Open Information Security Foundation

04/09/2026

VJ 03:37 PM Suricata Feature #8459 (New): firewall: support bypass option with firewall rules

Also test what happens to firewall rules with bypass in a TD rule. Victor Julien

04/01/2026

VJ 07:00 PM Suricata Bug #8444: firewall: accept:flow at app-layer hook bypasses app:td (IDS/IPS) evaluation

I think this works as designed. @accept:packet@ is meant to immediately accept the packet. @accept:flow@ is essentially @accept:packet@ applied to the current and all future packets in this flow.
If it is needed to create something to... Victor Julien

03/31/2026

VJ 10:48 AM Suricata Task #8437 (In Review): firewall: enable content inspect keywords for firewall mode (8.0.x backport)

https://github.com/OISF/suricata/pull/15128 Victor Julien

VJ 10:48 AM Suricata Task #8409 (In Review): firewall: add tests for hot reload of firewall mode rules (8.0.x backport)

https://github.com/OISF/suricata/pull/15128 Victor Julien

VJ 10:10 AM Suricata Task #8204 (Resolved): firewall: add tests for hot reload of firewall mode rules

https://github.com/OISF/suricata/pull/15127 Victor Julien

VJ 10:09 AM Suricata Bug #8313 (Resolved): firewall: rule language can't accept ARP

https://github.com/OISF/suricata/pull/15127 Victor Julien

VJ 06:47 AM Suricata Feature #8436 (New): rules: allow rule to modify midstream behavior per flow

A @config@ rule in the @pre_stream@ hook could selectively allow midstream pickups, e.g. from a known server with long sessions.
E.g. something like: Victor Julien

03/30/2026

VJ 03:49 PM Suricata Task #8435 (New): firewall: investigate handling of encapsulation/tunneling like GRE/VXLAN

These packets lead to several internal packets that are connected for the verdict. The rule language is not aware of this though.
First step would be to create a test for these cases:
* VXLAN
* Geneve
* GRE
* IP in IP
* etc
We... Victor Julien

03/28/2026

VJ 10:59 AM Suricata Task #7742: ftp: trigger raw stream inspection

https://github.com/OISF/suricata/pull/15114 is the correct link, I think. Victor Julien

VJ 10:57 AM Suricata Task #7742: ftp: trigger raw stream inspection

PR link missing? Victor Julien