011;)
+# allow session setup
+accept:packet tcp:all $HOME_NET any <> $EXTERNAL_NET 443 (flow:not_established; alert; sid:1021;)
+# some exception test
+accept:flow tcp:all $HOME_NET any <> 1.2.3.4 443 (flow:established; alert; sid:1022;)
+
+# default drop

diff --git a/tests/firewall/ruletype-firewall-77-ruleset-default-packet-policy/suricata.yaml b/tests/firewall/ruletype-firewall-77-ruleset-default-packet-policy/suricata.yaml
new file mode 100644 (file)
index 0000000..9e83402
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-77-ruleset-default-packet-policy/suricata.yaml
@@ -0,0 +1,68 @@
+%YAML 1.1
+---
+
+vars:
+  # more specific is better for alert accuracy and performance
+  address-groups:
+    HOME_NET: "[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]"
+    #HOME_NET: "[192.168.0.0/16]"
+    #HOME_NET: "[10.0.0.0/8]"
+    #HOME_NET: "[172.16.0.0/12]"
+    #HOME_NET: "any"
+
+    EXTERNAL_NET: "!$HOME_NET"
+    #EXTERNAL_NET: "any"
+
+    HTTP_SERVERS: "$HOME_NET"
+    SMTP_SERVERS: "$HOME_NET"
+    SQL_SERVERS: "$HOME_NET"
+    DNS_SERVERS: "$HOME_NET"
+    TELNET_SERVERS: "$HOME_NET"
+    AIM_SERVERS: "$EXTERNAL_NET"
+    DC_SERVERS: "$HOME_NET"
+    DNP3_SERVER: "$HOME_NET"
+    DNP3_CLIENT: "$HOME_NET"
+    MODBUS_CLIENT: "$HOME_NET"
+    MODBUS_SERVER: "$HOME_NET"
+    ENIP_CLIENT: "$HOME_NET"
+    ENIP_SERVER: "$HOME_NET"
+
+  port-groups:
+    HTTP_PORTS: "80"
+    SHELLCODE_PORTS: "!80"
+    ORACLE_PORTS: 1521
+    SSH_PORTS: 22
+    DNP3_PORTS: 20000
+    MODBUS_PORTS: 502
+    FILE_DATA_PORTS: "[$HTTP_PORTS,110,143]"
+    FTP_PORTS: 21
+    GENEVE_PORTS: 6081
+    VXLAN_PORTS: 4789
+    TEREDO_PORTS: 3544
+    SIP_PORTS: "[5060, 5061]"
+
+# Global stats configuration
+stats:
+  enabled: yes
+  interval: 8
+
+# Configure the type of alert (and other) logging you would like.
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
+      filename: eve.json
+      types:
+        - stats
+        - flow
+        - alert
+        - tls:
+            extended: yes     # enable this for extended logging information
+        - drop:
+            alerts: yes      # log alerts that caused drops
+            flows: all       # start or all: 'start' logs only a single drop
+
+
+firewall:
+  policies:
+    packet-filter: [ "reject:packet" ]

diff --git a/tests/firewall/ruletype-firewall-77-ruleset-default-packet-policy/test.yaml b/tests/firewall/ruletype-firewall-77-ruleset-default-packet-policy/test.yaml
new file mode 100644 (file)
index 0000000..76a2549
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-77-ruleset-default-packet-policy/test.yaml
@@ -0,0 +1,47 @@
+requires:
+  min-version: 9
+  features:
+    - LIBNET1.1
+
+pcap: ../../tls/tls-client-hello-frag-01/dump_mtu300.pcap
+
+args:
+  - --simulate-ips
+  - -k none
+
+checks:
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 1011
+- filter:
+    count: 3
+    match:
+      event_type: alert
+      alert.signature_id: 1021
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 1022
+- filter:
+    count: 59
+    match:
+      event_type: drop
+- filter:
+    count: 1
+    match:
+      event_type: flow
+      flow.pkts_toserver: 32
+      flow.pkts_toclient: 30
+      flow.state: "closed" # TODO due to no drop being applied to the flow, we only drop after stream/app-layer
+      flow.alerted: true
+      not-has-key: flow.action
+- filter:
+    count: 1
+    match:
+      event_type: stats
+      stats.ips.accepted: 3
+      stats.ips.rejected: 59
+      stats.ips.drop_reason.default_packet_policy: 59

diff --git a/tests/firewall/ruletype-firewall-78-ruleset-default-packet-policy-accept/firewall.rules b/tests/firewall/ruletype-firewall-78-ruleset-default-packet-policy-accept/firewall.rules
new file mode 100644 (file)
index 0000000..58cca31
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-78-ruleset-default-packet-policy-accept/firewall.rules
@@ -0,0 +1,3 @@
+# Packet rules
+
+# default policy: accept:packet

