Backport/8.0.x: firewall: test the default policy v1

[lukashino]

Redmine ticket: https://redmine.openinfosecfoundation.org/issues/8770

Patchset covers new commits from #3252 but is rebased onto #3229, and enables 8.0.7 for the new tests.

[Copilot]

Pull request overview

This backport updates the suricata-verify test suite to cover firewall default-policy behavior on the 8.0.x line, aligning firewall policy configuration with the newer packet/app schema and enabling the affected tests starting from Suricata 8.0.7.

Changes:

• Lower/adjust requires version gates across SMTP/MIME/rules/email-related tests to run on 8.0.7, updating related pre-/post-backport assertions.
• Convert multiple firewall test suricata.yaml files from the legacy packet-filter / top-level protocol layout to firewall.policies.packet + firewall.policies.app.<proto> (e.g., http1, http2, dns, tls, ftp).
• Add new firewall tests (141–151) that exercise default-policy precedence, substate behavior, and validation error reporting.

Reviewed changes

Copilot reviewed 141 out of 141 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
tests/smtp-quit/test.yaml	Lower min Suricata version gate to 8.0.7
tests/smtp-pipelined-rset-after-complete/test.yaml	Lower min Suricata version gate to 8.0.7
tests/smtp-pipelined-post-data-rset-sequence/test.yaml	Lower min Suricata version gate to 8.0.7
tests/smtp-no-helo-rset/test.yaml	Lower min Suricata version gate to 8.0.7
tests/smtp-no-helo-rset-helo-mail/test.yaml	Lower min Suricata version gate to 8.0.7
tests/smtp-no-helo-quit/test.yaml	Lower min Suricata version gate to 8.0.7
tests/smtp-long-DATA-line/test.yaml	Update pre-/post-8.0.7 behavioral split (lt-version / min-version)
tests/smtp-keywords/test.yaml	Update pre-/post-8.0.7 behavioral split (lt-version / min-version)
tests/smtp-file-data-02/test.yaml	Update version gates and “pre-8.0.7” commentary for SMTP timing/QUIT behavior
tests/smtp-file-data-01/test.yaml	Update version gates and “pre-8.0.7” commentary for SMTP timing/QUIT behavior
tests/smtp-errors/test.yaml	Update anomaly expectations for <8.0.7 vs >=8.0.7
tests/smtp-bug-5981/test.yaml	Update pre-/post-8.0.7 QUIT-tx expectation split
tests/rules/substate-hook/test.yaml	Lower min Suricata version gate to 8.0.7
tests/rules/substate-hook-02/test.yaml	Lower min Suricata version gate to 8.0.7
tests/rules/substate-hook-03/test.yaml	Lower min Suricata version gate to 8.0.7
tests/rules/http-response-body/test.yaml	Lower min Suricata version gate to 8.0.7
tests/rules/http-request-body/test.yaml	Lower min Suricata version gate to 8.0.7
tests/mime/mime-dec-very-small-inp/test.yaml	Update version gates and pre-/post-8.0.7 SMTP event positioning assumptions
tests/mime/mime-dec-parse-small-rem-inp/test.yaml	Update version gates and pre-/post-8.0.7 SMTP event positioning assumptions
tests/mime/mime-dec-parse-rem-sp/test.yaml	Update version gates and pre-/post-8.0.7 SMTP event positioning assumptions
tests/mime/mime-dec-parse-odd-len/test.yaml	Update version gates and pre-/post-8.0.7 SMTP event positioning assumptions
tests/mime/mime-dec-parse-long-filename02/test.yaml	Update version gates and pre-/post-8.0.7 SMTP event positioning assumptions
tests/mime/mime-dec-parse-long-filename01/test.yaml	Update version gates and pre-/post-8.0.7 SMTP event positioning assumptions
tests/mime/mime-dec-parse-line-test02/test.yaml	Update version gates and pre-/post-8.0.7 SMTP event positioning assumptions
