firewall: test the default policy v1

[lukashino]

Redmine ticket: https://redmine.openinfosecfoundation.org/issues/8712

Describe changes:

• Update to the new config format
• Add extra tests

[Copilot]

Pull request overview

Updates Suricata-verify firewall test fixtures to the new grouped firewall policy configuration format (packet/app, http1/tls/dns/etc.) and introduces new regression tests for firewall default-policy behavior (including per-protocol defaults).

Changes:

• Convert existing firewall test suricata.yaml files from legacy packet-filter / http / tls keys to the grouped packet + app format (e.g., app.http1, app.tls, app.dns, app.ftp*).
• Add new tests covering global default-policy accept behavior and per-protocol default-policy behavior for DNS.
• Adjust/normalize policy lists to the inline array style used by the new config format.

Reviewed changes

Copilot reviewed 42 out of 42 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
tests/firewall/ruletype-firewall-95-ruleset-default-packet-policy-accept-hook-alert/suricata.yaml	Convert firewall policy config to grouped packet/app format.
tests/firewall/ruletype-firewall-94-config-default-policy-http/suricata.yaml	Convert HTTP default-policy test config to app.http1 format.
tests/firewall/ruletype-firewall-93-lt-ua-mix-accept-hook/suricata.yaml	Convert HTTP policy block to app.http1 format.
tests/firewall/ruletype-firewall-92-lt-ua-mix/suricata.yaml	Convert HTTP policy block to app.http1 format.
tests/firewall/ruletype-firewall-89-defaults-over-drop/suricata.yaml	Convert packet + HTTP policies to packet.filter and app.http1.
tests/firewall/ruletype-firewall-88-default-accept-tx-pipeline/suricata.yaml	Convert packet + HTTP policies to packet.filter and app.http1.
tests/firewall/ruletype-firewall-87-broken-default-policy/suricata.yaml	Convert HTTP policy block to app.http1 format.
tests/firewall/ruletype-firewall-86-packet-filter-accept-flow-pass-with-td/suricata.yaml	Convert HTTP policy block to app.http1 format.
tests/firewall/ruletype-firewall-84-ruleset-default-app-policy-tls-request-started/suricata.yaml	Convert packet + TLS policies to packet.filter and app.tls.
tests/firewall/ruletype-firewall-83-ruleset-default-packet-policy-accept-flow/suricata.yaml	Convert packet policy to packet.filter.
tests/firewall/ruletype-firewall-82-ruleset-default-app-policy-accept-flow/suricata.yaml	Convert packet + TLS policies to packet.filter and app.tls.
tests/firewall/ruletype-firewall-81-ruleset-default-packet-policy-accept-hook-all/suricata.yaml	Convert packet + TLS policies to packet.filter and app.tls.
tests/firewall/ruletype-firewall-80-ruleset-default-packet-policy-accept-hook-no-rules/suricata.yaml	Convert packet policy to packet.filter.
tests/firewall/ruletype-firewall-79-ruleset-default-packet-policy-accept-hook/suricata.yaml	Convert packet policy to packet.filter.
tests/firewall/ruletype-firewall-78-ruleset-default-packet-policy-accept/suricata.yaml	Convert packet policy to packet.filter.
tests/firewall/ruletype-firewall-77-ruleset-default-packet-policy/suricata.yaml	Convert packet policy to packet.filter.
tests/firewall/ruletype-firewall-76-config-default-policy-http-accept-tx-td/suricata.yaml	Convert HTTP policy block to app.http1 format.
tests/firewall/ruletype-firewall-75-config-default-policy-http-accept-tx/suricata.yaml	Convert HTTP policy block to app.http1 format.
tests/firewall/ruletype-firewall-74-config-default-policy-dns/suricata.yaml	Convert DNS policy block to app.dns format.
tests/firewall/ruletype-firewall-73-config-default-policy-http/suricata.yaml	Convert HTTP policy block to app.http1 format.
tests/firewall/ruletype-firewall-72-config-default-policy-http/suricata.yaml	Convert HTTP policy block to app.http1 format.
tests/firewall/ruletype-firewall-71-reject-app-default-policy/suricata.yaml	Convert TLS policy block to app.tls format.
tests/firewall/ruletype-firewall-70-config-default-policy-http/suricata.yaml	Convert HTTP policy block to app.http1 format.
tests/firewall/ruletype-firewall-69-config-default-policy-tls-accept/suricata.yaml	Convert TLS policy block to app.tls format.
tests/firewall/ruletype-firewall-68-config-default-policy-tls/suricata.yaml	Convert TLS policy block to app.tls format.
tests/firewall/ruletype-firewall-124-http2-substate-default-policy/suricata.yaml	Convert HTTP/2 policy block to app.http2 format.
tests/firewall/ruletype-firewall-121-ftp-bounce/suricata.yaml	Convert packet + FTP/FTP-DATA policy blocks to grouped format.
tests/firewall/ruletype-firewall-120-ftp-drop-by-dynamic-port/suricata.yaml	Convert packet + FTP/FTP-DATA policy blocks to grouped format.
tests/firewall/ruletype-firewall-119-ftp-non-anonymous-default-allow/suricata.yaml	Convert packet + FTP/FTP-DATA policy blocks to grouped format.
tests/firewall/ruletype-firewall-115-ftp-download-active-user/suricata.yaml	Convert FTP-DATA policy block to app.ftp-data format.
tests/firewall/ruletype-firewall-108-default-app-policy-missed-rule-accept-tx-alert/suricata.yaml	Convert HTTP policy block to app.http1 format.
tests/firewall/ruletype-firewall-107-default-app-policy-missed-rule-accept-tx-alert/suricata.yaml	Convert HTTP policy block to app.http1 format.
tests/firewall/ruletype-firewall-106-default-app-policy-accept-flow-alert/suricata.yaml	Convert packet + HTTP policy blocks to grouped format.
tests/firewall/ruletype-firewall-105-default-packet-policy-alert-app-rule/suricata.yaml	Convert packet + HTTP policy blocks to grouped format.
tests/firewall/ruletype-firewall-104-default-app-policy-missed-rule-alert/suricata.yaml	Convert HTTP policy block to app.http1 format.
tests/firewall/ruletype-firewall-103-default-app-policy-drop-alert/suricata.yaml	Convert DNS policy block to app.dns format (with comments).
tests/firewall/firewall-default-policy-per-proto/test.yaml	New test assertions for per-protocol default-policy behavior.
tests/firewall/firewall-default-policy-per-proto/suricata.yaml	New config defining packet.default-policy and app.dns.default-policy.
tests/firewall/firewall-default-policy-per-proto/firewall.rules	New (comment-only) firewall rules file documenting test intent.
tests/firewall/firewall-default-policy-accept-hook/test.yaml	New test assertions for global default-policy accept behavior.
tests/firewall/firewall-default-policy-accept-hook/suricata.yaml	New config defining global firewall.policies.default-policy.
tests/firewall/firewall-default-policy-accept-hook/firewall.rules	New (comment-only) firewall rules file documenting test intent.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[lukashino]

Follow up in #3252