diff --git a/tests/firewall/ruletype-firewall-78-ruleset-default-packet-policy-accept/suricata.yaml b/tests/firewall/ruletype-firewall-78-ruleset-default-packet-policy-accept/suricata.yaml
new file mode 100644 (file)
index 0000000..b29bbda
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-78-ruleset-default-packet-policy-accept/suricata.yaml
@@ -0,0 +1,68 @@
+%YAML 1.1
+---
+
+vars:
+  # more specific is better for alert accuracy and performance
+  address-groups:
+    HOME_NET: "[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]"
+    #HOME_NET: "[192.168.0.0/16]"
+    #HOME_NET: "[10.0.0.0/8]"
+    #HOME_NET: "[172.16.0.0/12]"
+    #HOME_NET: "any"
+
+    EXTERNAL_NET: "!$HOME_NET"
+    #EXTERNAL_NET: "any"
+
+    HTTP_SERVERS: "$HOME_NET"
+    SMTP_SERVERS: "$HOME_NET"
+    SQL_SERVERS: "$HOME_NET"
+    DNS_SERVERS: "$HOME_NET"
+    TELNET_SERVERS: "$HOME_NET"
+    AIM_SERVERS: "$EXTERNAL_NET"
+    DC_SERVERS: "$HOME_NET"
+    DNP3_SERVER: "$HOME_NET"
+    DNP3_CLIENT: "$HOME_NET"
+    MODBUS_CLIENT: "$HOME_NET"
+    MODBUS_SERVER: "$HOME_NET"
+    ENIP_CLIENT: "$HOME_NET"
+    ENIP_SERVER: "$HOME_NET"
+
+  port-groups:
+    HTTP_PORTS: "80"
+    SHELLCODE_PORTS: "!80"
+    ORACLE_PORTS: 1521
+    SSH_PORTS: 22
+    DNP3_PORTS: 20000
+    MODBUS_PORTS: 502
+    FILE_DATA_PORTS: "[$HTTP_PORTS,110,143]"
+    FTP_PORTS: 21
+    GENEVE_PORTS: 6081
+    VXLAN_PORTS: 4789
+    TEREDO_PORTS: 3544
+    SIP_PORTS: "[5060, 5061]"
+
+# Global stats configuration
+stats:
+  enabled: yes
+  interval: 8
+
+# Configure the type of alert (and other) logging you would like.
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
+      filename: eve.json
+      types:
+        - stats
+        - flow
+        - alert
+        - tls:
+            extended: yes     # enable this for extended logging information
+        - drop:
+            alerts: yes      # log alerts that caused drops
+            flows: all       # start or all: 'start' logs only a single drop
+
+
+firewall:
+  policies:
+    packet-filter: [ "accept:packet" ]

diff --git a/tests/firewall/ruletype-firewall-78-ruleset-default-packet-policy-accept/test.yaml b/tests/firewall/ruletype-firewall-78-ruleset-default-packet-policy-accept/test.yaml
new file mode 100644 (file)
index 0000000..53a5247
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-78-ruleset-default-packet-policy-accept/test.yaml
@@ -0,0 +1,31 @@
+requires:
+  min-version: 9
+
+pcap: ../../tls/tls-client-hello-frag-01/dump_mtu300.pcap
+
+args:
+  - --simulate-ips
+  - -k none
+
+checks:
+- filter:
+    count: 0
+    match:
+      event_type: drop
+- filter:
+    count: 1
+    match:
+      event_type: flow
+      flow.pkts_toserver: 32
+      flow.pkts_toclient: 30
+      flow.state: "closed"
+      flow.alerted: false
+      not-has-key: flow.action
+- filter:
+    count: 1
+    match:
+      event_type: stats
+      stats.ips.accepted: 62
+      stats.ips.blocked: 0
+      stats.ips.rejected: 0
+      stats.ips.drop_reason.default_packet_policy: 0

diff --git a/tests/firewall/ruletype-firewall-79-ruleset-default-packet-policy-accept-hook/firewall.rules b/tests/firewall/ruletype-firewall-79-ruleset-default-packet-policy-accept-hook/firewall.rules
new file mode 100644 (file)
index 0000000..deed294
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-79-ruleset-default-packet-policy-accept-hook/firewall.rules
@@ -0,0 +1,8 @@
+# Packet rules
+
+# should not match
+accept:hook tcp:all any any -> any any (flags:RF; sid:1;)
+
+# default packet policy: accept:hook
+
+# no app rules, so drop ?

