draft: fw default policies with tcp.session keyword v1 - #3259
Draft
lukashino wants to merge 5 commits into
Draft
Conversation
Ticket: 8770
Ticket: 8770
Add 7 suricata-verify fixtures for the tcp.session: keyword: - fw-intent-tcp-session-equivalence: asserts tcp.session:setup,established matches identical packet set as flow:not_established + flow:established - fw-intent-stream-out-of-window-honored: out-of-window segment dropped regardless of tcp.session: accept rule - fw-intent-stream-midstream-policy-honored: midstream pickup rejected regardless of tcp.session: accept rule - fw-intent-decode-malformed-ipv4: decode-event emitted regardless of tcp.session: accept rule - fw-intent-syn-flood-drop-precedence: explicit drop takes precedence over tcp.session: accept after threshold trips - fw-intent-ipv6-stream-out-of-window-honored: IPv6 stream validation - fw-intent-ipv6-decode-malformed-header: IPv6 decode event validation Backport note: min-version lowered from 9 to 8.0.7 so the fixtures run on the 8.0.x backport, matching "tests: enable fw tests for 8.0.7".
There was a problem hiding this comment.
Pull request overview
This PR rebases and integrates recent suricata-verify firewall default-policy and tcp.session keyword fixture work, aligning the test suite for Suricata 8 (notably 8.0.7) and the newer firewall policy configuration layout.
Changes:
- Lower/adjust many test
requiresgates frommin-version: 9/lt-version: 9to8.0.7, updating associated “pre-version” expectations. - Add new firewall fixtures validating
tcp.session:behavior (equivalence, stream drop precedence, midstream/invalid handling, IPv6 coverage, SYN-flood precedence). - Update numerous firewall test
suricata.yamlfiles to the newerfirewall.policies.packet.*andfirewall.policies.app.*structure (includinghttp1,tls,dns,http2/doh2,ftp/ftp-data).
Reviewed changes
Copilot reviewed 170 out of 177 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| tests/smtp-quit/test.yaml | Gate SMTP quit test to Suricata 8.0.7. |
| tests/smtp-pipelined-rset-after-complete/test.yaml | Gate SMTP pipelining test to Suricata 8.0.7. |
| tests/smtp-pipelined-post-data-rset-sequence/test.yaml | Gate SMTP pipelining test to Suricata 8.0.7. |
| tests/smtp-no-helo-rset/test.yaml | Gate SMTP HELO/RSET behavior to Suricata 8.0.7. |
| tests/smtp-no-helo-rset-helo-mail/test.yaml | Gate SMTP HELO/RSET behavior to Suricata 8.0.7. |
| tests/smtp-no-helo-quit/test.yaml | Gate SMTP no-HELO quit behavior to Suricata 8.0.7. |
| tests/smtp-long-DATA-line/test.yaml | Update pre/post 8.0.7 expectations for trailing QUIT transaction behavior. |
| tests/smtp-keywords/test.yaml | Update pre/post 8.0.7 expectations for trailing QUIT transaction behavior. |
| tests/smtp-file-data-02/test.yaml | Update version gates and pre/post 8.0.7 expectations for SMTP tx completion and QUIT behavior. |
| tests/smtp-file-data-01/test.yaml | Update version gates and pre/post 8.0.7 expectations for SMTP tx completion and QUIT behavior. |
| tests/smtp-errors/test.yaml | Update anomaly-count expectations to pivot on 8.0.7 instead of 9. |
| tests/smtp-bug-5981/test.yaml | Update pre/post 8.0.7 expectations for trailing QUIT transaction behavior. |
| tests/rules/substate-hook/test.yaml | Gate substate-hook rule test to Suricata 8.0.7. |
| tests/rules/substate-hook-02/test.yaml | Gate substate-hook rule test to Suricata 8.0.7. |
| tests/rules/substate-hook-03/test.yaml | Gate substate-hook rule test to Suricata 8.0.7. |
