From 20f2befae513386e5a14b744aece867a89e9cb82 Mon Sep 17 00:00:00 2001 From: Lukas Sismis Date: Wed, 26 Aug 2026 16:16:00 +0200 Subject: [PATCH] tests: tests for scope inheritance in rules/policies Ticket: 8954 --- .../firewall.rules | 1 + .../suricata.yaml | 16 ++++++++++++++++ .../test.yaml | 13 +++++++++++++ .../firewall.rules | 4 ++++ .../suricata.yaml | 13 +++++++++++++ .../test.yaml | 13 +++++++++++++ .../firewall.rules | 7 +++++++ .../suricata.yaml | 14 ++++++++++++++ .../test.yaml | 12 ++++++++++++ 9 files changed, 93 insertions(+) create mode 100644 tests/firewall/firewall-action-scope-inherited-policies-invalid/firewall.rules create mode 100644 tests/firewall/firewall-action-scope-inherited-policies-invalid/suricata.yaml create mode 100644 tests/firewall/firewall-action-scope-inherited-policies-invalid/test.yaml create mode 100644 tests/firewall/firewall-action-scope-inherited-rule-invalid/firewall.rules create mode 100644 tests/firewall/firewall-action-scope-inherited-rule-invalid/suricata.yaml create mode 100644 tests/firewall/firewall-action-scope-inherited-rule-invalid/test.yaml create mode 100644 tests/firewall/firewall-action-scope-inherited-valid/firewall.rules create mode 100644 tests/firewall/firewall-action-scope-inherited-valid/suricata.yaml create mode 100644 tests/firewall/firewall-action-scope-inherited-valid/test.yaml diff --git a/tests/firewall/firewall-action-scope-inherited-policies-invalid/firewall.rules b/tests/firewall/firewall-action-scope-inherited-policies-invalid/firewall.rules new file mode 100644 index 0000000000..2993454a0a --- /dev/null +++ b/tests/firewall/firewall-action-scope-inherited-policies-invalid/firewall.rules @@ -0,0 +1 @@ +# testing default policies, no rules needed diff --git a/tests/firewall/firewall-action-scope-inherited-policies-invalid/suricata.yaml b/tests/firewall/firewall-action-scope-inherited-policies-invalid/suricata.yaml new file mode 100644 index 0000000000..92c0b477c0 --- /dev/null +++ b/tests/firewall/firewall-action-scope-inherited-policies-invalid/suricata.yaml @@ -0,0 +1,16 @@ +%YAML 1.1 +--- + +engine-analysis: + rules-fast-pattern: no + rules: yes + +logging: + outputs: + - file: + enabled: yes + filename: suricata.log + +firewall: + policies: + default-policy: [ "accept:hook", "pass" ] diff --git a/tests/firewall/firewall-action-scope-inherited-policies-invalid/test.yaml b/tests/firewall/firewall-action-scope-inherited-policies-invalid/test.yaml new file mode 100644 index 0000000000..4994161b88 --- /dev/null +++ b/tests/firewall/firewall-action-scope-inherited-policies-invalid/test.yaml @@ -0,0 +1,13 @@ +requires: + min-version: 9 + pcap: false + +args: + - --engine-analysis + +exit-code: 1 + +checks: + - shell: + args: grep -c "invalid action scope 'hook' in action 'pass'" suricata.log | xargs + expect: 1 diff --git a/tests/firewall/firewall-action-scope-inherited-rule-invalid/firewall.rules b/tests/firewall/firewall-action-scope-inherited-rule-invalid/firewall.rules new file mode 100644 index 0000000000..a88d4ca593 --- /dev/null +++ b/tests/firewall/firewall-action-scope-inherited-rule-invalid/firewall.rules @@ -0,0 +1,4 @@ +# "pass" without an explicit scope inherits the scope of the primary action. +# pass only supports packet and flow scope, so an inherited hook scope has to be +# rejected the same way an explicit "pass:hook" is. +accept:hook,pass tcp:all any any -> any any (sid:1;) diff --git a/tests/firewall/firewall-action-scope-inherited-rule-invalid/suricata.yaml b/tests/firewall/firewall-action-scope-inherited-rule-invalid/suricata.yaml new file mode 100644 index 0000000000..8b29af8c02 --- /dev/null +++ b/tests/firewall/firewall-action-scope-inherited-rule-invalid/suricata.yaml @@ -0,0 +1,13 @@ +%YAML 1.1 +--- + +engine-analysis: + rules-fast-pattern: no + rules: yes + +logging: + outputs: + - file: + enabled: yes + filename: suricata.log + diff --git a/tests/firewall/firewall-action-scope-inherited-rule-invalid/test.yaml b/tests/firewall/firewall-action-scope-inherited-rule-invalid/test.yaml new file mode 100644 index 0000000000..4994161b88 --- /dev/null +++ b/tests/firewall/firewall-action-scope-inherited-rule-invalid/test.yaml @@ -0,0 +1,13 @@ +requires: + min-version: 9 + pcap: false + +args: + - --engine-analysis + +exit-code: 1 + +checks: + - shell: + args: grep -c "invalid action scope 'hook' in action 'pass'" suricata.log | xargs + expect: 1 diff --git a/tests/firewall/firewall-action-scope-inherited-valid/firewall.rules b/tests/firewall/firewall-action-scope-inherited-valid/firewall.rules new file mode 100644 index 0000000000..653147da49 --- /dev/null +++ b/tests/firewall/firewall-action-scope-inherited-valid/firewall.rules @@ -0,0 +1,7 @@ +# An inherited scope that is valid for the secondary action must keep working. +# pass supports flow and packet scope: +accept:flow,pass tcp:all any any -> any any (sid:1;) +accept:packet,pass tcp:all any any -> any any (sid:2;) +# alert takes no scope of its own, so it may inherit any scope: +accept:hook,alert tcp:all any any -> any any (sid:3;) +accept:tx,alert http1:request_line any any -> any any (sid:4;) diff --git a/tests/firewall/firewall-action-scope-inherited-valid/suricata.yaml b/tests/firewall/firewall-action-scope-inherited-valid/suricata.yaml new file mode 100644 index 0000000000..52c6f84d97 --- /dev/null +++ b/tests/firewall/firewall-action-scope-inherited-valid/suricata.yaml @@ -0,0 +1,14 @@ +%YAML 1.1 +--- + +engine-analysis: + rules-fast-pattern: no + rules: yes + +logging: + default-log-level: notice + outputs: + - file: + enabled: yes + level: info + filename: suricata.log diff --git a/tests/firewall/firewall-action-scope-inherited-valid/test.yaml b/tests/firewall/firewall-action-scope-inherited-valid/test.yaml new file mode 100644 index 0000000000..67ea162ada --- /dev/null +++ b/tests/firewall/firewall-action-scope-inherited-valid/test.yaml @@ -0,0 +1,12 @@ +requires: + min-version: 9 + pcap: false + +args: + - --engine-analysis + +checks: + # all four rules load, none is rejected by the inherited-scope validation + - shell: + args: grep -c "4 rules successfully loaded, 0 rules failed" suricata.log | xargs + expect: 1