diff --git a/tests/firewall/ruletype-firewall-79-ruleset-default-packet-policy-accept-hook/suricata.yaml b/tests/firewall/ruletype-firewall-79-ruleset-default-packet-policy-accept-hook/suricata.yaml
new file mode 100644 (file)
index 0000000..acb5423
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-79-ruleset-default-packet-policy-accept-hook/suricata.yaml
@@ -0,0 +1,68 @@
+%YAML 1.1
+---
+
+vars:
+  # more specific is better for alert accuracy and performance
+  address-groups:
+    HOME_NET: "[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]"
+    #HOME_NET: "[192.168.0.0/16]"
+    #HOME_NET: "[10.0.0.0/8]"
+    #HOME_NET: "[172.16.0.0/12]"
+    #HOME_NET: "any"
+
+    EXTERNAL_NET: "!$HOME_NET"
+    #EXTERNAL_NET: "any"
+
+    HTTP_SERVERS: "$HOME_NET"
+    SMTP_SERVERS: "$HOME_NET"
+    SQL_SERVERS: "$HOME_NET"
+    DNS_SERVERS: "$HOME_NET"
+    TELNET_SERVERS: "$HOME_NET"
+    AIM_SERVERS: "$EXTERNAL_NET"
+    DC_SERVERS: "$HOME_NET"
+    DNP3_SERVER: "$HOME_NET"
+    DNP3_CLIENT: "$HOME_NET"
+    MODBUS_CLIENT: "$HOME_NET"
+    MODBUS_SERVER: "$HOME_NET"
+    ENIP_CLIENT: "$HOME_NET"
+    ENIP_SERVER: "$HOME_NET"
+
+  port-groups:
+    HTTP_PORTS: "80"
+    SHELLCODE_PORTS: "!80"
+    ORACLE_PORTS: 1521
+    SSH_PORTS: 22
+    DNP3_PORTS: 20000
+    MODBUS_PORTS: 502
+    FILE_DATA_PORTS: "[$HTTP_PORTS,110,143]"
+    FTP_PORTS: 21
+    GENEVE_PORTS: 6081
+    VXLAN_PORTS: 4789
+    TEREDO_PORTS: 3544
+    SIP_PORTS: "[5060, 5061]"
+
+# Global stats configuration
+stats:
+  enabled: yes
+  interval: 8
+
+# Configure the type of alert (and other) logging you would like.
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
+      filename: eve.json
+      types:
+        - stats
+        - flow
+        - alert
+        - tls:
+            extended: yes     # enable this for extended logging information
+        - drop:
+            alerts: yes      # log alerts that caused drops
+            flows: all       # start or all: 'start' logs only a single drop
+
+
+firewall:
+  policies:
+    packet-filter: [ "accept:hook" ]

diff --git a/tests/firewall/ruletype-firewall-79-ruleset-default-packet-policy-accept-hook/test.yaml b/tests/firewall/ruletype-firewall-79-ruleset-default-packet-policy-accept-hook/test.yaml
new file mode 100644 (file)
index 0000000..75ebe71
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-79-ruleset-default-packet-policy-accept-hook/test.yaml
@@ -0,0 +1,33 @@
+requires:
+  min-version: 9
+
+pcap: ../../tls/tls-client-hello-frag-01/dump_mtu300.pcap
+
+args:
+  - --simulate-ips
+  - -k none
+
+checks:
+- filter:
+    count: 59
+    match:
+      event_type: drop
+- filter:
+    count: 1
+    match:
+      event_type: flow
+      flow.pkts_toserver: 32
+      flow.pkts_toclient: 30
+      flow.state: "established"
+      flow.alerted: false
+      flow.action: drop
+- filter:
+    count: 1
+    match:
+      event_type: stats
+      stats.ips.accepted: 3
+      stats.ips.blocked: 59
+      stats.ips.rejected: 0
+      stats.ips.drop_reason.default_packet_policy: 0
+      stats.ips.drop_reason.default_app_policy: 1
+      stats.ips.drop_reason.flow_drop: 58

diff --git a/tests/firewall/ruletype-firewall-80-ruleset-default-packet-policy-accept-hook-no-rules/firewall.rules b/tests/firewall/ruletype-firewall-80-ruleset-default-packet-policy-accept-hook-no-rules/firewall.rules
new file mode 100644 (file)
index 0000000..f01bba7
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-80-ruleset-default-packet-policy-accept-hook-no-rules/firewall.rules
@@ -0,0 +1,5 @@
+# Packet rules
+
+# default packet policy: accept:hook
+
+# no app rules, so drop