| tests/rules/http-response-body/test.yaml | Pivot version gates from 9 to 8.0.7 for HTTP rules.json expectations. |
| tests/rules/http-request-body/test.yaml | Pivot version gates from 9 to 8.0.7 for HTTP rules.json expectations. |
| tests/mime/mime-dec-very-small-inp/test.yaml | Pivot version gates from 9 to 8.0.7 for MIME/SMTP timing + QUIT behavior. |
| tests/mime/mime-dec-parse-small-rem-inp/test.yaml | Pivot version gates from 9 to 8.0.7 for MIME/SMTP timing + QUIT behavior. |
| tests/mime/mime-dec-parse-rem-sp/test.yaml | Pivot version gates from 9 to 8.0.7 for MIME/SMTP timing + QUIT behavior. |
| tests/mime/mime-dec-parse-odd-len/test.yaml | Pivot version gates from 9 to 8.0.7 for MIME/SMTP timing + QUIT behavior. |
| tests/mime/mime-dec-parse-long-filename02/test.yaml | Pivot version gates from 9 to 8.0.7 for MIME/SMTP timing + QUIT behavior. |
| tests/mime/mime-dec-parse-long-filename01/test.yaml | Pivot version gates from 9 to 8.0.7 for MIME/SMTP timing + QUIT behavior. |
| tests/mime/mime-dec-parse-line-test02/test.yaml | Pivot version gates from 9 to 8.0.7 for MIME/SMTP timing + QUIT behavior. |
| tests/mime/mime-dec-parse-line-test01/test.yaml | Pivot version gates from 9 to 8.0.7 for MIME/SMTP timing + QUIT behavior. |
| tests/mime/mime-dec-parse-full-msg-test02/test.yaml | Pivot version gates from 9 to 8.0.7 for MIME/SMTP timing + QUIT behavior. |
| tests/mime/mime-dec-parse-full-msg-test01/test.yaml | Pivot version gates from 9 to 8.0.7 for MIME/SMTP timing + QUIT behavior. |
| tests/http2-keywords2/test.yaml | Pivot version gates from 9 to 8.0.7 for HTTP/2 keyword expectations. |
| tests/detect-email-subject/test.yaml | Pivot email.subject event timing gates to 8.0.7. |
| tests/detect-email-msg-id/test.yaml | Pivot email.message_id event timing gates to 8.0.7. |
| tests/detect-email-date/test.yaml | Pivot email.date event timing gates to 8.0.7. |
| tests/firewall/tcp-session-syn-flood-drop-precedence/test.yaml | New fixture validating drop precedence over tcp.session accept when threshold triggers. |
| tests/firewall/tcp-session-syn-flood-drop-precedence/suricata.yaml | New firewall-mode config for SYN-flood precedence fixture. |
| tests/firewall/tcp-session-syn-flood-drop-precedence/README.md | New fixture documentation. |
| tests/firewall/tcp-session-syn-flood-drop-precedence/firewall.rules | New firewall rules covering drop+threshold vs tcp.session accept. |
| tests/firewall/tcp-session-stream-out-of-window/test.yaml | New fixture validating stream drops out-of-window regardless of tcp.session accept. |
| tests/firewall/tcp-session-stream-out-of-window/suricata.yaml | New stream/firewall config for out-of-window fixture. |
| tests/firewall/tcp-session-stream-out-of-window/README.md | New fixture documentation. |
| tests/firewall/tcp-session-stream-out-of-window/firewall.rules | New firewall accept rule used to prove stream engine still drops invalid segments. |
| tests/firewall/tcp-session-midstream-policy/test.yaml | New fixture validating midstream-policy drop-flow overrides tcp.session accept. |
| tests/firewall/tcp-session-midstream-policy/suricata.yaml | New midstream-policy config for midstream fixture. |
| tests/firewall/tcp-session-midstream-policy/README.md | New fixture documentation. |
| tests/firewall/tcp-session-midstream-policy/firewall.rules | New firewall accept rule used to prove midstream-policy still rejects pickup. |
| tests/firewall/tcp-session-ipv6-stream-out-of-window/test.yaml | New IPv6 variant of out-of-window stream validation fixture. |
