firewall: test the default policy v2

[lukashino]

Follow-up of #3251

Redmine ticket: https://redmine.openinfosecfoundation.org/issues/8712

Describe changes:

• Update to the new config format
• Add extra tests

[Copilot]

Pull request overview

This PR updates Suricata-verify firewall test configurations to the newer firewall.policies schema (splitting packet vs app policies and using per-protocol app keys like http1), and adds a set of new tests that exercise default-policy resolution, precedence, hook aliasing, and validation.

Changes:

• Migrate existing firewall tests from legacy keys (e.g., packet-filter, http, tls) to the new packet: / app: policy layout.
• Add new ruletype-firewall-141 through ruletype-firewall-151 tests covering default-policy behavior (global/app/packet/per-protocol/substate) and invalid-scope validation.
• Update HTTP/2 + DoH2 policy hook naming to the new format under policies.app.

Reviewed changes

Copilot reviewed 84 out of 84 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
tests/firewall/ruletype-firewall-95-ruleset-default-packet-policy-accept-hook-alert/suricata.yaml	Convert firewall policy config to new packet/app layout.
tests/firewall/ruletype-firewall-94-config-default-policy-http/suricata.yaml	Convert HTTP default-policy config to policies.app.http1.
tests/firewall/ruletype-firewall-93-lt-ua-mix-accept-hook/suricata.yaml	Convert HTTP policy config to policies.app.http1.
tests/firewall/ruletype-firewall-92-lt-ua-mix/suricata.yaml	Convert HTTP policy config to policies.app.http1.
tests/firewall/ruletype-firewall-89-defaults-over-drop/suricata.yaml	Convert packet/http policies to policies.packet + policies.app.http1.
tests/firewall/ruletype-firewall-88-default-accept-tx-pipeline/suricata.yaml	Convert packet/http policies to policies.packet + policies.app.http1.
tests/firewall/ruletype-firewall-87-broken-default-policy/suricata.yaml	Convert HTTP policy config to policies.app.http1.
tests/firewall/ruletype-firewall-86-packet-filter-accept-flow-pass-with-td/suricata.yaml	Convert HTTP policy config to policies.app.http1.
tests/firewall/ruletype-firewall-84-ruleset-default-app-policy-tls-request-started/suricata.yaml	Convert packet/tls policies to policies.packet + policies.app.tls.
tests/firewall/ruletype-firewall-83-ruleset-default-packet-policy-accept-flow/suricata.yaml	Convert packet filter policy to policies.packet.filter.
tests/firewall/ruletype-firewall-82-ruleset-default-app-policy-accept-flow/suricata.yaml	Convert packet/tls policies to policies.packet + policies.app.tls.
tests/firewall/ruletype-firewall-81-ruleset-default-packet-policy-accept-hook-all/suricata.yaml	Convert packet/tls policies to policies.packet + policies.app.tls.
tests/firewall/ruletype-firewall-80-ruleset-default-packet-policy-accept-hook-no-rules/suricata.yaml	Convert packet filter policy to policies.packet.filter.
tests/firewall/ruletype-firewall-79-ruleset-default-packet-policy-accept-hook/suricata.yaml	Convert packet filter policy to policies.packet.filter.
tests/firewall/ruletype-firewall-78-ruleset-default-packet-policy-accept/suricata.yaml	Convert packet filter policy to policies.packet.filter.
tests/firewall/ruletype-firewall-77-ruleset-default-packet-policy/suricata.yaml	Convert packet filter policy to policies.packet.filter.
tests/firewall/ruletype-firewall-76-config-default-policy-http-accept-tx-td/suricata.yaml	Convert HTTP default-policy config to policies.app.http1.
tests/firewall/ruletype-firewall-75-config-default-policy-http-accept-tx/suricata.yaml	Convert HTTP default-policy config to policies.app.http1.
tests/firewall/ruletype-firewall-74-config-default-policy-dns/suricata.yaml	Convert DNS default-policy config to policies.app.dns.
tests/firewall/ruletype-firewall-73-config-default-policy-http/suricata.yaml	Convert HTTP default-policy config to policies.app.http1.
tests/firewall/ruletype-firewall-72-config-default-policy-http/suricata.yaml	Convert HTTP default-policy config to policies.app.http1.
tests/firewall/ruletype-firewall-71-reject-app-default-policy/suricata.yaml	Convert TLS policy config to policies.app.tls.
tests/firewall/ruletype-firewall-70-config-default-policy-http/suricata.yaml	Convert HTTP default-policy config to policies.app.http1.
tests/firewall/ruletype-firewall-69-config-default-policy-tls-accept/suricata.yaml	Convert TLS default-policy config to policies.app.tls.
tests/firewall/ruletype-firewall-68-config-default-policy-tls/suricata.yaml	Convert TLS default-policy config to policies.app.tls.
