From d2e47588af4b8a420a1f68a0d150926e32033c05 Mon Sep 17 00:00:00 2001 From: Lukas Sismis Date: Tue, 28 Jul 2026 17:26:08 +0200 Subject: [PATCH] fw: test the firewall default policy tiers Ticket: 8712 --- .../README.md | 7 ++ .../firewall.rules | 5 ++ .../suricata.yaml | 27 ++++++++ .../test.yaml | 39 +++++++++++ .../README.md | 2 + .../firewall.rules | 2 + .../suricata.yaml | 27 ++++++++ .../test.yaml | 41 ++++++++++++ .../README.md | 5 ++ .../firewall.rules | 3 + .../suricata.yaml | 28 ++++++++ .../test.yaml | 64 +++++++++++++++++++ .../README.md | 2 + .../firewall.rules | 1 + .../suricata.yaml | 29 +++++++++ .../test.yaml | 51 +++++++++++++++ .../README.md | 2 + .../firewall.rules | 2 + .../suricata.yaml | 32 ++++++++++ .../test.yaml | 43 +++++++++++++ .../README.md | 2 + .../firewall.rules | 1 + .../suricata.yaml | 10 +++ .../test.yaml | 15 +++++ .../README.md | 2 + .../firewall.rules | 1 + .../suricata.yaml | 10 +++ .../test.yaml | 15 +++++ .../README.md | 7 ++ .../firewall.rules | 1 + .../suricata.yaml | 13 ++++ .../test.yaml | 15 +++++ .../README.md | 5 ++ .../firewall.rules | 5 ++ .../suricata.yaml | 26 ++++++++ .../test.yaml | 41 ++++++++++++ 36 files changed, 581 insertions(+) create mode 100644 tests/firewall/ruletype-firewall-142-default-policy-packet-precedence/README.md create mode 100644 tests/firewall/ruletype-firewall-142-default-policy-packet-precedence/firewall.rules create mode 100644 tests/firewall/ruletype-firewall-142-default-policy-packet-precedence/suricata.yaml create mode 100644 tests/firewall/ruletype-firewall-142-default-policy-packet-precedence/test.yaml create mode 100644 tests/firewall/ruletype-firewall-143-default-policy-app-layer/README.md create mode 100644 tests/firewall/ruletype-firewall-143-default-policy-app-layer/firewall.rules create mode 100644 tests/firewall/ruletype-firewall-143-default-policy-app-layer/suricata.yaml create mode 100644 tests/firewall/ruletype-firewall-143-default-policy-app-layer/test.yaml create mode 100644 tests/firewall/ruletype-firewall-144-default-policy-substate/README.md create mode 100644 tests/firewall/ruletype-firewall-144-default-policy-substate/firewall.rules create mode 100644 tests/firewall/ruletype-firewall-144-default-policy-substate/suricata.yaml create mode 100644 tests/firewall/ruletype-firewall-144-default-policy-substate/test.yaml create mode 100644 tests/firewall/ruletype-firewall-145-default-policy-per-proto/README.md create mode 100644 tests/firewall/ruletype-firewall-145-default-policy-per-proto/firewall.rules create mode 100644 tests/firewall/ruletype-firewall-145-default-policy-per-proto/suricata.yaml create mode 100644 tests/firewall/ruletype-firewall-145-default-policy-per-proto/test.yaml create mode 100644 tests/firewall/ruletype-firewall-146-default-policy-tls-request-complete/README.md create mode 100644 tests/firewall/ruletype-firewall-146-default-policy-tls-request-complete/firewall.rules create mode 100644 tests/firewall/ruletype-firewall-146-default-policy-tls-request-complete/suricata.yaml create mode 100644 tests/firewall/ruletype-firewall-146-default-policy-tls-request-complete/test.yaml create mode 100644 tests/firewall/ruletype-firewall-147-default-policy-scope-packet-hook/README.md create mode 100644 tests/firewall/ruletype-firewall-147-default-policy-scope-packet-hook/firewall.rules create mode 100644 tests/firewall/ruletype-firewall-147-default-policy-scope-packet-hook/suricata.yaml create mode 100644 tests/firewall/ruletype-firewall-147-default-policy-scope-packet-hook/test.yaml create mode 100644 tests/firewall/ruletype-firewall-148-default-policy-scope-app-hook/README.md