Backport/8.0.x: firewall: test the default policy v1

tests/detect-email-date/test.yaml

@@ -15,17 +15,17 @@ checks:
       alert.signature_id: 1
 - filter:
     requires:
-      min-version: 9
+      min-version: 8.0.7
     count: 1
     match:
       event_type: smtp
       email.date: Fri, 21 Apr 2023 05:10:36 +0000
       pcap_cnt: 14
-# Pre-9 does not defer tx completion to the server response, so the
-# SMTP event lands one packet earlier. Remove when backported to 8.
+# Pre-8.0.7 does not defer tx completion to the server response, so the
+# SMTP event lands one packet earlier. Backported to 8.0.7.
 - filter:
     requires:
-      lt-version: 9
+      lt-version: 8.0.7
     count: 1
     match:
       event_type: smtp

tests/detect-email-msg-id/test.yaml

@@ -15,17 +15,17 @@ checks:
       alert.signature_id: 1
 - filter:
     requires:
-      min-version: 9
+      min-version: 8.0.7
     count: 1
     match:
       event_type: smtp
       email.message_id: <alpine.DEB.2.00.1311261630120.9535@sd-26634.dedibox.fr>
       pcap_cnt: 14
-# Pre-9 does not defer tx completion to the server response, so the
-# SMTP event lands one packet earlier. Remove when backported to 8.
+# Pre-8.0.7 does not defer tx completion to the server response, so the
+# SMTP event lands one packet earlier. Backported to 8.0.7.
 - filter:
     requires:
-      lt-version: 9
+      lt-version: 8.0.7
     count: 1
     match:
       event_type: smtp

tests/detect-email-subject/test.yaml

@@ -15,17 +15,17 @@ checks:
       alert.signature_id: 1
 - filter:
     requires:
-      min-version: 9
+      min-version: 8.0.7
     count: 1
     match:
       event_type: smtp
       pcap_cnt: 14
       email.subject: This is a test email
-# Pre-9 does not defer tx completion to the server response, so the
-# SMTP event lands one packet earlier. Remove when backported to 8.
+# Pre-8.0.7 does not defer tx completion to the server response, so the
+# SMTP event lands one packet earlier. Backported to 8.0.7.
 - filter:
     requires:
-      lt-version: 9
+      lt-version: 8.0.7
     count: 1
     match:
       event_type: smtp

tests/firewall/ruletype-firewall-103-default-app-policy-drop-alert/suricata.yaml

@@ -20,13 +20,14 @@ outputs:
 
 firewall:
   policies:
-    dns:
-      # Allow DNS requests to start.
-      request-started: ["accept:hook"]
+    app:
+      dns:
+        # Allow DNS requests to start.
+        request-started: ["accept:hook"]
 
-      # Drop and alert on all DNS requests that are not allowed in
-      # firewall.rules.
-      request-complete: ["drop:flow", "alert"]
+        # Drop and alert on all DNS requests that are not allowed in
+        # firewall.rules.
+        request-complete: ["drop:flow", "alert"]
 
-      # Accept all responses.
-      response-started: ["accept:flow"]
+        # Accept all responses.
+        response-started: ["accept:flow"]

tests/firewall/ruletype-firewall-104-default-app-policy-missed-rule-alert/suricata.yaml

@@ -21,6 +21,7 @@ outputs:
 
 firewall:
   policies:
-    http:
-      request-started: ["accept:hook"]
-      request-line: ["drop:flow", "alert"]
+    app:
+      http1:
+        request-started: ["accept:hook"]
+        request-line: ["drop:flow", "alert"]

tests/firewall/ruletype-firewall-105-default-packet-policy-alert-app-rule/suricata.yaml

@@ -21,17 +21,19 @@ outputs:
 
 firewall:
   policies:
-    packet-filter: ["accept:hook", "alert"]
-    http:
-      request-started: ["accept:hook"]
-      request-line: ["accept:hook"]
-      request-headers: ["accept:hook"]
-      request-body: ["accept:hook"]
-      request-trailer: ["accept:hook"]
-      request-complete: ["accept:hook"]
-      response-started: ["accept:hook"]
-      response-line: ["accept:hook"]
-      response-headers: ["accept:hook"]
-      response-body: ["accept:hook"]
-      response-trailer: ["accept:hook"]
-      response-complete: ["accept:hook"]
+    packet:
+      filter: ["accept:hook", "alert"]
+    app:
+      http1:
+        request-started: ["accept:hook"]
+        request-line: ["accept:hook"]
+        request-headers: ["accept:hook"]
+        request-body: ["accept:hook"]
+        request-trailer: ["accept:hook"]
+        request-complete: ["accept:hook"]
+        response-started: ["accept:hook"]
+        response-line: ["accept:hook"]
+        response-headers: ["accept:hook"]
+        response-body: ["accept:hook"]
+        response-trailer: ["accept:hook"]
+        response-complete: ["accept:hook"]

tests/firewall/ruletype-firewall-106-default-app-policy-accept-flow-alert/suricata.yaml

