From a261229aaf242baf4df5e5dc68bc84627bd2c4e6 Mon Sep 17 00:00:00 2001 From: Juliana Fajardini Date: Wed, 13 May 2026 12:47:27 -0300 Subject: [PATCH] detect: add flow drop by firewall as drop reason To track flow drops triggered by the firewall. Add flow drop by firewall as drop reason. As part of Ticket #7699 (cherry picked from commit 312967f291404affba1909d91571adce55e30122) --- etc/schema.json | 14 +++++++++----- src/decode.c | 5 +++++ src/decode.h | 1 + src/detect-engine-alert.c | 10 +++++++--- src/detect.c | 2 ++ src/flow-worker.c | 6 +++++- src/flow.c | 6 +++++- 7 files changed, 34 insertions(+), 10 deletions(-) diff --git a/etc/schema.json b/etc/schema.json index 676cdacabe..df8d84dd25 100644 --- a/etc/schema.json +++ b/etc/schema.json @@ -7382,24 +7382,28 @@ "default_app_policy": { "type": "integer", "description": - "Number of packets dropped due to firewall's mode default app policy" + "Count of packets dropped due to firewall's mode default app policy" }, "default_packet_policy": { "type": "integer", "description": - "Number of packets dropped due to firewall's mode default packet policy" + "Count of packets dropped due to firewall's mode default packet policy" + }, + "flow_drop": { + "type": "integer", + "description": "Count of packets dropped due to a firewall policy that led to flow drop" }, "pre_flow_hook": { "type": "integer", - "description": "Number of packets dropped due to pre-flow hook" + "description": "Count of packets dropped due to pre-flow hook" }, "pre_stream_hook": { "type": "integer", - "description": "Number of packets dropped due to pre-stream hook" + "description": "Count of packets dropped due to pre-stream hook" }, "rules": { "type": "integer", - "description": "Number of packets dropped due to firewall rules" + "description": "Count of packets dropped due to firewall rules" } } }, diff --git a/src/decode.c b/src/decode.c index 3302515153..7a40e130a1 100644 --- a/src/decode.c +++ b/src/decode.c @@ -949,6 +949,8 @@ const char *PacketDropReasonToString(enum PacketDropReason r) return "firewall pre stream hook"; case PKT_DROP_REASON_FW_FLOW_PRE_HOOK: return "firewall pre flow hook"; + case PKT_DROP_REASON_FW_FLOW_DROP: + return "firewall flow drop"; case PKT_DROP_REASON_NOT_SET: case PKT_DROP_REASON_MAX: return NULL; @@ -997,6 +999,8 @@ static const char *PacketDropReasonToJsonString(enum PacketDropReason r) return "firewall.drop_reason.pre_stream_hook"; case PKT_DROP_REASON_FW_FLOW_PRE_HOOK: return "firewall.drop_reason.pre_flow_hook"; + case PKT_DROP_REASON_FW_FLOW_DROP: + return "firewall.drop_reason.flow_drop"; case PKT_DROP_REASON_FW_DEFAULT_PACKET_POLICY: return "firewall.drop_reason.default_packet_policy"; case PKT_DROP_REASON_FW_DEFAULT_APP_POLICY: @@ -1039,6 +1043,7 @@ void CaptureStatsUpdate(ThreadVars *tv, const Packet *p) return; CaptureStats *s = &t_capture_stats; + if (EngineModeIsFirewall()) { /** The firewall mode and its stats counters should work as when there are two different * devices for the firewall control and the IPS control. diff --git a/src/decode.h b/src/decode.h index 31536dac14..5372dcfab7 100644 --- a/src/decode.h +++ b/src/decode.h @@ -406,6 +406,7 @@ enum PacketDropReason { PKT_DROP_REASON_FW_DEFAULT_APP_POLICY, /**< drop issued by default app policy */ PKT_DROP_REASON_FW_STREAM_PRE_HOOK, /**< drop issued in the pre_stream hook */ PKT_DROP_REASON_FW_FLOW_PRE_HOOK, /**< drop