Next/20221122/v4

.github/workflows/builds.yml

@@ -38,11 +38,6 @@ jobs:
     name: Prepare dependencies
     runs-on: ubuntu-latest
     steps:
-      - name: Cache ~/.cargo
-        uses: actions/cache@9b0c1fce7a93df8e3bb8926b0d6e9d89e92f20a7
-        with:
-          path: ~/.cargo
-          key: cargo
       - run: sudo apt update && sudo apt -y install jq curl
       - name: Parse repo and branch information
         env:
@@ -126,7 +121,7 @@ jobs:
         uses: actions/cache@9b0c1fce7a93df8e3bb8926b0d6e9d89e92f20a7
         with:
           path: ~/.cargo
-          key: cbindgen
+          key: ${{ github.job }}-cargo
       - name: Installing Rust
         run: |
           curl https://sh.rustup.rs -sSf | sh -s -- -y
@@ -152,8 +147,15 @@ jobs:
       - name: Cache cargo registry
         uses: actions/cache@9b0c1fce7a93df8e3bb8926b0d6e9d89e92f20a7
         with:
-          path: ~/.cargo/registry
-          key: cargo-registry
+          path: ~/.cargo
+          key: ${{ github.job }}-cargo
+
+      - name: Cache RPMs
+        uses: actions/cache@v3
+        with:
+          path: /var/cache/dnf
+          key: ${{ github.job }}-dnf
+      - run: echo "keepcache=1" >> /etc/dnf/dnf.conf
 
       - uses: actions/checkout@v3.1.0
 
@@ -260,8 +262,15 @@ jobs:
       - name: Cache cargo registry
         uses: actions/cache@9b0c1fce7a93df8e3bb8926b0d6e9d89e92f20a7
         with:
-          path: ~/.cargo/registry
-          key: cargo-registry
+          path: ~/.cargo
+          key: ${{ github.job }}-cargo
+
+      - name: Cache RPMs
+        uses: actions/cache@v3
+        with:
+          path: /var/cache/dnf
+          key: ${{ github.job }}-dnf
+      - run: echo "keepcache=1" >> /etc/dnf/dnf.conf
 
       - uses: actions/checkout@v3.1.0
 
@@ -380,6 +389,19 @@ jobs:
     container: centos:7
     needs: [prepare-deps, alma-8]
     steps:
+      - name: Cache ~/.cargo
+        uses: actions/cache@9b0c1fce7a93df8e3bb8926b0d6e9d89e92f20a7
+        with:
+          path: ~/.cargo
+          key: ${{ github.job }}-cargo
+
+      - name: Cache RPMs
+        uses: actions/cache@v3
+        with:
+          path: /var/cache/yum
+          key: ${{ github.job }}-yum
+      - run: echo "keepcache=1" >> /etc/yum.conf
+
       - name: Install system dependencies
         run: |
           yum -y install epel-release
@@ -451,8 +473,15 @@ jobs:
       - name: Cache cargo registry
         uses: actions/cache@9b0c1fce7a93df8e3bb8926b0d6e9d89e92f20a7
         with:
-          path: ~/.cargo/registry
-          key: cargo-registry
+          path: ~/.cargo
+          key: ${{ github.job }}-cargo
+
+      - name: Cache RPMs
+        uses: actions/cache@v3
+        with:
+          path: /var/cache/dnf
+          key: ${{ github.job }}-dnf
+      - run: echo "keepcache=1" >> /etc/dnf/dnf.conf
 
       - run: |
           dnf -y install \
@@ -541,8 +570,15 @@ jobs:
       - name: Cache cargo registry
         uses: actions/cache@9b0c1fce7a93df8e3bb8926b0d6e9d89e92f20a7
         with:
-          path: ~/.cargo/registry
-          key: cargo-registry
+          path: ~/.cargo
+          key: ${{ github.job }}-cargo
+
+      - name: Cache RPMs
+        uses: actions/cache@v3
+        with:
+          path: /var/cache/dnf
+          key: ${{ github.job }}-dnf
+      - run: echo "keepcache=1" >> /etc/dnf/dnf.conf
 
