# 9.0.0-beta1



* Feature #1005: conditional logging: controlling what gets logged
* Feature #1542: dump-config - extend into multi-detect supplied yaml configuration
* Bug #1826: Rule validation bug with fast_pattern:only and specified buffers
* Bug #1926: rule parsing: wrong content checked for fast_pattern (snort compatibility)
* Feature #1979: TCP/IP packets normalization/scrubbing
* Feature #1983: tls: events are directionless and trigger twice per flow direction
* Feature #1993: commandline: introduce --enable-all-outputs switch
* Feature #2375: Design and implement sensible per-thread capabilities
* Optimization #2621: Convert setup scripts from sh/ed/sed to Python.
* Feature #2678: list-keywords: add info about fast_pattern and transforms
* Feature #2958: Suricata 5.0.0beta1 and way too much anomaly logging
* Feature #3003: filestore to uses rename syscall instead of sendfile,which doesn't allow files to be sent across file systems
* Task #3166: src code file reorg
* Feature #3243: POP3 Support 
* Feature #3446: app-layer: implement MySQL parser
* Optimization #3540: krb5: use app-layer incomplete support
* Optimization #3707: Convert JSON Loggers to JsonBuilder
* Optimization #3734: af-packet: better support for csum offload
* Optimization #3766: Convert Stats to JsonBuilder
* Task #3836: Formatting rust code
* Feature #4089: rules: Flexible format transform
* Task #4098: smtp: convert parser to Rust
* Task #4122: tracking: handle various TLS decrypt headers in proxies and decryption tools
* Task #4143: tracking: file.data improvements
* Feature #4153: app-layer: rust derive style macros to generate common code
* Task #4161: tls: convert parser to Rust
* Feature #4174: tracking: app-layer frame inspection support
* Optimization #4490: rust: see if we can use SuricataStreamingBufferConfig
* Optimization #4517: cbindgen export the constants from Rust to C, also for macro such as BIT_U8(1), and remove duplicate definitions between rust and C
* Documentation #4557: Add document about JsonBuilder
* Task #4704: unix-socket: separate functionality from the unix socket interface
* Task #4707: detect: unify internal buffer names to use <proto>.<buffer> naming
* Optimization #4747: app-layer: make tx iterator a mandatory part of the API
* Task #4773: research: IPS behavior wrt resource limits
* Optimization #4802: af-packet: remove IPS support for tpacket-v3
* Optimization #4806: af-packet: remove autofp support
* Feature #4855: rules: refactor rule parsing into multi-stage parser
* Feature #4861: smb: support multi-stream file transfers
* Bug #4873: smb: midstream probing check affects performance 
* Feature #4906: ftp: add stream app-layer frame support 
* Feature #4910: dpdk: implement secondary mode
* Bug #4917: tls: leading GAP in toserver direction leads to various issues
* Task #4919: Add option to change sensor-name log field
* Task #4936: Use Rust to parse unix socket messages
* Optimization #4937: Convert Rule Profile JSON output to JsonBuilder
* Feature #4946: nfsv2: implement WRITE support
* Optimization #4950: Code improvement in KRB5State.parse function
* Feature #4965: protocol: SOCKS support
* Feature #4986: pgsql: support frames
* Optimization #4987: frames: unify handling of getting frame data, flags
* Feature #4990: eve/frames: make payload logging configurable
* Feature #5029: eve: telnet logger
* Feature #5044: rules: keyword for "count" of http_header_names
* Feature #5049: detect/frames: allow mixing with txs
* Task #5050: rules/frames: settle on rule syntax
* Task #5181: detect/engine-analyzer: add rule analyzer warnings about rules that could use the frame keyword/semantics/feature
* Feature #5194: tracking: options for simulating various exceptions
* Bug #5196: config: test mode should fail when there are invalid config values
* Optimization #5207: Common Rust parser for *bits
* Feature #5415: tftp: support keywords such as file.name, file.data etc...
