fw: test the firewall default policy tiers v3

tests/firewall/ruletype-firewall-142-default-policy-packet-precedence/README.md

@@ -0,0 +1,7 @@
+Test that packet.default-policy takes precedence over the global default-policy
+at a packet filter hook.
+
+Packet filter hook has no setting of its own, so it inherits reject:packet from
+packet.default-policy. That action distinguishes the winning tier from the
+alternatives: the global default is accept:hook and the built-in filter policy
+is drop:packet.

tests/firewall/ruletype-firewall-142-default-policy-packet-precedence/firewall.rules

@@ -0,0 +1,5 @@
+# The pre-flow and pre-stream hooks are only installed when a rule targets
+# them. Port 1 is not in the pcap, so neither rule ever matches and both hooks
+# fall to their configured policy.
+accept:packet tcp:pre_flow any any -> any 1 (sid:1;)
+accept:packet tcp:pre_stream any any -> any 1 (sid:2;)

tests/firewall/ruletype-firewall-142-default-policy-packet-precedence/suricata.yaml

@@ -0,0 +1,27 @@
+%YAML 1.1
+---
+
+stats:
+  enabled: yes
+  interval: 8
+
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular
+      filename: eve.json
+      types:
+        - stats
+        - flow
+        - alert
+        - drop:
+            alerts: yes
+            flows: all
+
+firewall:
+  policies:
+    default-policy: [ "accept:hook" ]
+    packet:
+      default-policy: [ "reject:packet" ]
+      pre-flow: [ "accept:hook" ]
+      pre-stream: [ "accept:hook" ]

tests/firewall/ruletype-firewall-142-default-policy-packet-precedence/test.yaml

@@ -0,0 +1,39 @@
+requires:
+  min-version: 9
+  features:
+    - LIBNET1.1
+
+pcap: ../../tls/tls-random/input.pcap
+
+args:
+  - --simulate-ips
+  - -k none
+
+checks:
+- filter:
+    count: 1
+    match:
+      event_type: flow
+      flow.pkts_toserver: 7
+      flow.pkts_toclient: 6
+- filter:
+    count: 0
+    match:
+      event_type: alert
+- filter:
+    count: 13
+    match:
+      event_type: drop
+      drop.reason: "firewall default packet policy"
+- filter:
+    count: 1
+    match:
+      event_type: stats
+      stats.flow.total: 1
+      stats.firewall.accepted: 0
+      stats.firewall.blocked: 0
+      stats.firewall.rejected: 13
+      stats.firewall.drop_reason.default_packet_policy: 13
+      stats.firewall.drop_reason.rules: 0
+      stats.firewall.drop_reason.pre_flow_hook: 0
+      stats.firewall.drop_reason.pre_stream_hook: 0

tests/firewall/ruletype-firewall-143-default-policy-app-layer/README.md

@@ -0,0 +1,2 @@
+Test that app.default-policy supplies the policy for the app-layer hooks of
+every protocol.

tests/firewall/ruletype-firewall-143-default-policy-app-layer/firewall.rules

@@ -0,0 +1,2 @@
+# No app rules at all: the app hooks are decided entirely by
+# app.default-policy.

tests/firewall/ruletype-firewall-143-default-policy-app-layer/suricata.yaml

@@ -0,0 +1,27 @@
+%YAML 1.1
+---
+
+stats:
+  enabled: yes
+  interval: 8
+
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular
+      filename: eve.json
+      types:
+        - stats
+        - flow
+        - alert
+        - dns
+        - drop:
+            alerts: yes
+            flows: all
+
+firewall:
+  policies:
+    packet:
+      filter: [ "accept:hook" ]
+    app:
+      default-policy: [ "accept:hook" ]

tests/firewall/ruletype-firewall-143-default-policy-app-layer/test.yaml

@@ -0,0 +1,41 @@
+requires:
+  min-version: 9
+
+pcap: ../../dns/dns-eve/input.pcap
+
+args:
+  - --simulate-ips
+  - -k none
+
+checks:
+- filter:
+    count: 4
+    match:
+      event_type: dns
+      dns.type: request
+- filter:
+    count: 4
+    match:
+      event_type: dns
+      dns.type: response
+- filter:
+    count: 0
+    match:
+      event_type: drop
+- filter:
+    count: 4
+    match:
+      event_type: flow
+      flow.alerted: false
+      not-has-key: flow.action
+- filter:
+    count: 1
+    match:
+      event_type: stats
+      stats.flow.total: 4
+      stats.firewall.accepted: 8
+      stats.firewall.blocked: 0
+      stats.firewall.rejected: 0
+      stats.firewall.drop_reason.default_app_policy: 0
+      stats.firewall.drop_reason.default_packet_policy: 0
+      stats.firewall.drop_reason.flow_drop: 0

tests/firewall/ruletype-firewall-144-default-policy-substate/README.md

@@ -0,0 +1,5 @@
+Test that a sub state's default-policy takes precedence over the per-protocol
+default-policy.
+
+Also test that a packet filter and sub state with no default-policy of its own
+(http2.global) falls through default-policy to up to the global level.