tests/mime/mime-dec-parse-line-test01/test.yaml	Update version gates and pre-/post-8.0.7 SMTP event positioning assumptions
tests/mime/mime-dec-parse-full-msg-test02/test.yaml	Update version gates and pre-/post-8.0.7 SMTP event positioning assumptions
tests/mime/mime-dec-parse-full-msg-test01/test.yaml	Update version gates and pre-/post-8.0.7 SMTP event positioning assumptions
tests/http2-keywords2/test.yaml	Update pre-/post-8.0.7 expectations for alert counts
tests/detect-email-subject/test.yaml	Update pre-/post-8.0.7 SMTP event positioning assumptions
tests/detect-email-msg-id/test.yaml	Update pre-/post-8.0.7 SMTP event positioning assumptions
tests/detect-email-date/test.yaml	Update pre-/post-8.0.7 SMTP event positioning assumptions
tests/firewall/ruletype-firewall-95-ruleset-default-packet-policy-accept-hook-alert/suricata.yaml	Migrate firewall policy config to packet/app schema
tests/firewall/ruletype-firewall-94-config-default-policy-http/suricata.yaml	Migrate HTTP policy config to app.http1 schema
tests/firewall/ruletype-firewall-93-lt-ua-mix-accept-hook/suricata.yaml	Migrate HTTP policy config to app.http1 schema
tests/firewall/ruletype-firewall-92-lt-ua-mix/suricata.yaml	Migrate HTTP policy config to app.http1 schema
tests/firewall/ruletype-firewall-89-defaults-over-drop/suricata.yaml	Migrate firewall policy config to packet/app.http1 schema
tests/firewall/ruletype-firewall-88-default-accept-tx-pipeline/suricata.yaml	Migrate firewall policy config to packet/app.http1 schema
tests/firewall/ruletype-firewall-87-broken-default-policy/suricata.yaml	Migrate HTTP policy config to app.http1 schema
tests/firewall/ruletype-firewall-86-packet-filter-accept-flow-pass-with-td/suricata.yaml	Migrate HTTP policy config to app.http1 schema
tests/firewall/ruletype-firewall-84-ruleset-default-app-policy-tls-request-started/suricata.yaml	Migrate firewall policy config to packet/app.tls schema
tests/firewall/ruletype-firewall-83-ruleset-default-packet-policy-accept-flow/suricata.yaml	Migrate packet filter config to packet.filter schema
tests/firewall/ruletype-firewall-82-ruleset-default-app-policy-accept-flow/suricata.yaml	Migrate firewall policy config to packet/app.tls schema
tests/firewall/ruletype-firewall-81-ruleset-default-packet-policy-accept-hook-all/suricata.yaml	Migrate firewall policy config to packet/app.tls schema
tests/firewall/ruletype-firewall-80-ruleset-default-packet-policy-accept-hook-no-rules/suricata.yaml	Migrate packet filter config to packet.filter schema
tests/firewall/ruletype-firewall-79-ruleset-default-packet-policy-accept-hook/suricata.yaml	Migrate packet filter config to packet.filter schema
tests/firewall/ruletype-firewall-78-ruleset-default-packet-policy-accept/suricata.yaml	Migrate packet filter config to packet.filter schema
tests/firewall/ruletype-firewall-77-ruleset-default-packet-policy/suricata.yaml	Migrate packet filter config to packet.filter schema
tests/firewall/ruletype-firewall-76-config-default-policy-http-accept-tx-td/suricata.yaml	Migrate HTTP policy config to app.http1 schema
tests/firewall/ruletype-firewall-75-config-default-policy-http-accept-tx/suricata.yaml	Migrate HTTP policy config to app.http1 schema
tests/firewall/ruletype-firewall-74-config-default-policy-dns/suricata.yaml	Migrate DNS policy config to app.dns schema
tests/firewall/ruletype-firewall-73-config-default-policy-http/suricata.yaml	Migrate HTTP policy config to app.http1 schema
tests/firewall/ruletype-firewall-72-config-default-policy-http/suricata.yaml	Migrate HTTP policy config to app.http1 schema
