next/1383/20260610/v1 - #15601
Merged
Merged
Conversation
Ticket: 8385 Add a new match subdomain option that enables blocking a domain and all its subdomains using datasets.
Ticket: 3836
Ticket: 3836
Guard DT_REG usage so directory walking code still builds on platforms where dirent does not expose d_type or DT_REG, such as Solaris.
Replace uses of the non-standard sun macro with __sun and use Solaris byte swap helpers from <sys/byteorder.h>. This keeps the Solaris-specific code paths reachable when building with standard-conforming toolchains.
Skip tm_gmtoff and tm_zone initialization on Solaris where those struct tm members are not available.
Only expose the ftp facility when the platform syslog headers define LOG_FTP.
Call a SPARC-specific helper during pre-init so the kernel emulates unaligned accesses for this process instead of terminating on alignment faults. This matches the Solaris/SPARC portability fix that motivated the original patch.
Only use RLIMIT_NPROC when the platform exposes that resource limit constant.
Extend the SCTP decoder to parse chunk headers after the 12-byte common header. Each chunk is validated for minimum header size and length consistency per RFC 4960 sec 3.2. Add SCTPChunkHdr and SCTPVars structs to track per-packet chunk metadata Add five new decoder events for protocol violations: - SCTP_CHUNK_TOO_SMALL: insufficient data for a chunk header - SCTP_CHUNK_LEN_INVALID: chunk length < 4 or exceeds packet - SCTP_INIT_CHUNK_NOT_ALONE: INIT/INIT_ACK bundled (RFC 4960 sec 6.10) - SCTP_INIT_WITH_NON_ZERO_VTAG: INIT with vtag != 0 (RFC 4960 sec 8.5.1) - SCTP_DATA_WITH_ZERO_VTAG: DATA chunk with vtag == 0 Ticket OISF#4251
Implement a sticky buffer to match the raw SCTP header (common header + chunks) Ticket OISF#4251
Add a U8 numeric keyword to match the first SCTP chunk type in a packet with prefilter support. Ticket OISF#4251
Add a U8 numeric keyword to match the number of SCTP chunks parsed in a packet with prefilter support. Ticket OISF#4251
Add a U32 numeric keyword to match the SCTP verification tag from the common header with prefilter support. Ticket OISF#4251
Log SCTP-specific fields in the EVE JSON "sctp" object for alert events. Ticket OISF#4251
Track the first DATA chunk's data offset and length during chunk iteration, then reassign p->payload to point at the user data. When no DATA chunk is present (INIT, SACK, HEARTBEAT, etc.), payload_len is set to 0 since there is no application data. Ticket OISF#4251
Add a sctp.data sticky multi-buffer that allows content matching on the bytes inside any of the SCTP DATA chunks extracted. Ticket OISF#4251
Add documentation for all sctp keywords. Ticket OISF#4251
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.36.1 to 4.36.2. - [Release notes](https://github.com/github/codeql-action/releases) - [Commits](github/codeql-action@v4.36.1...v4.36.2) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.36.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 6.0.1 to 7.0.0. - [Release notes](https://github.com/codecov/codecov-action/releases) - [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md) - [Commits](codecov/codecov-action@e79a696...fb8b358) --- updated-dependencies: - dependency-name: codecov/codecov-action dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
When Redis output is configured in stream/xadd mode with a positive stream-maxlen, SCConfLogOpenRedis() allocates redis_setup.stream_format and immediately passes it to snprintf(). If SCCalloc() fails, snprintf() receives a NULL destination pointer and the process can crash during Redis output initialization. Handle this unrecoverable setup failure with FatalError(), matching the surrounding Redis initialization error handling. Ticket: 8588
SCStrdup result was stored and immediately used without checking for NULL, which would cause a NULL dereference if allocation fails.
The original pointer was overwritten with the SCRealloc result before checking for NULL, causing a memory leak if reallocation fails. Check the temporary pointer first before assigning.
Two SCStrdup calls that set ref->key had no NULL check. On allocation failure the pointer would be used immediately, causing a NULL dereference.
Two fixes: - Remove extra parentheses in existing NULL check: (*ext) -> *ext, which was causing the cocci script to miss the check as a false negative. - Simplify SCHSConfigInit to return SCCalloc() directly; the caller in detect-engine.c already checks the return value for NULL.
If SCCalloc fails, decoded is NULL and the subsequent SCBase64Decode call would dereference it. Return early on allocation failure.
Coccinelle uses OCaml Str, not PCRE. The '|' and '()' characters are literals in OCaml Str, so 'identifier func =~ "(SCMalloc|SCCalloc|...)"' never matched anything — making the entire script a no-op since its introduction. Replace all five patterns with OCaml Str alternation syntax 'A\|B'. Ticket: 8641
PacketAlertCreate is called from PacketInit on the packet allocation path. Make PacketInit return bool and propagate the NULL result from PacketAlertCreate up through PacketGetFromAlloc, which already returns NULL to signal allocation failure to its callers. Update the UNITTESTS-only helpers in defrag.c accordingly: helpers returning Packet * use an explicit NULL check; the one returning int keeps the existing FAIL_IF style.
Add DEBUG_VALIDATE_BUG_ON() at four sites in DetectEngineSignatureIsDuplicate() where HashListTableLookup() is assumed to return non-NULL. Documents the invariant that every Signature in sig_list has a dup_sig_hash_table entry and catches violations in debug builds. Flagged by Svace static analyzer. Ticket: 8635
To fetch hook name from app-layer, or use built-ins.
LTE support depended on registered hook names, but did not support the built-in names. This commit adds the support. Ticket: OISF#8645.
victorjulien
requested review from
a team,
jasonish and
jufajardini
as code owners
June 11, 2026 00:30
|
NOTE: This PR may contain new authors. |
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## main #15601 +/- ##
========================================
Coverage 82.88% 82.89%
========================================
Files 999 1006 +7
Lines 272613 273487 +874
========================================
+ Hits 225968 226710 +742
- Misses 46645 46777 +132
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
jufajardini
reviewed
Jun 11, 2026
|
|
||
| .. container:: example-rule | ||
|
|
||
| reject dns any any -> any any (msg:"Blocked domain"; dns.query; dotprefix; dataset:isset,blocked-domains, type string, match subdomain, load blocked-domains.lst; sid:8000003; rev:1;) |
Contributor
There was a problem hiding this comment.
This is leading to a CI failure for Check rules doc: Error: detect-dataset: failed to set up dataset 'blocked-domains'. [DetectDatasetSetup:detect-dataset.c:640]
Contributor
There was a problem hiding this comment.
Commented on the PR as well...
Contributor
|
Consistent with the approved PRs, but the dataset doc rule addition is failing... |
|
WARNING:
Pipeline = 31952 |
jasonish
approved these changes
Jun 11, 2026
jasonish
left a comment
jasonish
left a comment
Member
There was a problem hiding this comment.
Staging looks OK; just that CI failure in documentation validation that will need some fixing.
This was referenced Jun 11, 2026
Closed
Closed
5 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
10 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Staging:
SV_BRANCH=OISF/suricata-verify#3157