Copyright | (c) 2013-2023 Brendan Hay |
---|---|
License | Mozilla Public License, v. 2.0. |
Maintainer | Brendan Hay |
Stability | auto-generated |
Portability | non-portable (GHC extensions) |
Safe Haskell | Safe-Inferred |
Language | Haskell2010 |
Documentation
data StatefulEngineOptions Source #
Configuration settings for the handling of the stateful rule groups in a firewall policy.
See: newStatefulEngineOptions
smart constructor.
StatefulEngineOptions' | |
|
Instances
newStatefulEngineOptions :: StatefulEngineOptions Source #
Create a value of StatefulEngineOptions
with all optional fields omitted.
Use generic-lens or optics to modify other optional fields.
The following record fields are available, with the corresponding lenses provided for backwards compatibility:
$sel:ruleOrder:StatefulEngineOptions'
, statefulEngineOptions_ruleOrder
- Indicates how to manage the order of stateful rule evaluation for the
policy. DEFAULT_ACTION_ORDER
is the default behavior. Stateful rules
are provided to the rule engine as Suricata compatible strings, and
Suricata evaluates them based on certain settings. For more information,
see
Evaluation order for stateful rules
in the Network Firewall Developer Guide.
$sel:streamExceptionPolicy:StatefulEngineOptions'
, statefulEngineOptions_streamExceptionPolicy
- Configures how Network Firewall processes traffic when a network
connection breaks midstream. Network connections can break due to
disruptions in external networks or within the firewall itself.
DROP
- Network Firewall fails closed and drops all subsequent traffic going to the firewall. This is the default behavior.CONTINUE
- Network Firewall continues to apply rules to the subsequent traffic without context from traffic before the break. This impacts the behavior of rules that depend on this context. For example, if you have a stateful rule todrop http
traffic, Network Firewall won't match the traffic for this rule because the service won't have the context from session initialization defining the application layer protocol as HTTP. However, this behavior is rule dependent—a TCP-layer rule using aflow:stateless
rule would still match, as would theaws:drop_strict
default action.
statefulEngineOptions_ruleOrder :: Lens' StatefulEngineOptions (Maybe RuleOrder) Source #
Indicates how to manage the order of stateful rule evaluation for the
policy. DEFAULT_ACTION_ORDER
is the default behavior. Stateful rules
are provided to the rule engine as Suricata compatible strings, and
Suricata evaluates them based on certain settings. For more information,
see
Evaluation order for stateful rules
in the Network Firewall Developer Guide.
statefulEngineOptions_streamExceptionPolicy :: Lens' StatefulEngineOptions (Maybe StreamExceptionPolicy) Source #
Configures how Network Firewall processes traffic when a network connection breaks midstream. Network connections can break due to disruptions in external networks or within the firewall itself.
DROP
- Network Firewall fails closed and drops all subsequent traffic going to the firewall. This is the default behavior.CONTINUE
- Network Firewall continues to apply rules to the subsequent traffic without context from traffic before the break. This impacts the behavior of rules that depend on this context. For example, if you have a stateful rule todrop http
traffic, Network Firewall won't match the traffic for this rule because the service won't have the context from session initialization defining the application layer protocol as HTTP. However, this behavior is rule dependent—a TCP-layer rule using aflow:stateless
rule would still match, as would theaws:drop_strict
default action.