OISF · jufajardini · Jul 17, 2026 · Jul 17, 2026 · Jul 30, 2026 · Aug 9, 2026
diff --git a/tests/firewall/ruletype-firewall-141-bypass-keyword-in-fw-mode/README.md b/tests/firewall/ruletype-firewall-141-bypass-keyword-in-fw-mode/README.md
@@ -0,0 +1,12 @@
+# Test
+
+Ensure that the engine accepts the `bypass` keyword in a firewall rule.
+
+The accepted firewall rule matches the decoded HTTP host
+`www.testmyids.com`, then accepts and bypass the flow at the
+`http1:request_headers` hook.
+
+## Ticket
+
+Related to
+https://redmine.openinfosecfoundation.org/issues/8459.
diff --git a/tests/firewall/ruletype-firewall-141-bypass-keyword-in-fw-mode/firewall.rules b/tests/firewall/ruletype-firewall-141-bypass-keyword-in-fw-mode/firewall.rules
@@ -0,0 +1,4 @@
+accept:hook tcp:all any any <> any 80 (sid:2000002;)
+accept:hook http1:request_started any any -> any 80 (sid:2000003;)
+accept:hook http1:request_line any any -> any 80 (sid:2000004;)
+accept:flow,alert http1:request_headers any any -> any 80 (msg:"Bypass HTTP host from firewall rule"; http.host; content:"www.testmyids.com"; bypass; sid:2000001;)
diff --git a/tests/firewall/ruletype-firewall-141-bypass-keyword-in-fw-mode/td.rules b/tests/firewall/ruletype-firewall-141-bypass-keyword-in-fw-mode/td.rules
@@ -0,0 +1,2 @@
+# Would alert on the HTTP response body if the firewall rule did not bypass the flow.
+alert http any any -> any any (msg:"Response body inspected after firewall bypass"; flow:to_client,established; http.response_body; content:"uid=0|28|root|29|"; sid:100001;)
diff --git a/tests/firewall/ruletype-firewall-141-bypass-keyword-in-fw-mode/test.yaml b/tests/firewall/ruletype-firewall-141-bypass-keyword-in-fw-mode/test.yaml
@@ -0,0 +1,40 @@
+requires:
+  min-version: 9
+
+pcap: ../../flowbit-oring/input.pcap
+
+args:
+  - --simulate-ips
+  - -k none
+
+checks:
+  - filter:
+      # We're enabling bypass in firewall rules only, in firewall mode
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 2000001
+        http.hostname: www.testmyids.com
+  - filter:
+      # Would remain 0 if bypass were enabled and suppressed TD inspection.
+      count: 0
+      match:
+        event_type: alert
+        alert.signature_id: 100001
+  - filter:
+      # We're enabling bypass in firewall rules only, in firewall mode
+      count: 1
+      match:
+        event_type: flow
+        flow.state: bypassed
+        flow.bypass: local
+  - filter:
+      # We're enabling bypass in firewall rules only, in firewall mode
+      count: 1
+      match:
+        event_type: stats
+        stats.flow_bypassed.local_pkts: 6
+  # bypass keyword is allowed in firewall mode, for firewall rules, only
+  - shell:
+      args: grep "keyword 'bypass' is not allowed in firewall mode" stderr | wc -l
+      expect: 0
diff --git a/...firewall-90-ban-replace-keyword/README.md → ...irewall-142-ban-replace-keyword/README.md b/...firewall-90-ban-replace-keyword/README.md → ...irewall-142-ban-replace-keyword/README.md
diff --git a/...all-90-ban-replace-keyword/firewall.rules → ...ll-142-ban-replace-keyword/firewall.rules b/...all-90-ban-replace-keyword/firewall.rules → ...ll-142-ban-replace-keyword/firewall.rules
diff --git a/...firewall-90-ban-replace-keyword/test.yaml → ...irewall-142-ban-replace-keyword/test.yaml b/...firewall-90-ban-replace-keyword/test.yaml → ...irewall-142-ban-replace-keyword/test.yaml
diff --git a/...-firewall-92-ban-bypass-keyword/README.md → ...firewall-143-ban-bypass-keyword/README.md b/...-firewall-92-ban-bypass-keyword/README.md → ...firewall-143-ban-bypass-keyword/README.md
@@ -1,7 +1,7 @@
 # Test
 
 Ensure that the engine throws an error if the `bypass` keyword is used
-in threat detection rules, as it's banned in firewall mode.
+in threat detection rules, as it's banned in firewall mode, for those.