       - run: |
           dnf -y install \
@@ -635,8 +671,15 @@ jobs:
       - name: Cache cargo registry
         uses: actions/cache@9b0c1fce7a93df8e3bb8926b0d6e9d89e92f20a7
         with:
-          path: ~/.cargo/registry
-          key: cargo-registry
+          path: ~/.cargo
+          key: ${{ github.job }}-cargo
+
+      - name: Cache RPMs
+        uses: actions/cache@v3
+        with:
+          path: /var/cache/dnf
+          key: ${{ github.job }}-dnf
+      - run: echo "keepcache=1" >> /etc/dnf/dnf.conf
 
       - run: |
           dnf -y install \
@@ -726,8 +769,15 @@ jobs:
       - name: Cache cargo registry
         uses: actions/cache@9b0c1fce7a93df8e3bb8926b0d6e9d89e92f20a7
         with:
-          path: ~/.cargo/registry
-          key: cargo-registry
+          path: ~/.cargo
+          key: ${{ github.job }}-cargo
+
+      - name: Cache RPMs
+        uses: actions/cache@v3
+        with:
+          path: /var/cache/dnf
+          key: ${{ github.job }}-dnf
+      - run: echo "keepcache=1" >> /etc/dnf/dnf.conf
 
       - run: |
           dnf -y install \
@@ -789,6 +839,11 @@ jobs:
     container: ubuntu:22.04
     needs: [prepare-deps, prepare-cbindgen]
     steps:
+      - name: Cache ~/.cargo
+        uses: actions/cache@9b0c1fce7a93df8e3bb8926b0d6e9d89e92f20a7
+        with:
+          path: ~/.cargo
+          key: ${{ github.job }}-cargo
       - name: Install dependencies
         run: |
           apt update
@@ -901,6 +956,11 @@ jobs:
     container: ubuntu:22.04
     needs: [prepare-deps, prepare-cbindgen]
     steps:
+      - name: Cache ~/.cargo
+        uses: actions/cache@9b0c1fce7a93df8e3bb8926b0d6e9d89e92f20a7
+        with:
+          path: ~/.cargo
+          key: ${{ github.job }}-cargo
       - name: Install dependencies
         run: |
           apt update
@@ -969,7 +1029,7 @@ jobs:
           CC: "clang-14"
           CXX: "clang++-14"
           RUSTFLAGS: "-C instrument-coverage"
-          CFLAGS: "-fprofile-instr-generate -fcoverage-mapping -O0 -g -fno-strict-aliasing -fsanitize=address -fno-omit-frame-pointer -fPIC -Wno-unused-parameter -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION=1 -Wimplicit-int-float-conversion -Wimplicit-int-conversion"
+          CFLAGS: "-fprofile-instr-generate -fcoverage-mapping -O0 -g -fno-strict-aliasing -fsanitize=address -fno-omit-frame-pointer -fPIC -Wno-unused-parameter -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION=1 -Wimplicit-int-float-conversion -Wimplicit-int-conversion -Werror"
           CXXFLAGS: "-fprofile-instr-generate -fcoverage-mapping -O0 -g -fno-strict-aliasing -fsanitize=address -fno-omit-frame-pointer -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION=1 -stdlib=libc++ -Wimplicit-int-float-conversion -Wimplicit-int-conversion"
           ac_cv_func_malloc_0_nonnull: "yes"
           ac_cv_func_realloc_0_nonnull: "yes"
@@ -993,6 +1053,11 @@ jobs:
     container: ubuntu:20.04
     needs: [prepare-deps, prepare-cbindgen]
     steps:
+      - name: Cache ~/.cargo
+        uses: actions/cache@9b0c1fce7a93df8e3bb8926b0d6e9d89e92f20a7
+        with:
+          path: ~/.cargo
+          key: ${{ github.job }}-cargo
 
