Backport 8.0.x/feat/8770 fw default policy v2 - #16116
Closed
lukashino wants to merge 3 commits into
Closed
Conversation
added 3 commits
August 26, 2026 09:48
Mapping an app-layer progress state to its generic request-/response- hook alias was hardcoded in multiple places. This commit adds a wrapper to unify it to a single function. It returns the config-form (hyphenated) name, or NULL for an intermediate state. Ticket: 8770 (cherry picked from commit 1aa0259)
Every hook has a built-in default policy, but expressing anything other than the built-in meant naming each hook explicitly. This commit adds a `default-policy` setting that covers all hooks below it. For any hook the most specific setting present wins. Ticket: 8770 (cherry picked from commit 0aaa80d)
Validate the resolved scope against the class of hook it is being applied to and fail at startup if it does not fit. Ticket: 8770 (cherry picked from commit 092ae27)
There was a problem hiding this comment.
Pull request overview
Backports hierarchical firewall default policies and hook-specific scope validation to Suricata 8.0.x.
Changes:
- Adds inherited global, packet, app, and protocol defaults.
- Validates action scopes against packet/app hooks.
- Documents precedence and reuses generic app-hook naming.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
src/detect-parse.h |
Exposes generic hook-name helper. |
src/detect-parse.c |
Implements policy inheritance and validation. |
src/detect-engine-analyzer.c |
Uses shared generic hook names. |
doc/userguide/firewall/firewall-design.rst |
Documents defaults and precedence. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+118
to
+122
| static const uint8_t fw_packet_hook_scopes[] = { | ||
| ACTION_SCOPE_PACKET, | ||
| ACTION_SCOPE_HOOK, | ||
| ACTION_SCOPE_FLOW, | ||
| }; |
Contributor
Author
There was a problem hiding this comment.
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## main-8.0.x #16116 +/- ##
==============================================
- Coverage 81.71% 81.69% -0.03%
==============================================
Files 1016 1016
Lines 277201 277243 +42
==============================================
- Hits 226509 226480 -29
- Misses 50692 50763 +71
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
|
Information: QA ran without warnings. Pipeline = 33362 |
victorjulien
approved these changes
Aug 26, 2026
Member
|
Merged in #16123, thanks! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up of pre-approved #16110
Add a default-policy setting that applies to all hooks below it. For any hook the most specific setting present wins.
Action scopes are now validated against the hook they reach. A global accept:tx arriving at a packet hook is a startup error instead of being applied silently.
Link to ticket: https://redmine.openinfosecfoundation.org/issues/8770
Backport of #16091
Describe changes:
v2:
v1:
SV_BRANCH=OISF/suricata-verify#3317