Commit Graph

18149 Commits (4b09622ebc60d4aeabcf8d96b310dc8f668ee406)
 

Author SHA1 Message Date
Juliana Fajardini 6f441ee435 decode/ipv4: minor clean-ups
Remove unused debug-like statements (commented out 'printf's).
1 month ago
Juliana Fajardini 426955782c schema: add descriptions to capture stats counters
Task #6434
1 month ago
Juliana Fajardini 3642594e14 schema: add descriptions to decoder stats counters
Continuation of
Task #7793
1 month ago
Juliana Fajardini 42d563f83e schema: fix typos s/ERPSAN/ERSPAN 1 month ago
Jeff Lucovsky 846eb44a9d ci/mt: Include MT tests in CI workflows
Add the MT live tests to the CI workflow.
1 month ago
Jeff Lucovsky 51c9609c7c mt/ci: Add MT live test
Add MT live test capability:
- multi-tenant.sh: harness that sets up and steps through MT steps
- suricata-mt.yaml: Adds MT capability to Suricata
- tenant-1.yaml: Per-tenant configuration file
1 month ago
Victor Julien 4764152567 output/filestore: reformat 1 month ago
Victor Julien d5f9261ef5 output/filestore: fix coverity issue 1427652
Fix PathMerge error handling bringing back CID 1427652.

The result doesn't need to be checked as we're already in an error state
and the path is only used to print to the user.
1 month ago
Victor Julien 81c348e4ed output/filestore: minor comment fixup 1 month ago
Victor Julien 6d8fc10b8f output/filestore: improve path handling
** CID 1666422:       Error handling issues  (CHECKED_RETURN)
/src/output-filestore.c: 350           in GetLogDirectory()

_____________________________________________________________________________________________
*** CID 1666422:         Error handling issues  (CHECKED_RETURN)
/src/output-filestore.c: 350             in GetLogDirectory()
344             log_base_dir = default_log_dir;
345         }
346         if (PathIsAbsolute(log_base_dir)) {
347             strlcpy(out, log_base_dir, out_size);
348         } else {
349             const char *default_log_prefix = SCConfigGetLogDirectory();
>>>     CID 1666422:         Error handling issues  (CHECKED_RETURN)
>>>     Calling "PathMerge" without checking return value (as is done elsewhere 19 out of 21 times).
350             PathMerge(out, out_size, default_log_prefix, log_base_dir);
351         }
352     }
353
354     static bool InitFilestoreDirectory(const char *dir)
355     {
1 month ago
Victor Julien 178f3baf4a detect: improve path handling for tenants
** CID 1666423:       Error handling issues  (CHECKED_RETURN)
/src/detect-engine.c: 4413           in DetectEngineMultiTenantSetup()

_____________________________________________________________________________________________
*** CID 1666423:         Error handling issues  (CHECKED_RETURN)
/src/detect-engine.c: 4413             in DetectEngineMultiTenantSetup()
4407                         goto bad_tenant;
4408                     }
4409                     SCLogDebug("tenant id: %u, %s", tenant_id, yaml_node->val);
4410
4411                     char yaml_path[PATH_MAX] = "";
4412                     if (path) {
>>>     CID 1666423:         Error handling issues  (CHECKED_RETURN)
>>>     Calling "PathMerge" without checking return value (as is done elsewhere 19 out of 21 times).
4413                         PathMerge(yaml_path, PATH_MAX, path, yaml_node->val);
4414                     } else {
4415                         strlcpy(yaml_path, yaml_node->val, sizeof(yaml_path));
4416                     }
4417                     SCLogDebug("tenant path: %s", yaml_path);
4418
1 month ago
Juliana Fajardini 21b13c5d2f decode/ipv6: actually set ipv6 pkt too small event
The event exists, but it was never set.
Disabled the existing rule, to avoid flooding.

Bug #7963
1 month ago
Victor Julien 0948a32470 runmodes: limit thread count consistently
Limit to 1024 like with worker threads.