 
 ## Ticket
 

diff --git a/...wall-92-ban-bypass-keyword/firewall.rules → ...all-143-ban-bypass-keyword/firewall.rules b/...wall-92-ban-bypass-keyword/firewall.rules → ...all-143-ban-bypass-keyword/firewall.rules
diff --git a/...e-firewall-92-ban-bypass-keyword/td.rules → ...-firewall-143-ban-bypass-keyword/td.rules b/...e-firewall-92-ban-bypass-keyword/td.rules → ...-firewall-143-ban-bypass-keyword/td.rules
diff --git a/...-firewall-92-ban-bypass-keyword/test.yaml → ...firewall-143-ban-bypass-keyword/test.yaml b/...-firewall-92-ban-bypass-keyword/test.yaml → ...firewall-143-ban-bypass-keyword/test.yaml
@@ -10,6 +10,6 @@ exit-code: 1
 
 checks:
   - shell:
-      args: grep "keyword 'bypass' is not allowed in firewall mode" stderr | wc -l
+      args: grep "keyword 'bypass' is not allowed in threat detection rules with firewall mode" stderr | wc -l
       expect: 1
 
diff --git a/tests/firewall/ruletype-firewall-144-bypass-keyword-drop/README.md b/tests/firewall/ruletype-firewall-144-bypass-keyword-drop/README.md
@@ -0,0 +1,14 @@
+Test that the engine properly errors out when an invalid rule action + bypass
+keyword is used.
+
+`bypass` cannot be used with `drop`, `reject`, `accept:packet`, `accept:hook`, `accept:tx`.
+
+PCAP
+====
+
+Reused from test tls-random
+
+Ticket
+======
+
+https://redmine.openinfosecfoundation.org/issues/8459
diff --git a/tests/firewall/ruletype-firewall-144-bypass-keyword-drop/firewall.rules b/tests/firewall/ruletype-firewall-144-bypass-keyword-drop/firewall.rules
@@ -0,0 +1,3 @@
+drop:packet tcp:all any any -> any any (alert; bypass; sid:99;)
+accept:flow tcp:flow_start any any -> any 443 (alert; flow:to_server; sid:1;)
+drop:flow tcp:flow_start any any -> any any (sid:2;)
diff --git a/tests/firewall/ruletype-firewall-144-bypass-keyword-drop/suricata.yaml b/tests/firewall/ruletype-firewall-144-bypass-keyword-drop/suricata.yaml
@@ -0,0 +1,23 @@
+%YAML 1.1
+---
+
+# Global stats configuration
+stats:
+  enabled: yes
+  interval: 8
+
+# Configure the type of alert (and other) logging you would like.
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
+      filename: eve.json
+      types:
+        - stats
+        - flow
+        - alert
+        - tls:
+            extended: yes     # enable this for extended logging information
+        - drop:
+            alerts: yes      # log alerts that caused drops
+            flows: all       # start or all: 'start' logs only a single drop
diff --git a/tests/firewall/ruletype-firewall-144-bypass-keyword-drop/test.yaml b/tests/firewall/ruletype-firewall-144-bypass-keyword-drop/test.yaml
@@ -0,0 +1,15 @@
+requires:
+  min-version: 9
+
+pcap: ../../tls/tls-random/input.pcap
+
+# the invalid combination rules should make the engine error out
+exit-code: 1
+
+args:
+  - --simulate-ips
+
+checks:
+- shell:
+    args: grep "keyword 'bypass' cannot be used in combination with 'drop' action" stderr | wc -l
+    expect: 1
diff --git a/tests/firewall/ruletype-firewall-145-bypass-keyword-reject/README.md b/tests/firewall/ruletype-firewall-145-bypass-keyword-reject/README.md
@@ -0,0 +1,14 @@
+Test that the engine properly errors out when an invalid rule action + bypass
+keyword is used.
+
+`bypass` cannot be used with `drop`, `reject`, `accept:packet`, `accept:hook`, `accept:tx`.
+
+PCAP
+====
+
+Reused from test tls-random
+
+Ticket
+======
+
+https://redmine.openinfosecfoundation.org/issues/8459
diff --git a/tests/firewall/ruletype-firewall-145-bypass-keyword-reject/firewall.rules b/tests/firewall/ruletype-firewall-145-bypass-keyword-reject/firewall.rules
@@ -0,0 +1,3 @@
+reject:packet tcp:all any any -> any any (alert; bypass; sid:99;)
+accept:flow tcp:flow_start any any -> any 443 (alert; flow:to_server; sid:1;)
+reject:flow tcp:flow_start any any -> any any (sid:2;)
diff --git a/tests/firewall/ruletype-firewall-145-bypass-keyword-reject/suricata.yaml b/tests/firewall/ruletype-firewall-145-bypass-keyword-reject/suricata.yaml
@@ -0,0 +1,23 @@
+%YAML 1.1
+---
+
+# Global stats configuration
+stats:
+  enabled: yes
+  interval: 8
+
+# Configure the type of alert (and other) logging you would like.