* Optimization #5453: af-packet ips: floods packets that should be learned
* Optimization #5476: decoder: compact & flexible storage of decoder data in the packet
* Feature #5495: implement grace period for midstream exception policy
* Task #5560: dpdk: Design a test-case for Suricata running as a secondary process
* Task #5610: tracking: new protocol: telnet
* Feature #5640: frames: tx frames
* Feature #5664: "Scope" bits should have an expiration
* Task #5682: tracking: smb performance issues
* Feature #5692: Add brotli content encoding to HTTP/1.1
* Bug #5704: Filestore is not working if landlock is enabled
* Feature #5726: ike: add frame support
* Feature #5775: http.headers - dynamic sticky buffers
* Optimization #5787: detect/filestore: optimize http tx handling
* Feature #5826: frames: logging of events set on frames
* Feature #5845: smb: Support SMB_COM_SESSION_SETUP_ANDX Request
* Feature #5973: warn when HTTP rules will only work for a specific version of HTTP 
* Feature #5974: Midstream exception policy "reject-both" support
* Optimization #6001: investigate: optional/configurable stats log verbosity
* Optimization #6002: stats/exception: allow configuring verbosity via unix socket
* Task #6028: c: C11 _s style buffer handling calls
* Task #6029: c: require C11
* Optimization #6061: cmdline: make --list-runmodes output friendlier
* Feature #6063: exception-policy: stream async policy
* Feature #6114: dpdk: wrap DPDK logs in a Suricata logger
* Task #6179: tracking: flash decompression deprecation and removal
* Task #6184: flash decompression: remove feature
* Security #6187: DetectEngineReload: handle allocation failures
* Optimization #6188: ConfYamlLoadString: handle allocation failures
* Task #6217: research: increased tcp.overlap after file data changes
* Optimization #6225: exception: standardize log message about set-up value
* Feature #6237: Multi-tenancy: Allow inner VLAN to be selected
* Task #6258: misc: clean-up commented out code
* Feature #6261: Add GRE as a parsible protocol 
* Task #6262: tracking: reduce stack usage
* Task #6273: misc: clean up left over printf calls
* Feature #6293: Support disabling forced flow reuse in low memory conditions
* Feature #6399: Per-thread stats values can be negative
* Feature #6424: HTTP/2 -  http.host behavior when both :authority pseudo header and host header are present
* Feature #6459: filebits: support for new type of bits
* Feature #6472: HTTP/3 support
* Task #6474: detect: smtp body inspection keyword
* Task #6485: [investigate] Scoring method for keywords and transforms
* Task #6489: test/stream/tcp-list: fix unittests 
* Task #6545: tls-store: unify with file-store
* Bug #6652: Configuration values trigger error instead of warning messages
* Optimization #6654: pgsql: optimize PDU processing logic
* Optimization #6703: detect-engine/port: Explore Rank Balanced trees for post grouping uses
* Feature #6723: detect: review existing keywords for usage of enumerations
* Feature #6724: detect: review existing keywords for usage of bitflags
* Feature #6729: websockets: support over HTTP/2
* Optimization #6747: dpdk: synchronized CPU stalls on Suricata workers
* Task #6849: brainstorm: should certain eve ouput types be removed (eg syslog)
* Task #6917: [investigate] exceptions: are drop reasons unique to policies?
* Task #6951: tracking: nfs performance issues
* Bug #6956: mqtt: create PDU frames without regard to the parsing function
* Optimization #6960: fuzz: target to test signatures compatibility
* Task #6968: decode: unify decode thread module with receive thread module
* Bug #6971: defrag: default policy is inconsistent
* Feature #6996: add transformation to keyword performance stats
* Feature #6999: output/json: enrich EVE w/ libmaxminddb geoip info
* Task #7030: arp: make arp opcodes into enum
* Task #7061: content-inspect: expand accepted range of depth/offset/distance & related
* Feature #7068: protocol support: STUN
* Feature #7070: eve: internal state output facility
* Task #7071: core/rust: use Direction enum for raw parser trigger fn
* Feature #7092: frames: support rules with multiple different frames
* Feature #7109: app-layer: stop generating anomalies after gap in the flow
* Feature #7125: threshold: by_src, by_dst, by_both should support vlan separation
* Documentation #7174: docs: investigate if RtD AddOns will impact our guides
* Optimization #7186: detect: represent direction with enum
* Feature #7211: detect/integers: support a count argument for array of integers
* Task #7232: http-log: remove
* Task #7233: tls-log: remove (deprecated in Suricata 8)
* Task #7234: syslog: remove standalone syslog output
* Optimization #7263: pgsql: limit tx.responses - configurable?
* Optimization #7266: detect/dns-query: clean-up and convert unit tests
* Optimization #7371: smb: events/counters for caches getting full
* Feature #7399: ipv6: support short notation of ipv6 addresses in output
* Optimization #7423: eve/json: reduce default memory buffer size; remove double buffering
* Feature #7480: detect/integers: array of integers should support an optional second argument to specify the index
* Task #7511: engine/analysis: store warnings and debugs in the rule struct
* Feature #7514: rules: add file specific hooks
* Bug #7528: decode: remove duplicate counters tracking unknown ethertype values
* Feature #7571: list-keywords should somehow show the multi-buffer keywords
* Task #7590: eve: remove syslog filetype