General minor cleanups.
2 months ago
Victor Julien f6b67a8d50 napatech: update thread count callback to match API change 2 months ago
Victor Julien 7807b47ca0 pfring: update thread count callback to match API change
Use uint16_t internally and in parsing as well.
2 months ago
Victor Julien b633887d83 runmodes: adapt to uint16_t thread count 2 months ago
Victor Julien fbf75f2e7d runmodes: let thread count callback return uint16_t
It will be a long time before we need more than 64k threads.

Update capture methods.
2 months ago
Victor Julien 5817afa356 runmodes: work around format truncation warnings
util-runmodes.c: In function 'RunModeSetLiveCaptureAutoFp':
util-runmodes.c:167:30: warning: '%02d' directive output may be truncated writing between 2 and 11 bytes into a region of size between 3 and 4 [-Wformat-truncation=]
  167 |                          "%s#%02d-%s", thread_name, thread+1,
      |                              ^~~~
util-runmodes.c:167:26: note: directive argument in the range [-2147483647, 2147483647]
  167 |                          "%s#%02d-%s", thread_name, thread+1,
      |                          ^~~~~~~~~~~~
util-runmodes.c:167:26: note: assuming directive output of 1 byte
util-runmodes.c:166:17: note: 'snprintf' output 5 or more bytes (assuming 16) into a destination of size 5
  166 |                 snprintf(printable_threadname, strlen(thread_name)+5+strlen(dev),
      |                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  167 |                          "%s#%02d-%s", thread_name, thread+1,
      |                          ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  168 |                          dev);
      |                          ~~~~
util-runmodes.c: In function 'RunModeSetLiveCaptureWorkersForDevice':
util-runmodes.c:280:88: warning: '%02d' directive output may be truncated writing between 2 and 10 bytes into a region of size between 3 and 4 [-Wformat-truncation=]
  280 |             snprintf(printable_threadname, strlen(thread_name)+5+strlen(live_dev), "%s#%02d-%s",
      |                                                                                        ^~~~
util-runmodes.c:280:84: note: directive argument in the range [1, 2147483647]
  280 |             snprintf(printable_threadname, strlen(thread_name)+5+strlen(live_dev), "%s#%02d-%s",
      |                                                                                    ^~~~~~~~~~~~
util-runmodes.c:280:84: note: assuming directive output of 1 byte
util-runmodes.c:280:13: note: 'snprintf' output 5 or more bytes (assuming 15) into a destination of size 5
  280 |             snprintf(printable_threadname, strlen(thread_name)+5+strlen(live_dev), "%s#%02d-%s",
      |             ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  281 |                      thread_name, thread+1, live_dev);
      |                      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
util-runmodes.c:275:91: warning: '%s' directive output may be truncated writing likely 1 or more bytes into a region of size between 0 and 1 [-Wformat-truncation=]
  275 |             snprintf(printable_threadname, strlen(thread_name)+5+strlen(live_dev), "%s#01-%s",
      |                                                                                           ^~
util-runmodes.c:275:84: note: assuming directive output of 1 byte
  275 |             snprintf(printable_threadname, strlen(thread_name)+5+strlen(live_dev), "%s#01-%s",
      |                                                                                    ^~~~~~~~~~
util-runmodes.c:275:13: note: 'snprintf' output 5 or more bytes (assuming 7) into a destination of size 5
  275 |             snprintf(printable_threadname, strlen(thread_name)+5+strlen(live_dev), "%s#01-%s",
      |             ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  276 |                      thread_name, live_dev);
      |                      ~~~~~~~~~~~~~~~~~~~~~~

