Ethertype values are now converted from network format to host format
before display occurs. Displayed values are now in hex instead of
integers.
Without this change, ethertype values such as 0xfbb7 are
displayed in decimal as: 47099 (0xb7fb).
The actual value is 64439 (0xfbb7); all logged ether_type values
will be displayed in host order in decimal format. This example
will log the ether type as 64439
Issue: 7855
Check bail condition before entering conditional wait.
CID 1554236: (#1 of 1): Indefinite wait (BAD_CHECK_OF_WAIT_COND)
dead_wait: A wait is performed without ensuring that the condition is not already satisfied while holding lock ThreadVars_.ctrl_mutex. This can cause unnecessary waiting if the notification happens before the lock is acquired.
CID 1554238: (#1 of 1): Indefinite wait (BAD_CHECK_OF_WAIT_COND)
dead_wait: A wait is performed without ensuring that the condition is not already satisfied while holding lock ThreadVars_.ctrl_mutex. This can cause unnecessary waiting if the notification happens before the lock is acquired.
Ticket: 7973
Files were supported on both TCP and UDP. But file detection keywords
such as file.data made signatures loading fail if the signature
was using an app-layer protocol that enabled on udp only, even
if the signatures could run smoothly.
IKE attributes are an array of TLV style objects, this means there can
be duplicate types seen on the wire. However, Suricata logs these as a
mapping with the type as the key. This can result in the JSON
containing duplicate keys.
To address this, log the attributes as an array of objects, allow
duplicates to exist, for example:
"client": {
"proposals": [
{
"sa_life_duration": "Unknown",
"sa_life_duration_raw": 86400,
}
}
}
is now logged as:
"client": {
"proposals": [
{"key": "sa_life_duration", "value": "Unknown", "raw": 86400}
]
}
Also adds `"version": 2` to each IKE record to note the change of
format from previous versions.
Ticket: #7902
DPDK Bonding API has been changed in DPDK version 23.11 where
the old *slave* API was marked as deprecated and the new *member*
API was marked as experimental.
This was unfortunately executed by marking both API variants
at the same time. The deprecated version is removed from the follow
up versions while the experimental version will become stable
in the next DPDK releases. This is based on a policy in DPDK where
an API change needs to merged in main for 1 stable release before
removing the experimental flag.
In DPDK 24.11 this has been fixed and warning supression is not
added.
Ticket: 7009
The exclude function incorrectly performs a XOR operation. While it
works when the worker cores occupy all cores, it is not the correct
operation. For example, when a core is affined to only management
and not worker threads, the XOR operation affines it to the worker set.
(1 XOR 0 -> 1, where in fact the desired outcome is 0)
Ticket: 7975
When the decoder finds a packet with wrong IP version for
IPv4|IPv6-in-IPv6 tunnels, it would set an event, but wouldn't flag the
packet invalid. This fixes that.
Bug #7964
Add MT live test capability:
- multi-tenant.sh: harness that sets up and steps through MT steps
- suricata-mt.yaml: Adds MT capability to Suricata
- tenant-1.yaml: Per-tenant configuration file
Fix PathMerge error handling bringing back CID 1427652.
The result doesn't need to be checked as we're already in an error state
and the path is only used to print to the user.
