next/1468/80x/20260826/v1

.github/workflows/builds.yml

@@ -517,7 +517,7 @@ jobs:
       matrix:
         container:
           - almalinux:9
-          - fedora:42
+          - fedora:44
     env:
       skip: true
     steps:
@@ -568,11 +568,11 @@ jobs:
       # We need a step for each RPM upload as we can't use the
       # container name directly in an artifact, as artifacts can't
       # have ':' in the name.
-      - if: ${{ matrix.container == 'fedora:42' &&  env.skip != 'true' }}
+      - if: ${{ matrix.container == 'fedora:44' &&  env.skip != 'true' }}
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
         name: Uploading RPMs
         with:
-          name: rpms-fedora-40
+          name: rpms-fedora-44
           path: suricata-rpms/devel/rpms
       - if: ${{ matrix.container == 'almalinux:9' && env.skip != 'true' }}
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
@@ -769,10 +769,10 @@ jobs:
       - run: make clean
       - run: make -j ${{ env.CPUS }}
 
-  fedora-42-sv-codecov:
-    name: Fedora 42 (Suricata Verify codecov)
+  fedora-44-sv-codecov:
+    name: Fedora 44 (Suricata Verify codecov)
     runs-on: ubuntu-latest
-    container: fedora:42
+    container: fedora:44
     needs: [prepare-deps, prepare-cbindgen]
     steps:
 
@@ -865,10 +865,10 @@ jobs:
           flags: suricata-verify
 
   # Fedora build using Clang.
-  fedora-42-clang:
-    name: Fedora 42 (clang, debug, asan, wshadow, rust-strict, systemd)
+  fedora-44-clang:
+    name: Fedora 44 (clang, debug, asan, wshadow, rust-strict, systemd)
     runs-on: ubuntu-latest
-    container: fedora:42
+    container: fedora:44
     needs: [prepare-deps, prepare-cbindgen]
     steps:
 
@@ -966,10 +966,10 @@ jobs:
       - run: src/suricata --build-info | grep -E "Systemd support:\s+yes" &> /dev/null
 
   # Fedora build using GCC.
-  fedora-42-gcc:
-    name: Fedora 42 (gcc, debug, flto, asan, wshadow, rust-strict)
+  fedora-44-gcc:
+    name: Fedora 44 (gcc, debug, flto, asan, wshadow, rust-strict)
     runs-on: ubuntu-latest
-    container: fedora:42
+    container: fedora:44
     needs: [prepare-deps, prepare-cbindgen]
     steps:
 
@@ -1066,7 +1066,7 @@ jobs:
   fedora-non-root:
     name: Fedora (non-root, debug, clang, asan, wshadow, rust-strict, no-ja)
     runs-on: ubuntu-latest
-    container: fedora:42
+    container: fedora:44
     needs: [prepare-deps, prepare-cbindgen]
     steps:
       - name: Determine number of CPUs

doc/userguide/firewall/firewall-design.rst

@@ -327,35 +327,47 @@ of :ref:`engine analysis<config:engine-analysis>`.
 Default policies
 ================
 
-Each hook has a default policy. By default ``packet.filter`` enforces a ``drop:packet`` policy and the
-``app`` hooks apply ``drop:flow``.
+Each hook has a default policy applied to traffic that no firewall rule handled.
+By default ``packet.filter`` enforces ``drop:packet``, ``packet.pre-flow`` and
+``packet.pre-stream`` enforce ``accept:hook``, and every ``app`` hook enforces
+``drop:flow``.
 
-The policies can be configured in ``firewall`` block in the config. Packet hooks
-live under ``packet`` and app-layer hooks under ``app``, keyed by protocol.
-
-Example for ``packet.filter``, to use reject instead of drop::
+Defaults are configured in the ``firewall.policies`` block. A ``default-policy``
+for any hook may be given at several levels and the most specific present
+setting wins::
 
     firewall:
       policies:
+        default-policy: ["accept:hook"]     # global fallback (all hooks)
         packet:
-          filter: [ "reject:packet" ]
-
-
-Example for DNS::
-
-    firewall:
-      policies:
+          default-policy: ["drop:packet"]   # fallback for packet hooks
+          filter:     ["reject:packet"]
+          pre-flow:   ["accept:hook"]
+          pre-stream: ["accept:hook"]
         app:
+          default-policy: ["drop:flow"]     # fallback for all app hooks
           dns:
+            default-policy: ["drop:flow"]   # fallback for dns hooks
             request-started: ["accept:hook"]
-
             # Drop and alert on all DNS requests that are not allowed in
             # firewall.rules.
             request-complete: ["drop:flow", "alert"]
-
             # Accept all responses.
             response-started: ["accept:tx"]
 
+Precedence:
+
+* packet hook: ``packet.<hook>`` > ``packet.default-policy`` >
+  ``policies.default-policy`` > built-in (``drop:packet`` or ``accept:hook``)
+* app hook: ``app.<proto>.<hook>`` > ``app.<proto>.default-policy`` >
+  ``app.default-policy`` > ``policies.default-policy`` > built-in (``drop:flow``)
+
+An action scope must be valid for the hook it is applied to. For example,
+defining ``accept:tx`` as a global default policy will fail to start Suricata,
+because ``packet`` policies do not accept ``tx``.
+Cover such hooks with a more specific setting so the incompatible default never
+reaches them.
+
 
 ARP handling in bridge mode
 ---------------------------

src/Makefile.am

@@ -1059,6 +1059,7 @@ libsuricata_c_a_SOURCES = \
 	thread-callbacks.c \
 	thread-storage.c \
 	threads.c \
+	threadvars.c \
 	tm-modules.c \
 	tm-queuehandlers.c \
 	tm-queues.c \

src/detect-engine-analyzer.c

@@ -2110,11 +2110,8 @@ int FirewallAnalyzer(const DetectEngineCtx *de_ctx)
             const char *name =
                     AppLayerParserGetStateNameById(IPPROTO_TCP, a, state, STREAM_TOSERVER);
             if (name == NULL) {
-                if (state == 0)
-                    name = "request-started";
-                else if (state == complete_state_ts)
-                    name = "request-complete";
-                else
+                name = DetectFirewallAppGenericHookName(state, complete_state_ts, STREAM_TOSERVER);
+                if (name == NULL)
                     name = "unknown";
             }
 
@@ -2136,11 +2133,8 @@ int FirewallAnalyzer(const DetectEngineCtx *de_ctx)
             const char *name =
                     AppLayerParserGetStateNameById(IPPROTO_TCP, a, state, STREAM_TOCLIENT);
             if (name == NULL) {
-                if (state == 0)
-                    name = "response-started";
-                else if (state == complete_state_tc)
-                    name = "response-complete";
-                else
+                name = DetectFirewallAppGenericHookName(state, complete_state_tc, STREAM_TOCLIENT);
+                if (name == NULL)
                     name = "unknown";
             }
             char table_name[128];