Ticket: #7905.
2 months ago
Victor Julien 1f46e2ba09 nfq: work around format truncation warning
Ticket: #7905.
2 months ago
Victor Julien 7bab39d447 output/lua: work around format truncation warnings
Use PathMerge to improve path handling and address these warnings:

output-lua.c: In function 'OutputLuaLogInitSub':
output-lua.c:657:48: warning: '%s' directive output may be truncated writing likely 1 or more bytes into a region of size between 0 and 4096 [-Wformat-truncation=]
  657 |     int ret = snprintf(path, sizeof(path),"%s%s%s", dir, strlen(dir) ? "/" : "", conf->val);
      |                                                ^~
output-lua.c:657:43: note: assuming directive output of 1 byte
  657 |     int ret = snprintf(path, sizeof(path),"%s%s%s", dir, strlen(dir) ? "/" : "", conf->val);
      |                                           ^~~~~~~~
output-lua.c:657:15: note: 'snprintf' output 1 or more bytes (assuming 4098) into a destination of size 4096
  657 |     int ret = snprintf(path, sizeof(path),"%s%s%s", dir, strlen(dir) ? "/" : "", conf->val);
      |               ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Ticket: #7905.
2 months ago
Victor Julien 99a79b595f eve/stats: work around format truncation warnings
This appears to be a FP. Work around it to allow for using this warning
as an error.

output-json-stats.c: In function 'StatsToJSON':
output-json-stats.c:253:65: warning: 'snprintf' output may be truncated before the last format character [-Wformat-truncation=]
  253 |                     snprintf(deltaname, sizeof(deltaname), "%s%s", stat_name, delta_suffix);
      |                                                                 ^
output-json-stats.c:253:21: note: 'snprintf' output 1 or more bytes (assuming 8) into a destination of size 7
  253 |                     snprintf(deltaname, sizeof(deltaname), "%s%s", stat_name, delta_suffix);
      |                     ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
output-json-stats.c:314:69: warning: 'snprintf' output may be truncated before the last format character [-Wformat-truncation=]
  314 |                         snprintf(deltaname, sizeof(deltaname), "%s%s", stat_name, delta_suffix);
      |                                                                     ^
output-json-stats.c:314:25: note: 'snprintf' output 1 or more bytes (assuming 8) into a destination of size 7
  314 |                         snprintf(deltaname, sizeof(deltaname), "%s%s", stat_name, delta_suffix);
      |                         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Ticket: #7905.
2 months ago
Victor Julien a57643c70b eve/alert: work around format truncation warning
This appears to be a FP. Work around it to allow for using this warning
as an error.

output-json-alert.c: In function 'AlertJsonReference':
output-json-alert.c:188:44: warning: '%s' directive output may be truncated writing likely 1 or more bytes into a region of size between 0 and 1 [-Wformat-truncation=]
  188 |         snprintf(kv_store, size_needed, "%s%s", kv->key, kv->reference);
      |                                            ^~
output-json-alert.c:188:41: note: assuming directive output of 1 byte
  188 |         snprintf(kv_store, size_needed, "%s%s", kv->key, kv->reference);
      |                                         ^~~~~~
output-json-alert.c:188:9: note: 'snprintf' output 1 or more bytes (assuming 3) into a destination of size 1
  188 |         snprintf(kv_store, size_needed, "%s%s", kv->key, kv->reference);
      |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Ticket: #7905.
2 months ago
Victor Julien 40363f7465 output/filestore: improve path handling
Use PathMerge where appropriate. Addresses format truncation warnings.