| tests/firewall/tcp-session-ipv6-stream-out-of-window/suricata.yaml | New IPv6 stream/firewall config for out-of-window fixture. |
| tests/firewall/tcp-session-ipv6-stream-out-of-window/README.md | New fixture documentation. |
| tests/firewall/tcp-session-ipv6-stream-out-of-window/firewall.rules | New firewall accept rule used to prove IPv6 stream still drops invalid segments. |
| tests/firewall/tcp-session-ipv6-decode-malformed/test.yaml | New fixture validating IPv6 decode anomaly still fires regardless of tcp.session accept. |
| tests/firewall/tcp-session-ipv6-decode-malformed/suricata.yaml | New firewall/anomaly config for IPv6 malformed decode fixture. |
| tests/firewall/tcp-session-ipv6-decode-malformed/README.md | New fixture documentation. |
| tests/firewall/tcp-session-ipv6-decode-malformed/firewall.rules | New firewall accept rule used to prove decode event still fires. |
| tests/firewall/tcp-session-equivalence/test.yaml | New fixture asserting tcp.session:setup,established equivalence to flow established/not_established pattern. |
| tests/firewall/tcp-session-equivalence/td.rules | New detect rules used for equivalence assertions. |
| tests/firewall/tcp-session-equivalence/suricata.yaml | New firewall-mode config for equivalence fixture. |
| tests/firewall/tcp-session-equivalence/README.md | New fixture documentation. |
| tests/firewall/tcp-session-equivalence/firewall.rules | New firewall rules to accept packets for the equivalence comparison. |
| tests/firewall/tcp-session-decode-malformed-ipv4/test.yaml | New fixture validating IPv4 decode anomalies still fire and exporting keyword info. |
| tests/firewall/tcp-session-decode-malformed-ipv4/suricata.yaml | New firewall/anomaly/stats config for IPv4 malformed decode fixture. |
| tests/firewall/tcp-session-decode-malformed-ipv4/README.md | New fixture documentation. |
| tests/firewall/tcp-session-decode-malformed-ipv4/firewall.rules | New firewall accept rule used to prove decode events still fire. |
| tests/firewall/ruletype-firewall-95-ruleset-default-packet-policy-accept-hook-alert/suricata.yaml | Convert firewall policy config to packet + app structured layout. |
| tests/firewall/ruletype-firewall-94-config-default-policy-http/suricata.yaml | Convert HTTP default policy config to app.http1 layout. |
| tests/firewall/ruletype-firewall-93-lt-ua-mix-accept-hook/suricata.yaml | Convert HTTP policy config to app.http1 layout. |
| tests/firewall/ruletype-firewall-92-lt-ua-mix/suricata.yaml | Convert HTTP policy config to app.http1 layout. |
| tests/firewall/ruletype-firewall-89-defaults-over-drop/suricata.yaml | Convert packet/http default policies to packet + app.http1 layout. |
| tests/firewall/ruletype-firewall-88-default-accept-tx-pipeline/suricata.yaml | Convert packet/http default policies to packet + app.http1 layout. |
| tests/firewall/ruletype-firewall-87-broken-default-policy/suricata.yaml | Convert broken-policy config to app.http1 layout for validation coverage. |
| tests/firewall/ruletype-firewall-86-packet-filter-accept-flow-pass-with-td/suricata.yaml | Convert HTTP policy config to app.http1 layout. |
| tests/firewall/ruletype-firewall-84-ruleset-default-app-policy-tls-request-started/suricata.yaml | Convert packet/tls default policies to packet + app.tls layout. |
| tests/firewall/ruletype-firewall-83-ruleset-default-packet-policy-accept-flow/suricata.yaml | Convert packet filter policy to packet.filter layout. |
