Skip to content

detect/http: report error on alloc failure #8653

detect/http: report error on alloc failure

detect/http: report error on alloc failure #8653

Workflow file for this run

name: builds
on:
push:
pull_request:
workflow_dispatch:
inputs:
LIBHTP_REPO:
LIBHTP_BRANCH:
SU_REPO:
SU_BRANCH:
SV_REPO:
SV_BRANCH:
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
permissions: read-all
env:
DEFAULT_SV_REPO: https://github.com/OISF/suricata-verify
DEFAULT_SV_BRANCH: master
DEFAULT_CFLAGS: "-Wall -Wextra -Werror -Wno-unused-parameter -Wno-unused-function"
# Apt sometimes likes to ask for user input, this will prevent that.
DEBIAN_FRONTEND: "noninteractive"
# A recent version of stable Rust that is known to pass build, test and other
# verification steps in this workflow. This was added because using "stable"
# could cause some steps to fail.
RUST_VERSION_KNOWN: "1.70.0"
# The minimum version of Rust supported.
RUST_VERSION_MIN: "1.63.0"
jobs:
prepare-deps:
name: Prepare dependencies
runs-on: ubuntu-latest
steps:
- name: Dumping github context for debugging
run: echo $JSON
env:
JSON: ${{ toJSON(github) }}
- run: sudo apt update && sudo apt -y install jq curl
- name: Parse repo and branch information
env:
# We fetch the actual pull request to get the latest body as
# github.event.pull_request.body has the body from the
# initial pull request.
PR_HREF: ${{ github.event.pull_request._links.self.href }}
run: |
if test "${PR_HREF}"; then
body=$(curl -s "${PR_HREF}" | jq -r .body | tr -d '\r')
echo "Parsing branch and PR info from:"
echo "${body}"
LIBHTP_REPO=$(echo "${body}" | awk -F = '/^LIBHTP_REPO=/ { print $2 }')
LIBHTP_BRANCH=$(echo "${body}" | awk -F = '/^LIBHTP_BRANCH=/ { print $2 }')
SU_REPO=$(echo "${body}" | awk -F = '/^SU_REPO=/ { print $2 }')
SU_BRANCH=$(echo "${body}" | awk -F = '/^SU_BRANCH=/ { print $2 }')
SV_REPO=$(echo "${body}" | awk -F = '/^SV_REPO=/ { print $2 }')
SV_BRANCH=$(echo "${body}" | awk -F = '/^SV_BRANCH=/ { print $2 }')
else
echo "No pull request body, will use inputs or defaults."
LIBHTP_REPO=${{ inputs.LIBHTP_REPO }}
LIBHTP_BRANCH=${{ inputs.LIBHTP_BRANCH }}
SU_REPO=${{ inputs.SU_REPO }}
SU_BRANCH=${{ inputs.SU_BRANCH }}
SV_REPO=${{ inputs.SV_REPO }}
SV_BRANCH=${{ inputs.SV_BRANCH }}
fi
# If the _REPO variables don't contain a full URL, add GitHub.
if [ "${LIBHTP_REPO}" ] && ! echo "${LIBHTP_REPO}" | grep -q '^https://'; then
LIBHTP_REPO="https://github.com/${LIBHTP_REPO}"
fi
if [ "${SU_REPO}" ] && ! echo "${SU_REPO}" | grep -q '^https://'; then
SU_REPO="https://github.com/${SU_REPO}"
fi
if [ "${SV_REPO}" ] && ! echo "${SV_REPO}" | grep -q '^https://'; then
SV_REPO="https://github.com/${SV_REPO}"
fi
echo LIBHTP_REPO=${LIBHTP_REPO} | tee -a ${GITHUB_ENV}
echo LIBHTP_BRANCH=${LIBHTP_BRANCH} | tee -a ${GITHUB_ENV}
echo SU_REPO=${SU_REPO} | tee -a ${GITHUB_ENV}
echo SU_BRANCH=${SU_BRANCH} | tee -a ${GITHUB_ENV}
echo SV_REPO=${SV_REPO:-${DEFAULT_SV_REPO}} | tee -a ${GITHUB_ENV}
echo SV_BRANCH=${SV_BRANCH:-${DEFAULT_SV_BRANCH}} | tee -a ${GITHUB_ENV}
- name: Annotate output
run: |
echo "::notice:: LIBHTP_REPO=${LIBHTP_REPO}"
echo "::notice:: LIBHTP_BRANCH=${LIBHTP_BRANCH}"
echo "::notice:: SU_REPO=${SU_REPO}"
echo "::notice:: SU_BRANCH=${SU_BRANCH}"
echo "::notice:: SV_REPO=${SV_REPO}"
echo "::notice:: SV_BRANCH=${SV_BRANCH}"