tests/firewall/ruletype-firewall-71-reject-app-default-policy/suricata.yaml	Migrate TLS policy config to app.tls schema
tests/firewall/ruletype-firewall-70-config-default-policy-http/suricata.yaml	Migrate HTTP policy config to app.http1 schema
tests/firewall/ruletype-firewall-69-config-default-policy-tls-accept/suricata.yaml	Migrate TLS policy config to app.tls schema
tests/firewall/ruletype-firewall-68-config-default-policy-tls/suricata.yaml	Migrate TLS policy config to app.tls schema
tests/firewall/ruletype-firewall-131-http2-mixed-rule/test.yaml	Lower min Suricata version gate to 8.0.7
tests/firewall/ruletype-firewall-131-http2-mixed-rule/suricata.yaml	Migrate HTTP/2 + DoH2 policy config to app.http2 / app.doh2 schema
tests/firewall/ruletype-firewall-130-smtp-rset-after-rcpt/test.yaml	Lower min Suricata version gate to 8.0.7
tests/firewall/ruletype-firewall-130-doh2-disabled/suricata.yaml	Migrate HTTP/2 + DoH2 policy config to app.http2 / app.doh2 schema
tests/firewall/ruletype-firewall-129-smtp-rset-next-tx-blocked-sender/test.yaml	Lower min Suricata version gate to 8.0.7
tests/firewall/ruletype-firewall-129-doh2-crash/test.yaml	Lower min Suricata version gate to 8.0.7
tests/firewall/ruletype-firewall-129-doh2-crash/suricata.yaml	Migrate HTTP/2 + DoH2 policy config to app.http2 / app.doh2 schema
tests/firewall/ruletype-firewall-128-smtp-rset-next-tx-delivered/test.yaml	Lower min Suricata version gate to 8.0.7
tests/firewall/ruletype-firewall-128-doh2/test.yaml	Lower min Suricata version gate to 8.0.7
tests/firewall/ruletype-firewall-128-doh2/suricata.yaml	Migrate HTTP/2 + DoH2 policy config to app.http2 / app.doh2 schema
tests/firewall/ruletype-firewall-127-smtp-interactive-commands/test.yaml	Lower min Suricata version gate to 8.0.7
tests/firewall/ruletype-firewall-127-http2-no-substate/test.yaml	Lower min Suricata version gate to 8.0.7
tests/firewall/ruletype-firewall-126-smtp-any-rcpt-allowed-accept/test.yaml	Lower min Suricata version gate to 8.0.7
tests/firewall/ruletype-firewall-126-http2-substate-lte/test.yaml	Lower min Suricata version gate to 8.0.7
tests/firewall/ruletype-firewall-125-smtp-all-rcpts-required-drop/test.yaml	Lower min Suricata version gate to 8.0.7
tests/firewall/ruletype-firewall-125-http2-substate/test.yaml	Lower min Suricata version gate to 8.0.7
tests/firewall/ruletype-firewall-124-smtp-blocked-rcpt-to/test.yaml	Lower min Suricata version gate to 8.0.7
tests/firewall/ruletype-firewall-124-http2-substate-default-policy/test.yaml	Lower min Suricata version gate to 8.0.7
tests/firewall/ruletype-firewall-124-http2-substate-default-policy/suricata.yaml	Migrate HTTP/2 policy config to app.http2 schema
tests/firewall/ruletype-firewall-123-smtp-blocked-sender/test.yaml	Lower min Suricata version gate to 8.0.7
tests/firewall/ruletype-firewall-123-http2-substate/test.yaml	Lower min Suricata version gate to 8.0.7
tests/firewall/ruletype-firewall-122-smtp/test.yaml	Lower min Suricata version gate to 8.0.7
tests/firewall/ruletype-firewall-122-http2-substate/test.yaml	Lower min Suricata version gate to 8.0.7
tests/firewall/ruletype-firewall-121-ftp-bounce/suricata.yaml	Migrate FTP policy config to packet/app.ftp/app.ftp-data schema
tests/firewall/ruletype-firewall-120-ftp-drop-by-dynamic-port/suricata.yaml	Migrate FTP policy config to packet/app.ftp/app.ftp-data schema
tests/firewall/ruletype-firewall-119-ftp-non-anonymous-default-allow/suricata.yaml	Migrate FTP policy config to packet/app.ftp/app.ftp-data schema
