OISF · jufajardini · Jul 17, 2026 · Jul 30, 2026 · Aug 9, 2026 · Aug 21, 2026
diff --git a/tests/firewall/ruletype-firewall-141-allow-bypass-keyword-firewall-rule/README.md b/tests/firewall/ruletype-firewall-141-allow-bypass-keyword-firewall-rule/README.md
@@ -0,0 +1,13 @@
+# Test
+
+Updated test to ensure that the engine accepts the `bypass` keyword in a firewall
+mode, in a firweall rule.
+
+The accepted firewall rule matches the decoded HTTP host
+`www.testmyids.com`, then accepts and bypasses the flow at the
+`http1:request_headers` hook.
+
+## Ticket
+
+Related to
+https://redmine.openinfosecfoundation.org/issues/8459.
diff --git a/...pass-keyword-firewall-rule/firewall.rules → ...pass-keyword-firewall-rule/firewall.rules b/...pass-keyword-firewall-rule/firewall.rules → ...pass-keyword-firewall-rule/firewall.rules
diff --git a/...ban-bypass-keyword-firewall-rule/td.rules → ...low-bypass-keyword-firewall-rule/td.rules b/...ban-bypass-keyword-firewall-rule/td.rules → ...low-bypass-keyword-firewall-rule/td.rules
diff --git a/...an-bypass-keyword-firewall-rule/test.yaml → ...ow-bypass-keyword-firewall-rule/test.yaml b/...an-bypass-keyword-firewall-rule/test.yaml → ...ow-bypass-keyword-firewall-rule/test.yaml
@@ -6,35 +6,35 @@ pcap: ../../flowbit-oring/input.pcap
 args:
   - --simulate-ips
   - -k none
-exit-code: 1
 
 checks:
+      # We're enabling bypass in firewall rules only, in firewall mode
+  - shell:
+      args: grep "keyword 'bypass' is not allowed in firewall mode" stderr | wc -l
+      expect: 0
   - filter:
-      # Would be 1 if bypass were enabled in firewall rules.
-      count: 0
+      # Expected 1 with bypass enabled in firewall rules.
+      count: 1
       match:
         event_type: alert
         alert.signature_id: 2000001
         http.hostname: www.testmyids.com
   - filter:
-      # Would remain 0 if bypass were enabled and suppressed TD inspection.
+      # Remains 0 if bypass is enabled and suppressed TD inspection.
       count: 0
       match:
         event_type: alert
         alert.signature_id: 100001
   - filter:
-      # Would be 1 if bypass were enabled in firewall rules.
-      count: 0
+      # Should be 1 if bypass is enabled in firewall rules.
+      count: 1
       match:
         event_type: flow
         flow.state: bypassed
         flow.bypass: local
   - filter:
-      # Would be 1 if bypass were enabled in firewall rules.
-      count: 0
+      # Should be 1 if bypass is enabled in firewall rules.
+      count: 1
       match:
         event_type: stats
         stats.flow_bypassed.local_pkts: 6
-  - shell:
-      args: grep "keyword 'bypass' is not allowed in firewall mode" stderr | wc -l
-      expect: 1
diff --git a/tests/firewall/ruletype-firewall-141-ban-bypass-keyword-firewall-rule/README.md b/tests/firewall/ruletype-firewall-141-ban-bypass-keyword-firewall-rule/README.md
diff --git a/...firewall-90-ban-replace-keyword/README.md → ...irewall-142-ban-replace-keyword/README.md b/...firewall-90-ban-replace-keyword/README.md → ...irewall-142-ban-replace-keyword/README.md
diff --git a/...all-90-ban-replace-keyword/firewall.rules → ...ll-142-ban-replace-keyword/firewall.rules b/...all-90-ban-replace-keyword/firewall.rules → ...ll-142-ban-replace-keyword/firewall.rules
diff --git a/...firewall-90-ban-replace-keyword/test.yaml → ...irewall-142-ban-replace-keyword/test.yaml b/...firewall-90-ban-replace-keyword/test.yaml → ...irewall-142-ban-replace-keyword/test.yaml
diff --git a/...-firewall-92-ban-bypass-keyword/README.md → ...firewall-143-ban-bypass-keyword/README.md b/...-firewall-92-ban-bypass-keyword/README.md → ...firewall-143-ban-bypass-keyword/README.md
@@ -1,7 +1,7 @@
 # Test
 
 Ensure that the engine throws an error if the `bypass` keyword is used
-in threat detection rules, as it's banned in firewall mode.