create mode 100644 tests/firewall/ruletype-firewall-148-default-policy-scope-app-hook/firewall.rules create mode 100644 tests/firewall/ruletype-firewall-148-default-policy-scope-app-hook/suricata.yaml create mode 100644 tests/firewall/ruletype-firewall-148-default-policy-scope-app-hook/test.yaml create mode 100644 tests/firewall/ruletype-firewall-149-default-policy-scope-substate/README.md create mode 100644 tests/firewall/ruletype-firewall-149-default-policy-scope-substate/firewall.rules create mode 100644 tests/firewall/ruletype-firewall-149-default-policy-scope-substate/suricata.yaml create mode 100644 tests/firewall/ruletype-firewall-149-default-policy-scope-substate/test.yaml create mode 100644 tests/firewall/ruletype-firewall-150-default-policy-packet-hooks/README.md create mode 100644 tests/firewall/ruletype-firewall-150-default-policy-packet-hooks/firewall.rules create mode 100644 tests/firewall/ruletype-firewall-150-default-policy-packet-hooks/suricata.yaml create mode 100644 tests/firewall/ruletype-firewall-150-default-policy-packet-hooks/test.yaml diff --git a/tests/firewall/ruletype-firewall-142-default-policy-packet-precedence/README.md b/tests/firewall/ruletype-firewall-142-default-policy-packet-precedence/README.md new file mode 100644 index 0000000000..61b52b92e7 --- /dev/null +++ b/tests/firewall/ruletype-firewall-142-default-policy-packet-precedence/README.md @@ -0,0 +1,7 @@ +Test that packet.default-policy takes precedence over the global default-policy +at a packet filter hook. + +Packet filter hook has no setting of its own, so it inherits reject:packet from +packet.default-policy. That action distinguishes the winning tier from the +alternatives: the global default is accept:hook and the built-in filter policy +is drop:packet. diff --git a/tests/firewall/ruletype-firewall-142-default-policy-packet-precedence/firewall.rules b/tests/firewall/ruletype-firewall-142-default-policy-packet-precedence/firewall.rules new file mode 100644 index 0000000000..83a2ff7ca1 --- /dev/null +++ b/tests/firewall/ruletype-firewall-142-default-policy-packet-precedence/firewall.rules @@ -0,0 +1,5 @@ +# The pre-flow and pre-stream hooks are only installed when a rule targets +# them. Port 1 is not in the pcap, so neither rule ever matches and both hooks +# fall to their configured policy. +accept:packet tcp:pre_flow any any -> any 1 (sid:1;) +accept:packet tcp:pre_stream any any -> any 1 (sid:2;) diff --git a/tests/firewall/ruletype-firewall-142-default-policy-packet-precedence/suricata.yaml b/tests/firewall/ruletype-firewall-142-default-policy-packet-precedence/suricata.yaml new file mode 100644 index 0000000000..dc51ea6eca --- /dev/null +++ b/tests/firewall/ruletype-firewall-142-default-policy-packet-precedence/suricata.yaml @@ -0,0 +1,27 @@ +%YAML 1.1 +--- + +stats: + enabled: yes + interval: 8 + +outputs: + - eve-log: + enabled: yes + filetype: regular + filename: eve.json + types: + - stats + - flow + - alert + - drop: + alerts: yes + flows: all + +firewall: + policies: + default-policy: [ "accept:hook" ] + packet: + default-policy: [ "reject:packet" ] + pre-flow: [ "accept:hook" ] + pre-stream: [ "accept:hook" ] diff --git a/tests/firewall/ruletype-firewall-142-default-policy-packet-precedence/test.yaml b/tests/firewall/ruletype-firewall-142-default-policy-packet-precedence/test.yaml new file mode 100644 index 0000000000..b3bc8f15be --- /dev/null +++ b/tests/firewall/ruletype-firewall-142-default-policy-packet-precedence/test.yaml @@ -0,0 +1,39 @@ +requires: + min-version: 9 + features: + - LIBNET1.1 + +pcap: ../../tls/tls-random/input.pcap + +args: + - --simulate-ips + - -k none + +checks: +- filter: + count: 1 + match: + event_type: flow + flow.pkts_toserver: 7 + flow.pkts_toclient: 6 +- filter: + count: 0 + match: + event_type: alert +- filter: + count: 13 + match: + event_type: drop + drop.reason: "firewall default packet policy" +- filter: + count: 1 + match: + event_type: stats + stats.flow.total: 1 + stats.firewall.accepted: 0 + stats.firewall.blocked: 0 + stats.firewall.rejected: 13 + stats.firewall.drop_reason.default_packet_policy: 13 + stats.firewall.drop_reason.rules: 0 + stats.firewall.drop_reason.pre_flow_hook: 0 + stats.firewall.drop_reason.pre_stream_hook: 0 diff --git a/tests/firewall/ruletype-firewall-143-default-policy-app-layer/README.md b/tests/firewall/ruletype-firewall-143-default-policy-app-layer/README.md new file mode 100644 index 0000000000..fbdb61f1bd --- /dev/null +++ b/tests/firewall/ruletype-firewall-143-default-policy-app-layer/README.md @@ -0,0 +1,2 @@ +Test that app.default-policy supplies the policy for the app-layer hooks of +every protocol. \ No newline at end of file diff --git a/tests/firewall/ruletype-firewall-143-default-policy-app-layer/firewall.rules b/tests/firewall/ruletype-firewall-143-default-policy-app-layer/firewall.rules new file mode 100644 index 0000000000..f74b20fc84 --- /dev/null +++ b/tests/firewall/ruletype-firewall-143-default-policy-app-layer/firewall.rules @@ -0,0 +1,2 @@ +# No app rules at all: the app hooks are decided entirely by +# app.default-policy. diff --git a/tests/firewall/ruletype-firewall-143-default-policy-app-layer/suricata.yaml b/tests/firewall/ruletype-firewall-143-default-policy-app-layer/suricata.yaml new file mode 100644 index 0000000000..fb6e53a0f1 --- /dev/null +++ b/tests/firewall/ruletype-firewall-143-default-policy-app-layer/suricata.yaml @@ -0,0 +1,27 @@ +%YAML 1.1 +--- + +stats: + enabled: yes + interval: 8 + +outputs: + - eve-log: + enabled: yes + filetype: regular + filename: eve.json + types: + - stats + - flow + - alert + - dns + - drop: + alerts: yes + flows: all + +firewall: + policies: + packet: + filter: [ "accept:hook" ] + app: + default-policy: [ "accept:hook" ] diff --git a/tests/firewall/ruletype-firewall-143-default-policy-app-layer/test.yaml b/tests/firewall/ruletype-firewall-143-default-policy-app-layer/test.yaml new file mode 100644 index 0000000000..c51a84748d --- /dev/null +++ b/tests/firewall/ruletype-firewall-143-default-policy-app-layer/test.yaml @@ -0,0 +1,41 @@ +requires: + min-version: 9 + +pcap: ../../dns/dns-eve/input.pcap + +args: + - --simulate-ips + - -k none + +checks: +- filter: + count: 4 + match: + event_type: dns + dns.type: request +- filter: + count: 4 + match: + event_type: dns + dns.type: response +- filter: + count: 0 + match: + event_type: drop +- filter: + count: 4 + match: + event_type: flow + flow.alerted: false + not-has-key: flow.action +- filter: + count: 1 + match: + event_type: stats + stats.flow.total: 4 + stats.firewall.accepted: 8 + stats.firewall.blocked: 0 + stats.firewall.rejected: 0 + stats.firewall.drop_reason.default_app_policy: 0 + stats.firewall.drop_reason.default_packet_policy: 0 + stats.firewall.drop_reason.flow_drop: 0 diff --git a/tests/firewall/ruletype-firewall-144-default-policy-substate/README.md b/tests/firewall/ruletype-firewall-144-default-policy-substate/README.md new file mode 100644 index 0000000000..f342a5f678 --- /dev/null +++ b/tests/firewall/ruletype-firewall-144-default-policy-substate/README.md @@ -0,0 +1,5 @@ +Test that a sub state's default-policy takes precedence over the per-protocol +default-policy. + +Also test that a packet filter