From cbe120669c0c5fb2826859052df11c59a5223229 Mon Sep 17 00:00:00 2001 From: Juliana Fajardini Date: Fri, 17 Jul 2026 16:37:39 -0300 Subject: [PATCH 1/4] tests: ban bypass kw only for td rules in fw mode Bypass keyword should work in firewall mode, with firewall rules. Related to Ticket #8459 --- .../firewall/ruletype-firewall-92-ban-bypass-keyword/README.md | 2 +- .../firewall/ruletype-firewall-92-ban-bypass-keyword/test.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/firewall/ruletype-firewall-92-ban-bypass-keyword/README.md b/tests/firewall/ruletype-firewall-92-ban-bypass-keyword/README.md index a514642236..4473f62f0f 100644 --- a/tests/firewall/ruletype-firewall-92-ban-bypass-keyword/README.md +++ b/tests/firewall/ruletype-firewall-92-ban-bypass-keyword/README.md @@ -1,7 +1,7 @@ # Test Ensure that the engine throws an error if the `bypass` keyword is used -in threat detection rules, as it's banned in firewall mode. +in threat detection rules, as it's banned in firewall mode, for those. ## Ticket diff --git a/tests/firewall/ruletype-firewall-92-ban-bypass-keyword/test.yaml b/tests/firewall/ruletype-firewall-92-ban-bypass-keyword/test.yaml index 47ebe9c623..24db351675 100644 --- a/tests/firewall/ruletype-firewall-92-ban-bypass-keyword/test.yaml +++ b/tests/firewall/ruletype-firewall-92-ban-bypass-keyword/test.yaml @@ -10,6 +10,6 @@ exit-code: 1 checks: - shell: - args: grep "keyword 'bypass' is not allowed in firewall mode" stderr | wc -l + args: grep "keyword 'bypass' is not allowed in threat detection rules with firewall mode" stderr | wc -l expect: 1 From 011120d8fd1b6b098795550e6f18c89309dced17 Mon Sep 17 00:00:00 2001 From: Juliana Fajardini Date: Wed, 29 Jul 2026 22:41:02 -0300 Subject: [PATCH 2/4] tests: add more tests for bypass in fw rules Related to Ticket: #8459 --- .../README.md | 14 +++++ .../firewall.rules | 3 + .../suricata.yaml | 23 +++++++ .../test.yaml | 15 +++++ .../README.md | 14 +++++ .../firewall.rules | 3 + .../suricata.yaml | 23 +++++++ .../test.yaml | 17 ++++++ .../README.md | 14 +++++ .../firewall.rules | 3 + .../suricata.yaml | 23 +++++++ .../test.yaml | 15 +++++ .../README.md | 14 +++++ .../firewall.rules | 3 + .../suricata.yaml | 23 +++++++ .../test.yaml | 15 +++++ .../README.md | 14 +++++ .../firewall.rules | 3 + .../suricata.yaml | 23 +++++++ .../test.yaml | 15 +++++ .../README.md | 14 +++++ .../firewall.rules | 3 + .../suricata.yaml | 23 +++++++ .../test.yaml | 15 +++++ .../README.md | 24 ++++++++ .../firewall.rules | 24 ++++++++ .../suricata.yaml | 22 +++++++ .../td.rules | 3 + .../test.yaml | 54 ++++++++++++++++ .../README.md | 36 +++++++++++ .../firewall.rules | 23 +++++++ .../suricata.yaml | 22 +++++++ .../td.rules | 9 +++ .../test.yaml | 61 +++++++++++++++++++ 34 files changed, 610 insertions(+) create mode 100644 tests/firewall/ruletype-firewall-144-bypass-keyword-drop/README.md create mode 100644 tests/firewall/ruletype-firewall-144-bypass-keyword-drop/firewall.rules create mode 100644 tests/firewall/ruletype-firewall-144-bypass-keyword-drop/suricata.yaml create mode 100644 tests/firewall/ruletype-firewall-144-bypass-keyword-drop/test.yaml create mode 100644 tests/firewall/ruletype-firewall-145-bypass-keyword-reject/README.md create mode 100644 tests/firewall/ruletype-firewall-145-bypass-keyword-reject/firewall.rules create mode 100644 tests/firewall/ruletype-firewall-145-bypass-keyword-reject/suricata.yaml create mode 100644 tests/firewall/ruletype-firewall-145-bypass-keyword-reject/test.yaml create mode 100644 tests/firewall/ruletype-firewall-146-bypass-keyword-accept-packet/README.md create mode 100644 tests/firewall/ruletype-firewall-146-bypass-keyword-accept-packet/firewall.rules create mode 100644 tests/firewall/ruletype-firewall-146-bypass-keyword-accept-packet/suricata.yaml create mode 100644 tests/firewall/ruletype-firewall-146-bypass-keyword-accept-packet/test.yaml create mode 100644 tests/firewall/ruletype-firewall-147-bypass-keyword-config/README.md create mode 100644 tests/firewall/ruletype-firewall-147-bypass-keyword-config/firewall.rules create mode 100644 tests/firewall/ruletype-firewall-147-bypass-keyword-config/suricata.yaml create mode 100644 tests/firewall/ruletype-firewall-147-bypass-keyword-config/test.yaml create mode 100644 tests/firewall/ruletype-firewall-148-bypass-keyword-accept-hook/README.md create mode 100644 tests/firewall/ruletype-firewall-148-bypass-keyword-accept-hook/firewall.rules create mode 100644 tests/firewall/ruletype-firewall-148-bypass-keyword-accept-hook/suricata.yaml create mode 100644 tests/firewall/ruletype-firewall-148-bypass-keyword-accept-hook/test.yaml create mode 100644 tests/firewall/ruletype-firewall-149-bypass-keyword-accept-tx/README.md create mode 100644 tests/firewall/ruletype-firewall-149-bypass-keyword-accept-tx/firewall.rules create mode 100644 tests/firewall/ruletype-firewall-149-bypass-keyword-accept-tx/suricata.yaml create mode 100644 tests/firewall/ruletype-firewall-149-bypass-keyword-accept-tx/test.yaml create mode 100644 tests/firewall/ruletype-firewall-150-bypass-keyword-accept-flow-td-drop-rule/README.md create mode 100644 tests/firewall/ruletype-firewall-150-bypass-keyword-accept-flow-td-drop-rule/firewall.rules create mode 100644 tests/firewall/ruletype-firewall-150-bypass-keyword-accept-flow-td-drop-rule/suricata.yaml