issued in the pre_flow hook */ + PKT_DROP_REASON_FW_FLOW_DROP, PKT_DROP_REASON_MAX, }; diff --git a/src/detect-engine-alert.c b/src/detect-engine-alert.c index ea3771bb8f..080ff3f1b8 100644 --- a/src/detect-engine-alert.c +++ b/src/detect-engine-alert.c @@ -153,7 +153,7 @@ int PacketAlertCheck(Packet *p, uint32_t sid) } #endif -static inline void RuleActionToFlow(const uint8_t action, Flow *f) +static inline void RuleActionToFlow(const uint8_t action, Flow *f, const bool fw_rule) { if (action & ACTION_ACCEPT) { f->flags |= FLOW_ACTION_ACCEPT; @@ -186,6 +186,10 @@ static inline void RuleActionToFlow(const uint8_t action, Flow *f) } } } + + if (fw_rule) { + f->aux_flags |= FLOW_AUX_ACTION_BY_FIREWALL; + } } /** \brief Apply action(s) and Set 'drop' sig info, @@ -222,7 +226,7 @@ static void PacketApplySignatureActions(Packet *p, const Signature *s, const Pac p->alerts.drop.s = (Signature *)s; } if ((p->flow != NULL) && (pa->flags & PACKET_ALERT_FLAG_APPLY_ACTION_TO_FLOW)) { - RuleActionToFlow(pa->action, p->flow); + RuleActionToFlow(pa->action, p->flow, is_fw_rule); } DEBUG_VALIDATE_BUG_ON(!PacketCheckAction(p, ACTION_DROP)); @@ -247,7 +251,7 @@ static void PacketApplySignatureActions(Packet *p, const Signature *s, const Pac if ((pa->action & (ACTION_PASS | ACTION_ACCEPT)) && (p->flow != NULL) && (pa->flags & PACKET_ALERT_FLAG_APPLY_ACTION_TO_FLOW)) { - RuleActionToFlow(pa->action, p->flow); + RuleActionToFlow(pa->action, p->flow, is_fw_rule); } } } diff --git a/src/detect.c b/src/detect.c index f4b8cc42d8..c6f10b961d 100644 --- a/src/detect.c +++ b/src/detect.c @@ -1640,6 +1640,7 @@ static const struct DetectFirewallPolicy *DetectFirewallApplyDefaultAppPolicy( if (policy->action_scope == ACTION_SCOPE_FLOW) { SCLogDebug("dropping flow"); p->flow->flags |= FLOW_ACTION_DROP; + p->flow->aux_flags |= FLOW_AUX_ACTION_BY_FIREWALL; } } else if (policy->action & ACTION_ACCEPT) { if (policy->action_scope == ACTION_SCOPE_FLOW) { @@ -2321,6 +2322,7 @@ static void DetectRunTx(ThreadVars *tv, if (s->action_scope == ACTION_SCOPE_FLOW) { SCLogDebug("drop flow because of rule with drop action"); f->flags |= FLOW_ACTION_DROP; + f->aux_flags |= FLOW_AUX_ACTION_BY_FIREWALL; } } } diff --git a/src/flow-worker.c b/src/flow-worker.c index ee39c088df..f21dc30a68 100644 --- a/src/flow-worker.c +++ b/src/flow-worker.c @@ -425,7 +425,11 @@ static inline void FlowWorkerStreamTCPUpdate(ThreadVars *tv, FlowWorkerThreadDat } if (FlowChangeProto(p->flow) && p->flow->flags & FLOW_ACTION_DROP) { // in case f->flags & FLOW_ACTION_DROP was set by one of the dequeued packets - PacketDrop(p, ACTION_DROP, PKT_DROP_REASON_FLOW_DROP); + if (p->flow->aux_flags & FLOW_AUX_ACTION_BY_FIREWALL) { + PacketDrop(p, ACTION_DROP, PKT_DROP_REASON_FW_FLOW_DROP); + } else { + PacketDrop(p, ACTION_DROP, PKT_DROP_REASON_FLOW_DROP); + } } } diff --git a/src/flow.c b/src/flow.c index 2c7255c43d..6890fe815f 100644 --- a/src/flow.c +++ b/src/flow.c @@ -519,7 +519,11 @@ void FlowHandlePacketUpdate(Flow *f, Packet *p, ThreadVars *tv, DecodeThreadVars } if (f->flags & FLOW_ACTION_DROP) { - PacketDrop(p, ACTION_DROP, PKT_DROP_REASON_FLOW_DROP); + if (f->aux_flags & FLOW_AUX_ACTION_BY_FIREWALL) { + PacketDrop(p, ACTION_DROP, PKT_DROP_REASON_FW_FLOW_DROP); + } else { + PacketDrop(p, ACTION_DROP, PKT_DROP_REASON_FLOW_DROP); + } } if (f->flags & FLOW_NOPAYLOAD_INSPECTION) {