next/1383/20260610/v1

.github/workflows/builds.yml

@@ -918,7 +918,7 @@ jobs:
           name: coverage-lcov-${{ github.job }}
           path: coverage.lcov
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f
         with:
           fail_ci_if_error: false
           files: coverage.lcov
@@ -1631,7 +1631,7 @@ jobs:
           name: coverage-lcov-${{ github.job }}
           path: coverage.lcov
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f
         with:
           fail_ci_if_error: false
           files: coverage.lcov
@@ -1743,7 +1743,7 @@ jobs:
           name: coverage-lcov-${{ github.job }}
           path: coverage.lcov
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f
         with:
           fail_ci_if_error: false
           files: coverage.lcov
@@ -1894,7 +1894,7 @@ jobs:
           name: coverage-lcov-${{ github.job }}
           path: coverage.lcov
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f
         with:
           fail_ci_if_error: false
           files: coverage.lcov
@@ -2138,7 +2138,7 @@ jobs:
           name: coverage-lcov-${{ github.job }}
           path: coverage.lcov
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f
         with:
           fail_ci_if_error: true
           files: coverage.lcov
@@ -2356,7 +2356,7 @@ jobs:
           name: coverage-lcov-${{ github.job }}
           path: coverage.lcov
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f
         with:
           fail_ci_if_error: false
           files: coverage.lcov

.github/workflows/codeql.yml

@@ -42,7 +42,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v4.36.1
+      uses: github/codeql-action/init@v4.36.2
       with:
         languages: ${{ matrix.language }}
         queries: security-extended
@@ -62,4 +62,4 @@ jobs:
        ./configure --enable-warnings --enable-unittests
        make
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v4.36.1
+      uses: github/codeql-action/analyze@v4.36.2

.github/workflows/codeqlpy.yml

@@ -43,7 +43,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v4.36.1
+      uses: github/codeql-action/init@v4.36.2
       with:
         languages: ${{ matrix.language }}
         queries: security-extended
@@ -64,4 +64,4 @@ jobs:
        ./configure --enable-warnings
        make
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v4.36.1
+      uses: github/codeql-action/analyze@v4.36.2

.github/workflows/scorecards-analysis.yml

@@ -51,6 +51,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload SARIF results"
-        uses: github/codeql-action/upload-sarif@8ed7f7c384ef65d96d422e33fe592d3572522558 # v1
+        uses: github/codeql-action/upload-sarif@eda5730a8bfb740e03a28087a958444c646e5842 # v1
         with:
           sarif_file: results.sarif

doc/userguide/rules/datasets.rst

@@ -81,7 +81,7 @@ Syntax::
     dataset:<set|unset|isset|isnotset>,<name> \
         [, type <string|md5|sha256|ipv4|ip>, save <file name>, load <file name>, state <file name>, memcap <size>, hashsize <size>
          , format <csv|json|ndjson>, context_key <output_key>, value_key <json_key>, array_key <json_path>,
-         remove_key];
+         remove_key, match subdomain];
 
 type <type>
   the data type: string, md5, sha256, ipv4, ip
@@ -112,7 +112,11 @@ array_key <key>
 remove_key
   if set, the JSON object pointed by value key will be removed
   from the alert event
-
+match subdomain
+  if set to ``subdomain``, enables hierarchical domain matching.
+  On lookup, the dataset walks up the domain label hierarchy until
+  a match is found. Only valid with ``isset``/``isnotset`` commands
+  and ``type string``. Best used with the ``dotprefix`` transform.
 
 .. note:: 'type' is mandatory and needs to be set.
 
@@ -137,6 +141,28 @@ on domain names to find TLDs in the dataset ``dns-tld-seen``:
 
 .. image:: dataset-examples/detect-unique-tlds.png
 
+3. Block domains and all their subdomains using a blocklist dataset:
+
+.. container:: example-rule
+
+    reject dns any any -> any any (msg:"Blocked domain"; dns.query; dotprefix; dataset:isset,blocked-domains, type string, match subdomain, load blocked-domains.lst; sid:8000003; rev:1;)
+
+The ``match subdomain`` option walks up the domain hierarchy on each
+lookup. Combined with ``dotprefix``, a query for ``mail.evil.com``
+becomes ``.mail.evil.com`` and is checked against the dataset as:
+``.mail.evil.com``, ``.evil.com``, ``.com``. If ``.evil.com`` is in the
+dataset, the rule matches.
+
+The dataset file should contain entries with a leading dot::
+
+    LmV2aWwuY29tCg==
+
+which is the base64 encoding of ``.evil.com``.
+
+When using ``ndjson`` format, use the raw dotted value in the JSON::
+
+    {"domain": ".evil.com"}
+
 Notice how it is not possible to do certain operations alone with datasets
 (example 2 above), but, it is possible to use a combination of other rule
 keywords. Keep in mind the cost of additional keywords though e.g. in the
@@ -184,7 +210,7 @@ Syntax::
 
     dataset:<isset|isnotset>,<name> \
         [, type <string|md5|sha256|ipv4|ip>, load <file name>, format <json|ndjson>, memcap <size>, hashsize <size>, context_key <json_key> \
-         , value_key <json_key>, array_key <json_path>];
+         , value_key <json_key>, array_key <json_path>, match subdomain];
 