create mode 100644 tests/firewall/ruletype-firewall-150-bypass-keyword-accept-flow-td-drop-rule/td.rules create mode 100644 tests/firewall/ruletype-firewall-150-bypass-keyword-accept-flow-td-drop-rule/test.yaml create mode 100644 tests/firewall/ruletype-firewall-151-bypass-keyword-accept-flow-td-pkt-drop-rule/README.md create mode 100644 tests/firewall/ruletype-firewall-151-bypass-keyword-accept-flow-td-pkt-drop-rule/firewall.rules create mode 100644 tests/firewall/ruletype-firewall-151-bypass-keyword-accept-flow-td-pkt-drop-rule/suricata.yaml create mode 100644 tests/firewall/ruletype-firewall-151-bypass-keyword-accept-flow-td-pkt-drop-rule/td.rules create mode 100644 tests/firewall/ruletype-firewall-151-bypass-keyword-accept-flow-td-pkt-drop-rule/test.yaml diff --git a/tests/firewall/ruletype-firewall-144-bypass-keyword-drop/README.md b/tests/firewall/ruletype-firewall-144-bypass-keyword-drop/README.md new file mode 100644 index 0000000000..af58f2eaf1 --- /dev/null +++ b/tests/firewall/ruletype-firewall-144-bypass-keyword-drop/README.md @@ -0,0 +1,14 @@ +Test that the engine properly errors out when an invalid rule action + bypass +keyword is used. + +`bypass` cannot be used with `drop`, `reject`, `accept:packet`, `accept:hook`, `accept:tx`. + +PCAP +==== + +Reused from test tls-random + +Ticket +====== + +https://redmine.openinfosecfoundation.org/issues/8459 diff --git a/tests/firewall/ruletype-firewall-144-bypass-keyword-drop/firewall.rules b/tests/firewall/ruletype-firewall-144-bypass-keyword-drop/firewall.rules new file mode 100644 index 0000000000..d1f93158fc --- /dev/null +++ b/tests/firewall/ruletype-firewall-144-bypass-keyword-drop/firewall.rules @@ -0,0 +1,3 @@ +drop:packet tcp:all any any -> any any (alert; bypass; sid:99;) +accept:flow tcp:flow_start any any -> any 443 (alert; flow:to_server; sid:1;) +drop:flow tcp:flow_start any any -> any any (sid:2;) diff --git a/tests/firewall/ruletype-firewall-144-bypass-keyword-drop/suricata.yaml b/tests/firewall/ruletype-firewall-144-bypass-keyword-drop/suricata.yaml new file mode 100644 index 0000000000..fa1ce7da18 --- /dev/null +++ b/tests/firewall/ruletype-firewall-144-bypass-keyword-drop/suricata.yaml @@ -0,0 +1,23 @@ +%YAML 1.1 +--- + +# Global stats configuration +stats: + enabled: yes + interval: 8 + +# Configure the type of alert (and other) logging you would like. +outputs: + - eve-log: + enabled: yes + filetype: regular #regular|syslog|unix_dgram|unix_stream|redis + filename: eve.json + types: + - stats + - flow + - alert + - tls: + extended: yes # enable this for extended logging information + - drop: + alerts: yes # log alerts that caused drops + flows: all # start or all: 'start' logs only a single drop diff --git a/tests/firewall/ruletype-firewall-144-bypass-keyword-drop/test.yaml b/tests/firewall/ruletype-firewall-144-bypass-keyword-drop/test.yaml new file mode 100644 index 0000000000..0b5519513c --- /dev/null +++ b/tests/firewall/ruletype-firewall-144-bypass-keyword-drop/test.yaml @@ -0,0 +1,15 @@ +requires: + min-version: 9 + +pcap: ../../tls/tls-random/input.pcap + +# the invalid combination rules should make the engine error out +exit-code: 1 + +args: + - --simulate-ips + +checks: +- shell: + args: grep "keyword 'bypass' cannot be used in combination with 'drop' action" stderr | wc -l + expect: 1 diff --git a/tests/firewall/ruletype-firewall-145-bypass-keyword-reject/README.md b/tests/firewall/ruletype-firewall-145-bypass-keyword-reject/README.md new file mode 100644 index 0000000000..af58f2eaf1 --- /dev/null +++ b/tests/firewall/ruletype-firewall-145-bypass-keyword-reject/README.md @@ -0,0 +1,14 @@ +Test that the engine properly errors out when an invalid rule action + bypass +keyword is used. + +`bypass` cannot be used with `drop`, `reject`, `accept:packet`, `accept:hook`, `accept:tx`. + +PCAP +==== + +Reused from test tls-random + +Ticket +====== + +https://redmine.openinfosecfoundation.org/issues/8459 diff --git a/tests/firewall/ruletype-firewall-145-bypass-keyword-reject/firewall.rules b/tests/firewall/ruletype-firewall-145-bypass-keyword-reject/firewall.rules new file mode 100644 index 0000000000..79265d57e7 --- /dev/null +++ b/tests/firewall/ruletype-firewall-145-bypass-keyword-reject/firewall.rules @@ -0,0 +1,3 @@ +reject:packet tcp:all any any -> any any (alert; bypass; sid:99;) +accept:flow tcp:flow_start any any -> any 443 (alert; flow:to_server; sid:1;) +reject:flow tcp:flow_start any any -> any any (sid:2;) diff --git a/tests/firewall/ruletype-firewall-145-bypass-keyword-reject/suricata.yaml b/tests/firewall/ruletype-firewall-145-bypass-keyword-reject/suricata.yaml new file mode 100644 index 0000000000..fa1ce7da18 --- /dev/null +++ b/tests/firewall/ruletype-firewall-145-bypass-keyword-reject/suricata.yaml @@ -0,0 +1,23 @@ +%YAML 1.1 +--- + +# Global stats configuration +stats: + enabled: yes + interval: 8 + +# Configure the type of alert (and other) logging you would like. +outputs: + - eve-log: + enabled: yes + filetype: regular #regular|syslog|unix_dgram|unix_stream|redis + filename: eve.json + types: + - stats + - flow + - alert + - tls: + extended: yes # enable this for extended logging information + - drop: + alerts: yes # log alerts that caused drops + flows: all # start or all: 'start' logs only