next/1382/20260610/v1

.github/workflows/authors.yml

@@ -1,9 +1,16 @@
 name: New Authors Check
 
+# pull_request_target runs with base-repo permissions (including write) even
+# for fork PRs, allowing us to post a comment directly without the artifact
+# hand-off to a second workflow_run workflow.
+#
+# Only git history is read here — no PR code is built or executed — so
+# checking out the PR head SHA is safe under pull_request_target.
 on:
-  pull_request:
+  pull_request_target:
 
-permissions: read-all
+permissions:
+  pull-requests: write
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -36,13 +43,17 @@ jobs:
                  echo has_new_authors="yes" >> $GITHUB_ENV
              fi
           done < commit-authors.txt
-      - run: mkdir new-authors
-      - run: cp new-authors.txt new-authors
-      - run: echo ${{ github.event.number }} > new-authors/pr-number.txt
-      - run: ls -l
-      - name: Upload new authors
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+      - name: Comment on PR
+        if: ${{ env.has_new_authors == 'yes' }}
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3
         with:
-          name: new-authors
-          path: new-authors
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            let msg = 'NOTE: This PR may contain new authors.';
+            await github.rest.issues.createComment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+              body: msg
+            });
 

.github/workflows/builds.yml

@@ -918,7 +918,7 @@ jobs:
           name: coverage-lcov-${{ github.job }}
           path: coverage.lcov
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f
         with:
           fail_ci_if_error: false
           files: coverage.lcov
@@ -1631,7 +1631,7 @@ jobs:
           name: coverage-lcov-${{ github.job }}
           path: coverage.lcov
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f
         with:
           fail_ci_if_error: false
           files: coverage.lcov
@@ -1743,7 +1743,7 @@ jobs:
           name: coverage-lcov-${{ github.job }}
           path: coverage.lcov
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f
         with:
           fail_ci_if_error: false
           files: coverage.lcov
@@ -1894,7 +1894,7 @@ jobs:
           name: coverage-lcov-${{ github.job }}
           path: coverage.lcov
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f
         with:
           fail_ci_if_error: false
           files: coverage.lcov
@@ -2138,7 +2138,7 @@ jobs:
           name: coverage-lcov-${{ github.job }}
           path: coverage.lcov
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f
         with:
           fail_ci_if_error: true
           files: coverage.lcov
@@ -2356,7 +2356,7 @@ jobs:
           name: coverage-lcov-${{ github.job }}
           path: coverage.lcov
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f
         with:
           fail_ci_if_error: false
           files: coverage.lcov

.github/workflows/codeql.yml

@@ -42,7 +42,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v4.36.1
+      uses: github/codeql-action/init@v4.36.2
       with:
         languages: ${{ matrix.language }}
         queries: security-extended
@@ -62,4 +62,4 @@ jobs:
        ./configure --enable-warnings --enable-unittests
        make
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v4.36.1
+      uses: github/codeql-action/analyze@v4.36.2

.github/workflows/codeqlpy.yml

@@ -43,7 +43,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v4.36.1
+      uses: github/codeql-action/init@v4.36.2
       with:
         languages: ${{ matrix.language }}
         queries: security-extended
@@ -64,4 +64,4 @@ jobs:
        ./configure --enable-warnings
        make
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v4.36.1
+      uses: github/codeql-action/analyze@v4.36.2

.github/workflows/scorecards-analysis.yml

@@ -51,6 +51,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload SARIF results"
-        uses: github/codeql-action/upload-sarif@8ed7f7c384ef65d96d422e33fe592d3572522558 # v1
+        uses: github/codeql-action/upload-sarif@eda5730a8bfb740e03a28087a958444c646e5842 # v1
         with:
           sarif_file: results.sarif

doc/userguide/rules/index.rst

@@ -33,6 +33,7 @@ Suricata Rules
    base64-keywords
    sip-keywords
    sdp-keywords
+   sctp-keywords
    rfb-keywords
    mqtt-keywords
    ike-keywords