       - name: Install dependencies
         run: |
@@ -1077,6 +1142,11 @@ jobs:
     container: ubuntu:20.04
     needs: alma-8
     steps:
+      - name: Cache ~/.cargo
+        uses: actions/cache@9b0c1fce7a93df8e3bb8926b0d6e9d89e92f20a7
+        with:
+          path: ~/.cargo
+          key: ${{ github.job }}-cargo
       - name: Install dependencies
         run: |
           apt update
@@ -1135,8 +1205,8 @@ jobs:
       - name: Cache cargo registry
         uses: actions/cache@9b0c1fce7a93df8e3bb8926b0d6e9d89e92f20a7
         with:
-          path: ~/.cargo/registry
-          key: cargo-registry
+          path: ~/.cargo
+          key: ${{ github.job }}-cargo
 
       - name: Install dependencies
         run: |
@@ -1207,8 +1277,8 @@ jobs:
       - name: Cache cargo registry
         uses: actions/cache@9b0c1fce7a93df8e3bb8926b0d6e9d89e92f20a7
         with:
-          path: ~/.cargo/registry
-          key: cargo-registry
+          path: ~/.cargo
+          key: ${{ github.job }}-cargo
 
       - name: Install dependencies
         run: |
@@ -1302,8 +1372,8 @@ jobs:
       - name: Cache cargo registry
         uses: actions/cache@9b0c1fce7a93df8e3bb8926b0d6e9d89e92f20a7
         with:
-          path: ~/.cargo/registry
-          key: cargo-registry
+          path: ~/.cargo
+          key: ${{ github.job }}-cargo
 
       - name: Install dependencies
         run: |
@@ -1365,8 +1435,8 @@ jobs:
       - name: Cache cargo registry
         uses: actions/cache@9b0c1fce7a93df8e3bb8926b0d6e9d89e92f20a7
         with:
-          path: ~/.cargo/registry
-          key: cargo-registry
+          path: ~/.cargo
+          key: ${{ github.job }}-cargo
 
       - run: |
           apt update
@@ -1435,6 +1505,11 @@ jobs:
     container: debian:9
     needs: [prepare-deps, prepare-cbindgen]
     steps:
+      - name: Cache ~/.cargo
+        uses: actions/cache@9b0c1fce7a93df8e3bb8926b0d6e9d89e92f20a7
+        with:
+          path: ~/.cargo
+          key: ${{ github.job }}-cargo
       - run: |
           apt update
           apt -y install \
@@ -1503,8 +1578,8 @@ jobs:
       - name: Cache cargo registry
         uses: actions/cache@9b0c1fce7a93df8e3bb8926b0d6e9d89e92f20a7
         with:
-          path: ~/.cargo/registry
-          key: cargo-registry
+          path: ~/.cargo
+          key: ${{ github.job }}-cargo
       - run: |
          brew install \
           autoconf \
@@ -1523,7 +1598,7 @@ jobs:
           rust \
           xz
       - name: Install cbindgen
-        run: cargo install --force --debug --version 0.24.3 cbindgen
+        run: cargo install --debug --version 0.24.3 cbindgen
       - run: echo "$HOME/.cargo/bin" >> $GITHUB_PATH
       - run: pip3 install PyYAML
       - uses: actions/checkout@v3.1.0
@@ -1554,6 +1629,11 @@ jobs:
       run:
         shell: msys2 {0}
     steps:
+      - name: Cache ~/.cargo
+        uses: actions/cache@9b0c1fce7a93df8e3bb8926b0d6e9d89e92f20a7
+        with:
+          path: ~/.cargo
+          key: ${{ github.job }}-cargo
       - uses: actions/checkout@v3.1.0
       - uses: msys2/setup-msys2@fa138fa56e2558760b9f2205135313c7345c5f3f
         with:
@@ -1605,6 +1685,11 @@ jobs:
       run:
         shell: msys2 {0}
     steps:
+      - name: Cache ~/.cargo
+        uses: actions/cache@9b0c1fce7a93df8e3bb8926b0d6e9d89e92f20a7
+        with:
+          path: ~/.cargo
+          key: ${{ github.job }}-cargo
       - uses: actions/checkout@v3.1.0
       - uses: msys2/setup-msys2@v2
         with:

.github/workflows/codeql.yml

@@ -17,7 +17,6 @@ jobs:
     permissions:
       actions: read
       contents: read
-      packages: write
       security-events: write
 
