From 7ac32910c9511f2f79c6ce48423132a4d723e5ed Mon Sep 17 00:00:00 2001
From: Victor Julien <vjulien@oisf.net>
Date: Fri, 20 Mar 2026 16:49:04 +0100
Subject: [PATCH] qa: add rule reload step to firewall test

Additionally, use bsize, pcre and urilen.

Ticket: #8204.
Ticket: #8397.
---
 qa/live/netns/afp-fw-netns-bridge.sh | 45 +++++++++++++++++++++++++++-
 qa/live/netns/firewall2.rules        | 15 ++++++++++
 2 files changed, 59 insertions(+), 1 deletion(-)
 create mode 100644 qa/live/netns/firewall2.rules

diff --git a/qa/live/netns/afp-fw-netns-bridge.sh b/qa/live/netns/afp-fw-netns-bridge.sh
index 339e0a3b36..190571828b 100755
--- a/qa/live/netns/afp-fw-netns-bridge.sh
+++ b/qa/live/netns/afp-fw-netns-bridge.sh
@@ -165,7 +165,7 @@ echo "* starting tshark on in the server namespace... done, pid $TSHARKSERVERPID
 
 echo "* starting Caddy..."
 # Start Caddy in the server namespace
-timeout --kill-after=240 --preserve-status 120 \
+timeout --kill-after=480 --preserve-status 240 \
     ip netns exec $serverns \
         caddy file-server --browse &
 CADDYPID=$!
@@ -205,14 +205,49 @@ if [ $PINGRES != 1 ]; then
     RES=1
 fi
 
+# first rulefile:
+# expecting 2 of 101 because of the curl and wget requests
+# expecting 1 of 102 because only wget is accepted
+SID101=$(jq -c 'select(.alert.signature_id==101)' ./eve.json | wc -l)
+SID102=$(jq -c 'select(.alert.signature_id==102)' ./eve.json | wc -l)
+echo "SID101 $SID101 SID102 $SID102"
+if [ $SID101 -ne 2 ]; then
+    echo "ERROR wrong alert count for sid 101: $SID101"
+    RES=1
+fi
+if [ $SID102 -ne 1 ]; then
+    echo "ERROR wrong alert count for sid 102: $SID102"
+    RES=1
+fi
+
+cp qa/live/netns/firewall2.rules firewall.rules
+ip netns exec $dutns \
+    ${SURICATASC} -c "reload-rules" /var/run/suricata/suricata-command.socket
+
 # give stats time to get updated
 sleep 10
 
+echo "* running wget in the \"client\" namespace..."
+set +e
+timeout --kill-after=30 --preserve-status 15 \
+    ip netns exec $clientns \
+        wget http://10.10.10.20/index.html
+WGETRES=$?
+set -e
+echo "* running wget in the \"client\" namespace... done"
+
+sleep 10
+
 echo "* shutting down tshark..."
 kill -INT $TSHARKSERVERPID
 wait $TSHARKSERVERPID
 echo "* shutting down tshark... done"
 
+# second rulefile (after reload)
+SID201=$(jq -c 'select(.alert.signature_id==201)' ./eve.json | wc -l)
+SID202=$(jq -c 'select(.alert.signature_id==202)' ./eve.json | wc -l)
+echo "SID201 $SID201 SID202 $SID202"
+
 ACCEPTED=$(jq -c 'select(.event_type == "stats")' ./eve.json | tail -n1 | jq '.stats.ips.accepted')
 BLOCKED=$(jq -c 'select(.event_type == "stats")' ./eve.json | tail -n1 | jq '.stats.ips.blocked')
 KERNEL_PACKETS=$(jq -c 'select(.event_type == "stats")' ./eve.json | tail -n1 | jq '.stats.capture.kernel_packets')
@@ -230,6 +265,14 @@ if [ $BLOCKED -lt 10 ]; then
     echo "ERROR should have seen 10+ blocked"
     RES=1
 fi
+if [ $SID201 -ne 1 ]; then
+    echo "ERROR wrong alert count for sid 201: $SID201"
+    RES=1
+fi
+if [ $SID202 -ne 1 ]; then
+    echo "ERROR wrong alert count for sid 202: $SID202"
+    RES=1
+fi
 
 # validate that we didn't receive pings
 SERVER_RECV_PING=$(jq -c '.[]' ./tshark-server.json|jq 'select(._source.layers.icmp."icmp.type"=="8")'|wc -l)
diff --git a/qa/live/netns/firewall2.rules b/qa/live/netns/firewall2.rules
new file mode 100644
index 0000000000..67181b6c54
--- /dev/null
+++ b/qa/live/netns/firewall2.rules
@@ -0,0 +1,15 @@
+accept:packet arp:all any any -> any any (alert; sid:200;)
+
+# allow session setup
+accept:hook tcp:all any any <> any 80 (flow:not_established; alert; sid:1021;)
+
+# pass rest of the flow to 
+accept:hook tcp:all any any <> any 80 (flow:established; alert; sid:1023;)
+#accept:hook ip:all any any <> any any (alert; sid:1024;)
+
+# default drop
+
+accept:hook http1:request_started any any -> any any (alert; sid:100;)
+accept:hook http1:request_line any any -> any any (http.method; bsize:3; urilen:>1; sid:201; alert;)
+accept:tx http1:request_headers any any -> any any (http.user_agent; pcre:"/wget/i"; sid:202; alert;)
+