diff --git a/tests/firewall/ruletype-firewall-80-ruleset-default-packet-policy-accept-hook-no-rules/suricata.yaml b/tests/firewall/ruletype-firewall-80-ruleset-default-packet-policy-accept-hook-no-rules/suricata.yaml
new file mode 100644 (file)
index 0000000..acb5423
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-80-ruleset-default-packet-policy-accept-hook-no-rules/suricata.yaml
@@ -0,0 +1,68 @@
+%YAML 1.1
+---
+
+vars:
+  # more specific is better for alert accuracy and performance
+  address-groups:
+    HOME_NET: "[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]"
+    #HOME_NET: "[192.168.0.0/16]"
+    #HOME_NET: "[10.0.0.0/8]"
+    #HOME_NET: "[172.16.0.0/12]"
+    #HOME_NET: "any"
+
+    EXTERNAL_NET: "!$HOME_NET"
+    #EXTERNAL_NET: "any"
+
+    HTTP_SERVERS: "$HOME_NET"
+    SMTP_SERVERS: "$HOME_NET"
+    SQL_SERVERS: "$HOME_NET"
+    DNS_SERVERS: "$HOME_NET"
+    TELNET_SERVERS: "$HOME_NET"
+    AIM_SERVERS: "$EXTERNAL_NET"
+    DC_SERVERS: "$HOME_NET"
+    DNP3_SERVER: "$HOME_NET"
+    DNP3_CLIENT: "$HOME_NET"
+    MODBUS_CLIENT: "$HOME_NET"
+    MODBUS_SERVER: "$HOME_NET"
+    ENIP_CLIENT: "$HOME_NET"
+    ENIP_SERVER: "$HOME_NET"
+
+  port-groups:
+    HTTP_PORTS: "80"
+    SHELLCODE_PORTS: "!80"
+    ORACLE_PORTS: 1521
+    SSH_PORTS: 22
+    DNP3_PORTS: 20000
+    MODBUS_PORTS: 502
+    FILE_DATA_PORTS: "[$HTTP_PORTS,110,143]"
+    FTP_PORTS: 21
+    GENEVE_PORTS: 6081
+    VXLAN_PORTS: 4789
+    TEREDO_PORTS: 3544
+    SIP_PORTS: "[5060, 5061]"
+
+# Global stats configuration
+stats:
+  enabled: yes
+  interval: 8
+
+# Configure the type of alert (and other) logging you would like.
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
+      filename: eve.json
+      types:
+        - stats
+        - flow
+        - alert
+        - tls:
+            extended: yes     # enable this for extended logging information
+        - drop:
+            alerts: yes      # log alerts that caused drops
+            flows: all       # start or all: 'start' logs only a single drop
+
+
+firewall:
+  policies:
+    packet-filter: [ "accept:hook" ]

diff --git a/tests/firewall/ruletype-firewall-80-ruleset-default-packet-policy-accept-hook-no-rules/test.yaml b/tests/firewall/ruletype-firewall-80-ruleset-default-packet-policy-accept-hook-no-rules/test.yaml
new file mode 100644 (file)
index 0000000..75ebe71
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-80-ruleset-default-packet-policy-accept-hook-no-rules/test.yaml
@@ -0,0 +1,33 @@
+requires:
+  min-version: 9
+
+pcap: ../../tls/tls-client-hello-frag-01/dump_mtu300.pcap
+
+args:
+  - --simulate-ips
+  - -k none
+
+checks:
+- filter:
+    count: 59
+    match:
+      event_type: drop
+- filter:
+    count: 1
+    match:
+      event_type: flow
+      flow.pkts_toserver: 32
+      flow.pkts_toclient: 30
+      flow.state: "established"
+      flow.alerted: false
+      flow.action: drop
+- filter:
+    count: 1
+    match:
+      event_type: stats
+      stats.ips.accepted: 3
+      stats.ips.blocked: 59
+      stats.ips.rejected: 0
+      stats.ips.drop_reason.default_packet_policy: 0
+      stats.ips.drop_reason.default_app_policy: 1
+      stats.ips.drop_reason.flow_drop: 58

diff --git a/tests/firewall/ruletype-firewall-81-ruleset-default-packet-policy-accept-hook-all/firewall.rules b/tests/firewall/ruletype-firewall-81-ruleset-default-packet-policy-accept-hook-all/firewall.rules
new file mode 100644 (file)
index 0000000..f01bba7
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-81-ruleset-default-packet-policy-accept-hook-all/firewall.rules
@@ -0,0 +1,5 @@
+# Packet rules
+
+# default packet policy: accept:hook
+
+# no app rules, so drop

