Skip to content

Conversation

jlucovsky
Copy link
Contributor

Continuation of #13584

Issue: 1412

Extend the checks added for 7549 to include buffers.

Only consider sig matches with compatible ids/lists.

Link to ticket: https://redmine.openinfosecfoundation.org/issues/1412

Describe changes:

  • Extend buffer/variable checks to buffers init data
  • In strict-mode, do not load rules using variables from different buffers.
  • When not in strict mode, issue warning for rules that use variables from different buffers.

Updates:

Provide values to any of the below to override the defaults.

  • To use a Suricata-Verify or Suricata-Update pull request,
    link to the pull request in the respective _BRANCH variable.
  • Leave unused overrides blank or remove.

SV_REPO=
SV_BRANCH=OISF/suricata-verify#2576
SU_REPO=
SU_BRANCH=

Issue: 1412

When in strict mode, issue an error and refuse to load the rule if
variables produced from a different buffer are used with a separate
buffer.

When not in strict mode (default), issue a warning and load the rule.

Only consider sig matches with compatible ids/lists.
Issue 1412

Add mention of byte_{extract,math,test,jump} variable usage
and buffer scope and include how the command line option
strict-rule-keywords affects validation.
@jlucovsky jlucovsky changed the title 1412/6 detect/var: Restrict var usage to single buffer Jul 19, 2025
Copy link

codecov bot commented Jul 19, 2025

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 83.70%. Comparing base (2e69e0d) to head (17da193).
⚠️ Report is 36 commits behind head on master.

Additional details and impacted files
@@            Coverage Diff             @@
##           master   #13622      +/-   ##
==========================================
+ Coverage   83.69%   83.70%   +0.01%     
==========================================
  Files        1011     1011              
  Lines      275071   275109      +38     
==========================================
+ Hits       230210   230276      +66     
+ Misses      44861    44833      -28     
Flag Coverage Δ
fuzzcorpus 62.83% <96.15%> (+0.07%) ⬆️
livemode 19.14% <0.00%> (+0.02%) ⬆️
pcap 44.75% <38.46%> (+0.01%) ⬆️
suricata-verify 65.09% <94.87%> (-0.02%) ⬇️
unittests 59.19% <74.35%> (+<0.01%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@suricata-qa
Copy link

Information: QA ran without warnings.

Pipeline = 27037

@catenacyber catenacyber added the decision-required Waiting on deliberation from the team label Jul 22, 2025
@catenacyber
Copy link
Contributor

I wonder what we want to do now that 8.0.0 is out and this was not merged in it 😢

@victorjulien victorjulien added the needs rebase Needs rebase to main label Aug 11, 2025
@jufajardini jufajardini removed the decision-required Waiting on deliberation from the team label Aug 11, 2025
@jlucovsky
Copy link
Contributor Author

Continued in #13716

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
needs rebase Needs rebase to main
Development

Successfully merging this pull request may close these issues.

5 participants