and sub state with no default-policy of its own +(http2.global) falls through default-policy to up to the global level. \ No newline at end of file diff --git a/tests/firewall/ruletype-firewall-144-default-policy-substate/firewall.rules b/tests/firewall/ruletype-firewall-144-default-policy-substate/firewall.rules new file mode 100644 index 0000000000..4944e9fd59 --- /dev/null +++ b/tests/firewall/ruletype-firewall-144-default-policy-substate/firewall.rules @@ -0,0 +1,3 @@ +# No rules, the hooks are decided entirely by the configured +# default policies. + diff --git a/tests/firewall/ruletype-firewall-144-default-policy-substate/suricata.yaml b/tests/firewall/ruletype-firewall-144-default-policy-substate/suricata.yaml new file mode 100644 index 0000000000..ad2569e28a --- /dev/null +++ b/tests/firewall/ruletype-firewall-144-default-policy-substate/suricata.yaml @@ -0,0 +1,28 @@ +%YAML 1.1 +--- + +stats: + enabled: yes + interval: 8 + +outputs: + - eve-log: + enabled: yes + filetype: regular + filename: eve.json + types: + - stats + - flow + - alert + - http2 + - drop: + alerts: yes + flows: all + +firewall: + policies: + default-policy: [ "accept:hook" ] + app: + http2: + stream: + default-policy: [ "drop:flow", "alert" ] diff --git a/tests/firewall/ruletype-firewall-144-default-policy-substate/test.yaml b/tests/firewall/ruletype-firewall-144-default-policy-substate/test.yaml new file mode 100644 index 0000000000..6aa9943747 --- /dev/null +++ b/tests/firewall/ruletype-firewall-144-default-policy-substate/test.yaml @@ -0,0 +1,64 @@ +requires: + min-version: 9 + +pcap: ../../http2-userinfo-authority/http2_userinfo_in_authority_1.pcap + +args: + - --simulate-ips + - -k none + +checks: +# The connection-level "global" sub state hooks run first and inherit the +# per-protocol accept:hook, so nothing drops while they are in charge. +- filter: + count: 0 + match: + event_type: drop + pcap_cnt: 4 +- filter: + count: 0 + match: + event_type: drop + pcap_cnt: 5 +- filter: + count: 0 + match: + event_type: drop + pcap_cnt: 6 +# The first "stream" sub state hook uses the sub state's own default, not the +# per-protocol one, so the flow is dropped here and the policy signature fires. +- filter: + count: 1 + match: + event_type: alert + alert.signature_id: 2201001 + app_proto: http2 + pcap_cnt: 7 +- filter: + count: 1 + match: + event_type: drop + drop.reason: "firewall default app policy" + pcap_cnt: 7 +- filter: + count: 2 + match: + event_type: drop + drop.reason: "firewall flow drop" +- filter: + count: 1 + match: + event_type: flow + app_proto: http2 + flow.action: drop +- filter: + count: 1 + match: + event_type: stats + stats.app_layer.flow.http2: 1 + stats.firewall.accepted: 6 + stats.firewall.blocked: 3 + stats.firewall.drop_reason.default_app_policy: 1 + stats.firewall.drop_reason.flow_drop: 2 + stats.firewall.drop_reason.rules: 0 + stats.firewall.drop_reason.default_packet_policy: 0 diff --git a/tests/firewall/ruletype-firewall-145-default-policy-per-proto/README.md b/tests/firewall/ruletype-firewall-145-default-policy-per-proto/README.md new file mode 100644 index 0000000000..83febf1ef0 --- /dev/null +++ b/tests/firewall/ruletype-firewall-145-default-policy-per-proto/README.md @@ -0,0 +1,2 @@ +Test that a per-protocol default-policy covers a protocol's app-layer hooks +while a specific hook setting carves one of them out. \ No newline at end of file diff --git a/tests/firewall/ruletype-firewall-145-default-policy-per-proto/firewall.rules b/tests/firewall/ruletype-firewall-145-default-policy-per-proto/firewall.rules new file mode 100644 index 0000000000..c882597962 --- /dev/null +++ b/tests/firewall/ruletype-firewall-145-default-policy-per-proto/firewall.rules @@ -0,0 +1 @@ +# The hooks are decided entirely by the configured default policies. \ No newline at end of file diff --git a/tests/firewall/ruletype-firewall-145-default-policy-per-proto/suricata.yaml b/tests/firewall/ruletype-firewall-145-default-policy-per-proto/suricata.yaml new file mode 100644 index 0000000000..9a6fa6a3c8 --- /dev/null +++ b/tests/firewall/ruletype-firewall-145-default-policy-per-proto/suricata.yaml @@ -0,0 +1,29 @@ +%YAML 1.1 +--- + +stats: + enabled: yes + interval: 8 + +outputs: + - eve-log: + enabled: yes + filetype: regular + filename: eve.json + types: + - stats + - flow + - alert + - dns + - drop: + alerts: yes + flows: all + +firewall: + policies: + packet: + default-policy: [ "accept:hook" ] + app: + dns: + default-policy: [ "drop:flow" ] + request-started: [ "accept:hook" ] diff --git a/tests/firewall/ruletype-firewall-145-default-policy-per-proto/test.yaml b/tests/firewall/ruletype-firewall-145-default-policy-per-proto/test.yaml new file mode 100644 index 0000000000..d185d9b91e --- /dev/null +++ b/tests/firewall/ruletype-firewall-145-default-policy-per-proto/test.yaml @@ -0,0 +1,51 @@ +requires: + min-version: 9 + +pcap: ../../dns/dns-eve/input.pcap + +args: + - --simulate-ips + - -k none + +checks: +- filter: + count: 4 + match: + event_type: dns + dns.type: request +- filter: + count: 0 + match: + event_type: dns + dns.type: response +- filter: + count: 8 + match: + event_type: drop +- filter: + count: 4 + match: + event_type: drop + drop.reason: "firewall default app policy" +- filter: + count: 4 + match: + event_type: drop + drop.reason: "firewall flow drop" +- filter: + count: 4 + match: + event_type: flow + flow.action: drop + flow.alerted: false +- filter: + count: 1 + match: + event_type: stats + stats.ips.accepted: 0 + stats.ips.blocked: 0 + stats.firewall.accepted: 0 + stats.firewall.blocked: 8 + stats.firewall.drop_reason.default_packet_policy: 0 + stats.firewall.drop_reason.default_app_policy: 4 + stats.firewall.drop_reason.flow_drop: 4 diff --git a/tests/firewall/ruletype-firewall-146-default-policy-tls-request-complete/README.md b/tests/firewall/ruletype-firewall-146-default-policy-tls-request-complete/README.md new file mode 100644 index 0000000000..f4565fac64 --- /dev/null +++ b/tests/firewall/ruletype-firewall-146-default-policy-tls-request-complete/README.md @@ -0,0 +1,2 @@ +Test that the generic request-complete hook alias resolves to a protocol's own +final state. diff --git a/tests/firewall/ruletype-firewall-146-default-policy-tls-request-complete/firewall.rules b/tests/firewall/ruletype-firewall-146-default-policy-tls-request-complete/firewall.rules new file mode 100644 index 0000000000..0f2ba73bef --- /dev/null +++ b/tests/firewall/ruletype-firewall-146-default-policy-tls-request-complete/firewall.rules @@ -0,0 +1,2 @@ +# No app rules: the tls hooks are decided entirely by the configured default +# policies. diff --git a/tests/firewall/ruletype-firewall-146-default-policy-tls-request-complete/suricata.yaml b/tests/firewall/ruletype-firewall-146-default-policy-tls-request-complete/suricata.yaml new file mode 100644 index 0000000000..3dbf01a5cf --- /dev/null +++ b/tests/firewall/ruletype-firewall-146-default-policy-tls-request-complete/suricata.yaml @@ -0,0 +1,32 @@ +%YAML 1.1 +--- + +stats: + enabled: yes + interval: 8 + +outputs: + - eve-log: + enabled: yes + filetype: regular + filename: eve.json + types: + - stats + - flow + - alert + - tls: + extended: yes + - drop: + alerts: yes + flows: all + +firewall: + policies: + packet: + filter: [ "accept:hook" ] + app: + tls: + default-policy: [ "accept:hook" ] + # TLS calls its to_server completion state "client_finished". The + # generic completion alias has to resolve to that same hook. + request-complete: [ "drop:flow", "alert" ] diff --git a/tests/firewall/ruletype-firewall-146-default-policy-tls-request-complete/test.yaml b/tests/firewall/ruletype-firewall-146-default-policy-tls-request-complete/test.yaml new file mode 100644 index 0000000000..af6be215bb --- /dev/null +++ b/tests/firewall/ruletype-firewall-146-default-policy-tls-request-complete/test.yaml @@ -0,0 +1,43 @@ +requires: + min-version: 9 + +pcap: ../../tls/tls-random/input.pcap + +args: + - --simulate-ips + - -k none + +checks: +# Exactly one drop + alert, on the packet where to_server reaches client_finished. +- filter: + count: 1 + match: + event_type: drop + drop.reason: "firewall default app policy" + pcap_cnt: 13 +- filter: + count: 1 + match: + event_type: alert + alert.signature_id: 2201001 + app_proto: tls + pcap_cnt: 13 +- filter: + count: 1 + match: + event_type: flow + app_proto: tls + flow.action: drop +- filter: + count: 1 + match: + event_type: stats + stats.flow.total: 1 + stats.app_layer.flow.tls: 1 + stats.firewall.accepted: 12 + stats.firewall.blocked: 1 + stats.firewall.rejected: 0 + stats.firewall.drop_reason.default_app_policy: 1 + stats.firewall.drop_reason.default_packet_policy: 0 + stats.firewall.drop_reason.rules: 0 + stats.firewall.drop_reason.flow_drop: 0 diff --git a/tests/firewall/ruletype-firewall-147-default-policy-scope-packet-hook/README.md b/tests/firewall/ruletype-firewall-147-default-policy-scope-packet-hook/README.md new file mode 100644 index 0000000000..c721c2c325 --- /dev/null +++ b/tests/firewall/ruletype-firewall-147-default-policy-scope-packet-hook/README.md @@ -0,0 +1,2 @@ +Test that a global default-policy carrying an app-only action scope is rejected +at startup when it reaches a packet hook. diff --git a/tests/firewall/ruletype-firewall-147-default-policy-scope-packet-hook/firewall.rules b/tests/firewall/ruletype-firewall-147-default-policy-scope-packet-hook/firewall.rules new file mode 100644 index 0000000000..952da784a5 --- /dev/null +++ b/tests/firewall/ruletype-firewall-147-default-policy-scope-packet-hook/firewall.rules @@ -0,0 +1 @@ +# A rule file has to exist so the run is in firewall-mode diff --git a/tests/firewall/ruletype-firewall-147-default-policy-scope-packet-hook/suricata.yaml b/tests/firewall/ruletype-firewall-147-default-policy-scope-packet-hook/suricata.yaml new file mode 100644 index 0000000000..a66e9c02b1 --- /dev/null +++ b/tests/firewall/ruletype-firewall-147-default-policy-scope-packet-hook/suricata.yaml @@ -0,0 +1,10 @@ +%YAML 1.1 +--- + +outputs: + - eve-log: + enabled: no + +firewall: + policies: + default-policy: [ "accept:tx" ] diff --git a/tests/firewall/ruletype-firewall-147-default-policy-scope-packet-hook/test.yaml b/tests/firewall/ruletype-firewall-147-default-policy-scope-packet-hook/test.yaml new file mode 100644 index 0000000000..910fb5ca2a --- /dev/null +++ b/tests/firewall/ruletype-firewall-147-default-policy-scope-packet-hook/test.yaml @@ -0,0 +1,15 @@ +requires: + min-version: 9 + pcap: false + +args: + - --simulate-ips + - -T + +exit-code: 1 + +checks: + - shell: + args: |- + grep -qF 'firewall.policies.default-policy: action scope ("tx") is not valid. Valid scopes: packet/hook/flow' stderr && echo found + expect: found diff --git a/tests/firewall/ruletype-firewall-148-default-policy-scope-app-hook/README.md b/tests/firewall/ruletype-firewall-148-default-policy-scope-app-hook/README.md