| tests/firewall/ruletype-firewall-82-ruleset-default-app-policy-accept-flow/suricata.yaml | Convert packet/tls policies to packet + app.tls layout. |
| tests/firewall/ruletype-firewall-81-ruleset-default-packet-policy-accept-hook-all/suricata.yaml | Convert packet/tls policies to packet + app.tls layout. |
| tests/firewall/ruletype-firewall-80-ruleset-default-packet-policy-accept-hook-no-rules/suricata.yaml | Convert packet filter policy to packet.filter layout. |
| tests/firewall/ruletype-firewall-79-ruleset-default-packet-policy-accept-hook/suricata.yaml | Convert packet filter policy to packet.filter layout. |
| tests/firewall/ruletype-firewall-78-ruleset-default-packet-policy-accept/suricata.yaml | Convert packet filter policy to packet.filter layout. |
| tests/firewall/ruletype-firewall-77-ruleset-default-packet-policy/suricata.yaml | Convert packet filter policy to packet.filter layout. |
| tests/firewall/ruletype-firewall-76-config-default-policy-http-accept-tx-td/suricata.yaml | Convert HTTP default policy config to app.http1 layout. |
| tests/firewall/ruletype-firewall-75-config-default-policy-http-accept-tx/suricata.yaml | Convert HTTP default policy config to app.http1 layout. |
| tests/firewall/ruletype-firewall-74-config-default-policy-dns/suricata.yaml | Convert DNS default policy config to app.dns layout. |
| tests/firewall/ruletype-firewall-73-config-default-policy-http/suricata.yaml | Convert HTTP default policy config to app.http1 layout. |
| tests/firewall/ruletype-firewall-72-config-default-policy-http/suricata.yaml | Convert HTTP default policy config to app.http1 layout. |
| tests/firewall/ruletype-firewall-71-reject-app-default-policy/suricata.yaml | Convert TLS reject policy config to app.tls layout. |
| tests/firewall/ruletype-firewall-70-config-default-policy-http/suricata.yaml | Convert HTTP default policy config to app.http1 layout. |
| tests/firewall/ruletype-firewall-69-config-default-policy-tls-accept/suricata.yaml | Convert TLS default policy config to app.tls layout. |
| tests/firewall/ruletype-firewall-68-config-default-policy-tls/suricata.yaml | Convert TLS default policy config to app.tls layout. |
| tests/firewall/ruletype-firewall-151-default-policy-per-proto/test.yaml | New fixture for per-protocol default-policy resolution behavior. |
| tests/firewall/ruletype-firewall-151-default-policy-per-proto/suricata.yaml | New config exercising packet.default-policy + app.<proto>.default-policy resolution. |
| tests/firewall/ruletype-firewall-151-default-policy-per-proto/README.md | New fixture documentation. |
| tests/firewall/ruletype-firewall-151-default-policy-per-proto/firewall.rules | New fixture rules placeholder (firewall-mode enablement). |
| tests/firewall/ruletype-firewall-150-default-policy-global/test.yaml | New fixture validating global default-policy covers all hooks. |
| tests/firewall/ruletype-firewall-150-default-policy-global/suricata.yaml | New config setting global firewall.policies.default-policy. |
| tests/firewall/ruletype-firewall-150-default-policy-global/README.md | New fixture documentation. |
| tests/firewall/ruletype-firewall-150-default-policy-global/firewall.rules | New fixture rules placeholder (firewall-mode enablement). |
| tests/firewall/ruletype-firewall-149-default-policy-scope-substate/test.yaml | New startup-validation fixture for invalid action scope under substate default-policy. |
| tests/firewall/ruletype-firewall-149-default-policy-scope-substate/suricata.yaml | New invalid config to trigger scope validation under app.http2.stream. |