a single drop diff --git a/tests/firewall/ruletype-firewall-145-bypass-keyword-reject/test.yaml b/tests/firewall/ruletype-firewall-145-bypass-keyword-reject/test.yaml new file mode 100644 index 0000000000..6af756f493 --- /dev/null +++ b/tests/firewall/ruletype-firewall-145-bypass-keyword-reject/test.yaml @@ -0,0 +1,17 @@ +requires: + min-version: 9 + features: + - LIBNET1.1 + +pcap: ../../tls/tls-random/input.pcap + +# the invalid combination rules should make the engine error out +exit-code: 1 + +args: + - --simulate-ips + +checks: +- shell: + args: grep "keyword 'bypass' cannot be used in combination with 'reject' action" stderr | wc -l + expect: 1 diff --git a/tests/firewall/ruletype-firewall-146-bypass-keyword-accept-packet/README.md b/tests/firewall/ruletype-firewall-146-bypass-keyword-accept-packet/README.md new file mode 100644 index 0000000000..af58f2eaf1 --- /dev/null +++ b/tests/firewall/ruletype-firewall-146-bypass-keyword-accept-packet/README.md @@ -0,0 +1,14 @@ +Test that the engine properly errors out when an invalid rule action + bypass +keyword is used. + +`bypass` cannot be used with `drop`, `reject`, `accept:packet`, `accept:hook`, `accept:tx`. + +PCAP +==== + +Reused from test tls-random + +Ticket +====== + +https://redmine.openinfosecfoundation.org/issues/8459 diff --git a/tests/firewall/ruletype-firewall-146-bypass-keyword-accept-packet/firewall.rules b/tests/firewall/ruletype-firewall-146-bypass-keyword-accept-packet/firewall.rules new file mode 100644 index 0000000000..ea71756fec --- /dev/null +++ b/tests/firewall/ruletype-firewall-146-bypass-keyword-accept-packet/firewall.rules @@ -0,0 +1,3 @@ +accept:packet tcp:all any any -> any any (alert; bypass; sid:99;) +accept:flow tcp:flow_start any any -> any 443 (alert; flow:to_server; sid:1;) +accept:flow tcp:flow_start any any -> any any (sid:2;) diff --git a/tests/firewall/ruletype-firewall-146-bypass-keyword-accept-packet/suricata.yaml b/tests/firewall/ruletype-firewall-146-bypass-keyword-accept-packet/suricata.yaml new file mode 100644 index 0000000000..fa1ce7da18 --- /dev/null +++ b/tests/firewall/ruletype-firewall-146-bypass-keyword-accept-packet/suricata.yaml @@ -0,0 +1,23 @@ +%YAML 1.1 +--- + +# Global stats configuration +stats: + enabled: yes + interval: 8 + +# Configure the type of alert (and other) logging you would like. +outputs: + - eve-log: + enabled: yes + filetype: regular #regular|syslog|unix_dgram|unix_stream|redis + filename: eve.json + types: + - stats + - flow + - alert + - tls: + extended: yes # enable this for extended logging information + - drop: + alerts: yes # log alerts that caused drops + flows: all # start or all: 'start' logs only a single drop diff --git a/tests/firewall/ruletype-firewall-146-bypass-keyword-accept-packet/test.yaml b/tests/firewall/ruletype-firewall-146-bypass-keyword-accept-packet/test.yaml new file mode 100644 index 0000000000..5faa00a1df --- /dev/null +++ b/tests/firewall/ruletype-firewall-146-bypass-keyword-accept-packet/test.yaml @@ -0,0 +1,15 @@ +requires: + min-version: 9 + +pcap: ../../tls/tls-random/input.pcap + +# the invalid combination rules should make the engine error out +exit-code: 1 + +args: + - --simulate-ips + +checks: +- shell: + args: grep "keyword 'bypass' cannot be used in combination with 'packet' scope" stderr | wc -l + expect: 1 diff --git a/tests/firewall/ruletype-firewall-147-bypass-keyword-config/README.md b/tests/firewall/ruletype-firewall-147-bypass-keyword-config/README.md new file mode 100644 index 0000000000..af58f2eaf1 --- /dev/null +++ b/tests/firewall/ruletype-firewall-147-bypass-keyword-config/README.md @@ -0,0 +1,14 @@ +Test that the engine properly errors out when an invalid rule action + bypass +keyword is used. + +`bypass` cannot be used with `drop`, `reject`, `accept:packet`, `accept:hook`, `accept:tx`. + +PCAP +==== + +Reused from test tls-random + +Ticket +====== + +https://redmine.openinfosecfoundation.org/issues/8459 diff --git a/tests/firewall/ruletype-firewall-147-bypass-keyword-config/firewall.rules b/tests/firewall/ruletype-firewall-147-bypass-keyword-config/firewall.rules new file mode 100644 index 0000000000..fdb9b73839 --- /dev/null +++ b/tests/firewall/ruletype-firewall-147-bypass-keyword-config/firewall.rules @@ -0,0 +1,3 @@ +config:packet tcp:all any any -> any any (alert; bypass; sid:99;) +accept:flow tcp:flow_start any any -> any 443 (alert; flow:to_server; sid:1;) +drop:flow tcp:flow_start any any -> any any (sid:2;) diff --git a/tests/firewall/ruletype-firewall-147-bypass-keyword-config/suricata.yaml b/tests/firewall/ruletype-firewall-147-bypass-keyword-config/suricata.yaml new file mode 100644 index 0000000000..fa1ce7da18 --- /dev/null +++ b/tests/firewall/ruletype-firewall-147-bypass-keyword-config/suricata.yaml @@ -0,0 +1,23 @@ +%YAML 1.1 +--- + +# Global stats configuration +stats: + enabled: yes + interval: 8 + +# Configure the type of alert (and other) logging you would like. +outputs: + - eve-log: + enabled: yes + filetype: regular #regular|syslog|unix_dgram|unix_stream|redis + filename: eve.json + types: + - stats + - flow + - alert + - tls: + extended: yes # enable this for extended logging information + - drop: + alerts: yes # log alerts that caused drops + flows: all # start or all: 'start' logs only a single drop diff --git a/tests/firewall/ruletype-firewall-147-bypass-keyword-config/test.yaml b/tests/firewall/ruletype-firewall-147-bypass-keyword-config/test.yaml new file mode 100644 index 0000000000..35bc773cab --- /dev/null +++ b/tests/firewall/ruletype-firewall-147-bypass-keyword-config/test.yaml @@ -0,0 +1,15 @@ +requires: + min-version: 9 + +pcap: ../../tls/tls-random/input.pcap + +# the invalid combination rules should make the engine error out +exit-code: 1 + +args: + - --simulate-ips + +checks: +- shell: + args: grep "keyword 'bypass' cannot be used in combination with 'config' action" stderr | wc -l + expect: 1 diff --git a/tests/firewall/ruletype-firewall-148-bypass-keyword-accept-hook/README.md b/tests/firewall/ruletype-firewall-148-bypass-keyword-accept-hook/README.md new file mode 100644 index 0000000000..af58f2eaf1 --- /dev/null +++ b/tests/firewall/ruletype-firewall-148-bypass-keyword-accept-hook/README.md @@ -0,0 +1,14 @@ +Test that the engine properly errors out when an invalid rule action + bypass +keyword is used. + +`bypass` cannot be used with `drop`, `reject`, `accept:packet`, `accept:hook`, `accept:tx`. + +PCAP +==== + +Reused from test tls-random + +Ticket +====== + +https://redmine.openinfosecfoundation.org/issues/8459 diff --git a/tests/firewall/ruletype-firewall-148-bypass-keyword-accept-hook/firewall.rules b/tests/firewall/ruletype-firewall-148-bypass-keyword-accept-hook/firewall.rules new file mode 100644 index 0000000000..fca1fe73ca --- /dev/null +++ b/tests/firewall/ruletype-firewall-148-bypass-keyword-accept-hook/firewall.rules @@ -0,0 +1,3 @@ +accept:hook tcp:all any any -> any any (alert; bypass; sid:99;) +accept:flow tcp:flow_start any any -> any 443 (alert; flow:to_server; sid:1;) +accept:flow tcp:flow_start any any -> any any (sid:2;) diff --git a/tests/firewall/ruletype-firewall-148-bypass-keyword-accept-hook/suricata.yaml b/tests/firewall/ruletype-firewall-148-bypass-keyword-accept-hook/suricata.yaml new file mode 100644 index 0000000000..fa1ce7da18 --- /dev/null +++ b/tests/firewall/ruletype-firewall-148-bypass-keyword-accept-hook/suricata.yaml @@ -0,0 +1,23 @@ +%YAML 1.1 +--- + +# Global stats configuration +stats: + enabled: yes + interval: 8 + +# Configure the type of alert (and other) logging you would like. +outputs: + - eve-log: + enabled: yes + filetype: regular #regular|syslog|unix_dgram|unix_stream|redis + filename: eve.json + types: + - stats + - flow + - alert + - tls: + extended: yes # enable this for extended logging information + - drop: + alerts: yes # log alerts that caused drops + flows: all # start or all: 'start' logs only a single drop diff --git a/tests/firewall/ruletype-firewall-148-bypass-keyword-accept-hook/test.yaml b/tests/firewall/ruletype-firewall-148-bypass-keyword-accept-hook/test.yaml new file mode 100644 index 0000000000..c803f64f6f --- /dev/null +++ b/tests/firewall/ruletype-firewall-148-bypass-keyword-accept-hook/test.yaml @@ -0,0 +1,15 @@ +requires: + min-version: 9 + +pcap: ../../tls/tls-random/input.pcap + +# the invalid combination rules should make the engine error out +exit-code: 1 + +args: + - --simulate-ips + +checks: +- shell: + args: grep "keyword 'bypass' cannot be used in combination with 'hook' scope" stderr | wc -l + expect: 1 diff --git a/tests/firewall/ruletype-firewall-149-bypass-keyword-accept-tx/README.md b/tests/firewall/ruletype-firewall-149-bypass-keyword-accept-tx/README.md new file mode 100644 index 0000000000..af58f2eaf1 --- /dev/null +++ b/tests/firewall/ruletype-firewall-149-bypass-keyword-accept-tx/README.md @@ -0,0 +1,14 @@ +Test that the engine properly errors out when an invalid rule action + bypass +keyword is used. + +`bypass` cannot be used with `drop`, `reject`, `accept:packet`, `accept:hook`, `accept:tx`. + +PCAP +==== + +Reused from test tls-random + +Ticket +====== + +https://redmine.openinfosecfoundation.org/issues/8459 diff --git a/tests/firewall/ruletype-firewall-149-bypass-keyword-accept-tx/firewall.rules b/tests/firewall/ruletype-firewall-149-bypass-keyword-accept-tx/firewall.rules new file mode 100644 index 0000000000..bdbb7b9de6 --- /dev/null +++ b/tests/firewall/ruletype-firewall-149-bypass-keyword-accept-tx/firewall.rules @@ -0,0 +1,3 @@ +accept:tx tcp:all any any -> any any (alert; bypass; sid:99;) +accept:flow tcp:flow_start any any -> any 443 (alert; flow:to_server; sid:1;) +accept:flow tcp:flow_start any any -> any any (sid:2;) diff --git a/tests/firewall/ruletype-firewall-149-bypass-keyword-accept-tx/suricata.yaml b/tests/firewall/ruletype-firewall-149-bypass-keyword-accept-tx/suricata.yaml new file mode 100644 index 0000000000..fa1ce7da18 --- /dev/null +++ b/tests/firewall/ruletype-firewall-149-bypass-keyword-accept-tx/suricata.yaml @@ -0,0 +1,23 @@ +%YAML 1.1 +--- + +# Global stats configuration +stats: + enabled: yes + interval: 8 + +# Configure the type of alert (and other) logging you would like. +outputs: + - eve-log: + enabled: yes + filetype: regular #regular|syslog|unix_dgram|unix_stream|redis + filename: eve.json + types: + - stats + - flow + - alert + - tls: + extended: yes # enable this for extended logging information + - drop: + alerts: yes # log alerts that caused drops + flows: all # start or all: 'start' logs only a single drop diff --git a/tests/firewall/ruletype-firewall-149-bypass-keyword-accept-tx/test.yaml