+in threat detection rules, as it's banned in firewall mode, for those.
 
 ## Ticket
 

diff --git a/...wall-92-ban-bypass-keyword/firewall.rules → ...all-143-ban-bypass-keyword/firewall.rules b/...wall-92-ban-bypass-keyword/firewall.rules → ...all-143-ban-bypass-keyword/firewall.rules
diff --git a/...e-firewall-92-ban-bypass-keyword/td.rules → ...-firewall-143-ban-bypass-keyword/td.rules b/...e-firewall-92-ban-bypass-keyword/td.rules → ...-firewall-143-ban-bypass-keyword/td.rules
diff --git a/...-firewall-92-ban-bypass-keyword/test.yaml → ...firewall-143-ban-bypass-keyword/test.yaml b/...-firewall-92-ban-bypass-keyword/test.yaml → ...firewall-143-ban-bypass-keyword/test.yaml
@@ -10,6 +10,6 @@ exit-code: 1
 
 checks:
   - shell:
-      args: grep "keyword 'bypass' is not allowed in firewall mode" stderr | wc -l
+      args: grep "keyword 'bypass' is not allowed in threat detection rules with firewall mode" stderr | wc -l
       expect: 1
 
diff --git a/tests/firewall/ruletype-firewall-144-bypass-keyword-drop/README.md b/tests/firewall/ruletype-firewall-144-bypass-keyword-drop/README.md
@@ -0,0 +1,14 @@
+Test that the engine properly errors out when an invalid rule action + bypass
+keyword is used.
+
+`bypass` cannot be used with `drop`, `reject`, `accept:packet`, `accept:hook`, `accept:tx`.
+
+PCAP
+====
+
+Reused from test tls-random
+
+Ticket
+======
+
+https://redmine.openinfosecfoundation.org/issues/8459
diff --git a/tests/firewall/ruletype-firewall-144-bypass-keyword-drop/firewall.rules b/tests/firewall/ruletype-firewall-144-bypass-keyword-drop/firewall.rules
@@ -0,0 +1,3 @@
+drop:packet tcp:all any any -> any any (alert; bypass; sid:99;)
+accept:flow tcp:flow_start any any -> any 443 (alert; flow:to_server; sid:1;)
+drop:flow tcp:flow_start any any -> any any (sid:2;)
diff --git a/tests/firewall/ruletype-firewall-144-bypass-keyword-drop/suricata.yaml b/tests/firewall/ruletype-firewall-144-bypass-keyword-drop/suricata.yaml
@@ -0,0 +1,23 @@
+%YAML 1.1
+---
+
+# Global stats configuration
+stats:
+  enabled: yes
+  interval: 8
+
+# Configure the type of alert (and other) logging you would like.
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
+      filename: eve.json
+      types:
+        - stats
+        - flow
+        - alert
+        - tls:
+            extended: yes     # enable this for extended logging information
+        - drop:
+            alerts: yes      # log alerts that caused drops
+            flows: all       # start or all: 'start' logs only a single drop
diff --git a/tests/firewall/ruletype-firewall-144-bypass-keyword-drop/test.yaml b/tests/firewall/ruletype-firewall-144-bypass-keyword-drop/test.yaml
@@ -0,0 +1,15 @@
+requires:
+  min-version: 9
+
+pcap: ../../tls/tls-random/input.pcap
+
+# the invalid combination rules should make the engine error out
+exit-code: 1
+
+args:
+  - --simulate-ips
+
+checks:
+- shell:
+    args: grep "keyword 'bypass' cannot be used in combination with 'drop' action" stderr | wc -l
+    expect: 1
diff --git a/tests/firewall/ruletype-firewall-145-bypass-keyword-reject/README.md b/tests/firewall/ruletype-firewall-145-bypass-keyword-reject/README.md
@@ -0,0 +1,14 @@
+Test that the engine properly errors out when an invalid rule action + bypass
+keyword is used.
+
+`bypass` cannot be used with `drop`, `reject`, `accept:packet`, `accept:hook`, `accept:tx`.