output-filestore.c: In function 'OutputFilestoreFinalizeFiles':
output-filestore.c:164:13: warning: '%lu' directive output may be truncated writing between 1 and 14 bytes into a region of size between 0 and 4095 [-Wformat-truncation=]
  164 |         if (snprintf(js_metadata_filename, sizeof(js_metadata_filename), "%s.%" PRIuMAX ".%u.json",
      |             ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  165 |                     final_filename, (uintmax_t)SCTIME_SECS(p->ts),
      |                     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  166 |                     ff->file_store_id) == (int)sizeof(js_metadata_filename)) {
      |                     ~~~~~~~~~~~~~~~~~~
output-filestore.c:164:13: note: directive argument in the range [0, 17592186044415]
output-filestore.c:164:13: note: 'snprintf' output between 10 and 4127 bytes into a destination of size 4096
output-filestore.c: In function 'OutputFilestoreLogInitCtx':
output-filestore.c:408:67: warning: '%s' directive output may be truncated writing up to 4095 bytes into a region of size 4027 [-Wformat-truncation=]
  408 |     int written = snprintf(ctx->tmpdir, sizeof(ctx->tmpdir) - 1, "%s/tmp",
      |                                                                   ^~
  409 |             log_directory);
      |             ~~~~~~~~~~~~~
output-filestore.c:408:19: note: 'snprintf' output between 5 and 4100 bytes into a destination of size 4027
  408 |     int written = snprintf(ctx->tmpdir, sizeof(ctx->tmpdir) - 1, "%s/tmp",
      |                   ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  409 |             log_directory);
      |             ~~~~~~~~~~~~~~

Ticket: #7905.
2 months ago
Victor Julien 840d372320 log/tlsstore: improve path handling
Use PathMerge.

Address format truncation warnings.

log-tlsstore.c: In function 'CreateFileName':
log-tlsstore.c:68:9: warning: '%s' directive output may be truncated writing likely 1 or more bytes into a region of size between 0 and 4095 [-Wformat-truncation=]
   68 |     if (snprintf(path, sizeof(path), "%s/%s%ld.%ld-%d.pem", tls_logfile_base_dir, dir,
      |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   69 |                 (long int)SCTIME_SECS(p->ts), (long int)SCTIME_USECS(p->ts),
      |                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   70 |                 file_id) == sizeof(path))
      |                 ~~~~~~~~
log-tlsstore.c:68:9: note: assuming directive output of 1 byte
log-tlsstore.c:68:9: note: directive argument in the range [0, 17592186044415]
log-tlsstore.c:68:9: note: directive argument in the range [0, 1048575]
log-tlsstore.c:68:9: note: using the range [-2147483648, 2147483647] for directive argument
log-tlsstore.c:68:9: note: 'snprintf' output 11 or more bytes (assuming 4126) into a destination of size 4096

Ticket: #7905.
2 months ago
Victor Julien 98730c2c43 log/pcap: improve path handling
Use proper path merging.

Address format truncation warnings.