diff --git a/tests/firewall/ruletype-firewall-81-ruleset-default-packet-policy-accept-hook-all/suricata.yaml b/tests/firewall/ruletype-firewall-81-ruleset-default-packet-policy-accept-hook-all/suricata.yaml
new file mode 100644 (file)
index 0000000..74b0e8b
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-81-ruleset-default-packet-policy-accept-hook-all/suricata.yaml
@@ -0,0 +1,80 @@
+%YAML 1.1
+---
+
+vars:
+  # more specific is better for alert accuracy and performance
+  address-groups:
+    HOME_NET: "[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]"
+    #HOME_NET: "[192.168.0.0/16]"
+    #HOME_NET: "[10.0.0.0/8]"
+    #HOME_NET: "[172.16.0.0/12]"
+    #HOME_NET: "any"
+
+    EXTERNAL_NET: "!$HOME_NET"
+    #EXTERNAL_NET: "any"
+
+    HTTP_SERVERS: "$HOME_NET"
+    SMTP_SERVERS: "$HOME_NET"
+    SQL_SERVERS: "$HOME_NET"
+    DNS_SERVERS: "$HOME_NET"
+    TELNET_SERVERS: "$HOME_NET"
+    AIM_SERVERS: "$EXTERNAL_NET"
+    DC_SERVERS: "$HOME_NET"
+    DNP3_SERVER: "$HOME_NET"
+    DNP3_CLIENT: "$HOME_NET"
+    MODBUS_CLIENT: "$HOME_NET"
+    MODBUS_SERVER: "$HOME_NET"
+    ENIP_CLIENT: "$HOME_NET"
+    ENIP_SERVER: "$HOME_NET"
+
+  port-groups:
+    HTTP_PORTS: "80"
+    SHELLCODE_PORTS: "!80"
+    ORACLE_PORTS: 1521
+    SSH_PORTS: 22
+    DNP3_PORTS: 20000
+    MODBUS_PORTS: 502
+    FILE_DATA_PORTS: "[$HTTP_PORTS,110,143]"
+    FTP_PORTS: 21
+    GENEVE_PORTS: 6081
+    VXLAN_PORTS: 4789
+    TEREDO_PORTS: 3544
+    SIP_PORTS: "[5060, 5061]"
+
+# Global stats configuration
+stats:
+  enabled: yes
+  interval: 8
+
+# Configure the type of alert (and other) logging you would like.
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
+      filename: eve.json
+      types:
+        - stats
+        - flow
+        - alert
+        - tls:
+            extended: yes     # enable this for extended logging information
+        - drop:
+            alerts: yes      # log alerts that caused drops
+            flows: all       # start or all: 'start' logs only a single drop
+
+
+firewall:
+  policies:
+    packet-filter: [ "accept:hook" ]
+    tls:
+      client-in-progress: [ "accept:hook" ]
+      client-hello-done: [ "accept:hook" ]
+      client-cert-done: [ "accept:hook" ]
+      client-handshake-done: [ "accept:hook" ]
+      client-finished: [ "accept:hook" ]
+      server-in-progress: [ "accept:hook" ]
+      server-hello: [ "accept:hook" ]
+      server-hello-done: [ "accept:hook" ]
+      server-cert-done: [ "accept:hook" ]
+      server-handshake-done: [ "accept:hook" ]
+      server-finished: [ "accept:hook" ]

diff --git a/tests/firewall/ruletype-firewall-81-ruleset-default-packet-policy-accept-hook-all/test.yaml b/tests/firewall/ruletype-firewall-81-ruleset-default-packet-policy-accept-hook-all/test.yaml
new file mode 100644 (file)
index 0000000..9d132b3
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-81-ruleset-default-packet-policy-accept-hook-all/test.yaml
@@ -0,0 +1,33 @@
+requires:
+  min-version: 9
+
+pcap: ../../tls/tls-client-hello-frag-01/dump_mtu300.pcap
+
+args:
+  - --simulate-ips
+  - -k none
+
+checks:
+- filter:
+    count: 0
+    match:
+      event_type: drop
+- filter:
+    count: 1
+    match:
+      event_type: flow
+      flow.pkts_toserver: 32
+      flow.pkts_toclient: 30
+      flow.state: "closed"
+      flow.alerted: false
+      not-has-key: flow.action
+- filter:
+    count: 1
+    match:
+      event_type: stats
+      stats.ips.accepted: 62
+      stats.ips.blocked: 0
+      stats.ips.rejected: 0
+      stats.ips.drop_reason.default_packet_policy: 0
+      stats.ips.drop_reason.default_app_policy: 0
+      stats.ips.drop_reason.flow_drop: 0