+
+PCAP
+====
+
+Reused from test tls-random
+
+Ticket
+======
+
+https://redmine.openinfosecfoundation.org/issues/8459
diff --git a/tests/firewall/ruletype-firewall-145-bypass-keyword-reject/firewall.rules b/tests/firewall/ruletype-firewall-145-bypass-keyword-reject/firewall.rules
@@ -0,0 +1,3 @@
+reject:packet tcp:all any any -> any any (alert; bypass; sid:99;)
+accept:flow tcp:flow_start any any -> any 443 (alert; flow:to_server; sid:1;)
+reject:flow tcp:flow_start any any -> any any (sid:2;)
diff --git a/tests/firewall/ruletype-firewall-145-bypass-keyword-reject/suricata.yaml b/tests/firewall/ruletype-firewall-145-bypass-keyword-reject/suricata.yaml
@@ -0,0 +1,23 @@
+%YAML 1.1
+---
+
+# Global stats configuration
+stats:
+  enabled: yes
+  interval: 8
+
+# Configure the type of alert (and other) logging you would like.
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
+      filename: eve.json
+      types:
+        - stats
+        - flow
+        - alert
+        - tls:
+            extended: yes     # enable this for extended logging information
+        - drop:
+            alerts: yes      # log alerts that caused drops
+            flows: all       # start or all: 'start' logs only a single drop
diff --git a/tests/firewall/ruletype-firewall-145-bypass-keyword-reject/test.yaml b/tests/firewall/ruletype-firewall-145-bypass-keyword-reject/test.yaml
@@ -0,0 +1,17 @@
+requires:
+  min-version: 9
+  features:
+    - LIBNET1.1
+
+pcap: ../../tls/tls-random/input.pcap
+
+# the invalid combination rules should make the engine error out
+exit-code: 1
+
+args:
+  - --simulate-ips
+
+checks:
+- shell:
+    args: grep "keyword 'bypass' cannot be used in combination with 'reject' action" stderr | wc -l
+    expect: 1
diff --git a/tests/firewall/ruletype-firewall-146-bypass-keyword-accept-packet/README.md b/tests/firewall/ruletype-firewall-146-bypass-keyword-accept-packet/README.md
@@ -0,0 +1,14 @@
+Test that the engine properly errors out when an invalid rule action + bypass
+keyword is used.
+
+`bypass` cannot be used with `drop`, `reject`, `accept:packet`, `accept:hook`, `accept:tx`.
+
+PCAP
+====
+
+Reused from test tls-random
+
+Ticket
+======
+
+https://redmine.openinfosecfoundation.org/issues/8459
diff --git a/tests/firewall/ruletype-firewall-146-bypass-keyword-accept-packet/firewall.rules b/tests/firewall/ruletype-firewall-146-bypass-keyword-accept-packet/firewall.rules
@@ -0,0 +1,3 @@
+accept:packet tcp:all any any -> any any (alert; bypass; sid:99;)
+accept:flow tcp:flow_start any any -> any 443 (alert; flow:to_server; sid:1;)
+accept:flow tcp:flow_start any any -> any any (sid:2;)
diff --git a/tests/firewall/ruletype-firewall-146-bypass-keyword-accept-packet/suricata.yaml b/tests/firewall/ruletype-firewall-146-bypass-keyword-accept-packet/suricata.yaml
@@ -0,0 +1,23 @@
+%YAML 1.1
+---
+
+# Global stats configuration
+stats:
+  enabled: yes
+  interval: 8
+
+# Configure the type of alert (and other) logging you would like.
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
+      filename: eve.json
+      types:
+        - stats
+        - flow
+        - alert
+        - tls:
+            extended: yes     # enable this for extended logging information
+        - drop:
+            alerts: yes      # log alerts that caused drops
+            flows: all       # start or all: 'start' logs only a single drop
diff --git a/tests/firewall/ruletype-firewall-146-bypass-keyword-accept-packet/test.yaml b/tests/firewall/ruletype-firewall-146-bypass-keyword-accept-packet/test.yaml
@@ -0,0 +1,15 @@
+requires:
+  min-version: 9
+
+pcap: ../../tls/tls-random/input.pcap
+
+# the invalid combination rules should make the engine error out
+exit-code: 1
+
+args:
+  - --simulate-ips
+
+checks:
+- shell:
+    args: grep "keyword 'bypass' cannot be used in combination with 'packet' scope" stderr | wc -l
+    expect: 1
diff --git a/tests/firewall/ruletype-firewall-147-bypass-keyword-config/README.md b/tests/firewall/ruletype-firewall-147-bypass-keyword-config/README.md
@@ -0,0 +1,14 @@
+Test that the engine properly errors out when an invalid rule action + bypass
+keyword is used.