b/tests/firewall/ruletype-firewall-149-bypass-keyword-accept-tx/test.yaml new file mode 100644 index 0000000000..d67bc76d75 --- /dev/null +++ b/tests/firewall/ruletype-firewall-149-bypass-keyword-accept-tx/test.yaml @@ -0,0 +1,15 @@ +requires: + min-version: 9 + +pcap: ../../tls/tls-random/input.pcap + +# the invalid combination rules should make the engine error out +exit-code: 1 + +args: + - --simulate-ips + +checks: +- shell: + args: grep "keyword 'bypass' cannot be used in combination with 'tx' scope" stderr | wc -l + expect: 1 diff --git a/tests/firewall/ruletype-firewall-150-bypass-keyword-accept-flow-td-drop-rule/README.md b/tests/firewall/ruletype-firewall-150-bypass-keyword-accept-flow-td-drop-rule/README.md new file mode 100644 index 0000000000..767eb14c6f --- /dev/null +++ b/tests/firewall/ruletype-firewall-150-bypass-keyword-accept-flow-td-drop-rule/README.md @@ -0,0 +1,24 @@ +Expectation +----------- + +Test that the engine maintains "the "firewall" and "IPS" work as two distinct +devices" premise in a scenario where the same flow packet triggers an +`accept:flow+bypass` firewall rule and a `drop packet` threat detection rule. + +As the firewall rule would be evaluated and processed first in the scenario of a +separate device, the td rule shouldn't drop the packet -- as it wouldn't even +"see" that packet, as a separate device. + +This test mirrors `ruletype-firewall-141` but adds the TD `drop` rule to check +for this corner case. + +Pcap +---- + +Reused from `flowbit-oring` test. + +Ticket +------ + +Related to https://redmine.openinfosecfoundation.org/issues/8459. + diff --git a/tests/firewall/ruletype-firewall-150-bypass-keyword-accept-flow-td-drop-rule/firewall.rules b/tests/firewall/ruletype-firewall-150-bypass-keyword-accept-flow-td-drop-rule/firewall.rules new file mode 100644 index 0000000000..d5f6152184 --- /dev/null +++ b/tests/firewall/ruletype-firewall-150-bypass-keyword-accept-flow-td-drop-rule/firewall.rules @@ -0,0 +1,24 @@ +# Packet rules + +accept:hook tcp:all any any -> any any (sid:100;) + +# default drop + +# App-layer rules + +accept:hook http1:request_started any any -> any any (sid:101;) +accept:hook http1:request_line any any -> any any (sid:102;) + +accept:flow,alert http1:request_headers any any -> any any (msg:"Firewall accept flow with bypass for testmyids"; http.host; content:"www.testmyids.com"; bypass; sid:103;) + +accept:hook http1:request_body any any -> any any (sid:104;) +accept:hook http1:request_trailer any any -> any any (sid:105;) +accept:hook http1:request_complete any any -> any any (sid:106;) + +accept:hook http1:response_started any any -> any any (sid:201;) +accept:hook http1:response_line any any -> any any (sid:202;) +accept:hook http1:response_headers any any -> any any (sid:203;) +accept:hook http1:response_body any any -> any any (sid:204;) +accept:hook http1:response_trailer any any -> any any (sid:205;) +accept:hook http1:response_complete any any -> any any (sid:206;) + diff --git a/tests/firewall/ruletype-firewall-150-bypass-keyword-accept-flow-td-drop-rule/suricata.yaml b/tests/firewall/ruletype-firewall-150-bypass-keyword-accept-flow-td-drop-rule/suricata.yaml new file mode 100644 index 0000000000..398a898e23 --- /dev/null +++ b/tests/firewall/ruletype-firewall-150-bypass-keyword-accept-flow-td-drop-rule/suricata.yaml @@ -0,0 +1,22 @@ +%YAML 1.1 +--- + +stats: + enabled: yes + interval: 8 + +outputs: + - eve-log: + enabled: yes + filetype: regular + filename: eve.json + types: + - stats + - alert: + verdict: true + - drop: + alerts: yes + flows: all + verdict: true + - flow + - http diff --git a/tests/firewall/ruletype-firewall-150-bypass-keyword-accept-flow-td-drop-rule/td.rules b/tests/firewall/ruletype-firewall-150-bypass-keyword-accept-flow-td-drop-rule/td.rules new file mode 100644 index 0000000000..5975d0c763 --- /dev/null +++ b/tests/firewall/ruletype-firewall-150-bypass-keyword-accept-flow-td-drop-rule/td.rules @@ -0,0 +1,3 @@ +drop:packet http any any -> any any (msg:"TD packet drop on HTTP host"; flow:to_server, established; http.host; content:"www.testmyids.com"; sid:100002;) + +alert http any any -> any any (msg:"Response body inspected after bypass"; flow:to_client,established; http.response_body; content:"uid=0|28|root|29|"; sid:100001;) diff --git a/tests/firewall/ruletype-firewall-150-bypass-keyword-accept-flow-td-drop-rule/test.yaml b/tests/firewall/ruletype-firewall-150-bypass-keyword-accept-flow-td-drop-rule/test.yaml new file mode 100644 index 0000000000..379c207afd --- /dev/null +++ b/tests/firewall/ruletype-firewall-150-bypass-keyword-accept-flow-td-drop-rule/test.yaml @@ -0,0 +1,54 @@ +requires: + min-version: 9 + +pcap: ../../flowbit-oring/input.pcap + +args: + - --simulate-ips + - -k none + +checks: +- filter: + count: 1 + match: + event_type: alert + alert.signature_id: 103 + pcap_cnt: 4 + verdict.action: accept +- filter: + count: 0 + match: + event_type: alert + alert.signature_id: 100002 +- filter: + count: 0 + match: + event_type: drop + alert.signature_id: 100002 +- filter: + count: 0 + match: + event_type: alert + alert.signature_id: 100001 +- filter: + count: 1 + match: + event_type: flow + flow.state: bypassed + flow.bypass: local + flow.alerted: true + flow.action: accept + flow.pkts_toserver: 