tests/firewall/ruletype-firewall-144-default-policy-substate/firewall.rules

@@ -0,0 +1,3 @@
+# No rules, the hooks are decided entirely by the configured
+# default policies.
+

tests/firewall/ruletype-firewall-144-default-policy-substate/suricata.yaml

@@ -0,0 +1,28 @@
+%YAML 1.1
+---
+
+stats:
+  enabled: yes
+  interval: 8
+
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular
+      filename: eve.json
+      types:
+        - stats
+        - flow
+        - alert
+        - http2
+        - drop:
+            alerts: yes
+            flows: all
+
+firewall:
+  policies:
+    default-policy: [ "accept:hook" ]
+    app:
+      http2:
+        stream:
+          default-policy: [ "drop:flow", "alert" ]

tests/firewall/ruletype-firewall-144-default-policy-substate/test.yaml

@@ -0,0 +1,64 @@
+requires:
+  min-version: 9
+
+pcap: ../../http2-userinfo-authority/http2_userinfo_in_authority_1.pcap
+
+args:
+  - --simulate-ips
+  - -k none
+
+checks:
+# The connection-level "global" sub state hooks run first and inherit the
+# per-protocol accept:hook, so nothing drops while they are in charge.
+- filter:
+    count: 0
+    match:
+      event_type: drop
+      pcap_cnt: 4
+- filter:
+    count: 0
+    match:
+      event_type: drop
+      pcap_cnt: 5
+- filter:
+    count: 0
+    match:
+      event_type: drop
+      pcap_cnt: 6
+# The first "stream" sub state hook uses the sub state's own default, not the
+# per-protocol one, so the flow is dropped here and the policy signature fires.
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 2201001
+      app_proto: http2
+      pcap_cnt: 7
+- filter:
+    count: 1
+    match:
+      event_type: drop
+      drop.reason: "firewall default app policy"
+      pcap_cnt: 7
+- filter:
+    count: 2
+    match:
+      event_type: drop
+      drop.reason: "firewall flow drop"
+- filter:
+    count: 1
+    match:
+      event_type: flow
+      app_proto: http2
+      flow.action: drop
+- filter:
+    count: 1
+    match:
+      event_type: stats
+      stats.app_layer.flow.http2: 1
+      stats.firewall.accepted: 6
+      stats.firewall.blocked: 3
+      stats.firewall.drop_reason.default_app_policy: 1
+      stats.firewall.drop_reason.flow_drop: 2
+      stats.firewall.drop_reason.rules: 0
+      stats.firewall.drop_reason.default_packet_policy: 0

tests/firewall/ruletype-firewall-145-default-policy-per-proto/README.md

@@ -0,0 +1,2 @@
+Test that a per-protocol default-policy covers a protocol's app-layer hooks
+while a specific hook setting carves one of them out.

tests/firewall/ruletype-firewall-145-default-policy-per-proto/firewall.rules

@@ -0,0 +1 @@
+# The hooks are decided entirely by the configured default policies.

tests/firewall/ruletype-firewall-145-default-policy-per-proto/suricata.yaml

@@ -0,0 +1,29 @@
+%YAML 1.1
+---
+
+stats:
+  enabled: yes
+  interval: 8
+
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular
+      filename: eve.json
+      types:
+        - stats
+        - flow
+        - alert
+        - dns
+        - drop:
+            alerts: yes
+            flows: all
+
+firewall:
+  policies:
+    packet:
+      default-policy: [ "accept:hook" ]
+    app:
+      dns:
+        default-policy: [ "drop:flow" ]
+        request-started: [ "accept:hook" ]

tests/firewall/ruletype-firewall-145-default-policy-per-proto/test.yaml

@@ -0,0 +1,51 @@
+requires:
+  min-version: 9
+
+pcap: ../../dns/dns-eve/input.pcap
+
+args:
+  - --simulate-ips
+  - -k none
+
+checks:
+- filter:
+    count: 4
+    match:
+      event_type: dns
+      dns.type: request
+- filter:
+    count: 0
+    match:
+      event_type: dns
+      dns.type: response
+- filter:
+    count: 8
+    match:
+      event_type: drop
+- filter:
+    count: 4
+    match:
+      event_type: drop
+      drop.reason: "firewall default app policy"
+- filter:
+    count: 4
+    match:
+      event_type: drop
+      drop.reason: "firewall flow drop"
+- filter:
+    count: 4
+    match:
+      event_type: flow
+      flow.action: drop
+      flow.alerted: false
+- filter:
+    count: 1
+    match:
+      event_type: stats
+      stats.ips.accepted: 0
+      stats.ips.blocked: 0
+      stats.firewall.accepted: 0
+      stats.firewall.blocked: 8
+      stats.firewall.drop_reason.default_packet_policy: 0
+      stats.firewall.drop_reason.default_app_policy: 4
+      stats.firewall.drop_reason.flow_drop: 4

tests/firewall/ruletype-firewall-146-default-policy-tls-request-complete/README.md

@@ -0,0 +1,2 @@
+Test that the generic request-complete hook alias resolves to a protocol's own
+final state.

tests/firewall/ruletype-firewall-146-default-policy-tls-request-complete/firewall.rules

@@ -0,0 +1,2 @@
+# No app rules: the tls hooks are decided entirely by the configured default
+# policies.

tests/firewall/ruletype-firewall-146-default-policy-tls-request-complete/suricata.yaml

@@ -0,0 +1,32 @@
+%YAML 1.1
+---
+
+stats:
+  enabled: yes
+  interval: 8
+
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular
+      filename: eve.json
+      types:
+        - stats
+        - flow
+        - alert
+        - tls:
+            extended: yes
+        - drop:
+            alerts: yes
+            flows: all
+
+firewall:
+  policies:
+    packet:
+      filter: [ "accept:hook" ]
+    app:
+      tls:
+        default-policy: [ "accept:hook" ]
+        # TLS calls its to_server completion state "client_finished". The
+        # generic completion alias has to resolve to that same hook.
+        request-complete: [ "drop:flow", "alert" ]