Open Information Security Foundation

07/03/2026

JI 11:00 PM Suricata Bug #8715 (In Review): smtp: subsequent helo/ehlo should be treated like a rset

In review as part of https://github.com/OISF/suricata/pull/15790. Jason Ish

JI 04:51 PM Suricata Feature #8393: firewall: support SMTP hook states for firewall rule evaluation

Some follow-up implementation notes.
Unlike FTP, where each request/response pair is a transaction, in SMTP the whole session until the end of data is a transaction, and I do think this makes sense after working on it for a while. But... Jason Ish

07/02/2026

JI 10:29 PM Suricata Bug #8715 (In Review): smtp: subsequent helo/ehlo should be treated like a rset

RFC 5321 states that a mid-session EHLO must be treated just like an RSET:
> An EHLO command MAY be issued by a client later in the session. If
> ...
Currently Suricata more or less just ignores it. Jason Ish

JI 04:21 PM Suricata Bug #8664 (Closed): ftp: support data channel for list, nlst, mlsd, appe, stou

Jason Ish

JI 04:21 PM Suricata Bug #8696 (Closed): ftp: support data channel for list, nlst, mlsd, appe, stou (8.0.x backport)

Jason Ish

JI 04:21 PM Suricata Bug #8696: ftp: support data channel for list, nlst, mlsd, appe, stou (8.0.x backport)

Merged with https://github.com/OISF/suricata/pull/15760. Jason Ish

JI 04:19 PM Suricata Feature #8564 (Closed): firewall: support FTP hook states for firewall rule evaluation (8.0.x backport)

Merged. Jason Ish

06/30/2026

JI 11:10 PM Suricata Feature #8393 (In Review): firewall: support SMTP hook states for firewall rule evaluation

Pull request: https://github.com/OISF/suricata/pull/15759 Jason Ish

JI 04:23 PM Suricata Bug #8696 (In Review): ftp: support data channel for list, nlst, mlsd, appe, stou (8.0.x backport)

Jason Ish

JI 04:21 PM Suricata Feature #8564 (In Review): firewall: support FTP hook states for firewall rule evaluation (8.0.x backport)

Jason Ish