util-runmodes.c: In function 'RunModeSetLiveCaptureAutoFp':
util-runmodes.c:167:30: warning: '%02d' directive output may be truncated writing between 2 and 11 bytes into a region of size between 3 and 4 [-Wformat-truncation=]
167 | "%s#%02d-%s", thread_name, thread+1,
| ^~~~
util-runmodes.c:167:26: note: directive argument in the range [-2147483647, 2147483647]
167 | "%s#%02d-%s", thread_name, thread+1,
| ^~~~~~~~~~~~
util-runmodes.c:167:26: note: assuming directive output of 1 byte
util-runmodes.c:166:17: note: 'snprintf' output 5 or more bytes (assuming 16) into a destination of size 5
166 | snprintf(printable_threadname, strlen(thread_name)+5+strlen(dev),
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
167 | "%s#%02d-%s", thread_name, thread+1,
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
168 | dev);
| ~~~~
util-runmodes.c: In function 'RunModeSetLiveCaptureWorkersForDevice':
util-runmodes.c:280:88: warning: '%02d' directive output may be truncated writing between 2 and 10 bytes into a region of size between 3 and 4 [-Wformat-truncation=]
280 | snprintf(printable_threadname, strlen(thread_name)+5+strlen(live_dev), "%s#%02d-%s",
| ^~~~
util-runmodes.c:280:84: note: directive argument in the range [1, 2147483647]
280 | snprintf(printable_threadname, strlen(thread_name)+5+strlen(live_dev), "%s#%02d-%s",
| ^~~~~~~~~~~~
util-runmodes.c:280:84: note: assuming directive output of 1 byte
util-runmodes.c:280:13: note: 'snprintf' output 5 or more bytes (assuming 15) into a destination of size 5
280 | snprintf(printable_threadname, strlen(thread_name)+5+strlen(live_dev), "%s#%02d-%s",
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
281 | thread_name, thread+1, live_dev);
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
util-runmodes.c:275:91: warning: '%s' directive output may be truncated writing likely 1 or more bytes into a region of size between 0 and 1 [-Wformat-truncation=]
275 | snprintf(printable_threadname, strlen(thread_name)+5+strlen(live_dev), "%s#01-%s",
| ^~
util-runmodes.c:275:84: note: assuming directive output of 1 byte
275 | snprintf(printable_threadname, strlen(thread_name)+5+strlen(live_dev), "%s#01-%s",
| ^~~~~~~~~~
util-runmodes.c:275:13: note: 'snprintf' output 5 or more bytes (assuming 7) into a destination of size 5
275 | snprintf(printable_threadname, strlen(thread_name)+5+strlen(live_dev), "%s#01-%s",
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
276 | thread_name, live_dev);
| ~~~~~~~~~~~~~~~~~~~~~~
Ticket: #7905.
Use PathMerge to improve path handling and address these warnings:
output-lua.c: In function 'OutputLuaLogInitSub':
output-lua.c:657:48: warning: '%s' directive output may be truncated writing likely 1 or more bytes into a region of size between 0 and 4096 [-Wformat-truncation=]
657 | int ret = snprintf(path, sizeof(path),"%s%s%s", dir, strlen(dir) ? "/" : "", conf->val);
| ^~
output-lua.c:657:43: note: assuming directive output of 1 byte
657 | int ret = snprintf(path, sizeof(path),"%s%s%s", dir, strlen(dir) ? "/" : "", conf->val);
| ^~~~~~~~
output-lua.c:657:15: note: 'snprintf' output 1 or more bytes (assuming 4098) into a destination of size 4096
657 | int ret = snprintf(path, sizeof(path),"%s%s%s", dir, strlen(dir) ? "/" : "", conf->val);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Ticket: #7905.
This appears to be a FP. Work around it to allow for using this warning
as an error.
output-json-stats.c: In function 'StatsToJSON':
output-json-stats.c:253:65: warning: 'snprintf' output may be truncated before the last format character [-Wformat-truncation=]
253 | snprintf(deltaname, sizeof(deltaname), "%s%s", stat_name, delta_suffix);
| ^
output-json-stats.c:253:21: note: 'snprintf' output 1 or more bytes (assuming 8) into a destination of size 7
253 | snprintf(deltaname, sizeof(deltaname), "%s%s", stat_name, delta_suffix);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
output-json-stats.c:314:69: warning: 'snprintf' output may be truncated before the last format character [-Wformat-truncation=]
314 | snprintf(deltaname, sizeof(deltaname), "%s%s", stat_name, delta_suffix);
| ^
output-json-stats.c:314:25: note: 'snprintf' output 1 or more bytes (assuming 8) into a destination of size 7
314 | snprintf(deltaname, sizeof(deltaname), "%s%s", stat_name, delta_suffix);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Ticket: #7905.
This appears to be a FP. Work around it to allow for using this warning
as an error.
output-json-alert.c: In function 'AlertJsonReference':
output-json-alert.c:188:44: warning: '%s' directive output may be truncated writing likely 1 or more bytes into a region of size between 0 and 1 [-Wformat-truncation=]
188 | snprintf(kv_store, size_needed, "%s%s", kv->key, kv->reference);
| ^~
output-json-alert.c:188:41: note: assuming directive output of 1 byte
188 | snprintf(kv_store, size_needed, "%s%s", kv->key, kv->reference);
| ^~~~~~
output-json-alert.c:188:9: note: 'snprintf' output 1 or more bytes (assuming 3) into a destination of size 1
188 | snprintf(kv_store, size_needed, "%s%s", kv->key, kv->reference);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Ticket: #7905.
Jeff Lucovsky
Victor Julien
Juliana Fajardini
Lukas Sismis
Philippe Antoine
Jason Ish
Philippe Antoine
dependabot[bot]