tests/firewall/ruletype-firewall-151-default-policy-per-proto/test.yaml	New test assertions for per-protocol default-policy behavior.
tests/firewall/ruletype-firewall-151-default-policy-per-proto/suricata.yaml	New Suricata config for per-protocol default-policy behavior.
tests/firewall/ruletype-firewall-151-default-policy-per-proto/README.md	New test documentation for per-protocol default-policy behavior.
tests/firewall/ruletype-firewall-151-default-policy-per-proto/firewall.rules	New rules file to enable firewall-mode for the test.
tests/firewall/ruletype-firewall-150-default-policy-global/test.yaml	New test assertions for global default-policy behavior.
tests/firewall/ruletype-firewall-150-default-policy-global/suricata.yaml	New Suricata config for global default-policy behavior.
tests/firewall/ruletype-firewall-150-default-policy-global/README.md	New test documentation for global default-policy behavior.
tests/firewall/ruletype-firewall-150-default-policy-global/firewall.rules	New rules file to enable firewall-mode for the test.
tests/firewall/ruletype-firewall-149-default-policy-scope-substate/test.yaml	New startup-failure test for invalid default-policy scope under a substate.
tests/firewall/ruletype-firewall-149-default-policy-scope-substate/suricata.yaml	New Suricata config that intentionally triggers invalid-scope validation.
tests/firewall/ruletype-firewall-149-default-policy-scope-substate/README.md	New test documentation for invalid-scope validation under a substate.
tests/firewall/ruletype-firewall-149-default-policy-scope-substate/firewall.rules	New rules file to enable firewall-mode for the test.
tests/firewall/ruletype-firewall-148-default-policy-scope-app-hook/test.yaml	New startup-failure test for invalid global default-policy scope at app hooks.
tests/firewall/ruletype-firewall-148-default-policy-scope-app-hook/suricata.yaml	New Suricata config that intentionally triggers invalid-scope validation.
tests/firewall/ruletype-firewall-148-default-policy-scope-app-hook/README.md	New test documentation for invalid-scope validation at app hooks.
tests/firewall/ruletype-firewall-148-default-policy-scope-app-hook/firewall.rules	New rules file to enable firewall-mode for the test.
tests/firewall/ruletype-firewall-147-default-policy-scope-packet-hook/test.yaml	New startup-failure test for invalid global default-policy scope at packet hooks.
tests/firewall/ruletype-firewall-147-default-policy-scope-packet-hook/suricata.yaml	New Suricata config that intentionally triggers invalid-scope validation.
tests/firewall/ruletype-firewall-147-default-policy-scope-packet-hook/README.md	New test documentation for invalid-scope validation at packet hooks.
tests/firewall/ruletype-firewall-147-default-policy-scope-packet-hook/firewall.rules	New rules file to enable firewall-mode for the test.
tests/firewall/ruletype-firewall-146-default-policy-tls-request-complete/test.yaml	New test assertions for TLS request-complete alias resolution + default-policy use.
tests/firewall/ruletype-firewall-146-default-policy-tls-request-complete/suricata.yaml	New Suricata config for TLS request-complete alias resolution test.
tests/firewall/ruletype-firewall-146-default-policy-tls-request-complete/README.md	New test documentation for TLS request-complete alias resolution.
tests/firewall/ruletype-firewall-146-default-policy-tls-request-complete/firewall.rules	New rules file to enable firewall-mode for the test.
tests/firewall/ruletype-firewall-145-default-policy-substate-fallthrough/test.yaml	New test assertions for substate default-policy fallthrough behavior.
tests/firewall/ruletype-firewall-145-default-policy-substate-fallthrough/suricata.yaml	New Suricata config for substate default-policy fallthrough behavior.
tests/firewall/ruletype-firewall-145-default-policy-substate-fallthrough/README.md	New test documentation for substate default-policy fallthrough behavior.
tests/firewall/ruletype-firewall-145-default-policy-substate-fallthrough/firewall.rules	New rules file to enable firewall-mode for the test.
tests/firewall/ruletype-firewall-144-default-policy-substate/test.yaml	New test assertions for substate default-policy precedence behavior.
tests/firewall/ruletype-firewall-144-default-policy-substate/suricata.yaml	New Suricata config for substate default-policy precedence behavior.
tests/firewall/ruletype-firewall-144-default-policy-substate/README.md	New test documentation for substate default-policy precedence behavior.
