Open Information Security Foundation

08/25/2026

YD 10:47 PM Suricata Bug #8948 (Triaged): firewall: app-layer hook rules for IMAP load without error but never match (IMAP is detection-only)

In firewall mode a rule can hook an application-layer state, e.g. @accept:hook <proto>:request_started@ or @drop:flow <proto>:request_started@. For IMAP these rules load without any error or warning, but they are completely inert: they n... Yash Datre

YD 06:37 AM Suricata Bug #8944 (In Progress): firewall: auto-accept-prior-states not honored when a same-hook drop rule leads the candidate list

In firewall mode, the "auto-accept prior states" notation (@accept:... proto:<hook@) is documented to accept the target hook *and* all hooks before it. This does not hold when a lower-SID @drop@ rule at the same target hook has a prefilt... Yash Datre

07/14/2026

YD 08:05 PM Suricata Feature #8712: firewall: add default app policy options

Yes, this should solve the use-case. Yash Datre

07/07/2026

YD 09:17 PM Suricata Feature #8393: firewall: support SMTP hook states for firewall rule evaluation

Thanks Jason, this looks good and covers our firewall use cases well — the session-level transaction with the @request_started@ → @request_data@ → @request_complete@ progression plus xbits maps cleanly onto our sender/recipient validatio... Yash Datre

06/25/2026

YD 02:33 AM Suricata Feature #7705: firewall: allow single rule to accept protocol detection in progress and the final protocol

Created the PR: https://github.com/OISF/suricata/pull/15727 Yash Datre

06/23/2026

YD 05:08 PM Suricata Feature #7704: firewall: allow single packet rule to accept tcp connection

Created a new PR as I accidentally closed the old one: https://github.com/OISF/suricata/pull/15714 Yash Datre

06/04/2026

YD 11:45 PM Suricata Feature #8472: firewall: Auto-Accept Prior States syntax for firewall mode intent rules

Found an edge case: @accept:flow dns:<request_complete@ / @dns:<response_complete@ (the auto-accept-prior-hooks @<@ syntax applied to DNS) corrupts the @packet:filter@ table, causing ALL packets to be dropped by the default packet policy... Yash Datre

06/03/2026

YD 01:01 AM Suricata Feature #7701: firewall: configurable default policies

While validating the "monitor mode" (running a firewall ruleset with default policies flipped from @drop@ to @accept:hook,alert@, so a default-drop ruleset can be trialed in production without disrupting traffic), we found there is no wa... Yash Datre

05/19/2026

YD 12:58 AM Suricata Feature #8472: firewall: Auto-Accept Prior States syntax for firewall mode intent rules

Thanks for sharing PR "#15402":https://github.com/OISF/suricata/pull/15402 — we've reviewed it and the referenced suricata-verify tests. Looks like the lazy-evaluation alternative from this issue: the @<@ operator keeps the rule as a sin... Yash Datre

05/11/2026

YD 06:52 AM Suricata Feature #8472: firewall: Auto-Accept Prior States syntax for firewall mode intent rules

h2. Design Proposal
One author-visible rule. The Rule_Loader auto-synthesises the accept chain from the protocol's registered state machine. Two equivalent syntaxes: Yash Datre