new file mode 100644 index 0000000000..ef648a89ce --- /dev/null +++ b/tests/firewall/ruletype-firewall-148-default-policy-scope-app-hook/README.md @@ -0,0 +1,2 @@ +Test that a global default-policy carrying a packet-only action scope is +rejected at startup when it reaches an app-layer hook. diff --git a/tests/firewall/ruletype-firewall-148-default-policy-scope-app-hook/firewall.rules b/tests/firewall/ruletype-firewall-148-default-policy-scope-app-hook/firewall.rules new file mode 100644 index 0000000000..952da784a5 --- /dev/null +++ b/tests/firewall/ruletype-firewall-148-default-policy-scope-app-hook/firewall.rules @@ -0,0 +1 @@ +# A rule file has to exist so the run is in firewall-mode diff --git a/tests/firewall/ruletype-firewall-148-default-policy-scope-app-hook/suricata.yaml b/tests/firewall/ruletype-firewall-148-default-policy-scope-app-hook/suricata.yaml new file mode 100644 index 0000000000..1353183dd2 --- /dev/null +++ b/tests/firewall/ruletype-firewall-148-default-policy-scope-app-hook/suricata.yaml @@ -0,0 +1,10 @@ +%YAML 1.1 +--- + +outputs: + - eve-log: + enabled: no + +firewall: + policies: + default-policy: [ "drop:packet" ] diff --git a/tests/firewall/ruletype-firewall-148-default-policy-scope-app-hook/test.yaml b/tests/firewall/ruletype-firewall-148-default-policy-scope-app-hook/test.yaml new file mode 100644 index 0000000000..1de6e49e83 --- /dev/null +++ b/tests/firewall/ruletype-firewall-148-default-policy-scope-app-hook/test.yaml @@ -0,0 +1,15 @@ +requires: + min-version: 9 + pcap: false + +args: + - --simulate-ips + - -T + +exit-code: 1 + +checks: + - shell: + args: |- + grep -qF 'firewall.policies.default-policy: action scope ("packet") is not valid. Valid scopes: flow/tx/hook' stderr && echo found + expect: found diff --git a/tests/firewall/ruletype-firewall-149-default-policy-scope-substate/README.md b/tests/firewall/ruletype-firewall-149-default-policy-scope-substate/README.md new file mode 100644 index 0000000000..f26c5b0269 --- /dev/null +++ b/tests/firewall/ruletype-firewall-149-default-policy-scope-substate/README.md @@ -0,0 +1,7 @@ +Test that action scope validation covers default policies nested under a sub +state. + +The rejected setting is app.http2.stream.default-policy rather than one at the +top of firewall.policies. The error quotes the full nested path, so the check +confirms both that the sub state tier is validated like any other and that the +message points at where the bad setting actually lives. diff --git a/tests/firewall/ruletype-firewall-149-default-policy-scope-substate/firewall.rules b/tests/firewall/ruletype-firewall-149-default-policy-scope-substate/firewall.rules new file mode 100644 index 0000000000..952da784a5 --- /dev/null +++ b/tests/firewall/ruletype-firewall-149-default-policy-scope-substate/firewall.rules @@ -0,0 +1 @@ +# A rule file has to exist so the run is in firewall-mode diff --git a/tests/firewall/ruletype-firewall-149-default-policy-scope-substate/suricata.yaml b/tests/firewall/ruletype-firewall-149-default-policy-scope-substate/suricata.yaml new file mode 100644 index 0000000000..312f17ed10 --- /dev/null +++ b/tests/firewall/ruletype-firewall-149-default-policy-scope-substate/suricata.yaml @@ -0,0 +1,13 @@ +%YAML 1.1 +--- + +outputs: + - eve-log: + enabled: no + +firewall: + policies: + app: + http2: + stream: + default-policy: [ "drop:packet" ] diff --git a/tests/firewall/ruletype-firewall-149-default-policy-scope-substate/test.yaml b/tests/firewall/ruletype-firewall-149-default-policy-scope-substate/test.yaml new file mode 100644 index 0000000000..8abff045ac --- /dev/null +++ b/tests/firewall/ruletype-firewall-149-default-policy-scope-substate/test.yaml @@ -0,0 +1,15 @@ +requires: + min-version: 9 + pcap: false + +args: + - --simulate-ips + - -T + +exit-code: 1 + +checks: + - shell: + args: |- + grep -qF 'firewall.policies.app.http2.stream.default-policy: action scope ("packet") is not valid. Valid scopes: flow/tx/hook' stderr && echo found + expect: found diff --git a/tests/firewall/ruletype-firewall-150-default-policy-packet-hooks/README.md b/tests/firewall/ruletype-firewall-150-default-policy-packet-hooks/README.md new file mode 100644 index 0000000000..c0b8cb6987 --- /dev/null +++ b/tests/firewall/ruletype-firewall-150-default-policy-packet-hooks/README.md @@ -0,0 +1,5 @@ +Test that packet.default-policy applies to every packet hook. + +The hook `pre-stream` has its built-in policy an `accept:hook`, so +inheriting drop:packet changes the outcome. pre-flow and filter are given +accept:hook of their own, leaving pre-stream as the only hook able to drop. diff --git a/tests/firewall/ruletype-firewall-150-default-policy-packet-hooks/firewall.rules b/tests/firewall/ruletype-firewall-150-default-policy-packet-hooks/firewall.rules new file mode 100644 index 0000000000..624f416452 --- /dev/null +++ b/tests/firewall/ruletype-firewall-150-default-policy-packet-hooks/firewall.rules @@ -0,0 +1,5 @@ +# The pre-flow and pre-stream hooks are only installed when a rule targets +# them, so these two rules exist purely to make the hooks run. Port 1 is not +# in the pcap, so neither ever matches and both hooks fall to their policy. +accept:packet tcp:pre_flow any any -> any 1 (sid:1;) +accept:packet tcp:pre_stream any any -> any 1 (sid:2;) diff --git a/tests/firewall/ruletype-firewall-150-default-policy-packet-hooks/suricata.yaml b/tests/firewall/ruletype-firewall-150-default-policy-packet-hooks/suricata.yaml new file mode 100644 index 0000000000..2575699a30 --- /dev/null +++ b/tests/firewall/ruletype-firewall-150-default-policy-packet-hooks/suricata.yaml @@ -0,0 +1,26 @@ +%YAML 1.1 +--- + +stats: + enabled: yes + interval: 8 + +outputs: + - eve-log: + enabled: yes + filetype: regular + filename: eve.json + types: + - stats + - flow + - alert + - drop: + alerts: yes + flows: all + +firewall: + policies: + packet: + default-policy: [ "drop:packet" ] + pre-flow: [ "accept:hook" ] + filter: [ "accept:hook" ] diff --git a/tests/firewall/ruletype-firewall-150-default-policy-packet-hooks/test.yaml b/tests/firewall/ruletype-firewall-150-default-policy-packet-hooks/test.yaml new file mode 100644 index 0000000000..a395ebda61 --- /dev/null +++ b/tests/firewall/ruletype-firewall-150-default-policy-packet-hooks/test.yaml @@ -0,0 +1,41 @@ +requires: + min-version: 9 + +pcap: ../../tls/tls-random/input.pcap + +args: + - --simulate-ips + - -k none + +checks: +# pre-flow accepted, so the flow was set up and the packets reached pre-stream. +- filter: + count: 1 + match: + event_type: flow + flow.pkts_toserver: 7 + flow.pkts_toclient: 6 +# Neither hook rule matches, so nothing alerts. +- filter: + count: 0 + match: + event_type: alert +# Every packet dies at pre-stream, on the policy it inherited from +# packet.default-policy. +- filter: + count: 13 + match: + event_type: drop + drop.reason: "firewall default packet policy" +- filter: + count: 1 + match: + event_type: stats + stats.flow.total: 1 + stats.firewall.accepted: 0 + stats.firewall.blocked: 13 + stats.firewall.rejected: 0 + stats.firewall.drop_reason.default_packet_policy: 13 + stats.firewall.drop_reason.rules: 0 + stats.firewall.drop_reason.pre_flow_hook: 0 + stats.firewall.drop_reason.pre_stream_hook: 0