tests/firewall/ruletype-firewall-144-default-policy-substate/firewall.rules	New rules file to enable firewall-mode for the test.
tests/firewall/ruletype-firewall-143-default-policy-app-layer/test.yaml	New test assertions for app.default-policy behavior across protocols.
tests/firewall/ruletype-firewall-143-default-policy-app-layer/suricata.yaml	New Suricata config for app.default-policy behavior across protocols.
tests/firewall/ruletype-firewall-143-default-policy-app-layer/README.md	New test documentation for app.default-policy behavior across protocols.
tests/firewall/ruletype-firewall-143-default-policy-app-layer/firewall.rules	New rules file to enable firewall-mode for the test.
tests/firewall/ruletype-firewall-142-default-policy-packet-precedence/test.yaml	New test assertions for packet default-policy precedence vs global default-policy.
tests/firewall/ruletype-firewall-142-default-policy-packet-precedence/suricata.yaml	New Suricata config for packet default-policy precedence behavior.
tests/firewall/ruletype-firewall-142-default-policy-packet-precedence/README.md	New test documentation for packet default-policy precedence behavior.
tests/firewall/ruletype-firewall-142-default-policy-packet-precedence/firewall.rules	New rules file to enable firewall-mode for the test.
tests/firewall/ruletype-firewall-141-default-policy-packet-hooks/test.yaml	New test assertions that packet default-policy applies across packet hooks.
tests/firewall/ruletype-firewall-141-default-policy-packet-hooks/suricata.yaml	New Suricata config for packet-hook default-policy coverage.
tests/firewall/ruletype-firewall-141-default-policy-packet-hooks/README.md	New test documentation for packet-hook default-policy coverage.
tests/firewall/ruletype-firewall-141-default-policy-packet-hooks/firewall.rules	New rules file to enable firewall-mode for the test.
tests/firewall/ruletype-firewall-131-http2-mixed-rule/suricata.yaml	Convert HTTP/2 + DoH2 policies to policies.app.* with updated hook keys.
tests/firewall/ruletype-firewall-130-doh2-disabled/suricata.yaml	Convert HTTP/2 + DoH2 policies to policies.app.* with updated hook keys.
tests/firewall/ruletype-firewall-129-doh2-crash/suricata.yaml	Convert HTTP/2 + DoH2 policies to policies.app.* with updated hook keys.
tests/firewall/ruletype-firewall-128-doh2/suricata.yaml	Convert HTTP/2 + DoH2 policies to policies.app.* with updated hook keys.
tests/firewall/ruletype-firewall-124-http2-substate-default-policy/suricata.yaml	Convert HTTP/2 substate policies to policies.app.http2.*.
tests/firewall/ruletype-firewall-121-ftp-bounce/suricata.yaml	Convert packet + FTP/FTP-DATA policies to policies.packet + policies.app.*.
tests/firewall/ruletype-firewall-120-ftp-drop-by-dynamic-port/suricata.yaml	Convert packet + FTP/FTP-DATA policies to policies.packet + policies.app.*.
tests/firewall/ruletype-firewall-119-ftp-non-anonymous-default-allow/suricata.yaml	Convert packet + FTP/FTP-DATA policies to policies.packet + policies.app.*.
tests/firewall/ruletype-firewall-115-ftp-download-active-user/suricata.yaml	Convert FTP-DATA policies to policies.app.ftp-data.
tests/firewall/ruletype-firewall-108-default-app-policy-missed-rule-accept-tx-alert/suricata.yaml	Convert HTTP policies to policies.app.http1.
tests/firewall/ruletype-firewall-107-default-app-policy-missed-rule-accept-tx-alert/suricata.yaml	Convert HTTP policies to policies.app.http1.
tests/firewall/ruletype-firewall-106-default-app-policy-accept-flow-alert/suricata.yaml	Convert packet/http policies to policies.packet + policies.app.http1.
tests/firewall/ruletype-firewall-105-default-packet-policy-alert-app-rule/suricata.yaml	Convert packet/http policies to policies.packet + policies.app.http1.
tests/firewall/ruletype-firewall-104-default-app-policy-missed-rule-alert/suricata.yaml	Convert HTTP policies to policies.app.http1.
tests/firewall/ruletype-firewall-103-default-app-policy-drop-alert/suricata.yaml	Convert DNS policies to policies.app.dns.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[catenacyber]

Why is main8 CI red ?

[lukashino]

YAML configuration format has been changed for the firewall mode. It passes in relevant PRs

[lukashino]

hm ok, so this would require some test duplication because the YAML format changed on tests that were targeting version 8 and higher.

I expect the Suricata 8 backport might be fast-forwarded since it is part of OISF/suricata#15951

[victorjulien]

Needs a rebase.

[lukashino]

#3307 follow-up