| tests/firewall/ruletype-firewall-149-default-policy-scope-substate/README.md | New fixture documentation. |
| tests/firewall/ruletype-firewall-149-default-policy-scope-substate/firewall.rules | New fixture rules placeholder (firewall-mode enablement). |
| tests/firewall/ruletype-firewall-148-default-policy-scope-app-hook/test.yaml | New startup-validation fixture for invalid global default-policy scope at app hook. |
| tests/firewall/ruletype-firewall-148-default-policy-scope-app-hook/suricata.yaml | New invalid config to trigger app-hook scope validation. |
| tests/firewall/ruletype-firewall-148-default-policy-scope-app-hook/README.md | New fixture documentation. |
| tests/firewall/ruletype-firewall-148-default-policy-scope-app-hook/firewall.rules | New fixture rules placeholder (firewall-mode enablement). |
| tests/firewall/ruletype-firewall-147-default-policy-scope-packet-hook/test.yaml | New startup-validation fixture for invalid global default-policy scope at packet hook. |
| tests/firewall/ruletype-firewall-147-default-policy-scope-packet-hook/suricata.yaml | New invalid config to trigger packet-hook scope validation. |
| tests/firewall/ruletype-firewall-147-default-policy-scope-packet-hook/README.md | New fixture documentation. |
| tests/firewall/ruletype-firewall-147-default-policy-scope-packet-hook/firewall.rules | New fixture rules placeholder (firewall-mode enablement). |
| tests/firewall/ruletype-firewall-146-default-policy-tls-request-complete/test.yaml | New fixture verifying request-complete alias mapping for TLS final state. |
| tests/firewall/ruletype-firewall-146-default-policy-tls-request-complete/suricata.yaml | New TLS default-policy config to exercise request-complete alias resolution. |
| tests/firewall/ruletype-firewall-146-default-policy-tls-request-complete/README.md | New fixture documentation. |
| tests/firewall/ruletype-firewall-146-default-policy-tls-request-complete/firewall.rules | New fixture rules placeholder (firewall-mode enablement). |
| tests/firewall/ruletype-firewall-145-default-policy-substate-fallthrough/test.yaml | New fixture verifying substate fallthrough to per-protocol default-policy. |
| tests/firewall/ruletype-firewall-145-default-policy-substate-fallthrough/suricata.yaml | New http2 config with protocol default + substate default to test fallthrough. |
| tests/firewall/ruletype-firewall-145-default-policy-substate-fallthrough/README.md | New fixture documentation. |
| tests/firewall/ruletype-firewall-145-default-policy-substate-fallthrough/firewall.rules | New fixture rules placeholder (firewall-mode enablement). |
| tests/firewall/ruletype-firewall-144-default-policy-substate/test.yaml | New fixture verifying substate default-policy precedence over per-protocol default-policy. |
| tests/firewall/ruletype-firewall-144-default-policy-substate/suricata.yaml | New http2 config to enforce different defaults at protocol vs substate tiers. |
| tests/firewall/ruletype-firewall-144-default-policy-substate/README.md | New fixture documentation. |
| tests/firewall/ruletype-firewall-144-default-policy-substate/firewall.rules | New fixture rules placeholder (firewall-mode enablement). |
| tests/firewall/ruletype-firewall-143-default-policy-app-layer/test.yaml | New fixture verifying app.default-policy applies across protocols. |
| tests/firewall/ruletype-firewall-143-default-policy-app-layer/suricata.yaml | New config with packet.filter + app.default-policy. |