+
+`bypass` cannot be used with `drop`, `reject`, `accept:packet`, `accept:hook`, `accept:tx`.
+
+PCAP
+====
+
+Reused from test tls-random
+
+Ticket
+======
+
+https://redmine.openinfosecfoundation.org/issues/8459
diff --git a/tests/firewall/ruletype-firewall-147-bypass-keyword-config/firewall.rules b/tests/firewall/ruletype-firewall-147-bypass-keyword-config/firewall.rules
@@ -0,0 +1,3 @@
+config:packet tcp:all any any -> any any (alert; bypass; sid:99;)
+accept:flow tcp:flow_start any any -> any 443 (alert; flow:to_server; sid:1;)
+drop:flow tcp:flow_start any any -> any any (sid:2;)
diff --git a/tests/firewall/ruletype-firewall-147-bypass-keyword-config/suricata.yaml b/tests/firewall/ruletype-firewall-147-bypass-keyword-config/suricata.yaml
@@ -0,0 +1,23 @@
+%YAML 1.1
+---
+
+# Global stats configuration
+stats:
+  enabled: yes
+  interval: 8
+
+# Configure the type of alert (and other) logging you would like.
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
+      filename: eve.json
+      types:
+        - stats
+        - flow
+        - alert
+        - tls:
+            extended: yes     # enable this for extended logging information
+        - drop:
+            alerts: yes      # log alerts that caused drops
+            flows: all       # start or all: 'start' logs only a single drop
diff --git a/tests/firewall/ruletype-firewall-147-bypass-keyword-config/test.yaml b/tests/firewall/ruletype-firewall-147-bypass-keyword-config/test.yaml
@@ -0,0 +1,15 @@
+requires:
+  min-version: 9
+
+pcap: ../../tls/tls-random/input.pcap
+
+# the invalid combination rules should make the engine error out
+exit-code: 1
+
+args:
+  - --simulate-ips
+
+checks:
+- shell:
+    args: grep "keyword 'bypass' cannot be used in combination with 'config' action" stderr | wc -l
+    expect: 1
diff --git a/tests/firewall/ruletype-firewall-148-bypass-keyword-accept-hook/README.md b/tests/firewall/ruletype-firewall-148-bypass-keyword-accept-hook/README.md
@@ -0,0 +1,14 @@
+Test that the engine properly errors out when an invalid rule action + bypass
+keyword is used.
+
+`bypass` cannot be used with `drop`, `reject`, `accept:packet`, `accept:hook`, `accept:tx`.
+
+PCAP
+====
+
+Reused from test tls-random
+
+Ticket
+======
+
+https://redmine.openinfosecfoundation.org/issues/8459
diff --git a/tests/firewall/ruletype-firewall-148-bypass-keyword-accept-hook/firewall.rules b/tests/firewall/ruletype-firewall-148-bypass-keyword-accept-hook/firewall.rules
@@ -0,0 +1,3 @@
+accept:hook tcp:all any any -> any any (alert; bypass; sid:99;)
+accept:flow tcp:flow_start any any -> any 443 (alert; flow:to_server; sid:1;)
+accept:flow tcp:flow_start any any -> any any (sid:2;)
diff --git a/tests/firewall/ruletype-firewall-148-bypass-keyword-accept-hook/suricata.yaml b/tests/firewall/ruletype-firewall-148-bypass-keyword-accept-hook/suricata.yaml
@@ -0,0 +1,23 @@
+%YAML 1.1
+---
+
+# Global stats configuration
+stats:
+  enabled: yes
+  interval: 8
+
+# Configure the type of alert (and other) logging you would like.
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
+      filename: eve.json
+      types:
+        - stats
+        - flow
+        - alert
+        - tls:
+            extended: yes     # enable this for extended logging information
+        - drop:
+            alerts: yes      # log alerts that caused drops
+            flows: all       # start or all: 'start' logs only a single drop
diff --git a/tests/firewall/ruletype-firewall-148-bypass-keyword-accept-hook/test.yaml b/tests/firewall/ruletype-firewall-148-bypass-keyword-accept-hook/test.yaml
@@ -0,0 +1,15 @@
+requires:
+  min-version: 9
+
+pcap: ../../tls/tls-random/input.pcap
+
+# the invalid combination rules should make the engine error out
+exit-code: 1
+
+args:
+  - --simulate-ips
+
+checks:
+- shell:
+    args: grep "keyword 'bypass' cannot be used in combination with 'hook' scope" stderr | wc -l
+    expect: 1