 Example rules could look like::
 

doc/userguide/rules/index.rst

@@ -33,6 +33,7 @@ Suricata Rules
    base64-keywords
    sip-keywords
    sdp-keywords
+   sctp-keywords
    rfb-keywords
    mqtt-keywords
    ike-keywords

doc/userguide/rules/sctp-keywords.rst

@@ -0,0 +1,150 @@
+.. role:: example-rule-emphasis
+
+SCTP Keywords
+=============
+
+Suricata supports sticky buffers and keywords for matching on SCTP
+packet headers, chunks, and metadata.
+
+Sticky buffers are expected to be followed by one or more
+:doc:`payload-keywords`.
+
+sctp.hdr
+--------
+
+Sticky buffer to match on the raw SCTP header and all chunks.
+
+Example rule:
+
+.. container:: example-rule
+
+    alert sctp any any -> any any (msg:"SCTP header match"; :example-rule-emphasis:`sctp.hdr; content:"|01|"; offset:8; depth:1;` sid:1; rev:1;)
+
+``sctp.hdr`` is a 'sticky buffer'.
+
+``sctp.hdr`` can be used as ``fast_pattern``.
+
+sctp.chunk_data
+---------------
+
+Sticky buffer to match on any SCTP DATA chunk user payload.
+
+When a packet contains DATA chunks, the packet payload (``p->payload``)
+is set to the user data of the first DATA chunk. A bare ``content``
+match (without a sticky buffer) therefore inspects the first DATA
+chunk's payload. Use ``sctp.chunk_data`` to inspect all DATA chunks
+independently.
+
+Example rule:
+
+.. container:: example-rule
+
+    alert sctp any any -> any any (msg:"SCTP DATA payload match"; :example-rule-emphasis:`sctp.chunk_data; content:"test";` sid:2; rev:1;)
+
+``sctp.chunk_data`` is a 'sticky buffer'.
+
+``sctp.chunk_data`` can be used as ``fast_pattern``.
+
+sctp.vtag
+---------
+
+Match on the SCTP verification tag field in the common header.
+
+sctp.vtag uses an :ref:`unsigned 32-bit integer <rules-integer-keywords>`.
+
+Syntax::
+
+ sctp.vtag:[op]<number>
+
+The verification tag can be matched exactly, or compared using the _op_ setting::
+
+ sctp.vtag:12345         # exactly 12345
+ sctp.vtag:>0            # greater than 0
+ sctp.vtag:100-200       # range 100 to 200
+
+Example rule:
+
+.. container:: example-rule
+
+    alert sctp any any -> any any (msg:"SCTP vtag match"; :example-rule-emphasis:`sctp.vtag:0;` sid:3; rev:1;)
+
+sctp.chunk_type
+---------------
+
+Match on the type of any SCTP chunk in the packet.
+
+sctp.chunk_type uses an :ref:`unsigned 8-bit integer <rules-integer-keywords>`.
+
+Syntax::
+
+ sctp.chunk_type:[!]<value>
+ sctp.chunk_type:[op]<number>
+
+Values can be specified by name or by numeric value. The following
+named chunk types are supported:
+
+================= =====
+Name              Value
+================= =====
+data              0
+init              1
+init_ack          2
+sack              3
+heartbeat         4
+hb_ack            5
+abort             6
+shutdown          7
+shutdown_ack      8
+error             9
+cookie_echo       10
+cookie_ack        11
+ecne              12
+cwr               13
+shutdown_complete 14
+forward_tsn       192
+================= =====
+
+Named values are case-insensitive and can be negated with ``!``::
+
+ sctp.chunk_type:init          # INIT chunk
+ sctp.chunk_type:init_ack      # INIT ACK chunk
+ sctp.chunk_type:!data         # any chunk that is not DATA
+
+Numeric values support comparison operators and ranges::
+
+ sctp.chunk_type:1             # INIT chunk (type 1)
+ sctp.chunk_type:0-4           # range 0 to 4
+
+Example rules:
+
+.. container:: example-rule
+
+    alert sctp any any -> any any (msg:"SCTP INIT chunk detected"; :example-rule-emphasis:`sctp.chunk_type:init;` sid:4; rev:1;)
+
+.. container:: example-rule
+
+    alert sctp any any -> any any (msg:"SCTP INIT chunk detected"; :example-rule-emphasis:`sctp.chunk_type:1;` sid:5; rev:1;)
+
+sctp.chunk_cnt
+--------------
+
+Match on the number of SCTP chunks in the packet.
+
+sctp.chunk_cnt uses an :ref:`unsigned 8-bit integer <rules-integer-keywords>`.
+
+Syntax::
+
+ sctp.chunk_cnt:[op]<number>
+
+The chunk count can be matched exactly, or compared using the _op_ setting::
+
+ sctp.chunk_cnt:1        # exactly 1 chunk
+ sctp.chunk_cnt:>3       # more than 3 chunks
+ sctp.chunk_cnt:2-5      # range 2 to 5
+
+Example rule:
+
+.. container:: example-rule
+
+    alert sctp any any -> any any (msg:"SCTP packet with multiple chunks"; :example-rule-emphasis:`sctp.chunk_cnt:>1;` sid:5; rev:1;)
+