From d189f7a961b1dfb14c4f3b221f657047242fe214 Mon Sep 17 00:00:00 2001
From: Shivani Bhardwaj <shivani@oisf.net>
Date: Sat, 13 Jun 2026 12:53:00 +0530
Subject: [PATCH] flowbits: add deprecation notice for toggle command

Task 8638
---
 doc/userguide/rules/flow-keywords.rst | 5 ++++-
 doc/userguide/upgrade.rst             | 9 +++++++++
 src/detect-flowbits.c                 | 5 +++++
 src/detect.h                          | 1 +
 4 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/doc/userguide/rules/flow-keywords.rst b/doc/userguide/rules/flow-keywords.rst
index fdea2183da..9db86a53b6 100644
--- a/doc/userguide/rules/flow-keywords.rst
+++ b/doc/userguide/rules/flow-keywords.rst
@@ -27,6 +27,9 @@ flowbits: isset, name
 flowbits: toggle, name
   Reverses the present setting. So for example if a condition is set,
   it will be unset and vice-versa.
+
+  .. deprecated:: 7.0.17
+     The ``toggle`` command is deprecated and will be removed in Suricata 9.0.
 flowbits: unset, name
   Can be used to unset the condition in the flow.
 flowbits: isnotset, name
@@ -305,4 +308,4 @@ Signature example::
 
  alert tcp any any -> any any (msg:"Flow longer than one hour"; flow.age:>3600; flowbits: isnotset, onehourflow; flowbits: onehourflow, name; sid:1; rev:1;)
 
-In this example, we combine `flow.age` and `flowbits` to get an alert on the first packet after the flow's age is older than one hour.
\ No newline at end of file
+In this example, we combine `flow.age` and `flowbits` to get an alert on the first packet after the flow's age is older than one hour.
diff --git a/doc/userguide/upgrade.rst b/doc/userguide/upgrade.rst
index af956d7b40..bee65478dc 100644
--- a/doc/userguide/upgrade.rst
+++ b/doc/userguide/upgrade.rst
@@ -34,6 +34,15 @@ also check all the new features that have been added but are not covered by
 this guide. Those features are either not enabled by default or require
 dedicated new configuration.
 
+Upgrading to 7.0.17
+-------------------
+
+Deprecations
+~~~~~~~~~~~~~
+
+- The ``flowbits`` ``toggle`` command is now deprecated and will be removed in
+  Suricata 9.0.
+
 Upgrading to 7.0.14
 -------------------
 
diff --git a/src/detect-flowbits.c b/src/detect-flowbits.c
index cf225af9c9..b35165d94b 100644
--- a/src/detect-flowbits.c
+++ b/src/detect-flowbits.c
@@ -301,6 +301,11 @@ int DetectFlowbitSetup (DetectEngineCtx *de_ctx, Signature *s, const char *rawst
         fb_cmd = DETECT_FLOWBITS_CMD_UNSET;
     } else if (strcmp(fb_cmd_str,"toggle") == 0) {
         fb_cmd = DETECT_FLOWBITS_CMD_TOGGLE;
+        if ((de_ctx->flags & DE_WARN_FLOWBITS_TOGGLE_DEPRECATION) == 0) {
+            de_ctx->flags |= DE_WARN_FLOWBITS_TOGGLE_DEPRECATION;
+            SCLogWarning("flowbits \"toggle\" command is deprecated and will be removed in "
+                         "Suricata 9 (see ticket #8595)");
+        }
     } else {
         SCLogError("ERROR: flowbits action \"%s\" is not supported.", fb_cmd_str);
         goto error;
diff --git a/src/detect.h b/src/detect.h
index e930a1d01d..b2a26c7309 100644
--- a/src/detect.h
+++ b/src/detect.h
@@ -323,6 +323,7 @@ typedef struct DetectPort_ {
 
 /* Detection Engine flags */
 #define DE_QUIET           0x01     /**< DE is quiet (esp for unittests) */
+#define DE_WARN_FLOWBITS_TOGGLE_DEPRECATION 0x02
 
 typedef struct IPOnlyCIDRItem_ {
     /* address data for this item */