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
+      filename: eve.json
+      types:
+        - stats
+        - flow
+        - alert
+        - tls:
+            extended: yes     # enable this for extended logging information
+        - drop:
+            alerts: yes      # log alerts that caused drops
+            flows: all       # start or all: 'start' logs only a single drop
diff --git a/tests/firewall/ruletype-firewall-145-bypass-keyword-reject/test.yaml b/tests/firewall/ruletype-firewall-145-bypass-keyword-reject/test.yaml
@@ -0,0 +1,15 @@
+requires:
+  min-version: 9
+
+pcap: ../../tls/tls-random/input.pcap
+
+# the invalid combination rules should make the engine error out
+exit-code: 1
+
+args:
+  - --simulate-ips
+
+checks:
+- shell:
+    args: grep "keyword 'bypass' cannot be used in combination with 'reject' action" stderr | wc -l
+    expect: 1
diff --git a/tests/firewall/ruletype-firewall-146-bypass-keyword-accept-packet/README.md b/tests/firewall/ruletype-firewall-146-bypass-keyword-accept-packet/README.md
@@ -0,0 +1,14 @@
+Test that the engine properly errors out when an invalid rule action + bypass
+keyword is used.
+
+`bypass` cannot be used with `drop`, `reject`, `accept:packet`, `accept:hook`, `accept:tx`.
+
+PCAP
+====
+
+Reused from test tls-random
+
+Ticket
+======
+
+https://redmine.openinfosecfoundation.org/issues/8459
diff --git a/tests/firewall/ruletype-firewall-146-bypass-keyword-accept-packet/firewall.rules b/tests/firewall/ruletype-firewall-146-bypass-keyword-accept-packet/firewall.rules
@@ -0,0 +1,3 @@
+accept:packet tcp:all any any -> any any (alert; bypass; sid:99;)
+accept:flow tcp:flow_start any any -> any 443 (alert; flow:to_server; sid:1;)
+accept:flow tcp:flow_start any any -> any any (sid:2;)
diff --git a/tests/firewall/ruletype-firewall-146-bypass-keyword-accept-packet/suricata.yaml b/tests/firewall/ruletype-firewall-146-bypass-keyword-accept-packet/suricata.yaml
@@ -0,0 +1,23 @@
+%YAML 1.1
+---
+
+# Global stats configuration
+stats:
+  enabled: yes
+  interval: 8
+
+# Configure the type of alert (and other) logging you would like.
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
+      filename: eve.json
+      types:
+        - stats
+        - flow
+        - alert
+        - tls:
+            extended: yes     # enable this for extended logging information
+        - drop:
+            alerts: yes      # log alerts that caused drops
+            flows: all       # start or all: 'start' logs only a single drop
diff --git a/tests/firewall/ruletype-firewall-146-bypass-keyword-accept-packet/test.yaml b/tests/firewall/ruletype-firewall-146-bypass-keyword-accept-packet/test.yaml
@@ -0,0 +1,15 @@
+requires:
+  min-version: 9
+
+pcap: ../../tls/tls-random/input.pcap
+
+# the invalid combination rules should make the engine error out
+exit-code: 1
+
+args:
+  - --simulate-ips
+
+checks:
+- shell:
+    args: grep "keyword 'bypass' cannot be used in combination with 'packet' scope" stderr | wc -l
+    expect: 1
diff --git a/tests/firewall/ruletype-firewall-147-bypass-keyword-config/README.md b/tests/firewall/ruletype-firewall-147-bypass-keyword-config/README.md
@@ -0,0 +1,14 @@
+Test that the engine properly errors out when an invalid rule action + bypass
+keyword is used.
+
+`bypass` cannot be used with `drop`, `reject`, `accept:packet`, `accept:hook`, `accept:tx`.
+
+PCAP
+====
+
+Reused from test tls-random
+
+Ticket
+======
+
+https://redmine.openinfosecfoundation.org/issues/8459
diff --git a/tests/firewall/ruletype-firewall-147-bypass-keyword-config/firewall.rules b/tests/firewall/ruletype-firewall-147-bypass-keyword-config/firewall.rules
@@ -0,0 +1,3 @@
+config:packet tcp:all any any -> any any (alert; bypass; sid:99;)
+accept:flow tcp:flow_start any any -> any 443 (alert; flow:to_server; sid:1;)
+drop:flow tcp:flow_start any any -> any any (sid:2;)
diff --git a/tests/firewall/ruletype-firewall-147-bypass-keyword-config/suricata.yaml b/tests/firewall/ruletype-firewall-147-bypass-keyword-config/suricata.yaml
@@ -0,0 +1,23 @@
+%YAML 1.1
+---
+
+# Global stats configuration
+stats:
+  enabled: yes
+  interval: 8
+
+# Configure the type of alert (and other) logging you would like.
