tests: tests for scope inheritance in rules/policies v1

tests/firewall/firewall-action-scope-inherited-policies-invalid/firewall.rules

@@ -0,0 +1 @@
+# testing default policies, no rules needed

tests/firewall/firewall-action-scope-inherited-policies-invalid/suricata.yaml

@@ -0,0 +1,16 @@
+%YAML 1.1
+---
+
+engine-analysis:
+  rules-fast-pattern: no
+  rules: yes
+
+logging:
+  outputs:
+    - file:
+        enabled: yes
+        filename: suricata.log
+
+firewall:
+  policies:
+    default-policy: [ "accept:hook", "pass" ]

tests/firewall/firewall-action-scope-inherited-policies-invalid/test.yaml

@@ -0,0 +1,13 @@
+requires:
+  min-version: 9
+  pcap: false
+
+args:
+  - --engine-analysis
+
+exit-code: 1
+
+checks:
+  - shell:
+      args: grep -c "invalid action scope 'hook' in action 'pass'" suricata.log | xargs
+      expect: 1

tests/firewall/firewall-action-scope-inherited-rule-invalid/firewall.rules

@@ -0,0 +1,4 @@
+# "pass" without an explicit scope inherits the scope of the primary action.
+# pass only supports packet and flow scope, so an inherited hook scope has to be
+# rejected the same way an explicit "pass:hook" is.
+accept:hook,pass tcp:all any any -> any any (sid:1;)

tests/firewall/firewall-action-scope-inherited-rule-invalid/suricata.yaml

@@ -0,0 +1,13 @@
+%YAML 1.1
+---
+
+engine-analysis:
+  rules-fast-pattern: no
+  rules: yes
+
+logging:
+  outputs:
+    - file:
+        enabled: yes
+        filename: suricata.log
+

tests/firewall/firewall-action-scope-inherited-rule-invalid/test.yaml

@@ -0,0 +1,13 @@
+requires:
+  min-version: 9
+  pcap: false
+
+args:
+  - --engine-analysis
+
+exit-code: 1
+
+checks:
+  - shell:
+      args: grep -c "invalid action scope 'hook' in action 'pass'" suricata.log | xargs
+      expect: 1

tests/firewall/firewall-action-scope-inherited-valid/firewall.rules

@@ -0,0 +1,7 @@
+# An inherited scope that is valid for the secondary action must keep working.
+# pass supports flow and packet scope:
+accept:flow,pass tcp:all any any -> any any (sid:1;)
+accept:packet,pass tcp:all any any -> any any (sid:2;)
+# alert takes no scope of its own, so it may inherit any scope:
+accept:hook,alert tcp:all any any -> any any (sid:3;)
+accept:tx,alert http1:request_line any any -> any any (sid:4;)

tests/firewall/firewall-action-scope-inherited-valid/suricata.yaml

@@ -0,0 +1,14 @@
+%YAML 1.1
+---
+
+engine-analysis:
+  rules-fast-pattern: no
+  rules: yes
+
+logging:
+  default-log-level: notice
+  outputs:
+    - file:
+        enabled: yes
+        level: info
+        filename: suricata.log

tests/firewall/firewall-action-scope-inherited-valid/test.yaml

@@ -0,0 +1,12 @@
+requires:
+  min-version: 9
+  pcap: false
+
+args:
+  - --engine-analysis
+
+checks:
+  # all four rules load, none is rejected by the inherited-scope validation
+  - shell:
+      args: grep -c "4 rules successfully loaded, 0 rules failed" suricata.log | xargs
+      expect: 1