6 + flow.pkts_toclient: 4 +- filter: + count: 1 + match: + event_type: stats + stats.ips.blocked: 0 + stats.ips.accepted: 3 + stats.ips.drop_reason.rules: 0 + stats.flow.end.state.local_bypassed: 1 + stats.flow_bypassed.local_pkts: 6 + stats.detect.alert: 1 + stats.firewall.accepted: 4 + stats.firewall.blocked: 0 diff --git a/tests/firewall/ruletype-firewall-151-bypass-keyword-accept-flow-td-pkt-drop-rule/README.md b/tests/firewall/ruletype-firewall-151-bypass-keyword-accept-flow-td-pkt-drop-rule/README.md new file mode 100644 index 0000000000..cb345749a2 --- /dev/null +++ b/tests/firewall/ruletype-firewall-151-bypass-keyword-accept-flow-td-pkt-drop-rule/README.md @@ -0,0 +1,36 @@ +Expectation +----------- + +Test that `bypass` on a firewall `accept:flow` rule is terminal, especially when +the competing TD rule is a *packet* rule. + +Firewall rule sid:103 accepts and bypasses the flow at the +`http1:request_headers` hook. The threat detection rule sid:100003 would match +against the same packet and could drop it, but shouldn't, just as it would happen +with the firewall in a separate device. The IPS rules cannot act on an unseen +packet. + +Difference from ruletype-firewall-150 +------------------------------------- + +Test 150 uses an `http` TD rule, which lands in the *app* detect table and is +inspected inside `DetectRunTx`, after the firewall rule on the same transaction. +The bypass therefore suppresses it and 150 passes. + +This test uses `tcp-pkt`, forcing the TD rule into the *packet* detect +table. This explores the scenario with Packet rules, which are inspected in `DetectRulePacketRules`, which runs before +`DetectRunTx`. We're then checking that a TD alert that would be queued before +the firewall rule matched and the bypass applied won't affect the firewall's bypass. + +sid:100001 would alert on the HTTP response body if the flow were still being +inspected, and must not alert: the flow left inspection at the request headers. + +Pcap +---- + +Reused from the `flowbit-oring` test. + +Ticket +------ + +Related to https://redmine.openinfosecfoundation.org/issues/8459. diff --git a/tests/firewall/ruletype-firewall-151-bypass-keyword-accept-flow-td-pkt-drop-rule/firewall.rules b/tests/firewall/ruletype-firewall-151-bypass-keyword-accept-flow-td-pkt-drop-rule/firewall.rules new file mode 100644 index 0000000000..c913fb7dcc --- /dev/null +++ b/tests/firewall/ruletype-firewall-151-bypass-keyword-accept-flow-td-pkt-drop-rule/firewall.rules @@ -0,0 +1,23 @@ +# Packet rules + +accept:hook tcp:all any any -> any any (sid:100;) + +# default drop + +# App-layer rules + +accept:hook http1:request_started any any -> any any (sid:101;) +accept:hook http1:request_line any any -> any any (sid:102;) + +accept:flow,alert http1:request_headers any any -> any any (msg:"Firewall accept flow with bypass for testmyids"; http.host; content:"www.testmyids.com"; bypass; sid:103;) + +accept:hook http1:request_body any any -> any any (sid:104;) +accept:hook http1:request_trailer any any -> any any (sid:105;) +accept:hook http1:request_complete any any -> any any (sid:106;) + +accept:hook http1:response_started any any -> any any (sid:201;) +accept:hook http1:response_line any any -> any any (sid:202;) +accept:hook http1:response_headers any any -> any any (sid:203;) +accept:hook http1:response_body any any -> any any (sid:204;) +accept:hook http1:response_trailer any any -> any any (sid:205;) +accept:hook http1:response_complete any any -> any any (sid:206;) diff --git a/tests/firewall/ruletype-firewall-151-bypass-keyword-accept-flow-td-pkt-drop-rule/suricata.yaml b/tests/firewall/ruletype-firewall-151-bypass-keyword-accept-flow-td-pkt-drop-rule/suricata.yaml new file mode 100644 index 0000000000..398a898e23 --- /dev/null +++ b/tests/firewall/ruletype-firewall-151-bypass-keyword-accept-flow-td-pkt-drop-rule/suricata.yaml @@ -0,0 +1,22 @@ +%YAML 1.1 +--- + +stats: + enabled: yes + interval: 8 + +outputs: + - eve-log: + enabled: yes + filetype: regular + filename: eve.json + types: + - stats + - alert: + verdict: true + - drop: + alerts: yes + flows: all + verdict: true + - flow + - http diff --git a/tests/firewall/ruletype-firewall-151-bypass-keyword-accept-flow-td-pkt-drop-rule/td.rules b/tests/firewall/ruletype-firewall-151-bypass-keyword-accept-flow-td-pkt-drop-rule/td.rules new file mode 100644 index 0000000000..e79e92b46c --- /dev/null +++ b/tests/firewall/ruletype-firewall-151-bypass-keyword-accept-flow-td-pkt-drop-rule/td.rules @@ -0,0 +1,9 @@ +# Packet-scope threat detection drop on the very packet that firewall sid:103 +# accepts and bypasses. `tcp-pkt` forces this into the packet detect table, so +# unlike the app-layer TD rule in test 150 it is evaluated before the firewall +# rule is reached in the alert queue. +drop:packet tcp-pkt any any -> any any (msg:"TD packet drop on raw HTTP host"; flow:to_server,established; content:"www.testmyids.com"; sid:100003;) + +# Would alert on the response body if the flow were still being inspected. +# Must not alert: the flow was bypassed at the request headers. +alert http any any -> any any (msg:"Response body inspected after bypass"; flow:to_client,established; http.response_body; content:"uid=0|28|root|29|"; sid:100001;) diff --git