diff --git a/tests/firewall/ruletype-firewall-82-ruleset-default-app-policy-accept-flow/firewall.rules b/tests/firewall/ruletype-firewall-82-ruleset-default-app-policy-accept-flow/firewall.rules
new file mode 100644 (file)
index 0000000..f01bba7
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-82-ruleset-default-app-policy-accept-flow/firewall.rules
@@ -0,0 +1,5 @@
+# Packet rules
+
+# default packet policy: accept:hook
+
+# no app rules, so drop

diff --git a/tests/firewall/ruletype-firewall-82-ruleset-default-app-policy-accept-flow/suricata.yaml b/tests/firewall/ruletype-firewall-82-ruleset-default-app-policy-accept-flow/suricata.yaml
new file mode 100644 (file)
index 0000000..50448d7
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-82-ruleset-default-app-policy-accept-flow/suricata.yaml
@@ -0,0 +1,70 @@
+%YAML 1.1
+---
+
+vars:
+  # more specific is better for alert accuracy and performance
+  address-groups:
+    HOME_NET: "[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]"
+    #HOME_NET: "[192.168.0.0/16]"
+    #HOME_NET: "[10.0.0.0/8]"
+    #HOME_NET: "[172.16.0.0/12]"
+    #HOME_NET: "any"
+
+    EXTERNAL_NET: "!$HOME_NET"
+    #EXTERNAL_NET: "any"
+
+    HTTP_SERVERS: "$HOME_NET"
+    SMTP_SERVERS: "$HOME_NET"
+    SQL_SERVERS: "$HOME_NET"
+    DNS_SERVERS: "$HOME_NET"
+    TELNET_SERVERS: "$HOME_NET"
+    AIM_SERVERS: "$EXTERNAL_NET"
+    DC_SERVERS: "$HOME_NET"
+    DNP3_SERVER: "$HOME_NET"
+    DNP3_CLIENT: "$HOME_NET"
+    MODBUS_CLIENT: "$HOME_NET"
+    MODBUS_SERVER: "$HOME_NET"
+    ENIP_CLIENT: "$HOME_NET"
+    ENIP_SERVER: "$HOME_NET"
+
+  port-groups:
+    HTTP_PORTS: "80"
+    SHELLCODE_PORTS: "!80"
+    ORACLE_PORTS: 1521
+    SSH_PORTS: 22
+    DNP3_PORTS: 20000
+    MODBUS_PORTS: 502
+    FILE_DATA_PORTS: "[$HTTP_PORTS,110,143]"
+    FTP_PORTS: 21
+    GENEVE_PORTS: 6081
+    VXLAN_PORTS: 4789
+    TEREDO_PORTS: 3544
+    SIP_PORTS: "[5060, 5061]"
+
+# Global stats configuration
+stats:
+  enabled: yes
+  interval: 8
+
+# Configure the type of alert (and other) logging you would like.
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
+      filename: eve.json
+      types:
+        - stats
+        - flow
+        - alert
+        - tls:
+            extended: yes     # enable this for extended logging information
+        - drop:
+            alerts: yes      # log alerts that caused drops
+            flows: all       # start or all: 'start' logs only a single drop
+
+
+firewall:
+  policies:
+    packet-filter: [ "accept:hook" ]
+    tls:
+      client-in-progress: [ "accept:flow" ]

diff --git a/tests/firewall/ruletype-firewall-82-ruleset-default-app-policy-accept-flow/test.yaml b/tests/firewall/ruletype-firewall-82-ruleset-default-app-policy-accept-flow/test.yaml
new file mode 100644 (file)
index 0000000..94bd99d
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-82-ruleset-default-app-policy-accept-flow/test.yaml
@@ -0,0 +1,33 @@
+requires:
+  min-version: 9
+
+pcap: ../../tls/tls-client-hello-frag-01/dump_mtu300.pcap
+
+args:
+  - --simulate-ips
+  - -k none
+
+checks:
+- filter:
+    count: 0
+    match:
+      event_type: drop
+- filter:
+    count: 1
+    match:
+      event_type: flow
+      flow.pkts_toserver: 32
+      flow.pkts_toclient: 30
+      flow.state: "closed"
+      flow.alerted: false
+      flow.action: "accept"
+- filter:
+    count: 1
+    match:
+      event_type: stats
+      stats.ips.accepted: 62
+      stats.ips.blocked: 0
+      stats.ips.rejected: 0
+      stats.ips.drop_reason.default_packet_policy: 0
+      stats.ips.drop_reason.default_app_policy: 0
+      stats.ips.drop_reason.flow_drop: 0

