Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add additional global state return value to socketfilterfw parser #1842

Merged
merged 2 commits into from
Aug 20, 2024
Merged

Add additional global state return value to socketfilterfw parser #1842

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6d0731f
Add new global state value to socketfilterfw parser
Micah-Kolide Aug 20, 2024
3ce2dc1
Fix comment
Micah-Kolide Aug 20, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion ee/tables/execparsers/socketfilterfw/parser.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -113,7 +113,10 @@ func sanitizeState(state string) string {
// When the "block all" firewall option is enabled, it doesn't
// include a state like string, which is why we match on
// the string value of "connections" for that mode.
case "1", "on", "enabled", "connections":
//
// When both the Firewall and Stealth Mode are enabled,
// the global firewall state value is `2` instead of `1`.
case "1", "2", "on", "enabled", "connections":
return "1"
case "throttled", "brief", "detail":
// The "logging option" value differs from the booleans.
Expand Down
2 changes: 1 addition & 1 deletion ee/tables/execparsers/socketfilterfw/parser_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,7 +67,7 @@ func TestParse(t *testing.T) {
"block_all_enabled": "0",
"allow_built-in_signed_enabled": "1",
"allow_downloaded_signed_enabled": "1",
"stealth_enabled": "0",
"stealth_enabled": "1",
"logging_enabled": "1",
"logging_option": "throttled",
},
Expand Down
4 changes: 2 additions & 2 deletions ee/tables/execparsers/socketfilterfw/test-data/data.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
Firewall is enabled. (State = 1)
Firewall is enabled. (State = 2)
Firewall has block all state set to disabled.
Automatically allow built-in signed software ENABLED.
Automatically allow downloaded signed software ENABLED.
Firewall stealth mode is off
Stealth mode enabled
Log mode is on
Log Option is throttled
Loading