Bug/8954 action scope verify v2

[lukashino]

Follow-up of #3323

Redmine ticket: https://redmine.openinfosecfoundation.org/issues/8954

Describe changes:
v2:

• tests for pass keyword (in)compatibility added

[Copilot]

Pull request overview

Adds Suricata-verify firewall tests covering action-scope inheritance and pass secondary-action compatibility rules (ticket 8954 follow-up), ensuring invalid configurations are rejected and valid combinations continue to load.

Changes:

• Add a valid ruleset test ensuring inherited scopes remain acceptable where supported (including pass scope inheritance and alert inheritance).
• Add invalid cases ensuring pass rejects unsupported inherited scopes (rule + default-policy variants).
• Add valid/invalid cases ensuring pass is only permitted as a secondary action after accept (rule + policy variants).

Reviewed changes

Copilot reviewed 18 out of 18 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
tests/firewall/firewall-action-scope-inherited-valid/test.yaml	Verifies expected successful rule-load outcome for valid inherited scopes.
tests/firewall/firewall-action-scope-inherited-valid/suricata.yaml	Engine-analysis + logging config for the valid inherited-scope test.
tests/firewall/firewall-action-scope-inherited-valid/firewall.rules	Ruleset covering valid inherited-scope combinations (incl. pass + alert).
tests/firewall/firewall-action-scope-inherited-rule-invalid/test.yaml	Expects failure + specific log message for invalid inherited scope into pass (rule case).
tests/firewall/firewall-action-scope-inherited-rule-invalid/suricata.yaml	Engine-analysis + logging config for invalid inherited-scope rule test.
tests/firewall/firewall-action-scope-inherited-rule-invalid/firewall.rules	Single rule intended to trigger invalid inherited-scope validation.
tests/firewall/firewall-action-scope-inherited-policies-invalid/test.yaml	Expects failure + specific log message for invalid inherited scope into pass (policy case).
tests/firewall/firewall-action-scope-inherited-policies-invalid/suricata.yaml	Defines default-policy intended to trigger invalid inherited-scope validation.
tests/firewall/firewall-action-scope-inherited-policies-invalid/firewall.rules	Placeholder rules file (policy-only test).
tests/firewall/firewall-action-pass-requires-accept-valid/test.yaml	Verifies expected successful rule-load outcome for valid accept→pass usage.
tests/firewall/firewall-action-pass-requires-accept-valid/suricata.yaml	Engine-analysis + logging config for valid pass-requires-accept test.
tests/firewall/firewall-action-pass-requires-accept-valid/firewall.rules	Ruleset covering valid pass usage after accept and allowed alert usage.
tests/firewall/firewall-action-pass-requires-accept-rule-invalid/test.yaml	Expects failure + specific log message when pass follows a non-accept primary (rule case).
tests/firewall/firewall-action-pass-requires-accept-rule-invalid/suricata.yaml	Engine-analysis + logging config for invalid pass-requires-accept rule test.
tests/firewall/firewall-action-pass-requires-accept-rule-invalid/firewall.rules	Single rule intended to trigger invalid pass-requires-accept validation.
tests/firewall/firewall-action-pass-requires-accept-policies-invalid/test.yaml	Expects failure + specific log message when policy chain includes invalid pass placement.
tests/firewall/firewall-action-pass-requires-accept-policies-invalid/suricata.yaml	Defines policy chain intended to trigger invalid pass placement validation.
tests/firewall/firewall-action-pass-requires-accept-policies-invalid/firewall.rules	Minimal rules file for policy-only test.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.