fw: tighten pre-flow hook scopes and apply flow scope to packet drop v1

[lukashino]

The commits cover these Redmine tickets:

• https://redmine.openinfosecfoundation.org/issues/8967
• https://redmine.openinfosecfoundation.org/issues/8969

Describe changes:

• flow scope got excluded from pre-flow hook (as flow object is not available when hook is evaluated)
• flow policy is applied when a packet's default policy is hit

SV_BRANCH=OISF/suricata-verify#3327

[Copilot]

Pull request overview

This PR refines Suricata’s firewall default-policy handling by (1) tightening which action scopes are allowed for the pre-flow packet hook (since a Flow may not exist yet) and (2) ensuring flow-scoped default packet drops persist by marking the Flow when the default policy is hit.

Changes:

• Add a dedicated policy-class for packet pre-flow hooks to disallow flow action scope during policy resolution.
• When the default packet policy is drop:flow and a flow exists, set FLOW_ACTION_DROP | FLOW_ACTION_BY_FIREWALL on the flow so subsequent packets are dropped at flow-level.
• Route pre-flow packet policy loading through the new policy-class so invalid scopes are rejected with appropriate hints.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
src/detect.c	Applies flow-scoped default packet drops to the flow by setting flow drop flags when applicable.
src/detect-parse.c	Introduces a pre-flow packet policy class and scope set; uses it when resolving the pre-flow default policy.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[suricata-qa]

Information: QA ran without warnings.

Pipeline = 33414

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 83.04%. Comparing base (7c66954) to head (12c423d).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #16129      +/-   ##
==========================================
- Coverage   83.06%   83.04%   -0.02%     
==========================================
  Files        1004     1004              
  Lines      277376   277421      +45     
==========================================
- Hits       230389   230371      -18     
- Misses      46987    47050      +63     

Flag	Coverage Δ
fuzzcorpus	61.49% <0.00%> (-0.01%)	⬇️
livemode	18.40% <0.00%> (-0.02%)	⬇️
netns	22.82% <33.33%> (-0.06%)	⬇️
pcap	45.38% <0.00%> (-0.05%)	⬇️
suricata-verify	67.12% <100.00%> (-0.04%)	⬇️
unittests	58.53% <0.00%> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[catenacyber]

Thanks for the work, just one question, but I think it is good

CI/QA : ✅
Git ID set : looks fine for me
CLA : you already contributed
Doc update : I think we do not need one
Redmine ticket : ok, I would have made 2 PRs as these fixes are independent
Tests : looks good
Dependencies added: none
Code : good, just one question
Commits segmentation : cool
Commit messages : cool

[victorjulien]

During staging I get

===> engine-analysis-default-policy: FAILED: got exit code 1, expected 0

I have no additional details right now. Can this be caused by the PR?

[catenacyber]

Indeed, this PR fails engine-analysis-default-policy which must not have been run when it was created

output/stderr 
Error: detect-parse: firewall.policies.default-policy: action scope ("flow") is not valid. Valid scopes: packet/hook [ResolveFirewallPolicy:detect-parse.c:4334]
Error: detect: loading firewall policies failed [LoadFirewallRuleFiles:detect-engine-loader.c:305]

[catenacyber]

Needs to be rebased and pass current SV