 

rust/src/http2/decompression.rs

@@ -50,6 +50,11 @@ impl HTTP2cursor {
     pub fn set_position(&mut self, pos: u64) {
         return self.cursor.set_position(pos);
     }
+
+    pub fn clear(&mut self) {
+        self.cursor.get_mut().clear();
+        self.cursor.set_position(0);
+    }
 }
 
 // we need to implement this as flate2 and brotli crates
@@ -156,8 +161,7 @@ fn http2_decompress<'a>(
         }
     }
     //brotli does not consume all input if it reaches some end
-
-    decoder.get_mut().set_position(0);
+    decoder.get_mut().clear();
     return Ok(&output[..offset]);
 }
 

rust/src/http2/http2.rs

@@ -933,6 +933,7 @@ impl HTTP2State {
                     let over = head.flags & parser::HTTP2_FLAG_HEADER_EOS != 0;
                     let ftype = head.ftype;
                     let sid = head.stream_id;
+                    let padded = head.flags & parser::HTTP2_FLAG_HEADER_PADDED != 0;
                     if dir == Direction::ToServer {
                         tx.frames_ts.push(HTTP2Frame {
                             header: head,
@@ -956,9 +957,12 @@ impl HTTP2State {
                                     } else {
                                         tx_same.ft_ts.tx_id = tx_same.tx_id - 1;
                                     };
-
+                                    let mut dinput = &rem[..hlsafe];
+                                    if padded && rem.len() > 0 && usize::from(rem[0]) < hlsafe{
+                                        dinput = &rem[1..hlsafe - usize::from(rem[0])];
+                                    }
                                     match tx_same.decompress(
-                                        &rem[..hlsafe],
+                                        dinput,
                                         dir,
                                         sfcm,
                                         over,

rust/src/http2/parser.rs

@@ -585,7 +585,7 @@ pub struct HTTP2FrameHeaders {
 //end stream
 pub const HTTP2_FLAG_HEADER_EOS: u8 = 0x1;
 pub const HTTP2_FLAG_HEADER_END_HEADERS: u8 = 0x4;
-const HTTP2_FLAG_HEADER_PADDED: u8 = 0x8;
+pub const HTTP2_FLAG_HEADER_PADDED: u8 = 0x8;
 const HTTP2_FLAG_HEADER_PRIORITY: u8 = 0x20;
 
 fn http2_parse_headers_blocks<'a>(

src/detect-engine-address.c

@@ -462,7 +462,7 @@ static int DetectAddressParseString(DetectAddress *dd, const char *str)
                 if (cidr < 0) {
                     SCLogError(SC_ERR_INVALID_SIGNATURE,
                             "netmask \"%s\" is not usable. Only netmasks that are compatible with "
-                            "CIDR notation are supported. See #5168.",
+                            "CIDR notation are supported. See ticket #5168.",
                             mask);
                     goto error;
                 }

src/output-json-stats.c

@@ -401,8 +401,9 @@ static OutputInitResult OutputStatsLogInitSub(ConfNode *conf, OutputCtx *parent_
 
     if (stats_decoder_events &&
             strcmp(stats_decoder_events_prefix, "decoder") == 0) {
-        SCLogWarning(SC_WARN_EVE_MISSING_EVENTS, "eve.stats will not display "
-                "all decoder events correctly. See #2225. Set a prefix in "
+        SCLogWarning(SC_WARN_EVE_MISSING_EVENTS,
+                "eve.stats will not display "
+                "all decoder events correctly. See ticket #2225. Set a prefix in "
                 "stats.decoder-events-prefix.");
     }
 

src/runmode-af-packet.c

@@ -738,7 +738,9 @@ int AFPRunModeIsIPS()
     }
 
     if (has_ids && has_ips) {
-        SCLogInfo("AF_PACKET mode using IPS and IDS mode");
+        SCLogWarning(SC_ERR_INVALID_ARGUMENT,
+                "AF_PACKET using both IPS and TAP/IDS mode, this will not "
+                "be allowed in Suricata 8 due to undefined behavior. See ticket #5588.");
         for (ldev = 0; ldev < nlive; ldev++) {
             const char *live_dev = LiveGetDeviceName(ldev);
             if (live_dev == NULL) {