@@ -21,6 +21,8 @@ outputs:
 
 firewall:
   policies:
-    packet-filter: ["accept:hook"]
-    http:
-      request-started: ["accept:flow", "alert"]
+    packet:
+      filter: ["accept:hook"]
+    app:
+      http1:
+        request-started: ["accept:flow", "alert"]

tests/firewall/ruletype-firewall-107-default-app-policy-missed-rule-accept-tx-alert/suricata.yaml

@@ -21,8 +21,9 @@ outputs:
 
 firewall:
   policies:
-    http:
-      request-started: ["accept:hook"]
-      request-line:
-        - "accept:tx"
-        - "alert"
+    app:
+      http1:
+        request-started: ["accept:hook"]
+        request-line:
+          - "accept:tx"
+          - "alert"

tests/firewall/ruletype-firewall-108-default-app-policy-missed-rule-accept-tx-alert/suricata.yaml

@@ -21,8 +21,9 @@ outputs:
 
 firewall:
   policies:
-    http:
-      request-started: ["accept:hook"]
-      request-line:
-        - "accept:tx"
-        - "alert"
+    app:
+      http1:
+        request-started: ["accept:hook"]
+        request-line:
+          - "accept:tx"
+          - "alert"

tests/firewall/ruletype-firewall-115-ftp-download-active-user/suricata.yaml

@@ -21,8 +21,7 @@ outputs:
 
 firewall:
   policies:
-    ftp-data:
-      request-started:
-        - "accept:flow"
-      response-started:
-        - "accept:flow"
+    app:
+      ftp-data:
+        request-started: ["accept:flow"]
+        response-started: ["accept:flow"]

tests/firewall/ruletype-firewall-119-ftp-non-anonymous-default-allow/suricata.yaml

@@ -22,21 +22,23 @@ outputs:
 
 firewall:
   policies:
-    packet-filter:
-      - "accept:hook"
-
-    ftp:
-      request-started:
-        - "accept:hook"
-      request-complete:
-        - "accept:hook"
-      response-started:
-        - "accept:hook"
-      response-complete:
+    packet:
+      filter:
         - "accept:hook"
 
-    ftp-data:
-      request-started:
-        - "accept:flow"
-      response-started:
-        - "accept:flow"
+    app:
+      ftp:
+        request-started:
+          - "accept:hook"
+        request-complete:
+          - "accept:hook"
+        response-started:
+          - "accept:hook"
+        response-complete:
+          - "accept:hook"
+
+      ftp-data:
+        request-started:
+          - "accept:flow"
+        response-started:
+          - "accept:flow"

tests/firewall/ruletype-firewall-120-ftp-drop-by-dynamic-port/suricata.yaml

@@ -22,21 +22,23 @@ outputs:
 
 firewall:
   policies:
-    packet-filter:
-      - "accept:hook"
-
-    ftp:
-      request-started:
-        - "accept:hook"
-      request-complete:
-        - "accept:hook"
-      response-started:
-        - "accept:hook"
-      response-complete:
+    packet:
+      filter:
         - "accept:hook"
 
-    ftp-data:
-      request-started:
-        - "accept:flow"
-      response-started:
-        - "accept:flow"
+    app:
+      ftp:
+        request-started:
+          - "accept:hook"
+        request-complete:
+          - "accept:hook"
+        response-started:
+          - "accept:hook"
+        response-complete:
+          - "accept:hook"
+
+      ftp-data:
+        request-started:
+          - "accept:flow"
+        response-started:
+          - "accept:flow"

tests/firewall/ruletype-firewall-121-ftp-bounce/suricata.yaml

@@ -22,21 +22,23 @@ outputs:
 
 firewall:
   policies:
-    packet-filter:
-      - "accept:hook"
-
-    ftp:
-      request-started:
-        - "accept:hook"
-      request-complete:
-        - "accept:hook"
-      response-started:
-        - "accept:hook"
-      response-complete:
+    packet:
+      filter:
         - "accept:hook"
 
-    ftp-data:
-      request-started:
-        - "accept:flow"
-      response-started:
-        - "accept:flow"
+    app:
+      ftp:
+        request-started:
+          - "accept:hook"
+        request-complete:
+          - "accept:hook"
+        response-started:
+          - "accept:hook"
+        response-complete:
+          - "accept:hook"
+
+      ftp-data:
+        request-started:
+          - "accept:flow"
+        response-started:
+          - "accept:flow"

tests/firewall/ruletype-firewall-122-http2-substate/test.yaml

@@ -1,5 +1,5 @@
 requires:
-  min-version: 9
+  min-version: 8.0.7
 
 pcap: ../../http2-userinfo-authority/http2_userinfo_in_authority_1.pcap
 

tests/firewall/ruletype-firewall-122-smtp/test.yaml

@@ -1,5 +1,5 @@
 requires:
-  min-version: 9
+  min-version: 8.0.7
 
 pcap: smtp-simple-session.pcap
 

tests/firewall/ruletype-firewall-123-http2-substate/test.yaml

@@ -1,5 +1,5 @@
 requires:
-  min-version: 9
+  min-version: 8.0.7
 
 pcap: false
 

tests/firewall/ruletype-firewall-123-smtp-blocked-sender/test.yaml

@@ -1,5 +1,5 @@
 requires:
-  min-version: 9
+  min-version: 8.0.7
 
 pcap: ../ruletype-firewall-122-smtp/smtp-simple-session.pcap