a/tests/firewall/ruletype-firewall-151-bypass-keyword-accept-flow-td-pkt-drop-rule/test.yaml b/tests/firewall/ruletype-firewall-151-bypass-keyword-accept-flow-td-pkt-drop-rule/test.yaml new file mode 100644 index 0000000000..e680664b86 --- /dev/null +++ b/tests/firewall/ruletype-firewall-151-bypass-keyword-accept-flow-td-pkt-drop-rule/test.yaml @@ -0,0 +1,61 @@ +requires: + min-version: 9 + +pcap: ../../flowbit-oring/input.pcap + +args: + - --simulate-ips + - -k none + +checks: +# The firewall rule must and its bypass be applied, so the rule and its accept must be visible. +- filter: + count: 1 + match: + event_type: alert + alert.signature_id: 103 + pcap_cnt: 4 + alert.action: allowed + verdict.action: accept + +# Threat detection must not be consulted for the bypassed packet. +- filter: + count: 0 + match: + event_type: alert + alert.signature_id: 100003 + +# The rest of the flow is not inspected after the bypass. +- filter: + count: 0 + match: + event_type: alert + alert.signature_id: 100001 + +# No alert may carry a blocking verdict. +- filter: + count: 0 + match: + event_type: drop + +# If these fail, the test is not reproducing the intended corner case +- filter: + count: 1 + match: + event_type: flow + flow.state: bypassed + flow.bypass: local + flow.action: accept + flow.pkts_toserver: 6 + flow.pkts_toclient: 4 + +- filter: + count: 1 + match: + event_type: stats + stats.ips.blocked: 0 + stats.ips.accepted: 3 + stats.ips.drop_reason.rules: 0 + stats.firewall.accepted: 4 + stats.flow.end.state.local_bypassed: 1 + stats.flow_bypassed.local_pkts: 6 From e799c12db2cd567d5991b515d66fa633886b5419 Mon Sep 17 00:00:00 2001 From: Juliana Fajardini Date: Sun, 9 Aug 2026 18:30:04 -0300 Subject: [PATCH 3/4] tests/firewall: rename dirs with duplicate numbers Tests in directories: - ruletype-firewall-90-ban-replace-keyword - ruletype-firewall-92-ban-bypass-keyword Had duplicated numbers, re-number them. --- .../README.md | 0 .../firewall.rules | 0 .../test.yaml | 0 .../README.md | 0 .../firewall.rules | 0 .../td.rules | 0 .../test.yaml | 0 7 files changed, 0 insertions(+), 0 deletions(-) rename tests/firewall/{ruletype-firewall-90-ban-replace-keyword => ruletype-firewall-142-ban-replace-keyword}/README.md (100%) rename tests/firewall/{ruletype-firewall-90-ban-replace-keyword => ruletype-firewall-142-ban-replace-keyword}/firewall.rules (100%) rename tests/firewall/{ruletype-firewall-90-ban-replace-keyword => ruletype-firewall-142-ban-replace-keyword}/test.yaml (100%) rename tests/firewall/{ruletype-firewall-92-ban-bypass-keyword => ruletype-firewall-143-ban-bypass-keyword}/README.md (100%) rename tests/firewall/{ruletype-firewall-92-ban-bypass-keyword => ruletype-firewall-143-ban-bypass-keyword}/firewall.rules (100%) rename tests/firewall/{ruletype-firewall-92-ban-bypass-keyword => ruletype-firewall-143-ban-bypass-keyword}/td.rules (100%) rename tests/firewall/{ruletype-firewall-92-ban-bypass-keyword => ruletype-firewall-143-ban-bypass-keyword}/test.yaml (100%) diff --git a/tests/firewall/ruletype-firewall-90-ban-replace-keyword/README.md b/tests/firewall/ruletype-firewall-142-ban-replace-keyword/README.md similarity index 100% rename from tests/firewall/ruletype-firewall-90-ban-replace-keyword/README.md rename to tests/firewall/ruletype-firewall-142-ban-replace-keyword/README.md diff --git a/tests/firewall/ruletype-firewall-90-ban-replace-keyword/firewall.rules b/tests/firewall/ruletype-firewall-142-ban-replace-keyword/firewall.rules similarity index 100% rename from tests/firewall/ruletype-firewall-90-ban-replace-keyword/firewall.rules rename to tests/firewall/ruletype-firewall-142-ban-replace-keyword/firewall.rules diff --git a/tests/firewall/ruletype-firewall-90-ban-replace-keyword/test.yaml b/tests/firewall/ruletype-firewall-142-ban-replace-keyword/test.yaml similarity index 100% rename from tests/firewall/ruletype-firewall-90-ban-replace-keyword/test.yaml rename to tests/firewall/ruletype-firewall-142-ban-replace-keyword/test.yaml diff --git a/tests/firewall/ruletype-firewall-92-ban-bypass-keyword/README.md b/tests/firewall/ruletype-firewall-143-ban-bypass-keyword/README.md similarity index 100% rename from tests/firewall/ruletype-firewall-92-ban-bypass-keyword/README.md rename to tests/firewall/ruletype-firewall-143-ban-bypass-keyword/README.md diff --git a/tests/firewall/ruletype-firewall-92-ban-bypass-keyword/firewall.rules b/tests/firewall/ruletype-firewall-143-ban-bypass-keyword/firewall.rules similarity index 100% rename from tests/firewall/ruletype-firewall-92-ban-bypass-keyword/firewall.rules rename to tests/firewall/ruletype-firewall-143-ban-bypass-keyword/firewall.rules diff --git a/tests/firewall/ruletype-firewall-92-ban-bypass-keyword/td.rules b/tests/firewall/ruletype-firewall-143-ban-bypass-keyword/td.rules similarity index 100% rename from tests/firewall/ruletype-firewall-92-ban-bypass-keyword/td.rules rename to tests/firewall/ruletype-firewall-143-ban-bypass-keyword/td.rules diff --git a/tests/firewall/ruletype-firewall-92-ban-bypass-keyword/test.yaml b/tests/firewall/ruletype-firewall-143-ban-bypass-keyword/test.yaml similarity index 100% rename from tests/firewall/ruletype-firewall-92-ban-bypass-keyword/test.yaml rename to tests/firewall/ruletype-firewall-143-ban-bypass-keyword/test.yaml From 6970988c6a8b9f443ac657e608eddeacde62db99 