Dataset match subdomain/v2

[antoineaboufayssal]

Previously #15058

Contribution style:

• I have read the contributing guide lines at
  https://docs.suricata.io/en/latest/devguide/contributing/contribution-process.html

Our Contribution agreements:

• I have signed the Open Information Security Foundation contribution agreement at
  https://suricata.io/about/contribution-agreement/ (note: this is only required once)

Changes (if applicable):

• I have updated the User Guide (in doc/userguide/) to reflect the changes made
• I have created a ticket at
  https://redmine.openinfosecfoundation.org/projects/suricata/issues

Link to ticket: https://redmine.openinfosecfoundation.org/issues/8385

Describe changes:

• add match subdomain option for datasets

SV_BRANCH=OISF/suricata-verify#2979

[codecov]

Codecov Report

❌ Patch coverage is 76.08696% with 11 lines in your changes missing coverage. Please review.
✅ Project coverage is 82.60%. Comparing base (6587e36) to head (4bff9c5).

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #15073   +/-   ##
=======================================
  Coverage   82.59%   82.60%           
=======================================
  Files         990      990           
  Lines      271761   271806   +45     
=======================================
+ Hits       224465   224522   +57     
+ Misses      47296    47284   -12     

Flag	Coverage Δ
fuzzcorpus	61.02% <17.39%> (-0.01%)	⬇️
livemode	18.35% <10.86%> (-0.02%)	⬇️
netns	18.35% <0.00%> (-0.02%)	⬇️
pcap	45.22% <0.00%> (-0.04%)	⬇️
suricata-verify	66.13% <76.08%> (-0.01%)	⬇️
unittests	58.82% <0.00%> (-0.02%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[catenacyber]

Thanks for the work

CI : ✅
Code : good
Commits segmentation : I would squash but ok
Commit messages : nice
Git ID set : looks fine for me
CLA : you already contributed
Doc update : ok
Redmine ticket : ok
Rustfmt : no rust
Tests : cool
Dependencies added: none

[catenacyber]

So, where did you find this constant ?

[antoineaboufayssal]

A valid domain name is limited to 253 bytes (whether it's dns, http host, tls sni, ...), giving at most 126 labels (1 char + 1 dot per label). Buffers like http.host are not length enforced, but anything beyond that limit is malformed or malicious and shouldn't match the dataset entry.

[catenacyber]

Cool

A valid domain name is limited to 253 bytes

Where did you find this ?

[antoineaboufayssal]

RFC 1035 defines it for DNS. (it's actually 255 bytes but a length byte and a null terminator byte are needed, hence the 253)

So maybe my statement up there wasn't 100% accurate :) While an http.host can exceed the 253 limit, it would not be a "globally resolvable domain". Perhaps used for an internal/private network?

[antoineaboufayssal]

@victorjulien @catenacyber any updates on this?

also would it be possible to backport it?

[catenacyber]

Thanks for your work, it is fine for me. We are waiting on Victor's review...

[jufajardini]

This is leading to a CI failure for Check rules doc: Error: detect-dataset: failed to set up dataset 'blocked-domains'. [DetectDatasetSetup:detect-dataset.c:640]

https://github.com/OISF/suricata/actions/runs/27315514634/job/80695160734?pr=15601#step:22:12

[antoineaboufayssal]

Is it because of load blocked-domains.lst? It's trying to find the file relative to the path of the rule file itself. Examples 1 and 2 use state instead of load.

[victorjulien]

I think this just may show a limitation of the check. I don't think it is aware of how datasets needs a file to load here. I'd say the check is wrong, not this doc example.

[catenacyber]

Here is a fix #15605

[victorjulien]

Merged in #15601, thanks!

[jufajardini]

@victorjulien @catenacyber any updates on this?

also would it be possible to backport it?

Hi @antoineaboufayssal if you could prepare a backport patch for this so we can review and test, we'll consider backporting it :)

[antoineaboufayssal]

Hi @antoineaboufayssal if you could prepare a backport patch for this so we can review and test, we'll consider backporting it :)

done! #16024