log-pcap.c: In function 'PcapLogInitRingBuffer':
log-pcap.c:970:13: warning: '%s' directive output may be truncated writing up to 255 bytes into a region of size between 0 and 4095 [-Wformat-truncation=]
  970 |         if (snprintf(path, PATH_MAX, "%s/%s", pattern, entry->d_name) == PATH_MAX)
      |             ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
log-pcap.c:970:13: note: 'snprintf' output between 2 and 4352 bytes into a destination of size 4096
log-pcap.c: In function 'PcapLogOpenFileCtx':
log-pcap.c:1796:56: warning: '%s' directive output may be truncated writing likely 1 or more bytes into a region of size between 0 and 4095 [-Wformat-truncation=]
 1796 |                 ret = snprintf(filename, PATH_MAX, "%s/%s.%u.%" PRIu32 ".%" PRIu32 "%s", pl->dir,
      |                                                        ^~
log-pcap.c:1796:52: note: assuming directive output of 1 byte
 1796 |                 ret = snprintf(filename, PATH_MAX, "%s/%s.%u.%" PRIu32 ".%" PRIu32 "%s", pl->dir,
      |                                                    ^~~~~~~~~~~~
log-pcap.c:1796:52: note: using the range [0, 4294967295] for directive argument
log-pcap.c:1796:52: note: directive argument in the range [0, 1048575]
log-pcap.c:1796:52: note: assuming directive output of 1 byte
log-pcap.c:1796:23: note: 'snprintf' output 8 or more bytes (assuming 4111) into a destination of size 4096
 1796 |                 ret = snprintf(filename, PATH_MAX, "%s/%s.%u.%" PRIu32 ".%" PRIu32 "%s", pl->dir,
      |                       ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 1797 |                         pl->prefix, pl->thread_number, (uint32_t)SCTIME_SECS(ts),
      |                         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 1798 |                         (uint32_t)SCTIME_USECS(ts), pl->suffix);
      |                         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
log-pcap.c:1793:56: warning: '%s' directive output may be truncated writing likely 1 or more bytes into a region of size between 0 and 4095 [-Wformat-truncation=]
 1793 |                 ret = snprintf(filename, PATH_MAX, "%s/%s.%u.%" PRIu32 "%s", pl->dir, pl->prefix,
      |                                                        ^~
log-pcap.c:1793:52: note: assuming directive output of 1 byte
 1793 |                 ret = snprintf(filename, PATH_MAX, "%s/%s.%u.%" PRIu32 "%s", pl->dir, pl->prefix,
      |                                                    ^~~~~~~~~~~~
log-pcap.c:1793:52: note: using the range [0, 4294967295] for directive argument
log-pcap.c:1793:52: note: assuming directive output of 1 byte
log-pcap.c:1793:23: note: 'snprintf' output 6 or more bytes (assuming 4103) into a destination of size 4096
 1793 |                 ret = snprintf(filename, PATH_MAX, "%s/%s.%u.%" PRIu32 "%s", pl->dir, pl->prefix,
      |                       ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 1794 |                         pl->thread_number, (uint32_t)SCTIME_SECS(ts), pl->suffix);
      |                         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
log-pcap.c:1738:52: warning: '%s' directive output may be truncated writing likely 1 or more bytes into a region of size between 0 and 4095 [-Wformat-truncation=]
 1738 |             ret = snprintf(filename, PATH_MAX, "%s/%s.%" PRIu32 ".%" PRIu32 "%s", pl->dir,
      |                                                    ^~
log-pcap.c:1738:48: note: assuming directive output of 1 byte
 1738 |             ret = snprintf(filename, PATH_MAX, "%s/%s.%" PRIu32 ".%" PRIu32 "%s", pl->dir,
      |                                                ^~~~~~~~~
log-pcap.c:1738:48: note: using the range [0, 4294967295] for directive argument
log-pcap.c:1738:48: note: directive argument in the range [0, 1048575]
log-pcap.c:1738:48: note: assuming directive output of 1 byte
log-pcap.c:1738:19: note: 'snprintf' output 6 or more bytes (assuming 4109) into a destination of size 4096
 1738 |             ret = snprintf(filename, PATH_MAX, "%s/%s.%" PRIu32 ".%" PRIu32 "%s", pl->dir,
      |                   ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 1739 |                     pl->prefix, (uint32_t)SCTIME_SECS(ts), (uint32_t)SCTIME_USECS(ts), pl->suffix);
      |                     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
log-pcap.c:1735:52: warning: '%s' directive output may be truncated writing likely 1 or more bytes into a region of size between 0 and 4095 [-Wformat-truncation=]
 1735 |             ret = snprintf(filename, PATH_MAX, "%s/%s.%" PRIu32 "%s", pl->dir, pl->prefix,
      |                                                    ^~
log-pcap.c:1735:48: note: assuming directive output of 1 byte
 1735 |             ret = snprintf(filename, PATH_MAX, "%s/%s.%" PRIu32 "%s", pl->dir, pl->prefix,
      |                                                ^~~~~~~~~
log-pcap.c:1735:48: note: using the range [0, 4294967295] for directive argument
log-pcap.c:1735:48: note: assuming directive output of 1 byte
log-pcap.c:1735:19: note: 'snprintf' output 4 or more bytes (assuming 4101) into a destination of size 4096
 1735 |             ret = snprintf(filename, PATH_MAX, "%s/%s.%" PRIu32 "%s", pl->dir, pl->prefix,
      |                   ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 1736 |                     (uint32_t)SCTIME_SECS(ts), pl->suffix);
      |                     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Ticket: #7905.
2 months ago
Victor Julien 3d0d7b740e detect/port: address format truncation warnings
This appears to be a FP. Work around it to allow for using this warning
as an error.

