Backport 8.0.x/feat/8770 fw default policy v1 - #16110
Closed
lukashino wants to merge 3 commits into
Closed
Conversation
added 3 commits
August 25, 2026 20:31
Mapping an app-layer progress state to its generic request-/response- hook alias was hardcoded in multiple places. This commit adds a wrapper to unify it to a single function. It returns the config-form (hyphenated) name, or NULL for an intermediate state. Ticket: 8770 (cherry picked from commit 1aa0259)
Every hook has a built-in default policy, but expressing anything other than the built-in meant naming each hook explicitly. This commit adds a `default-policy` setting that covers all hooks below it. For any hook the most specific setting present wins. Ticket: 8770 (cherry picked from commit 0aaa80d)
Validate the resolved scope against the class of hook it is being applied to and fail at startup if it does not fit. Ticket: 8770 (cherry picked from commit 092ae27)
There was a problem hiding this comment.
Pull request overview
Adds hierarchical firewall default policies with hook-specific precedence and action-scope validation.
Changes:
- Resolves packet and application policies through inherited defaults.
- Validates action scopes against packet/application hooks.
- Documents configuration precedence and supported scopes.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
src/detect-parse.h |
Exposes generic application-hook naming. |
src/detect-parse.c |
Implements inheritance and scope validation. |
src/detect-engine-analyzer.c |
Reuses generic hook naming. |
doc/userguide/firewall/firewall-design.rst |
Documents defaults and precedence. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+4200
to
+4201
| struct DetectFirewallPolicy *pol = &fw_policies->pkt[id]; // built-in default | ||
| int r = ResolveFirewallPolicy(pol, DETECT_FIREWALL_POLICY_CLASS_PACKET, &chain); |
Contributor
Author
There was a problem hiding this comment.
This seems plausible, but will require a fix to main first. Will create a separate RM ticket.
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## main-8.0.x #16110 +/- ##
==============================================
- Coverage 81.69% 81.68% -0.02%
==============================================
Files 1016 1016
Lines 277166 277209 +43
==============================================
+ Hits 226430 226437 +7
- Misses 50736 50772 +36
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
|
Information: QA ran without warnings. Pipeline = 33347 |
victorjulien
approved these changes
Aug 26, 2026
victorjulien
requested changes
Aug 26, 2026
victorjulien
left a comment
victorjulien
left a comment
Member
There was a problem hiding this comment.
Needs a rebase to resolve a small conflict.
Contributor
Author
|
Continues in #16116 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add a default-policy setting that applies to all hooks below it. For any hook the most specific setting present wins.
Action scopes are now validated against the hook they reach. A global accept:tx arriving at a packet hook is a startup error instead of being applied silently.
Link to ticket: https://redmine.openinfosecfoundation.org/issues/8770
Backport of #16091
Describe changes:
v1:
SV_BRANCH=OISF/suricata-verify#3317