Backport 8.0.x: firewall: add default-policy to policy config v1 - #15951

Closed

lukashino wants to merge 69 commits into

OISF:main-8.0.xfrom

lukashino:backport-8.0.x/feat/8712-fw-default-policy-v1

Commits on Jul 10, 2026

smtp: add firewall progress states

jasonish
authored and
victorjulien
committed
de46175
smtp: complete transactions by progress state

jasonish
authored and
victorjulien
committed
ebbe9a7
smtp: handle pipelined replies on owning tx

jasonish
authored and
victorjulien
committed
0118ba2
smtp: don't create transaction for trailing quit

jasonish
authored and
victorjulien
committed
fddc9e2
htp: remove duplicate entries in the event table
victorjulien
committed
2f075e8
detect/file: remove unused registration fields
victorjulien
committed
56b3ece
detect/file.data: reduce scope for MPM datatype
victorjulien
committed
d8b869f
detect/parse: tighten hook parsing
victorjulien
committed
628b0b2
app-layer: minor code cleanup for GetStateProgress
victorjulien
committed
52577df
app-layer/parser: remove misleading comment
victorjulien
committed
df4bacc
app-layer: cleanup inspect id getter
victorjulien
committed
b7c8636
http/xff: harden code against http in detection-only
victorjulien
committed
46d39d0
detect/alert: split append func per packet/tx
victorjulien
committed
5011437
detect: move packet alert logic into helper
victorjulien
committed
7b71e22
detect: extend app-layer-protocol to accept a pipe-separated value list

yashda
authored and
victorjulien
committed
c3bef92
http2: split progress per direction

catenacyber
authored and
victorjulien
committed
e379d17
http2: global txs are unidirectional

catenacyber
authored and
victorjulien
committed
7bfb577
http2: replace state todrop with a dedicated boolean

catenacyber
authored and
victorjulien
committed
2ea3afc
bindgen: add stddef
victorjulien
committed
8933283
app-layer: start of substate API support
victorjulien
committed
3316da4
detect: support per tx sub states
victorjulien
committed
8b26d63
detect/parse: initial substate support
victorjulien
committed
99f3b8f
detect/app-layer-event: support sub-state progress handling
victorjulien
committed
2a96758
output/tx: support substate completion flags
victorjulien
committed
e8abfa9
http2: split transaction state machines
victorjulien
committed
f6bc591
detect/parse: initial http2 substate support
victorjulien
committed
a822738
detect/file: register http/2 with sub-state
victorjulien
committed
079782c
detect/http2: don't double register engines
victorjulien
committed
c486a4c
detect/dns: register keywords for DOH2 as well
victorjulien
committed
91c76f7
detect/http: register keywords for HTTP/2
victorjulien
committed
3e5d5f7
detect: change how DOH2 inspection works
victorjulien
committed
e7b5240
output/dns: update for DOH2 change
victorjulien
committed
c9ef3bf
http2: mark HTTP2TxProgress and HTTP2TxGlobalProgress as AppLayerState
victorjulien
committed
fe2f9d0
http2: register names for states per sub-state
victorjulien
committed
05bcc64
detect/firewall: policy for substates
victorjulien
committed
00dadae
detect/parse: parse sub state hooks
victorjulien
committed
a44fb56
http2: set event on frame types not allowed on stream id
victorjulien
committed
07b4674
http2: update push promise to account for stream id 0 filtering
victorjulien
committed
0cd2e8d
detect/parse: don't setup sub states if protocol doesn't support it
victorjulien
committed
57aec26
app-layer: for sub state API treat DOH2 as HTTP/2
victorjulien
committed
35369aa
detect/parse: allow bigger protocol/hook specifications
victorjulien
committed
4156641
detect/firewall: implement app policy as hash table
victorjulien
committed
7f8fb20
detect/firewall: add default alert signature to policy object
victorjulien
committed
ab7767b
detect/mpm: don't register engines for disabled protocols
victorjulien
committed
164754d
detect: add debug validation checks
victorjulien
committed
22f3d1e
app-layer: use macro for progress ceiling
victorjulien
committed
957bcb9
detect/alert: store sub-state in PacketAlert
victorjulien
committed
feb9d86
eve/alert: add sub state output
victorjulien
committed
e11bb03
detect/firewall: support lte mode for substate
victorjulien
committed
512a186
detect/firewall: support substate in analyzer
victorjulien
committed
3208779
detect: give clear errors for http2 w/o substate
victorjulien
committed
6bdbd83
detect: add debug validation checks to assert assumptions
victorjulien
committed
41b60bc
detect/firewall: harden policy lookup logic
victorjulien
committed
532770a
eve/alert: clean up state logging
victorjulien
committed
67339d0
eve/alert: log sub state progress values
victorjulien
committed
9af776f
detect: sync prefilter and app inspect alproto logic
victorjulien
committed
f179816
http2: rename state *start to *started
victorjulien
committed
9bd5a75
doh2: do not enable parser if http2 is disabled
victorjulien
committed
fc99592
app-layer: check if protocol is enabled for sub state callbacks
victorjulien
committed
ee79d0d
detect/firewall: avoid passing state match for policy
victorjulien
committed
0350bc4
detect: use sub state to select inspect engines
victorjulien
committed
aaa49d9
output/tx: allow registering logging at substate
victorjulien
committed
33e0be0
detect: strict validation of buffers
victorjulien
committed
5053634
app-layer: add substate support to list hooks
victorjulien
committed
94296e8

Commits on Jul 29, 2026

yaml/firewall: expand firewall options explanation

jufajardini
authored and
lukashino
committed
f1775f1
detect/firewall: address HTTP/1 policies as http1

Lukas Sismis
authored and
lukashino
committed
3c04da1
detect/firewall: group policies under packet and app nodes

Lukas Sismis
authored and
lukashino
committed
488a6da
detect/firewall: add default-policy to policy config

Lukas Sismis
authored and
lukashino
committed
7da45e2
detect/firewall: validate action scope against the hook class

Lukas Sismis
authored and
lukashino
committed
5368ee3