detect-engine-port.c: In function 'DetectPortParseDo':
detect-engine-port.c:858:35: warning: 'snprintf' output may be truncated before the last format character [-Wformat-truncation=]
  858 |                              "[%s]", rule_var_port);
      |                                   ^
detect-engine-port.c:857:21: note: 'snprintf' output 3 or more bytes (assuming 4) into a destination of size 3
  857 |                     snprintf(alloc_rule_var_port, strlen(rule_var_port) + 3,
      |                     ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  858 |                              "[%s]", rule_var_port);
      |                              ~~~~~~~~~~~~~~~~~~~~~~
detect-engine-port.c:928:34: warning: 'snprintf' output may be truncated before the last format character [-Wformat-truncation=]
  928 |                             "[%s]", rule_var_port);
      |                                  ^
detect-engine-port.c:927:21: note: 'snprintf' output 3 or more bytes (assuming 4) into a destination of size 3
  927 |                     snprintf(alloc_rule_var_port, strlen(rule_var_port) + 3,
      |                     ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  928 |                             "[%s]", rule_var_port);
      |                             ~~~~~~~~~~~~~~~~~~~~~~

Ticket: #7905.
2 months ago
Victor Julien 5564838c22 detect/mpm: address format truncation warnings
detect-engine-mpm.c: In function ‘BuildBasicPname’:
detect-engine-mpm.c:197:43: error: ‘snprintf’ output may be truncated before the last format character [-Werror=format-truncation=]
  197 |         snprintf(pname, sizeof(pname), "%s", name);
      |                                           ^
detect-engine-mpm.c:197:9: note: ‘snprintf’ output 1 or more bytes (assuming 2) into a destination of size 1
  197 |         snprintf(pname, sizeof(pname), "%s", name);
      |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
detect-engine-mpm.c: In function ‘AppendTransformsToPname’:
detect-engine-mpm.c:231:61: error: ‘%s’ directive output may be truncated writing up to 1023 bytes into a region of size 7 [-Werror=format-truncation=]
  231 |             snprintf(xforms_print, sizeof(xforms_print), " (%s)", xforms);
      |                                                             ^~    ~~~~~~
detect-engine-mpm.c:231:13: note: ‘snprintf’ output between 4 and 1027 bytes into a destination of size 9
  231 |             snprintf(xforms_print, sizeof(xforms_print), " (%s)", xforms);
      |             ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Ticket: #7905.
2 months ago
Victor Julien 103bad19bb detect/iponly: address format truncation warnings
This appears to be a FP. Work around it to allow for using this warning
as an error.

detect-engine-iponly.c: In function 'IPOnlyCIDRListParse2':
detect-engine-iponly.c:721:35: warning: 'snprintf' output may be truncated before the last format character [-Wformat-truncation=]
  721 |                              "[%s]", rule_var_address);
      |                                   ^
detect-engine-iponly.c:720:21: note: 'snprintf' output 3 or more bytes (assuming 4) into a destination of size 3
  720 |                     snprintf(temp_rule_var_address, strlen(rule_var_address) + 3,
      |                     ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  721 |                              "[%s]", rule_var_address);
      |                              ~~~~~~~~~~~~~~~~~~~~~~~~~
detect-engine-iponly.c:782:34: warning: 'snprintf' output may be truncated before the last format character [-Wformat-truncation=]
  782 |                             "[%s]", rule_var_address);
      |                                  ^
detect-engine-iponly.c:781:21: note: 'snprintf' output 3 or more bytes (assuming 4) into a destination of size 3
  781 |                     snprintf(temp_rule_var_address, strlen(rule_var_address) + 3,
      |                     ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  782 |                             "[%s]", rule_var_address);
      |                             ~~~~~~~~~~~~~~~~~~~~~~~~~

Ticket: #7905.
2 months ago
Victor Julien 981f902138 app-layer/smtp: address format truncation warning
This appears to be a FP. Work around it to allow for using this warning
as an error.

