lucaspalomodevelop/core
1
0
Fork 0
mirror of https://github.com/lucaspalomodevelop/core.git synced 2026-03-20 03:16:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

"bypass" keyword in suricata user defined rules (#6752)

Browse Source
This commit is contained in:
Monviech 2023-08-16 21:38:02 +02:00 committed by GitHub
parent 6095400258
commit 119537dfc4
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 12 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/opnsense/mvc/app/controllers/OPNsense/IDS/forms/dialogUserDefined.xml
View File

@ -29,6 +29,12 @@
<type>dropdown</type>
<help>Set action to perform here, only used when in IPS mode.</help>
</field>
<field>
<id>rule.bypass</id>
<label>Bypass</label>
<type>checkbox</type>
<help>Set bypass keyword. Increases traffic throughput. Suricata reads a packet, decodes it, checks it in the flow table. If the corresponding flow is local bypassed then it simply skips all streaming, detection and output and the packet goes directly out in IDS mode and to verdict in IPS mode.</help>
</field>
<field>
<id>rule.description</id>
<label>Description</label>

6
src/opnsense/mvc/app/models/OPNsense/IDS/IDS.xml
View File

@ -1,6 +1,6 @@
<model>
<mount>//OPNsense/IDS</mount>
<version>1.0.7</version>
<version>1.0.8</version>
<description>
OPNsense IDS
</description>
@ -113,6 +113,10 @@
<pass>Pass</pass>
</OptionValues>
</action>
<bypass type="BooleanField">
<default>0</default>
<Required>Y</Required>
</bypass>
</rule>
</userDefinedRules>
<files>

2
src/opnsense/service/templates/OPNsense/IDS/OPNsense.rules
View File

@ -9,7 +9,7 @@
{% for rule in helpers.toList('OPNsense.IDS.userDefinedRules.rule') %}
{% if rule.enabled|default('0') == '1' %}
{{rule.action}}{% if rule.fingerprint|default('') != ""
%} tls {% else %} ip {% endif %} {% if rule.source|default('') != "" %} {{ rule.source }} {% else %} any {% endif %} any -> {% if rule.destination|default('') != "" %} {{ rule.destination }} {% else %} any {% endif %} any (msg:"{{rule.description.replace('"','\"')}}"; {%
%} tls {% else %} ip {% endif %} {% if rule.source|default('') != "" %} {{ rule.source }} {% else %} any {% endif %} any -> {% if rule.destination|default('') != "" %} {{ rule.destination }} {% else %} any {% endif %} any (msg:"{{rule.description.replace('"','\"')}}"; {% if rule.bypass|default('0') == '1' %}bypass;{% endif %}{%
if rule.fingerprint|default('') != "" %} tls.fingerprint:"{{rule.fingerprint.lower()}}";{% endif
%} sid:{{
4294967295 - loop.index