next/1402/70x/20260622/v1

doc/userguide/rules/flow-keywords.rst

@@ -27,6 +27,9 @@ flowbits: isset, name
 flowbits: toggle, name
   Reverses the present setting. So for example if a condition is set,
   it will be unset and vice-versa.
+
+  .. deprecated:: 7.0.17
+     The ``toggle`` command is deprecated and will be removed in Suricata 9.0.
 flowbits: unset, name
   Can be used to unset the condition in the flow.
 flowbits: isnotset, name
@@ -305,4 +308,4 @@ Signature example::
 
  alert tcp any any -> any any (msg:"Flow longer than one hour"; flow.age:>3600; flowbits: isnotset, onehourflow; flowbits: onehourflow, name; sid:1; rev:1;)
 
-In this example, we combine `flow.age` and `flowbits` to get an alert on the first packet after the flow's age is older than one hour.
+In this example, we combine `flow.age` and `flowbits` to get an alert on the first packet after the flow's age is older than one hour.

doc/userguide/upgrade.rst

@@ -34,6 +34,15 @@ also check all the new features that have been added but are not covered by
 this guide. Those features are either not enabled by default or require
 dedicated new configuration.
 
+Upgrading to 7.0.17
+-------------------
+
+Deprecations
+~~~~~~~~~~~~~
+
+- The ``flowbits`` ``toggle`` command is now deprecated and will be removed in
+  Suricata 9.0.
+
 Upgrading to 7.0.14
 -------------------
 

rust/cbindgen.toml

@@ -112,6 +112,7 @@ exclude = [
     "IPPROTO_TCP",
     "IPPROTO_UDP",
     "SRepCatGetByShortname",
+    "DETECT_BYTEMATH_ENDIAN_DEFAULT",
 ]
 
 # Types of items that we'll generate. If empty, then all types of item are emitted.

src/detect-flowbits.c

@@ -301,6 +301,11 @@ int DetectFlowbitSetup (DetectEngineCtx *de_ctx, Signature *s, const char *rawst
         fb_cmd = DETECT_FLOWBITS_CMD_UNSET;
     } else if (strcmp(fb_cmd_str,"toggle") == 0) {
         fb_cmd = DETECT_FLOWBITS_CMD_TOGGLE;
+        if ((de_ctx->flags & DE_WARN_FLOWBITS_TOGGLE_DEPRECATION) == 0) {
+            de_ctx->flags |= DE_WARN_FLOWBITS_TOGGLE_DEPRECATION;
+            SCLogWarning("flowbits \"toggle\" command is deprecated and will be removed in "
+                         "Suricata 9 (see ticket #8595)");
+        }
     } else {
         SCLogError("ERROR: flowbits action \"%s\" is not supported.", fb_cmd_str);
         goto error;

src/detect-pcre.c

@@ -641,6 +641,21 @@ static DetectPcreData *DetectPcreParse (DetectEngineCtx *de_ctx,
     if (capture_names == NULL || strlen(capture_names) == 0)
         opts |= PCRE2_NO_AUTO_CAPTURE;
 
+#ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
+    // forbid use of \X Unicode extended grapheme cluster as slow
+    bool escape = false;
+    for (size_t i = 0; i < strlen(re); i++) {
+        if (escape) {
+            if (re[i] == 'X') {
+                goto error;
+            }
+            escape = false;
+        } else if (re[i] == '\\') {
+            escape = true;
+        }
+    }
+
+#endif
     pd->parse_regex.regex =
             pcre2_compile((PCRE2_SPTR8)re, PCRE2_ZERO_TERMINATED, opts, &en, &eo2, NULL);
     if (pd->parse_regex.regex == NULL && en == 115) { // reference to nonexistent subpattern

src/detect.h

@@ -323,6 +323,7 @@ typedef struct DetectPort_ {
 
 /* Detection Engine flags */
 #define DE_QUIET           0x01     /**< DE is quiet (esp for unittests) */
+#define DE_WARN_FLOWBITS_TOGGLE_DEPRECATION 0x02
 
 typedef struct IPOnlyCIDRItem_ {
     /* address data for this item */

src/win32-service.c

@@ -219,18 +219,29 @@ int SCServiceInstall(int argc, char **argv)
     do {
         memset(path, 0, sizeof(path));
 
-        if (GetModuleFileName(NULL, path, MAX_PATH) == 0 ){
+        path[0] = '"';
+        if (GetModuleFileName(NULL, path + 1, sizeof(path) - 1) == 0) {
             SCLogError("Can't get path to service binary: %d", (int)GetLastError());
             break;
         }
+        if (strlcat(path, "\"", sizeof(path)) >= sizeof(path)) {
+            SCLogError("failed to construct service path string: path truncated: %s", path);
+            break;
+        }
 
         /* skip name of binary itself */
         for (i = 1; i < argc; i++) {
             if ((strlen(argv[i]) <= strlen("--service-install")) && (strncmp("--service-install", argv[i], strlen(argv[i])) == 0)) {
                 continue;
             }
-            strlcat(path, " ", sizeof(path) - strlen(path) - 1);
-            strlcat(path, argv[i], sizeof(path) - strlen(path) - 1);
+            if (strlcat(path, " ", sizeof(path)) >= sizeof(path)) {
+                SCLogError("failed to construct service path string: path truncated: %s", path);
+                return -1;
+            }
+            if (strlcat(path, argv[i], sizeof(path)) >= sizeof(path)) {
+                SCLogError("failed to construct service path string: path truncated: %s", path);
+                return -1;
+            }
         }
 
         if ((scm = OpenSCManager(NULL, NULL, SC_MANAGER_ALL_ACCESS)) == NULL) {
@@ -344,18 +355,29 @@ int SCServiceChangeParams(int argc, char **argv)
     do {
         memset(path, 0, sizeof(path));
 
-        if (GetModuleFileName(NULL, path, MAX_PATH) == 0 ){
+        path[0] = '"';
+        if (GetModuleFileName(NULL, path + 1, sizeof(path) - 1) == 0) {
             SCLogError("Can't get path to service binary: %d", (int)GetLastError());
             break;
         }
+        if (strlcat(path, "\"", sizeof(path)) >= sizeof(path)) {
+            SCLogError("failed to construct service path string: path truncated: %s", path);
+            break;
+        }
 
         /* skip name of binary itself */
         for (i = 1; i < argc; i++) {
             if ((strlen(argv[i]) <= strlen("--service-change-params")) && (strncmp("--service-change-params", argv[i], strlen(argv[i])) == 0)) {
                 continue;
             }
-            strlcat(path, " ", sizeof(path) - strlen(path) - 1);
-            strlcat(path, argv[i], sizeof(path) - strlen(path) - 1);
+            if (strlcat(path, " ", sizeof(path)) >= sizeof(path)) {
+                SCLogError("failed to construct service path string: path truncated: %s", path);
+                return -1;
+            }
+            if (strlcat(path, argv[i], sizeof(path)) >= sizeof(path)) {
+                SCLogError("failed to construct service path string: path truncated: %s", path);
+                return -1;
+            }
         }
 
         if ((scm = OpenSCManager(NULL, NULL, SC_MANAGER_ALL_ACCESS)) == NULL) {