doc/userguide/rules/sctp-keywords.rst

@@ -0,0 +1,150 @@
+.. role:: example-rule-emphasis
+
+SCTP Keywords
+=============
+
+Suricata supports sticky buffers and keywords for matching on SCTP
+packet headers, chunks, and metadata.
+
+Sticky buffers are expected to be followed by one or more
+:doc:`payload-keywords`.
+
+sctp.hdr
+--------
+
+Sticky buffer to match on the raw SCTP header and all chunks.
+
+Example rule:
+
+.. container:: example-rule
+
+    alert sctp any any -> any any (msg:"SCTP header match"; :example-rule-emphasis:`sctp.hdr; content:"|01|"; offset:8; depth:1;` sid:1; rev:1;)
+
+``sctp.hdr`` is a 'sticky buffer'.
+
+``sctp.hdr`` can be used as ``fast_pattern``.
+
+sctp.chunk_data
+---------------
+
+Sticky buffer to match on any SCTP DATA chunk user payload.
+
+When a packet contains DATA chunks, the packet payload (``p->payload``)
+is set to the user data of the first DATA chunk. A bare ``content``
+match (without a sticky buffer) therefore inspects the first DATA
+chunk's payload. Use ``sctp.chunk_data`` to inspect all DATA chunks
+independently.
+
+Example rule:
+
+.. container:: example-rule
+
+    alert sctp any any -> any any (msg:"SCTP DATA payload match"; :example-rule-emphasis:`sctp.chunk_data; content:"test";` sid:2; rev:1;)
+
+``sctp.chunk_data`` is a 'sticky buffer'.
+
+``sctp.chunk_data`` can be used as ``fast_pattern``.
+
+sctp.vtag
+---------
+
+Match on the SCTP verification tag field in the common header.
+
+sctp.vtag uses an :ref:`unsigned 32-bit integer <rules-integer-keywords>`.
+
+Syntax::
+
+ sctp.vtag:[op]<number>
+
+The verification tag can be matched exactly, or compared using the _op_ setting::
+
+ sctp.vtag:12345         # exactly 12345
+ sctp.vtag:>0            # greater than 0
+ sctp.vtag:100-200       # range 100 to 200
+
+Example rule:
+
+.. container:: example-rule
+
+    alert sctp any any -> any any (msg:"SCTP vtag match"; :example-rule-emphasis:`sctp.vtag:0;` sid:3; rev:1;)
+
+sctp.chunk_type
+---------------
+
+Match on the type of any SCTP chunk in the packet.
+
+sctp.chunk_type uses an :ref:`unsigned 8-bit integer <rules-integer-keywords>`.
+
+Syntax::
+
+ sctp.chunk_type:[!]<value>
+ sctp.chunk_type:[op]<number>
+
+Values can be specified by name or by numeric value. The following
+named chunk types are supported:
+
+================= =====
+Name              Value
+================= =====
+data              0
+init              1
+init_ack          2
+sack              3
+heartbeat         4
+hb_ack            5
+abort             6
+shutdown          7
+shutdown_ack      8
+error             9
+cookie_echo       10
+cookie_ack        11
+ecne              12
+cwr               13
+shutdown_complete 14
+forward_tsn       192
+================= =====
+
+Named values are case-insensitive and can be negated with ``!``::
+
+ sctp.chunk_type:init          # INIT chunk
+ sctp.chunk_type:init_ack      # INIT ACK chunk
+ sctp.chunk_type:!data         # any chunk that is not DATA
+
+Numeric values support comparison operators and ranges::
+
+ sctp.chunk_type:1             # INIT chunk (type 1)
+ sctp.chunk_type:0-4           # range 0 to 4
+
+Example rules:
+
+.. container:: example-rule
+
+    alert sctp any any -> any any (msg:"SCTP INIT chunk detected"; :example-rule-emphasis:`sctp.chunk_type:init;` sid:4; rev:1;)
+
+.. container:: example-rule
+
+    alert sctp any any -> any any (msg:"SCTP INIT chunk detected"; :example-rule-emphasis:`sctp.chunk_type:1;` sid:5; rev:1;)
+
+sctp.chunk_cnt
+--------------
+
+Match on the number of SCTP chunks in the packet.
+
+sctp.chunk_cnt uses an :ref:`unsigned 8-bit integer <rules-integer-keywords>`.
+
+Syntax::
+
+ sctp.chunk_cnt:[op]<number>
+
+The chunk count can be matched exactly, or compared using the _op_ setting::
+
+ sctp.chunk_cnt:1        # exactly 1 chunk
+ sctp.chunk_cnt:>3       # more than 3 chunks
+ sctp.chunk_cnt:2-5      # range 2 to 5
+
+Example rule:
+
+.. container:: example-rule
+
+    alert sctp any any -> any any (msg:"SCTP packet with multiple chunks"; :example-rule-emphasis:`sctp.chunk_cnt:>1;` sid:5; rev:1;)
+