| tests/firewall/ruletype-firewall-143-default-policy-app-layer/README.md | New fixture documentation. |
| tests/firewall/ruletype-firewall-143-default-policy-app-layer/firewall.rules | New fixture rules placeholder (firewall-mode enablement). |
| tests/firewall/ruletype-firewall-142-default-policy-packet-precedence/test.yaml | New fixture verifying packet.default-policy precedence at packet hooks. |
| tests/firewall/ruletype-firewall-142-default-policy-packet-precedence/suricata.yaml | New config setting both global and packet-tier defaults for precedence test. |
| tests/firewall/ruletype-firewall-142-default-policy-packet-precedence/README.md | New fixture documentation. |
| tests/firewall/ruletype-firewall-142-default-policy-packet-precedence/firewall.rules | New fixture hook-install rules for packet-tier precedence test. |
| tests/firewall/ruletype-firewall-141-default-policy-packet-hooks/test.yaml | New fixture verifying packet.default-policy applies to multiple packet hooks. |
| tests/firewall/ruletype-firewall-141-default-policy-packet-hooks/suricata.yaml | New config exercising packet-hook default-policy inheritance. |
| tests/firewall/ruletype-firewall-141-default-policy-packet-hooks/README.md | New fixture documentation. |
| tests/firewall/ruletype-firewall-141-default-policy-packet-hooks/firewall.rules | New fixture hook-install rules for packet-hook coverage. |
| tests/firewall/ruletype-firewall-140-smtp-pipelined-post-data-rset-sequence/test.yaml | Gate firewall SMTP fixture to Suricata 8.0.7. |
| tests/firewall/ruletype-firewall-139-smtp-pipelined-post-data-mail-from/test.yaml | Gate firewall SMTP fixture to Suricata 8.0.7. |
| tests/firewall/ruletype-firewall-136-smtp-multi-mail-blocked-sender/test.yaml | Gate firewall SMTP fixture to Suricata 8.0.7. |
| tests/firewall/ruletype-firewall-135-smtp-multi-mail-accept/test.yaml | Gate firewall SMTP fixture to Suricata 8.0.7. |
| tests/firewall/ruletype-firewall-134-smtp-rset-then-quit/test.yaml | Gate firewall SMTP fixture to Suricata 8.0.7. |
| tests/firewall/ruletype-firewall-133-smtp-out-of-order-commands/test.yaml | Gate firewall SMTP fixture to Suricata 8.0.7. |
| tests/firewall/ruletype-firewall-132-smtp-nested-mail-from/test.yaml | Gate firewall SMTP fixture to Suricata 8.0.7. |
| tests/firewall/ruletype-firewall-131-smtp-quit-after-mail-from/test.yaml | Gate firewall SMTP fixture to Suricata 8.0.7. |
| tests/firewall/ruletype-firewall-131-http2-mixed-rule/test.yaml | Gate firewall HTTP/2 mixed-rule fixture to Suricata 8.0.7. |
| tests/firewall/ruletype-firewall-131-http2-mixed-rule/suricata.yaml | Convert HTTP/2 + DoH2 policies to app.http2 / app.doh2 structured layout. |
| tests/firewall/ruletype-firewall-130-smtp-rset-after-rcpt/test.yaml | Gate firewall SMTP fixture to Suricata 8.0.7. |
| tests/firewall/ruletype-firewall-130-doh2-disabled/suricata.yaml | Convert HTTP/2 + DoH2 policies to app.* structured layout for DoH2-disabled case. |
| tests/firewall/ruletype-firewall-129-smtp-rset-next-tx-blocked-sender/test.yaml | Gate firewall SMTP fixture to Suricata 8.0.7. |
| tests/firewall/ruletype-firewall-129-doh2-crash/test.yaml | Gate DoH2 crash regression fixture to Suricata 8.0.7. |
| tests/firewall/ruletype-firewall-129-doh2-crash/suricata.yaml | Convert HTTP/2 + DoH2 policies to app.* structured layout for crash case. |
| tests/firewall/ruletype-firewall-128-smtp-rset-next-tx-delivered/test.yaml | Gate firewall SMTP fixture to Suricata 8.0.7. |