Mon Sep 17 00:00:00 2001 From: Juliana Fajardini Date: Thu, 20 Aug 2026 23:11:42 -0300 Subject: [PATCH 4/4] tests: update firewall-141 test to allow bypass With the patch for #8459, a firewall rule should accept the bypass keyword. Related to Ticket: #8459 --- .../README.md | 13 +++++++++++ .../firewall.rules | 0 .../td.rules | 0 .../test.yaml | 22 +++++++++---------- .../README.md | 16 -------------- 5 files changed, 24 insertions(+), 27 deletions(-) create mode 100644 tests/firewall/ruletype-firewall-141-allow-bypass-keyword-firewall-rule/README.md rename tests/firewall/{ruletype-firewall-141-ban-bypass-keyword-firewall-rule => ruletype-firewall-141-allow-bypass-keyword-firewall-rule}/firewall.rules (100%) rename tests/firewall/{ruletype-firewall-141-ban-bypass-keyword-firewall-rule => ruletype-firewall-141-allow-bypass-keyword-firewall-rule}/td.rules (100%) rename tests/firewall/{ruletype-firewall-141-ban-bypass-keyword-firewall-rule => ruletype-firewall-141-allow-bypass-keyword-firewall-rule}/test.yaml (62%) delete mode 100644 tests/firewall/ruletype-firewall-141-ban-bypass-keyword-firewall-rule/README.md diff --git a/tests/firewall/ruletype-firewall-141-allow-bypass-keyword-firewall-rule/README.md b/tests/firewall/ruletype-firewall-141-allow-bypass-keyword-firewall-rule/README.md new file mode 100644 index 0000000000..e79ecbecc7 --- /dev/null +++ b/tests/firewall/ruletype-firewall-141-allow-bypass-keyword-firewall-rule/README.md @@ -0,0 +1,13 @@ +# Test + +Updated test to ensure that the engine accepts the `bypass` keyword in a firewall +mode, in a firweall rule. + +The accepted firewall rule matches the decoded HTTP host +`www.testmyids.com`, then accepts and bypasses the flow at the +`http1:request_headers` hook. + +## Ticket + +Related to +https://redmine.openinfosecfoundation.org/issues/8459. diff --git a/tests/firewall/ruletype-firewall-141-ban-bypass-keyword-firewall-rule/firewall.rules b/tests/firewall/ruletype-firewall-141-allow-bypass-keyword-firewall-rule/firewall.rules similarity index 100% rename from tests/firewall/ruletype-firewall-141-ban-bypass-keyword-firewall-rule/firewall.rules rename to tests/firewall/ruletype-firewall-141-allow-bypass-keyword-firewall-rule/firewall.rules diff --git a/tests/firewall/ruletype-firewall-141-ban-bypass-keyword-firewall-rule/td.rules b/tests/firewall/ruletype-firewall-141-allow-bypass-keyword-firewall-rule/td.rules similarity index 100% rename from tests/firewall/ruletype-firewall-141-ban-bypass-keyword-firewall-rule/td.rules rename to tests/firewall/ruletype-firewall-141-allow-bypass-keyword-firewall-rule/td.rules diff --git a/tests/firewall/ruletype-firewall-141-ban-bypass-keyword-firewall-rule/test.yaml b/tests/firewall/ruletype-firewall-141-allow-bypass-keyword-firewall-rule/test.yaml similarity index 62% rename from tests/firewall/ruletype-firewall-141-ban-bypass-keyword-firewall-rule/test.yaml rename to tests/firewall/ruletype-firewall-141-allow-bypass-keyword-firewall-rule/test.yaml index 761b04d927..5519ea3d95 100644 --- a/tests/firewall/ruletype-firewall-141-ban-bypass-keyword-firewall-rule/test.yaml +++ b/tests/firewall/ruletype-firewall-141-allow-bypass-keyword-firewall-rule/test.yaml @@ -6,35 +6,35 @@ pcap: ../../flowbit-oring/input.pcap args: - --simulate-ips - -k none -exit-code: 1 checks: + # We're enabling bypass in firewall rules only, in firewall mode + - shell: + args: grep "keyword 'bypass' is not allowed in firewall mode" stderr | wc -l + expect: 0 - filter: - # Would be 1 if bypass were enabled in firewall rules. - count: 0 + # Expected 1 with bypass enabled in firewall rules. + count: 1 match: event_type: alert alert.signature_id: 2000001 http.hostname: www.testmyids.com - filter: - # Would remain 0 if bypass were enabled and suppressed TD inspection. + # Remains 0 if bypass is enabled and suppressed TD inspection. count: 0 match: event_type: alert alert.signature_id: 100001 - filter: - # Would be 1 if bypass were enabled in firewall rules. - count: 0 + # Should be 1 if bypass is enabled in firewall rules. + count: 1 match: event_type: flow flow.state: bypassed flow.bypass: local - filter: - # Would be 1 if bypass were enabled in firewall rules. - count: 0 + # Should be 1 if bypass is enabled in firewall rules. + count: 1 match: event_type: stats stats.flow_bypassed.local_pkts: 6 - - shell: - args: grep "keyword 'bypass' is not allowed in firewall mode" stderr | wc -l - expect: 1 diff --git a/tests/firewall/ruletype-firewall-141-ban-bypass-keyword-firewall-rule/README.md b/tests/firewall/ruletype-firewall-141-ban-bypass-keyword-firewall-rule/README.md deleted file mode 100644 index a0f30b6482..0000000000 --- a/tests/firewall/ruletype-firewall-141-ban-bypass-keyword-firewall-rule/README.md +++ /dev/null @@ -1,16 +0,0 @@ -# Test - -Ensure that the engine rejects the `bypass` keyword in a firewall rule. - -The rejected firewall rule would match the decoded HTTP host -`www.testmyids.com`, then accept and bypass the flow at the -`http1:request_headers` hook. The retained event checks document the behavior -expected if bypass support is enabled in the future. - -This ticket also contains valid checks for if the bypass were to be allowed in -firewall mode. - -## Ticket - -Related to -https://redmine.openinfosecfoundation.org/issues/8459.