tests/firewall/ruletype-firewall-115-ftp-download-active-user/suricata.yaml	Migrate FTP-DATA policy config to app.ftp-data schema
tests/firewall/ruletype-firewall-108-default-app-policy-missed-rule-accept-tx-alert/suricata.yaml	Migrate HTTP policy config to app.http1 schema
tests/firewall/ruletype-firewall-107-default-app-policy-missed-rule-accept-tx-alert/suricata.yaml	Migrate HTTP policy config to app.http1 schema
tests/firewall/ruletype-firewall-106-default-app-policy-accept-flow-alert/suricata.yaml	Migrate packet + HTTP policy config to packet/app.http1 schema
tests/firewall/ruletype-firewall-105-default-packet-policy-alert-app-rule/suricata.yaml	Migrate packet + HTTP policy config to packet/app.http1 schema
tests/firewall/ruletype-firewall-104-default-app-policy-missed-rule-alert/suricata.yaml	Migrate HTTP policy config to app.http1 schema
tests/firewall/ruletype-firewall-103-default-app-policy-drop-alert/suricata.yaml	Migrate DNS policy config to app.dns schema
tests/firewall/ruletype-firewall-141-default-policy-packet-hooks/test.yaml	Add test for packet.default-policy behavior across packet hooks
tests/firewall/ruletype-firewall-141-default-policy-packet-hooks/suricata.yaml	Add config for packet.default-policy across packet hooks
tests/firewall/ruletype-firewall-141-default-policy-packet-hooks/README.md	Document packet-hook default-policy behavior under test
tests/firewall/ruletype-firewall-141-default-policy-packet-hooks/firewall.rules	Add rules to install hooks needed for the packet default-policy test
tests/firewall/ruletype-firewall-142-default-policy-packet-precedence/test.yaml	Add test for packet.default-policy precedence over global default
tests/firewall/ruletype-firewall-142-default-policy-packet-precedence/suricata.yaml	Add config for packet.default-policy precedence scenario
tests/firewall/ruletype-firewall-142-default-policy-packet-precedence/README.md	Document precedence behavior under test
tests/firewall/ruletype-firewall-142-default-policy-packet-precedence/firewall.rules	Add rules to install hooks needed for precedence test
tests/firewall/ruletype-firewall-143-default-policy-app-layer/test.yaml	Add test for app.default-policy covering app-layer hooks
tests/firewall/ruletype-firewall-143-default-policy-app-layer/suricata.yaml	Add config for app.default-policy scenario
tests/firewall/ruletype-firewall-143-default-policy-app-layer/README.md	Document app.default-policy behavior under test
tests/firewall/ruletype-firewall-143-default-policy-app-layer/firewall.rules	Add minimal rule file to enable firewall-mode run
tests/firewall/ruletype-firewall-144-default-policy-substate/test.yaml	Add test for substate default-policy precedence over per-protocol
tests/firewall/ruletype-firewall-144-default-policy-substate/suricata.yaml	Add config for HTTP/2 substate default-policy precedence
tests/firewall/ruletype-firewall-144-default-policy-substate/README.md	Document substate resolution chain under test
tests/firewall/ruletype-firewall-144-default-policy-substate/firewall.rules	Add minimal hook installation for HTTP/2 substate test
tests/firewall/ruletype-firewall-145-default-policy-substate-fallthrough/test.yaml	Add test for substate fallthrough to per-protocol default
tests/firewall/ruletype-firewall-145-default-policy-substate-fallthrough/suricata.yaml	Add config for fallthrough behavior scenario
tests/firewall/ruletype-firewall-145-default-policy-substate-fallthrough/README.md	Document fallthrough behavior under test
