From ffbf72493e0c351971187a68d722f76221405302 Mon Sep 17 00:00:00 2001 From: Ricardo Valdes Date: Wed, 16 Sep 2026 20:34:39 -0400 Subject: [PATCH] fix: align pfSense filter and rule contracts --- filters/audits/pfsense.md | 40 ++++++++++ filters/pfsense/pfsense_fw.yml | 75 +++++++++++++++++-- .../testdata/filter-contracts/pfsense.json | 41 ++++++++++ 3 files changed, 151 insertions(+), 5 deletions(-) create mode 100644 filters/audits/pfsense.md create mode 100644 plugins/alerts/testdata/filter-contracts/pfsense.json diff --git a/filters/audits/pfsense.md b/filters/audits/pfsense.md new file mode 100644 index 000000000..24118b1d2 --- /dev/null +++ b/filters/audits/pfsense.md @@ -0,0 +1,40 @@ +# pfSense normalization and rule review + +Normalize policy outcomes and validate standard IP/protocol values. + +This draft targets UTMStack `v11`. It contains 1 filter changes +and 0 rule changes for this technology only. Review covered +1 filter configurations and 3 matching shipped rule files. +Unchanged rules are listed in the regression manifest; they are not duplicated in the diff. + +## Contract and validation + +- Compared exact standard names/types with go-sdk v1.1.31 and the supplied UTMStack dictionaries. +- Checked documented pipeline ordering, rename/move behavior, open vendor log fields, + event-side versus alert-side fields, and surviving fields used by affected rule predicates/history/grouping. +- Strict SDK configuration decoding and actual CEL compilation pass for this scope. +- 2 synthetic normalization cases pass, including SDK Event conversion and any + trigger predicate assertions recorded in the manifest. +- The scoped alerts module tests and `git diff --check` pass with the shared contract runner applied. + +The shared alert-contract PR supplies the reusable Go runner for the manifest in +`plugins/alerts/testdata/filter-contracts/pfsense.json`. Apply that support before running `go test ./...` in `plugins/alerts`. + +The model starts from synthetic extraction results. It does not run complex grok, +JSON/KV/XML/CSV extraction, time conversion, dynamic plugins, historical OpenSearch +queries, or the closed EventProcessor. Raw vendor logs and resulting alerts must +still be checked in staging before rollout. No customer false-positive reduction +has been measured and no production rollout is included. + + + +## References + +- [SDK schema](https://github.com/threatwinds/go-sdk/blob/v1.1.31/plugins/plugins.proto) +- [Filter steps](https://github.com/threatwinds/go-sdk/wiki/Filter-Steps-Reference) +- [Standard event schema](https://github.com/threatwinds/go-sdk/wiki/Standard-Event-Schema) +- [Rule implementation](https://github.com/threatwinds/go-sdk/wiki/Implementing-Rules) + +`afterEvents`, empty noncapturing grok names, supported numeric strings, and custom +`log.*` fields are accepted. Existing textual protocol casing and vendor action names +are preserved unless a concrete consumer mismatch requires correction. diff --git a/filters/pfsense/pfsense_fw.yml b/filters/pfsense/pfsense_fw.yml index 2d402b794..154bba6ff 100644 --- a/filters/pfsense/pfsense_fw.yml +++ b/filters/pfsense/pfsense_fw.yml @@ -342,14 +342,14 @@ pipeline: function: string params: key: actionResult - value: "pass" - where: 'equalsIgnoreCase("action", "pass")' + value: success + where: equalsIgnoreCase("action", "pass") - add: function: string params: key: actionResult - value: "blocked" - where: 'equalsIgnoreCase("action", "block")' + value: denied + where: equalsIgnoreCase("action", "block") # ................................................# # Fileds conversions @@ -381,4 +381,69 @@ pipeline: # ..........................................................................# - delete: fields: - - log.csvMsg \ No newline at end of file + - log.csvMsg + + # Keep addresses in IP fields and retain other source values under log. + - rename: + from: + - origin.ip + to: log.unparsedOriginIp + where: exists("origin.ip") && (!(inCIDR("origin.ip","0.0.0.0/0") || inCIDR("origin.ip","::/0")) || oneOf("origin.ip",["0.0.0.0","::"])) + - rename: + from: + - target.ip + to: log.unparsedTargetIp + where: exists("target.ip") && (!(inCIDR("target.ip","0.0.0.0/0") || inCIDR("target.ip","::/0")) || oneOf("target.ip",["0.0.0.0","::"])) + - add: + function: string + params: + key: protocol + value: ICMP + where: equals("protocol",1) + - add: + function: string + params: + key: protocol + value: TCP + where: equals("protocol",6) + - add: + function: string + params: + key: protocol + value: UDP + where: equals("protocol",17) + - add: + function: string + params: + key: protocol + value: GRE + where: equals("protocol",47) + - add: + function: string + params: + key: protocol + value: ESP + where: equals("protocol",50) + - add: + function: string + params: + key: protocol + value: AH + where: equals("protocol",51) + - add: + function: string + params: + key: protocol + value: ICMPV6 + where: equals("protocol",58) + - add: + function: string + params: + key: protocol + value: SCTP + where: equals("protocol",132) + - rename: + from: + - protocol + to: log.ipProtocolNumber + where: exists("protocol") && greaterOrEqual("protocol",0) diff --git a/plugins/alerts/testdata/filter-contracts/pfsense.json b/plugins/alerts/testdata/filter-contracts/pfsense.json new file mode 100644 index 000000000..dcae205a3 --- /dev/null +++ b/plugins/alerts/testdata/filter-contracts/pfsense.json @@ -0,0 +1,41 @@ +{ + "technology": "pfSense", + "filters": [ + "filters/pfsense/pfsense_fw.yml" + ], + "rules": [ + "rules/pfsense/dns_resolver_cache_poisoning.yml", + "rules/pfsense/pfsense_admin_brute_force.yml", + "rules/pfsense/snort_suricata_ids_alerts.yml" + ], + "fixtures": [ + { + "name": "pfSense pass", + "filter": "pfsense/pfsense_fw.yml", + "input": { + "log": { + "action": "pass" + } + }, + "expected": { + "actionResult": "success" + }, + "absent": [], + "rules": {} + }, + { + "name": "pfSense block", + "filter": "pfsense/pfsense_fw.yml", + "input": { + "log": { + "action": "block" + } + }, + "expected": { + "actionResult": "denied" + }, + "absent": [], + "rules": {} + } + ] +}