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
+      filename: eve.json
+      types:
+        - stats
+        - flow
+        - alert
+        - tls:
+            extended: yes     # enable this for extended logging information
+        - drop:
+            alerts: yes      # log alerts that caused drops
+            flows: all       # start or all: 'start' logs only a single drop
diff --git a/tests/firewall/ruletype-firewall-147-bypass-keyword-config/test.yaml b/tests/firewall/ruletype-firewall-147-bypass-keyword-config/test.yaml
@@ -0,0 +1,15 @@
+requires:
+  min-version: 9
+
+pcap: ../../tls/tls-random/input.pcap
+
+# the invalid combination rules should make the engine error out
+exit-code: 1
+
+args:
+  - --simulate-ips
+
+checks:
+- shell:
+    args: grep "keyword 'bypass' cannot be used in combination with 'config' action" stderr | wc -l
+    expect: 1
diff --git a/tests/firewall/ruletype-firewall-148-bypass-keyword-accept-hook/README.md b/tests/firewall/ruletype-firewall-148-bypass-keyword-accept-hook/README.md
@@ -0,0 +1,14 @@
+Test that the engine properly errors out when an invalid rule action + bypass
+keyword is used.
+
+`bypass` cannot be used with `drop`, `reject`, `accept:packet`, `accept:hook`, `accept:tx`.
+
+PCAP
+====
+
+Reused from test tls-random
+
+Ticket
+======
+
+https://redmine.openinfosecfoundation.org/issues/8459
diff --git a/tests/firewall/ruletype-firewall-148-bypass-keyword-accept-hook/firewall.rules b/tests/firewall/ruletype-firewall-148-bypass-keyword-accept-hook/firewall.rules
@@ -0,0 +1,3 @@
+accept:hook tcp:all any any -> any any (alert; bypass; sid:99;)
+accept:flow tcp:flow_start any any -> any 443 (alert; flow:to_server; sid:1;)
+accept:flow tcp:flow_start any any -> any any (sid:2;)
diff --git a/tests/firewall/ruletype-firewall-148-bypass-keyword-accept-hook/suricata.yaml b/tests/firewall/ruletype-firewall-148-bypass-keyword-accept-hook/suricata.yaml
@@ -0,0 +1,23 @@
+%YAML 1.1
+---
+
+# Global stats configuration
+stats:
+  enabled: yes
+  interval: 8
+
+# Configure the type of alert (and other) logging you would like.
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
+      filename: eve.json
+      types:
+        - stats
+        - flow
+        - alert
+        - tls:
+            extended: yes     # enable this for extended logging information
+        - drop:
+            alerts: yes      # log alerts that caused drops
+            flows: all       # start or all: 'start' logs only a single drop
diff --git a/tests/firewall/ruletype-firewall-148-bypass-keyword-accept-hook/test.yaml b/tests/firewall/ruletype-firewall-148-bypass-keyword-accept-hook/test.yaml
@@ -0,0 +1,15 @@
+requires:
+  min-version: 9
+
+pcap: ../../tls/tls-random/input.pcap
+
+# the invalid combination rules should make the engine error out
+exit-code: 1
+
+args:
+  - --simulate-ips
+
+checks:
+- shell:
+    args: grep "keyword 'bypass' cannot be used in combination with 'hook' scope" stderr | wc -l
+    expect: 1
diff --git a/tests/firewall/ruletype-firewall-149-bypass-keyword-accept-tx/README.md b/tests/firewall/ruletype-firewall-149-bypass-keyword-accept-tx/README.md
@@ -0,0 +1,14 @@
+Test that the engine properly errors out when an invalid rule action + bypass
+keyword is used.
+
+`bypass` cannot be used with `drop`, `reject`, `accept:packet`, `accept:hook`, `accept:tx`.
+
+PCAP
+====
+
+Reused from test tls-random
+
+Ticket
+======
+
+https://redmine.openinfosecfoundation.org/issues/8459
diff --git a/tests/firewall/ruletype-firewall-149-bypass-keyword-accept-tx/firewall.rules b/tests/firewall/ruletype-firewall-149-bypass-keyword-accept-tx/firewall.rules
@@ -0,0 +1,3 @@
+accept:tx tcp:all any any -> any any (alert; bypass; sid:99;)
+accept:flow tcp:flow_start any any -> any 443 (alert; flow:to_server; sid:1;)
+accept:flow tcp:flow_start any any -> any any (sid:2;)
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,2 @@
		# Would alert on the HTTP response body if the firewall rule did not bypass the flow.
		alert http any any -> any any (msg:"Response body inspected after firewall bypass"; flow:to_client,established; http.response_body; content:"uid=0\|28\|root\|29\|"; sid:100001;)