tests/firewall/ruletype-firewall-145-default-policy-substate-fallthrough/firewall.rules	Add rules to enable firewall-mode and hook installation
tests/firewall/ruletype-firewall-146-default-policy-tls-request-complete/test.yaml	Add TLS test for request-complete alias resolving to protocol final state
tests/firewall/ruletype-firewall-146-default-policy-tls-request-complete/suricata.yaml	Add config for TLS request-complete alias coverage
tests/firewall/ruletype-firewall-146-default-policy-tls-request-complete/README.md	Document request-complete alias behavior under test
tests/firewall/ruletype-firewall-146-default-policy-tls-request-complete/firewall.rules	Add minimal rule file to enable firewall-mode run
tests/firewall/ruletype-firewall-147-default-policy-scope-packet-hook/test.yaml	Add negative test for invalid app-only scope in global default-policy (packet hook)
tests/firewall/ruletype-firewall-147-default-policy-scope-packet-hook/suricata.yaml	Add config with invalid global default-policy scope
tests/firewall/ruletype-firewall-147-default-policy-scope-packet-hook/README.md	Document scope validation behavior under test
tests/firewall/ruletype-firewall-147-default-policy-scope-packet-hook/firewall.rules	Add minimal rule file to enable firewall-mode run
tests/firewall/ruletype-firewall-148-default-policy-scope-app-hook/test.yaml	Add negative test for invalid packet-only scope in global default-policy (app hook)
tests/firewall/ruletype-firewall-148-default-policy-scope-app-hook/suricata.yaml	Add config with invalid global default-policy scope
tests/firewall/ruletype-firewall-148-default-policy-scope-app-hook/README.md	Document scope validation behavior under test
tests/firewall/ruletype-firewall-148-default-policy-scope-app-hook/firewall.rules	Add minimal rule file to enable firewall-mode run
tests/firewall/ruletype-firewall-149-default-policy-scope-substate/test.yaml	Add negative test for invalid scope in nested substate default-policy
tests/firewall/ruletype-firewall-149-default-policy-scope-substate/suricata.yaml	Add config with invalid nested default-policy scope
tests/firewall/ruletype-firewall-149-default-policy-scope-substate/README.md	Document nested-path validation expectation
tests/firewall/ruletype-firewall-149-default-policy-scope-substate/firewall.rules	Add minimal rule file to enable firewall-mode run
tests/firewall/ruletype-firewall-150-default-policy-global/test.yaml	Add test that global default-policy covers packet + app hooks
tests/firewall/ruletype-firewall-150-default-policy-global/suricata.yaml	Add config for global default-policy scenario
tests/firewall/ruletype-firewall-150-default-policy-global/README.md	Document global default-policy behavior under test
tests/firewall/ruletype-firewall-150-default-policy-global/firewall.rules	Add minimal rule file to enable firewall-mode run
tests/firewall/ruletype-firewall-151-default-policy-per-proto/test.yaml	Add test for per-protocol default-policy with a carved-out hook
tests/firewall/ruletype-firewall-151-default-policy-per-proto/suricata.yaml	Add config for per-protocol default-policy scenario
tests/firewall/ruletype-firewall-151-default-policy-per-proto/README.md	Document per-protocol default-policy behavior under test
tests/firewall/ruletype-firewall-151-default-policy-per-proto/firewall.rules	Add minimal rule file to enable firewall-mode run

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[catenacyber]

Why is main CI red ?