Limit scheme lenght to < 256 as well.

app-layer-smtp.c: In function 'SMTPConfigure':
app-layer-smtp.c:371:69: warning: 'snprintf' output may be truncated before the last format character [-Wformat-truncation=]
  371 |                     int r = snprintf(new_val, scheme_len + 1, "%s://", scheme->val);
      |                                                                     ^
app-layer-smtp.c:371:29: note: 'snprintf' output 4 or more bytes (assuming 5) into a destination of size 4
  371 |                     int r = snprintf(new_val, scheme_len + 1, "%s://", scheme->val);
      |                             ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Ticket: #7905.
2 months ago
Victor Julien 56b357d4a4 detect/analyzer: address format truncation warning
detect-engine-analyzer.c: In function ‘SetupEngineAnalysis’:
detect-engine-analyzer.c:493:60: error: ‘%s’ directive output may be truncated writing up to 63 bytes into a region of size 3 [-Werror=format-truncation=]
  493 |         snprintf(ea->file_prefix, cfg_prefix_len + 1 + 1, "%s.", de_ctx->config_prefix);
      |                                                            ^~
detect-engine-analyzer.c:493:9: note: ‘snprintf’ output between 2 and 65 bytes into a destination of size 3
  493 |         snprintf(ea->file_prefix, cfg_prefix_len + 1 + 1, "%s.", de_ctx->config_prefix);
      |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Ticket: #7905.
2 months ago
Victor Julien bccbab6e33 detect/address: address format-trunction warnings
This appears to be a FP. Work around it to allow for using this warning
as an error.

detect-engine-address.c: In function ‘DetectAddressParseInternal’:
detect-engine-address.c:851:35: error: ‘snprintf’ output may be truncated before the last format character [-Werror=format-truncation=]
  851 |                              "[%s]", rule_var_address);
      |                                   ^
detect-engine-address.c:850:21: note: ‘snprintf’ output 3 or more bytes (assuming 4) into a destination of size 3
  850 |                     snprintf(temp_rule_var_address, str_size,
      |                     ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  851 |                              "[%s]", rule_var_address);
      |                              ~~~~~~~~~~~~~~~~~~~~~~~~~
detect-engine-address.c:919:34: error: ‘snprintf’ output may be truncated before the last format character [-Werror=format-truncation=]
  919 |                             "[%s]", rule_var_address);
      |                                  ^
detect-engine-address.c:918:21: note: ‘snprintf’ output 3 or more bytes (assuming 4) into a destination of size 3
  918 |                     snprintf(temp_rule_var_address, strlen(rule_var_address) + 3,
      |                     ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  919 |                             "[%s]", rule_var_address);
      |                             ~~~~~~~~~~~~~~~~~~~~~~~~~

Ticket: #7905.
2 months ago
Victor Julien f48099edd3 detect/datasets: address format truncation warnings
detect-dataset.c: In function ‘SetupLoadPath’:
detect-dataset.c:391:9: error: ‘%s’ directive output may be truncated writing likely 1 or more bytes into a region of size between 0 and 4095 [-Werror=format-truncation=]
  391 |     if (snprintf(path, sizeof(path), "%s/%s", dir, load) >= (int)sizeof(path)) // TODO windows path
      |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
detect-dataset.c:391:9: note: assuming directive output of 1 byte
detect-dataset.c:391:9: note: ‘snprintf’ output 2 or more bytes (assuming 4098) into a destination of size 4096

