fw: test the firewall default policy tiers v3

[lukashino]

Follow-up of #3251

Redmine ticket: https://redmine.openinfosecfoundation.org/issues/8712

Describe changes:
v3:

• polished + rebased

v1/2:

• Update to the new config format
• Add extra tests

[Copilot]

Pull request overview

Adds a new set of Suricata-Verify firewall tests focused on default-policy tiering/precedence and scope validation (packet vs app vs substate), improving regression coverage for the firewall policy configuration behavior referenced by the Redmine ticket.

Changes:

• Introduces new firewall tests that validate default-policy precedence across global/packet/app layers and substates.
• Adds tests ensuring default policies apply correctly to packet hooks and app-layer hook aliases (e.g., request-complete).
• Adds config-validation tests asserting invalid action scopes in default-policy settings are rejected with the correct error path.

Reviewed changes

Copilot reviewed 36 out of 36 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
tests/firewall/ruletype-firewall-142-default-policy-packet-precedence/test.yaml	Validates packet.default-policy precedence and resulting events/stats
tests/firewall/ruletype-firewall-142-default-policy-packet-precedence/suricata.yaml	Configures global vs packet default-policy precedence scenario
tests/firewall/ruletype-firewall-142-default-policy-packet-precedence/README.md	Documents intent/expected precedence behavior
tests/firewall/ruletype-firewall-142-default-policy-packet-precedence/firewall.rules	Installs packet hooks without matching to exercise fallback policy
tests/firewall/ruletype-firewall-143-default-policy-app-layer/test.yaml	Validates app.default-policy provides policy for app-layer hooks
tests/firewall/ruletype-firewall-143-default-policy-app-layer/suricata.yaml	Configures app.default-policy accept baseline
tests/firewall/ruletype-firewall-143-default-policy-app-layer/README.md	Documents app.default-policy coverage goal
tests/firewall/ruletype-firewall-143-default-policy-app-layer/firewall.rules	Provides rule file placeholder for firewall-mode run
tests/firewall/ruletype-firewall-144-default-policy-substate/test.yaml	Validates substate default-policy precedence and fallback behavior
tests/firewall/ruletype-firewall-144-default-policy-substate/suricata.yaml	Configures http2 substate default-policy behavior
tests/firewall/ruletype-firewall-144-default-policy-substate/README.md	Documents expected precedence across proto/substate/global tiers
tests/firewall/ruletype-firewall-144-default-policy-substate/firewall.rules	Provides empty ruleset to ensure policy-driven behavior
tests/firewall/ruletype-firewall-145-default-policy-per-proto/test.yaml	Validates per-protocol default-policy with a hook carve-out
tests/firewall/ruletype-firewall-145-default-policy-per-proto/suricata.yaml	Configures per-proto dns default-policy plus request-started override
tests/firewall/ruletype-firewall-145-default-policy-per-proto/README.md	Documents per-proto default-policy + override intent
tests/firewall/ruletype-firewall-145-default-policy-per-proto/firewall.rules	Provides empty ruleset to keep behavior policy-driven
tests/firewall/ruletype-firewall-146-default-policy-tls-request-complete/test.yaml	Validates request-complete alias resolution to protocol final state
tests/firewall/ruletype-firewall-146-default-policy-tls-request-complete/suricata.yaml	Configures tls request-complete policy and defaults
tests/firewall/ruletype-firewall-146-default-policy-tls-request-complete/README.md	Documents request-complete alias resolution expectation
tests/firewall/ruletype-firewall-146-default-policy-tls-request-complete/firewall.rules	Empty ruleset to ensure defaults/aliases drive outcome
tests/firewall/ruletype-firewall-147-default-policy-scope-packet-hook/test.yaml	Ensures invalid default-policy scope is rejected for packet hooks
tests/firewall/ruletype-firewall-147-default-policy-scope-packet-hook/suricata.yaml	Configures invalid action scope (tx) for default-policy
tests/firewall/ruletype-firewall-147-default-policy-scope-packet-hook/README.md	Documents invalid-scope-at-packet-hook validation intent
tests/firewall/ruletype-firewall-147-default-policy-scope-packet-hook/firewall.rules	Placeholder to force firewall-mode
tests/firewall/ruletype-firewall-148-default-policy-scope-app-hook/test.yaml	Ensures invalid default-policy scope is rejected for app-layer hooks
tests/firewall/ruletype-firewall-148-default-policy-scope-app-hook/suricata.yaml	Configures invalid action scope (packet) for global default-policy
tests/firewall/ruletype-firewall-148-default-policy-scope-app-hook/README.md	Documents invalid-scope-at-app-hook validation intent
tests/firewall/ruletype-firewall-148-default-policy-scope-app-hook/firewall.rules	Placeholder to force firewall-mode
tests/firewall/ruletype-firewall-149-default-policy-scope-substate/test.yaml	Ensures nested substate default-policy scope validation emits full path
tests/firewall/ruletype-firewall-149-default-policy-scope-substate/suricata.yaml	Configures invalid scope under app.http2.stream.default-policy
tests/firewall/ruletype-firewall-149-default-policy-scope-substate/README.md	Documents nested-path validation and message expectation
tests/firewall/ruletype-firewall-149-default-policy-scope-substate/firewall.rules	Placeholder to force firewall-mode
tests/firewall/ruletype-firewall-150-default-policy-packet-hooks/test.yaml	Validates packet.default-policy applies across packet hooks (pre-stream)
tests/firewall/ruletype-firewall-150-default-policy-packet-hooks/suricata.yaml	Configures packet hook policies and packet.default-policy inheritance
tests/firewall/ruletype-firewall-150-default-policy-packet-hooks/README.md	Documents expected hook inheritance behavior
tests/firewall/ruletype-firewall-150-default-policy-packet-hooks/firewall.rules	Installs packet hooks without matching to exercise inherited policy

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[victorjulien]

Merged in #3312, thanks!