Suricata

Dear colleagues,

I have noticed that Suricata signatures (i.e. file provided to Suricata using the -s option) do not detect data located on established connections with TCP Fast Open (TFO) on established connections:

1. cat /etc/suricata/rules/local.rules
   alert tcp any any -> any any (msg:"WEB-ATTACKS /etc/passwd command attempt"; flow:established; content:"/etc/passwd"; classtype:web-application-attack; sid:1328; rev:6;)

1. suricata -V
   This is Suricata version 4.1.5 RELEASE

1. suricata -c /etc/suricata/suricata.yaml -r tfo.pcap

Impact
Many OSes however support TFO so these payload in SYN and SYNACK packets should reach applications if TFO is used.

I am attaching the .pcap and the local.rules so you can verify the bug.