Ticket: #7905.
2 months ago
Victor Julien 14987dca35 detect/datarep: fix format truncation warning
detect-datarep.c: In function ‘SetupLoadPath’:
detect-datarep.c:262:9: error: ‘%s’ directive output may be truncated writing likely 1 or more bytes into a region of size between 0 and 4095 [-Werror=format-truncation=]
  262 |     if (snprintf(path, sizeof(path), "%s/%s", dir, load) >= (int)sizeof(path)) // TODO windows path
      |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
detect-datarep.c:262:9: note: assuming directive output of 1 byte
detect-datarep.c:262:9: note: ‘snprintf’ output 2 or more bytes (assuming 4098) into a destination of size 4096
cc1: all warnings being treated as errors

Ticket: #7905.
2 months ago
Victor Julien 8630b29611 util/pidfile: address format truncation warning
util-pidfile.c: In function ‘SCPidfileCreate’:
util-pidfile.c:49:18: error: ‘%lu’ directive output may be truncated writing between 1 and 20 bytes into a region of size 16 [-Werror=format-truncation=]
   49 |     size_t len = snprintf(val, sizeof(val), "%"PRIuMAX"\n", (uintmax_t)getpid());
      |                  ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
util-pidfile.c:49:18: note: using the range [0, 18446744073709551615] for directive argument
util-pidfile.c:49:18: note: ‘snprintf’ output between 3 and 22 bytes into a destination of size 16
   49 |     size_t len = snprintf(val, sizeof(val), "%"PRIuMAX"\n", (uintmax_t)getpid());
      |                  ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors

Ticket: #7905.
2 months ago
Victor Julien 746823f3df github-actions: update rust checks to 1.90 2 months ago
Victor Julien ec418248d6 rust: update highest known rustc version to 1.90 2 months ago
Victor Julien 870b40220c rust: cargo update 2 months ago
Philippe Antoine f7f8fbc116 scripts: setup app layer rustfmt mod.rs last
Otherwise rustfmt complains that parser.rs does not exist yet
2 months ago
Philippe Antoine 096ba42ce9 detect/integers: add some meaningful error messages
To help rule writers
2 months ago
Philippe Antoine 4f7fc25a1a detect/dnp3: make dnp3.ind a generic uint16 bitflags keyword
Ticket: 6724

Allows operations such as negation
2 months ago
Philippe Antoine c1917dec21 detect/integers: make mqtt use generic detect_parse_uint_bitflags
Ticket: 6724
2 months ago
Philippe Antoine 867f5bfa21 detect/integers: generic detect_parse_uint_bitflags
Ticket: 6724

This will ease other keywords with bitflags, by having a generic
function + an association between flag string and bit value.
2 months ago
Cheng Longfei 9fb33bbaf6 lua: fix null dereference in tx HTTP accessor functions
Fix crashes in Lua when calling tx:response_line(), tx:request_line(),
tx:request_uri_raw(), or tx:request_host() on incomplete or malformed
HTTP transactions.

These functions return bstr pointers which may be NULL. Add NULL
checks before calling bstr_ptr() and bstr_len() to avoid segfaults.

Ticket: #7829
2 months ago
Victor Julien 48972d544c doc/userguide: link to protocol details from transactional rules 2 months ago
Victor Julien 480e664b4c doc/userguide: add xbits tx scope support
Ticket #7680.
2 months ago
Victor Julien a1c4167d94 doc/userguide: add initial protocols overview
Explain per protocol mechanics for rule matching.
2 months ago
Victor Julien 7034a17d1d doc/devguide: remove WIP mention of files in txs
Work has been completed, so comment is no longer accurate.
2 months ago
Victor Julien e2a5bc058c doc/userguide: fix DCERPC headings 2 months ago
Victor Julien be5c83ed53 doc/userguide: add rule hooks to protocol doc
Ticket #7662.
2 months ago
Victor Julien 91f258e2bc doc/userguide: add missing app-layer protocols 2 months ago