| tests/firewall/ruletype-firewall-128-doh2/test.yaml | Gate DoH2 fixture to Suricata 8.0.7. |
| tests/firewall/ruletype-firewall-128-doh2/suricata.yaml | Convert HTTP/2 + DoH2 policies to app.* structured layout. |
| tests/firewall/ruletype-firewall-127-smtp-interactive-commands/test.yaml | Gate firewall SMTP fixture to Suricata 8.0.7. |
| tests/firewall/ruletype-firewall-127-http2-no-substate/test.yaml | Gate firewall HTTP/2 no-substate fixture to Suricata 8.0.7. |
| tests/firewall/ruletype-firewall-126-smtp-any-rcpt-allowed-accept/test.yaml | Gate firewall SMTP fixture to Suricata 8.0.7. |
| tests/firewall/ruletype-firewall-126-http2-substate-lte/test.yaml | Gate firewall HTTP/2 substate fixture to Suricata 8.0.7. |
| tests/firewall/ruletype-firewall-125-smtp-all-rcpts-required-drop/test.yaml | Gate firewall SMTP fixture to Suricata 8.0.7. |
| tests/firewall/ruletype-firewall-125-http2-substate/test.yaml | Gate firewall HTTP/2 substate fixture to Suricata 8.0.7. |
| tests/firewall/ruletype-firewall-124-smtp-blocked-rcpt-to/test.yaml | Gate firewall SMTP fixture to Suricata 8.0.7. |
| tests/firewall/ruletype-firewall-124-http2-substate-default-policy/test.yaml | Gate firewall HTTP/2 default-policy fixture to Suricata 8.0.7. |
| tests/firewall/ruletype-firewall-124-http2-substate-default-policy/suricata.yaml | Convert HTTP/2 policies to app.http2 structured layout. |
| tests/firewall/ruletype-firewall-123-smtp-blocked-sender/test.yaml | Gate firewall SMTP fixture to Suricata 8.0.7. |
| tests/firewall/ruletype-firewall-123-http2-substate/test.yaml | Gate firewall HTTP/2 substate fixture to Suricata 8.0.7. |
| tests/firewall/ruletype-firewall-122-smtp/test.yaml | Gate firewall SMTP fixture to Suricata 8.0.7. |
| tests/firewall/ruletype-firewall-122-http2-substate/test.yaml | Gate firewall HTTP/2 substate fixture to Suricata 8.0.7. |
| tests/firewall/ruletype-firewall-121-ftp-bounce/suricata.yaml | Convert FTP/FTP-DATA + packet policies to packet + app structured layout. |
| tests/firewall/ruletype-firewall-120-ftp-drop-by-dynamic-port/suricata.yaml | Convert FTP/FTP-DATA + packet policies to packet + app structured layout. |
| tests/firewall/ruletype-firewall-119-ftp-non-anonymous-default-allow/suricata.yaml | Convert FTP/FTP-DATA + packet policies to packet + app structured layout. |
| tests/firewall/ruletype-firewall-115-ftp-download-active-user/suricata.yaml | Convert FTP-DATA policies to app.ftp-data layout. |
| tests/firewall/ruletype-firewall-108-default-app-policy-missed-rule-accept-tx-alert/suricata.yaml | Convert HTTP policy config to app.http1 layout. |
| tests/firewall/ruletype-firewall-107-default-app-policy-missed-rule-accept-tx-alert/suricata.yaml | Convert HTTP policy config to app.http1 layout. |
| tests/firewall/ruletype-firewall-106-default-app-policy-accept-flow-alert/suricata.yaml | Convert packet/http policies to packet + app.http1 layout. |
| tests/firewall/ruletype-firewall-105-default-packet-policy-alert-app-rule/suricata.yaml | Convert packet/http policies to packet + app.http1 layout. |
| tests/firewall/ruletype-firewall-104-default-app-policy-missed-rule-alert/suricata.yaml | Convert HTTP policy config to app.http1 layout. |
| tests/firewall/ruletype-firewall-103-default-app-policy-drop-alert/suricata.yaml | Convert DNS policy config to app.dns layout. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Evaluating the SV rebase of two recent works (#3255 and #3156), each on top of SV branch for OISF/suricata#15854
Works aim for integration towards Suricata 8.