From a78300740818dfa634d4e19a50d7051544ee655a Mon Sep 17 00:00:00 2001 From: Juliana Fajardini Date: Wed, 27 May 2026 17:47:52 -0300 Subject: [PATCH] detect/bypass: ban bypass keyword for firewall mode Related to Ticket #8551 --- doc/userguide/rules/bypass-keyword.rst | 5 +++++ src/detect-bypass.c | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/doc/userguide/rules/bypass-keyword.rst b/doc/userguide/rules/bypass-keyword.rst index 86525a8480..6572f72f01 100644 --- a/doc/userguide/rules/bypass-keyword.rst +++ b/doc/userguide/rules/bypass-keyword.rst @@ -11,6 +11,11 @@ The ``bypass`` keyword is useful in cases where there is a large flow expected The ``bypass`` keyword is considered a post-match keyword. +.. note:: + + ``bypass`` cannot be used in firewall mode, not even with Threat Detection + rules, as this could lead to bypassing the firewall altogether. + bypass ------ diff --git a/src/detect-bypass.c b/src/detect-bypass.c index 44af06cd63..61f93c0564 100644 --- a/src/detect-bypass.c +++ b/src/detect-bypass.c @@ -64,7 +64,7 @@ void DetectBypassRegister(void) sigmatch_table[DETECT_BYPASS].Match = DetectBypassMatch; sigmatch_table[DETECT_BYPASS].Setup = DetectBypassSetup; sigmatch_table[DETECT_BYPASS].Free = NULL; - sigmatch_table[DETECT_BYPASS].flags = SIGMATCH_NOOPT; + sigmatch_table[DETECT_BYPASS].flags = SIGMATCH_NOOPT | SIGMATCH_BAN_FIREWALL_MODE; } static int DetectBypassSetup(DetectEngineCtx *de_ctx, Signature *s, const char *str)