Firewall/v1

[victorjulien]

Some initial tests towards https://redmine.openinfosecfoundation.org/issues/7269

[catenacyber]

This is a draft, right ?

[victorjulien]

This is a draft, right ?

Why?

[catenacyber]

The wording Some initial tests towards made me think so.
Are the tests supposed to pass ?

[jasonish]

If possible, it might be nice to see what "user" story each scenario is testing?

[victorjulien]

Not sure I get it. Each test has a README that describes the test. What else is needed?

[jasonish]

Not sure I get it. Each test has a README that describes the test. What else is needed?

Was thinking of something more applicable to an end-user looking for examples.. Like:

• drop all TLS except with sni www.google.com
• drop all else

Where stuff like 3whs is a lower level implementation detail. Or perhaps that is better suited for the firewall chapter in the docs?

[victorjulien]

This is not for users, but are tests for supporting development. The tests are self documenting in my opinion.

[jufajardini]

Not sure I get it. Each test has a README that describes the test. What else is needed?

Was thinking of something more applicable to an end-user looking for examples.. Like:

* drop all TLS except with sni [www.google.com](http://www.google.com)

* drop all else

Where stuff like 3whs is a lower level implementation detail. Or perhaps that is better suited for the firewall chapter in the docs?

I guess we can add explanations in docs and link to the tests, and then one would complement the other 🤔

[catenacyber]

And would you like to add a rule like
pass tls any any <> any 443 (flow:established; tx.progress:<tls.sni; sid:3;)

right ?

[victorjulien]

I think so, ya. We'd have to think about how to expose the internal progress tracking to users, but I think we'd need something like this.

[catenacyber]

Cool
Do you have a redmine ticket for this improvement ?

SV PR is good like that, and you can make a special SV-only merge
https://github.com/OISF/suricata-verify/pulls?q=is%3Apr+is%3Aopen+review%3Aapproved+label%3A%22tests+pass%22

[catenacyber]

Good passing tests for current behavior in my opinion

[victorjulien]

Merged in #2139, thanks!