Skip to content

flowbits: add deprecation notice for toggle command #15664

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
victorjulien merged 2 commits into from
Jun 22, 2026
Merged

flowbits: add deprecation notice for toggle command #15664

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d189f7a
flowbits: add deprecation notice for toggle command
inashivb Jun 13, 2026
6a23995
rust: exclude DETECT_BYTEMATH_ENDIAN_DEFAULT from bindings
inashivb Jun 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion doc/userguide/rules/flow-keywords.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,9 @@ flowbits: isset, name
flowbits: toggle, name
Reverses the present setting. So for example if a condition is set,
it will be unset and vice-versa.

.. deprecated:: 7.0.17

@jufajardini jufajardini Jun 18, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

TIL this annotation style. ✨

@inashivb inashivb Jun 19, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

AI told me about this 🙈

The ``toggle`` command is deprecated and will be removed in Suricata 9.0.
flowbits: unset, name
Can be used to unset the condition in the flow.
flowbits: isnotset, name
Expand Down Expand Up @@ -305,4 +308,4 @@ Signature example::

alert tcp any any -> any any (msg:"Flow longer than one hour"; flow.age:>3600; flowbits: isnotset, onehourflow; flowbits: onehourflow, name; sid:1; rev:1;)

In this example, we combine `flow.age` and `flowbits` to get an alert on the first packet after the flow's age is older than one hour.
In this example, we combine `flow.age` and `flowbits` to get an alert on the first packet after the flow's age is older than one hour.
9 changes: 9 additions & 0 deletions doc/userguide/upgrade.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,15 @@ also check all the new features that have been added but are not covered by
this guide. Those features are either not enabled by default or require
dedicated new configuration.

Upgrading to 7.0.17
-------------------

Deprecations
~~~~~~~~~~~~~

- The ``flowbits`` ``toggle`` command is now deprecated and will be removed in
Suricata 9.0.

Upgrading to 7.0.14
-------------------

Expand Down
1 change: 1 addition & 0 deletions rust/cbindgen.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -112,6 +112,7 @@ exclude = [
"IPPROTO_TCP",
"IPPROTO_UDP",
"SRepCatGetByShortname",
"DETECT_BYTEMATH_ENDIAN_DEFAULT",
]

# Types of items that we'll generate. If empty, then all types of item are emitted.
Expand Down
5 changes: 5 additions & 0 deletions src/detect-flowbits.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -301,6 +301,11 @@ int DetectFlowbitSetup (DetectEngineCtx *de_ctx, Signature *s, const char *rawst
fb_cmd = DETECT_FLOWBITS_CMD_UNSET;
} else if (strcmp(fb_cmd_str,"toggle") == 0) {
fb_cmd = DETECT_FLOWBITS_CMD_TOGGLE;
if ((de_ctx->flags & DE_WARN_FLOWBITS_TOGGLE_DEPRECATION) == 0) {
de_ctx->flags |= DE_WARN_FLOWBITS_TOGGLE_DEPRECATION;
SCLogWarning("flowbits \"toggle\" command is deprecated and will be removed in "
"Suricata 9 (see ticket #8595)");
}
} else {
SCLogError("ERROR: flowbits action \"%s\" is not supported.", fb_cmd_str);
goto error;
Expand Down
1 change: 1 addition & 0 deletions src/detect.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -323,6 +323,7 @@ typedef struct DetectPort_ {

/* Detection Engine flags */
#define DE_QUIET 0x01 /**< DE is quiet (esp for unittests) */
#define DE_WARN_FLOWBITS_TOGGLE_DEPRECATION 0x02

typedef struct IPOnlyCIDRItem_ {
/* address data for this item */
Expand Down
Loading