Merge 0e380279e2 into 9a37bb659b

doc/userguide/configuration/suricata-yaml.rst

@@ -2858,8 +2858,8 @@ use of.
     vista: []
     windows2k3: []
 
-Suricata as a Firewall options (experimental)
----------------------------------------------
+Suricata as a Firewall options
+------------------------------
 
 It is possible to run Suricata as a firewall.
 Please read :ref:`Firewall Mode Design <firewall mode design>` before using this.

doc/userguide/firewall/firewall-design.rst

@@ -3,7 +3,7 @@
 Firewall Mode Design
 ********************
 
-.. note:: In Suricata 8 the firewall mode is experimental and subject to change.
+.. note:: Suricata firewall mode features and behavior are still subject to change.
 
 The firewall mode in Suricata allows the use of a ruleset that has different
 properties than the default "threat detection" rulesets:

doc/userguide/firewall/firewall-example.rst

@@ -1,8 +1,6 @@
 Firewall Ruleset Examples
 =========================
 
-.. note:: In Suricata 8 the firewall mode is experimental and subject to change.
-
 HTTP
 ----
 

doc/userguide/firewall/firewall-unsupported-keywords.rst

@@ -0,0 +1,28 @@
+Firewall Mode Unsupported Keywords
+==================================
+
+Certain rule keywords are not supported in firewall mode, either completely or
+based on rulesets.
+
+A keyword may be unsupported in firewall rules, in threat detection rules, or in
+firewall mode altogether.
+
+This is done when there is a chance that the keyword would lead to the firewall
+verdict being skipped, contradicted, or when there could happen inconsistent
+states from interactions between firewall and threat detection rules matching.
+
+.. note:: Future releases may add support for such keywords where it makes sense.
+
+Unsupported Keywords
+--------------------
+
+Firewall Mode
+~~~~~~~~~~~~~
+
+* Bypass
+* Replace
+
+Threat Detection Rules
+~~~~~~~~~~~~~~~~~~~~~~
+
+* Config (both the ``config`` keyword and the ``config`` action)

doc/userguide/firewall/index.rst

@@ -8,3 +8,4 @@ Firewall Mode
    firewall-stats
    tls-state-migration
    ssh-state-migration
+   firewall-unsupported-keywords

src/suricata.c

@@ -2832,7 +2832,6 @@ int PostConfLoadedSetup(SCInstance *suri)
         }
     }
     if (suri->is_firewall) {
-        SCLogWarning("firewall mode is EXPERIMENTAL and subject to change");
         EngineModeSetFirewall(g_engine_host_mode);
     }
 

suricata.yaml.in

@@ -2383,7 +2383,7 @@ reference-config-file: @e_sysconfdir@reference.config
 # threshold-file: @e_sysconfdir@threshold.config
 
 ##
-## Suricata as a Firewall options (experimental)
+## Suricata as a Firewall options
 ##
 firewall:
   # toggle to enable firewall mode