diff --git a/tests/firewall/ruletype-firewall-83-ruleset-default-packet-policy-accept-flow/firewall.rules b/tests/firewall/ruletype-firewall-83-ruleset-default-packet-policy-accept-flow/firewall.rules
new file mode 100644 (file)
index 0000000..f01bba7
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-83-ruleset-default-packet-policy-accept-flow/firewall.rules
@@ -0,0 +1,5 @@
+# Packet rules
+
+# default packet policy: accept:hook
+
+# no app rules, so drop

diff --git a/tests/firewall/ruletype-firewall-83-ruleset-default-packet-policy-accept-flow/suricata.yaml b/tests/firewall/ruletype-firewall-83-ruleset-default-packet-policy-accept-flow/suricata.yaml
new file mode 100644 (file)
index 0000000..a6530bb
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-83-ruleset-default-packet-policy-accept-flow/suricata.yaml
@@ -0,0 +1,68 @@
+%YAML 1.1
+---
+
+vars:
+  # more specific is better for alert accuracy and performance
+  address-groups:
+    HOME_NET: "[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]"
+    #HOME_NET: "[192.168.0.0/16]"
+    #HOME_NET: "[10.0.0.0/8]"
+    #HOME_NET: "[172.16.0.0/12]"
+    #HOME_NET: "any"
+
+    EXTERNAL_NET: "!$HOME_NET"
+    #EXTERNAL_NET: "any"
+
+    HTTP_SERVERS: "$HOME_NET"
+    SMTP_SERVERS: "$HOME_NET"
+    SQL_SERVERS: "$HOME_NET"
+    DNS_SERVERS: "$HOME_NET"
+    TELNET_SERVERS: "$HOME_NET"
+    AIM_SERVERS: "$EXTERNAL_NET"
+    DC_SERVERS: "$HOME_NET"
+    DNP3_SERVER: "$HOME_NET"
+    DNP3_CLIENT: "$HOME_NET"
+    MODBUS_CLIENT: "$HOME_NET"
+    MODBUS_SERVER: "$HOME_NET"
+    ENIP_CLIENT: "$HOME_NET"
+    ENIP_SERVER: "$HOME_NET"
+
+  port-groups:
+    HTTP_PORTS: "80"
+    SHELLCODE_PORTS: "!80"
+    ORACLE_PORTS: 1521
+    SSH_PORTS: 22
+    DNP3_PORTS: 20000
+    MODBUS_PORTS: 502
+    FILE_DATA_PORTS: "[$HTTP_PORTS,110,143]"
+    FTP_PORTS: 21
+    GENEVE_PORTS: 6081
+    VXLAN_PORTS: 4789
+    TEREDO_PORTS: 3544
+    SIP_PORTS: "[5060, 5061]"
+
+# Global stats configuration
+stats:
+  enabled: yes
+  interval: 8
+
+# Configure the type of alert (and other) logging you would like.
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
+      filename: eve.json
+      types:
+        - stats
+        - flow
+        - alert
+        - tls:
+            extended: yes     # enable this for extended logging information
+        - drop:
+            alerts: yes      # log alerts that caused drops
+            flows: all       # start or all: 'start' logs only a single drop
+
+
+firewall:
+  policies:
+    packet-filter: [ "accept:flow" ]

diff --git a/tests/firewall/ruletype-firewall-83-ruleset-default-packet-policy-accept-flow/test.yaml b/tests/firewall/ruletype-firewall-83-ruleset-default-packet-policy-accept-flow/test.yaml
new file mode 100644 (file)
index 0000000..99853e8
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-83-ruleset-default-packet-policy-accept-flow/test.yaml
@@ -0,0 +1,33 @@
+requires:
+  min-version: 9
+
+pcap: ../../tls/tls-client-hello-frag-01/dump_mtu300.pcap
+
+args:
+  - --simulate-ips
+  - -k none
+
+checks:
+- filter:
+    count: 0
+    match:
+      event_type: drop
+- filter:
+    count: 1
+    match:
+      event_type: flow
+      flow.pkts_toserver: 32
+      flow.pkts_toclient: 30
+      flow.state: "closed"
+      flow.alerted: false
+      flow.action: accept
+- filter:
+    count: 1
+    match:
+      event_type: stats
+      stats.ips.accepted: 62
+      stats.ips.blocked: 0
+      stats.ips.rejected: 0
+      stats.ips.drop_reason.default_packet_policy: 0
+      stats.ips.drop_reason.default_app_policy: 0
+      stats.ips.drop_reason.flow_drop: 0

