flowbits: add deprecation notice for toggle command

Task 8638

Author: inashivb

doc/userguide/rules/flow-keywords.rst

@@ -27,6 +27,9 @@ flowbits: isset, name
 flowbits: toggle, name
   Reverses the present setting. So for example if a condition is set,
   it will be unset and vice-versa.
+
+  .. deprecated:: 7.0.17
+     The ``toggle`` command is deprecated and will be removed in Suricata 9.0.
 flowbits: unset, name
   Can be used to unset the condition in the flow.
 flowbits: isnotset, name
@@ -305,4 +308,4 @@ Signature example::
 
  alert tcp any any -> any any (msg:"Flow longer than one hour"; flow.age:>3600; flowbits: isnotset, onehourflow; flowbits: onehourflow, name; sid:1; rev:1;)
 
-In this example, we combine `flow.age` and `flowbits` to get an alert on the first packet after the flow's age is older than one hour.
+In this example, we combine `flow.age` and `flowbits` to get an alert on the first packet after the flow's age is older than one hour.

doc/userguide/upgrade.rst

@@ -34,6 +34,15 @@ also check all the new features that have been added but are not covered by
 this guide. Those features are either not enabled by default or require
 dedicated new configuration.
 
+Upgrading to 7.0.17
+-------------------
+
+Deprecations
+~~~~~~~~~~~~~
+
+- The ``flowbits`` ``toggle`` command is now deprecated and will be removed in
+  Suricata 9.0.
+
 Upgrading to 7.0.14
 -------------------
 

src/detect-flowbits.c

@@ -301,6 +301,11 @@ int DetectFlowbitSetup (DetectEngineCtx *de_ctx, Signature *s, const char *rawst
         fb_cmd = DETECT_FLOWBITS_CMD_UNSET;
     } else if (strcmp(fb_cmd_str,"toggle") == 0) {
         fb_cmd = DETECT_FLOWBITS_CMD_TOGGLE;
+        if ((de_ctx->flags & DE_WARN_FLOWBITS_TOGGLE_DEPRECATION) == 0) {
+            de_ctx->flags |= DE_WARN_FLOWBITS_TOGGLE_DEPRECATION;
+            SCLogWarning("flowbits \"toggle\" command is deprecated and will be removed in "
+                         "Suricata 9 (see ticket #8595)");
+        }
     } else {
         SCLogError("ERROR: flowbits action \"%s\" is not supported.", fb_cmd_str);
         goto error;

src/detect.h

@@ -323,6 +323,7 @@ typedef struct DetectPort_ {
 
 /* Detection Engine flags */
 #define DE_QUIET           0x01     /**< DE is quiet (esp for unittests) */
+#define DE_WARN_FLOWBITS_TOGGLE_DEPRECATION 0x02
 
 typedef struct IPOnlyCIDRItem_ {
     /* address data for this item */