diff --git a/tests/firewall/ruletype-firewall-84-ruleset-default-app-policy-tls-request-started/firewall.rules b/tests/firewall/ruletype-firewall-84-ruleset-default-app-policy-tls-request-started/firewall.rules
new file mode 100644 (file)
index 0000000..f01bba7
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-84-ruleset-default-app-policy-tls-request-started/firewall.rules
@@ -0,0 +1,5 @@
+# Packet rules
+
+# default packet policy: accept:hook
+
+# no app rules, so drop

diff --git a/tests/firewall/ruletype-firewall-84-ruleset-default-app-policy-tls-request-started/suricata.yaml b/tests/firewall/ruletype-firewall-84-ruleset-default-app-policy-tls-request-started/suricata.yaml
new file mode 100644 (file)
index 0000000..b0dde03
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-84-ruleset-default-app-policy-tls-request-started/suricata.yaml
@@ -0,0 +1,70 @@
+%YAML 1.1
+---
+
+vars:
+  # more specific is better for alert accuracy and performance
+  address-groups:
+    HOME_NET: "[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]"
+    #HOME_NET: "[192.168.0.0/16]"
+    #HOME_NET: "[10.0.0.0/8]"
+    #HOME_NET: "[172.16.0.0/12]"
+    #HOME_NET: "any"
+
+    EXTERNAL_NET: "!$HOME_NET"
+    #EXTERNAL_NET: "any"
+
+    HTTP_SERVERS: "$HOME_NET"
+    SMTP_SERVERS: "$HOME_NET"
+    SQL_SERVERS: "$HOME_NET"
+    DNS_SERVERS: "$HOME_NET"
+    TELNET_SERVERS: "$HOME_NET"
+    AIM_SERVERS: "$EXTERNAL_NET"
+    DC_SERVERS: "$HOME_NET"
+    DNP3_SERVER: "$HOME_NET"
+    DNP3_CLIENT: "$HOME_NET"
+    MODBUS_CLIENT: "$HOME_NET"
+    MODBUS_SERVER: "$HOME_NET"
+    ENIP_CLIENT: "$HOME_NET"
+    ENIP_SERVER: "$HOME_NET"
+
+  port-groups:
+    HTTP_PORTS: "80"
+    SHELLCODE_PORTS: "!80"
+    ORACLE_PORTS: 1521
+    SSH_PORTS: 22
+    DNP3_PORTS: 20000
+    MODBUS_PORTS: 502
+    FILE_DATA_PORTS: "[$HTTP_PORTS,110,143]"
+    FTP_PORTS: 21
+    GENEVE_PORTS: 6081
+    VXLAN_PORTS: 4789
+    TEREDO_PORTS: 3544
+    SIP_PORTS: "[5060, 5061]"
+
+# Global stats configuration
+stats:
+  enabled: yes
+  interval: 8
+
+# Configure the type of alert (and other) logging you would like.
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
+      filename: eve.json
+      types:
+        - stats
+        - flow
+        - alert
+        - tls:
+            extended: yes     # enable this for extended logging information
+        - drop:
+            alerts: yes      # log alerts that caused drops
+            flows: all       # start or all: 'start' logs only a single drop
+
+
+firewall:
+  policies:
+    packet-filter: [ "accept:hook" ]
+    tls:
+      request-started: [ "accept:flow" ]

diff --git a/tests/firewall/ruletype-firewall-84-ruleset-default-app-policy-tls-request-started/test.yaml b/tests/firewall/ruletype-firewall-84-ruleset-default-app-policy-tls-request-started/test.yaml
new file mode 100644 (file)
index 0000000..94bd99d
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-84-ruleset-default-app-policy-tls-request-started/test.yaml
@@ -0,0 +1,33 @@
+requires:
+  min-version: 9
+
+pcap: ../../tls/tls-client-hello-frag-01/dump_mtu300.pcap
+
+args:
+  - --simulate-ips
+  - -k none
+
+checks:
+- filter:
+    count: 0
+    match:
+      event_type: drop
+- filter:
+    count: 1
+    match:
+      event_type: flow
+      flow.pkts_toserver: 32
+      flow.pkts_toclient: 30
+      flow.state: "closed"
+      flow.alerted: false
+      flow.action: "accept"
+- filter:
+    count: 1
+    match:
+      event_type: stats
+      stats.ips.accepted: 62
+      stats.ips.blocked: 0
+      stats.ips.rejected: 0
+      stats.ips.drop_reason.default_packet_policy: 0
+      stats.ips.drop_reason.default_app_policy: 0
+      stats.ips.drop_reason.flow_drop: 0