# Now checkout Suricata for the bundle script.
- name: Checking out Suricata
uses: actions/[email protected]
- name: Fetching libhtp
run: |
DESTDIR=./bundle ./scripts/bundle.sh libhtp
tar zcf libhtp.tar.gz -C bundle libhtp
- name: Fetching suricata-update
run: |
DESTDIR=./bundle ./scripts/bundle.sh suricata-update
tar zcf suricata-update.tar.gz -C bundle suricata-update
- name: Fetching suricata-verify
run: |
# Looking for a pull request number. in the SV_BRANCH
# value. This could be "pr/NNN", "pull/NNN" or a link to an
# OISF/suricata-verify pull request.
pr=$(echo "${SV_BRANCH}" | sed -n \
-e 's/^https:\/\/github.com\/OISF\/suricata-verify\/pull\/\([0-9]*\)$/\1/p' \
-e 's/^pull\/\([0-9]*\)$/\1/p' \
-e 's/^pr\/\([0-9]*\)$/\1/p')
if [ "${pr}" ]; then
SV_BRANCH="refs/pull/${pr}/head"
echo "Using suricata-verify pull-request ${SV_BRANCH}"
else
echo "Using suricata-verify branch ${SV_BRANCH}"
fi
git clone --depth 1 ${SV_REPO} suricata-verify
cd suricata-verify
git fetch --depth 1 origin ${SV_BRANCH}
git -c advice.detachedHead=false checkout FETCH_HEAD
cd ..
tar zcf suricata-verify.tar.gz suricata-verify
- name: Uploading prep archive
uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce
with:
name: prep
path: |
libhtp.tar.gz
suricata-update.tar.gz
suricata-verify.tar.gz
prepare-cbindgen:
name: Prepare cbindgen
runs-on: ubuntu-latest
steps:
- name: Cache ~/.cargo
uses: actions/[email protected]
with:
path: ~/.cargo
key: ${{ github.job }}-cargo
- name: Installing Rust
run: |
curl https://sh.rustup.rs -sSf | sh -s -- -y
echo "$HOME/.cargo/bin" >> $GITHUB_PATH
rustup target add x86_64-unknown-linux-musl
- name: Building static cbindgen for Linux
run: |
cargo install --target x86_64-unknown-linux-musl --debug cbindgen
cp $HOME/.cargo/bin/cbindgen .
- name: Uploading prep archive
uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce
with:
name: prep
path: .
almalinux-9:
name: AlmaLinux 9
runs-on: ubuntu-latest
container: almalinux:9
needs: [prepare-deps]
steps:
# Cache Rust stuff.
- name: Cache cargo registry
uses: actions/[email protected]
with:
path: ~/.cargo
key: ${{ github.job }}-cargo
- name: Cache RPMs
uses: actions/[email protected]
with:
path: /var/cache/dnf
key: ${{ github.job }}-dnf
- run: echo "keepcache=1" >> /etc/dnf/dnf.conf
- uses: actions/[email protected]
# Download and extract dependency archives created during prep
# job.
- uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a
with:
name: prep
path: prep
- run: tar xvf prep/libhtp.tar.gz
- run: tar xvf prep/suricata-update.tar.gz
- run: tar xvf prep/suricata-verify.tar.gz
- name: Install system packages
run: |
dnf -y install dnf-plugins-core epel-release
dnf config-manager --set-enabled crb
dnf -y install \
autoconf \
automake \
cargo-vendor \
cbindgen \
diffutils \
numactl-devel \
dpdk-devel \
file-devel \
gcc \
gcc-c++ \
git \
jansson-devel \
jq \
lua-devel \
libtool \
libyaml-devel \
libnfnetlink-devel \
libnetfilter_queue-devel \
libnet-devel \
libcap-ng-devel \
libevent-devel \
libmaxminddb-devel \
libpcap-devel \
libtool \
lz4-devel \
make \
nss-devel \
pcre2-devel \
pkgconfig \
python3-devel \
python3-sphinx \
python3-yaml \
rust-toolset \
sudo \
which \
zlib-devel
# These packages required to build the PDF.
dnf -y install \
texlive-latex \
texlive-cmap \
texlive-collection-latexrecommended \
texlive-fncychap \
texlive-titlesec \
texlive-tabulary \
texlive-framed \
texlive-wrapfig \
texlive-upquote \
texlive-capt-of \
texlive-needspace
#- name: Setup cppclean
# run: |
# git clone --depth 1 --branch suricata https://github.com/catenacyber/cppclean
# cd cppclean
# python3 setup.py install
- name: Configuring
run: |
./autogen.sh
CFLAGS="${DEFAULT_CFLAGS}" ./configure
- run: make -j2 distcheck
env:
DISTCHECK_CONFIGURE_FLAGS: "--enable-unittests --enable-debug --enable-lua --enable-geoip --enable-profiling --enable-profiling-locks --enable-dpdk"
- run: test -e doc/userguide/suricata.1
- name: Checking includes
run: |
cppclean src/*.h | grep "does not need to be #included" | python3 scripts/cppclean_check.py
- name: Building Rust documentation
run: make doc
working-directory: rust
- run: make install
- run: suricatasc -h
- run: suricata-update -V
- name: Check if Suricata-Update example configuration files are installed
run: |
test -e /usr/local/lib/suricata/python/suricata/update/configs/disable.conf
test -e /usr/local/lib/suricata/python/suricata/update/configs/drop.conf
test -e /usr/local/lib/suricata/python/suricata/update/configs/enable.conf
test -e /usr/local/lib/suricata/python/suricata/update/configs/modify.conf
test -e /usr/local/lib/suricata/python/suricata/update/configs/threshold.in
test -e /usr/local/lib/suricata/python/suricata/update/configs/update.yaml
- name: Build C json filetype plugin
working-directory: examples/plugins/c-json-filetype
run: make
- name: Check C json filetype plugin
run: test -e examples/plugins/c-json-filetype/.libs/json-filetype.so.0.0.0
- name: Installing headers and library
run: |
make install-headers
make install-library
- name: Test plugin build with Makefile.example
working-directory: examples/plugins/c-json-filetype
run: PATH=/usr/local/bin:$PATH make -f Makefile.example
almalinux-9-templates:
name: AlmaLinux 9 Test Templates
runs-on: ubuntu-latest
container: almalinux:9
needs: [prepare-deps]
steps:
- name: Cache RPMs
uses: actions/[email protected]
with:
path: /var/cache/dnf
# TODO: Find some variable that matches the job name.
key: almalinux-9-templates-dnf
- run: echo "keepcache=1" >> /etc/dnf/dnf.conf
# Cache Rust stuff.
- name: Cache cargo registry
uses: actions/[email protected]
with:
path: ~/.cargo/registry
key: cargo-registry
- uses: actions/[email protected]
# Download and extract dependency archives created during prep
# job.
- uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a
with:
name: prep
path: prep
- run: tar xvf prep/libhtp.tar.gz
- run: tar xvf prep/suricata-update.tar.gz
- run: tar xvf prep/suricata-verify.tar.gz
- name: Install system packages
run: |
dnf -y install dnf-plugins-core epel-release
dnf config-manager --set-enabled crb
dnf -y install \
autoconf \
automake \
cbindgen \
diffutils \
numactl-devel \
dpdk-devel \
file-devel \
gcc \
gcc-c++ \
git \
jansson-devel \
jq \
lua-devel \
libtool \
libyaml-devel \
libnfnetlink-devel \
libnetfilter_queue-devel \
libnet-devel \
libcap-ng-devel \
libevent-devel \
libmaxminddb-devel \
libpcap-devel \
libtool \
lz4-devel \
make \
nss-devel \
pcre2-devel \
pkgconfig \
python3-devel \
python3-sphinx \
python3-yaml \
sudo \
which \
zlib-devel
- run: curl https://sh.rustup.rs -sSf | sh -s -- --default-toolchain stable -y
- run: echo "$HOME/.cargo/bin" >> $GITHUB_PATH
- run: rustup component add rustfmt
- run: rustup component add clippy
- name: Build
run: |
./autogen.sh
CFLAGS="${DEFAULT_CFLAGS}" ./configure
make -j2
- run: ./scripts/setup-app-layer.py --parser --logger --detect FooBar payload
- run: make -j2
- run: ./src/suricata --list-app-layer-protos | grep foobar
- name: Verify rustfmt
run: rustfmt -v --check src/applayerfoobar/*.rs
working-directory: rust
- name: Verify clippy
run: cargo clippy --all-features
working-directory: rust
almalinux-8:
name: AlmaLinux 8
runs-on: ubuntu-latest
container: almalinux:8
needs: [prepare-deps, prepare-cbindgen]
steps:
# Cache Rust stuff.
- name: Cache cargo registry
uses: actions/[email protected]
with:
path: ~/.cargo
key: ${{ github.job }}-cargo
- name: Cache RPMs
uses: actions/[email protected]
with:
path: /var/cache/dnf
key: ${{ github.job }}-dnf
- run: echo "keepcache=1" >> /etc/dnf/dnf.conf
- uses: actions/[email protected]
# Prebuild check for duplicate SIDs
- name: Check for duplicate SIDs
run: |
dups=$(sed -n 's/^alert.*sid:\([[:digit:]]*\);.*/\1/p' ./rules/*.rules|sort|uniq -d|tr '\n' ' ')
if [[ "${dups}" != "" ]]; then
echo "::error::Duplicate SIDs found:${dups}"
exit 1
fi
# Download and extract dependency archives created during prep
# job.
- uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a
with:
name: prep
path: prep
- run: tar xvf prep/libhtp.tar.gz
- run: tar xvf prep/suricata-update.tar.gz
- run: tar xvf prep/suricata-verify.tar.gz
- name: Setup cbindgen
run: |
mkdir -p $HOME/.cargo/bin
cp prep/cbindgen $HOME/.cargo/bin
chmod 755 $HOME/.cargo/bin/cbindgen
echo "$HOME/.cargo/bin" >> $GITHUB_PATH
- name: Install system packages
run: |
yum -y install dnf-plugins-core
yum config-manager --set-enabled powertools
yum -y install \
autoconf \
automake \
cargo-vendor \
diffutils \
numactl-devel \
dpdk-devel \
file-devel \
gcc \
gcc-c++ \
git \
jansson-devel \
jq \
lua-devel \
libtool \
libyaml-devel \
libnfnetlink-devel \
libnetfilter_queue-devel \
libnet-devel \
libcap-ng-devel \
libevent-devel \
libmaxminddb-devel \
libpcap-devel \
libtool \
lz4-devel \
make \
nss-devel \
pcre2-devel \
pkgconfig \
python3-devel \
python3-yaml \
rust-toolset \
sudo \
which \
zlib-devel
- name: Configuring
run: |
./autogen.sh
CFLAGS="${DEFAULT_CFLAGS}" ./configure
- run: make -j2 check
- name: Checking includes
run: |
cppclean src/*.h | grep "does not need to be #included" | python3 scripts/cppclean_check.py
- run: make install
- run: suricatasc -h
- run: suricata-update -V
centos-stream9:
name: CentOS Stream 9
runs-on: ubuntu-latest
container: quay.io/centos/centos:stream9
needs: [prepare-deps, debian-12-dist]
steps:
# Cache Rust stuff.
- name: Cache cargo registry
uses: actions/[email protected]
with:
path: ~/.cargo
key: ${{ github.job }}-cargo
- name: Cache RPMs
uses: actions/[email protected]
with:
path: /var/cache/dnf
key: ${{ github.job }}-dnf
- run: echo "keepcache=1" >> /etc/dnf/dnf.conf
- name: Install system packages
run: |
dnf -y install dnf-plugins-core epel-release
dnf config-manager --set-enabled crb
dnf -y install \
autoconf \
automake \
cargo-vendor \
cbindgen \
diffutils \
numactl-devel \
dpdk-devel \
file-devel \
gcc \
gcc-c++ \
git \
jansson-devel \
jq \
lua-devel \
libtool \
libyaml-devel \
libnfnetlink-devel \
libnetfilter_queue-devel \
libnet-devel \
libcap-ng-devel \
libevent-devel \
libmaxminddb-devel \
libpcap-devel \
libtool \
lz4-devel \
make \
nss-devel \
pcre2-devel \
pkgconfig \
python3-devel \
python3-sphinx \
python3-yaml \
rust-toolset \
sudo \
which \
zlib-devel
- name: Download suricata.tar.gz
uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a
with:
name: dist
- run: tar zxvf suricata-*.tar.gz --strip-components=1
- name: ./configure
run: CFLAGS="${DEFAULT_CFLAGS}" ./configure
- run: make -j2
- run: make install
- run: make install-conf
- run: suricatasc -h
- run: suricata-update -V
- name: Check if Suricata-Update example configuration files are installed
run: |
test -e /usr/local/lib/suricata/python/suricata/update/configs/disable.conf
test -e /usr/local/lib/suricata/python/suricata/update/configs/drop.conf
test -e /usr/local/lib/suricata/python/suricata/update/configs/enable.conf
test -e /usr/local/lib/suricata/python/suricata/update/configs/modify.conf
test -e /usr/local/lib/suricata/python/suricata/update/configs/threshold.in
test -e /usr/local/lib/suricata/python/suricata/update/configs/update.yaml
- uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a
with:
name: prep
path: prep
- run: tar xf prep/suricata-verify.tar.gz
- run: python3 ./suricata-verify/run.py -q --debug-failed
- run: suricata-update -V
- run: suricatasc -h
centos-stream8:
name: CentOS Stream 8
runs-on: ubuntu-latest
container: quay.io/centos/centos:stream8
needs: [prepare-deps, debian-12-dist]
steps:
# Cache Rust stuff.
- name: Cache cargo registry
uses: actions/[email protected]
with:
path: ~/.cargo
key: ${{ github.job }}-cargo
- name: Cache RPMs
uses: actions/[email protected]
with:
path: /var/cache/dnf
key: ${{ github.job }}-dnf
- run: echo "keepcache=1" >> /etc/dnf/dnf.conf
- name: Install system packages
run: |
dnf -y install dnf-plugins-core epel-release
dnf config-manager --set-enabled powertools
dnf -y install \
autoconf \
automake \
diffutils \
numactl-devel \
dpdk-devel \
file-devel \
gcc \
gcc-c++ \
git \
jansson-devel \
jq \
lua-devel \
libtool \
libyaml-devel \
libnfnetlink-devel \
libnetfilter_queue-devel \
libnet-devel \
libcap-ng-devel \
libevent-devel \
libmaxminddb-devel \
libpcap-devel \
libtool \
lz4-devel \
make \
nss-devel \
pcre2-devel \
pkgconfig \
python3-devel \
python3-yaml \
rust-toolset \
sudo \
which \
zlib-devel
- name: Download suricata.tar.gz
uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a
with:
name: dist
- run: tar zxvf suricata-*.tar.gz --strip-components=1
- name: ./configure
run: CFLAGS="${DEFAULT_CFLAGS}" ./configure
- run: make -j2
- run: make install
- run: make install-conf
- run: suricatasc -h
- run: suricata-update -V
- name: Check if Suricata-Update example configuration files are installed
run: |
test -e /usr/local/lib/suricata/python/suricata/update/configs/disable.conf
test -e /usr/local/lib/suricata/python/suricata/update/configs/drop.conf
test -e /usr/local/lib/suricata/python/suricata/update/configs/enable.conf
test -e /usr/local/lib/suricata/python/suricata/update/configs/modify.conf
test -e /usr/local/lib/suricata/python/suricata/update/configs/threshold.in
test -e /usr/local/lib/suricata/python/suricata/update/configs/update.yaml
- uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a
with:
name: prep
path: prep
- run: tar xf prep/suricata-verify.tar.gz
- run: python3 ./suricata-verify/run.py -q --debug-failed
- run: suricata-update -V
- run: suricatasc -h
centos-7:
name: CentOS 7
runs-on: ubuntu-latest
container: centos:7
needs: [prepare-deps, debian-12-dist]
steps:
- name: Cache ~/.cargo
uses: actions/[email protected]
with:
path: ~/.cargo
key: ${{ github.job }}-cargo
- name: Cache RPMs
uses: actions/[email protected]
with:
path: /var/cache/yum
key: ${{ github.job }}-yum
- run: echo "keepcache=1" >> /etc/yum.conf
- name: Install system dependencies
run: |
yum -y install epel-release
yum -y install \
autoconf \
automake \
cargo \
diffutils \
file-devel \
gcc \
gcc-c++ \
jansson-devel \
jq \
lua-devel \
libtool \
libyaml-devel \
libnfnetlink-devel \
libnetfilter_queue-devel \
libnet-devel \
libcap-ng-devel \
libevent-devel \
libmaxminddb-devel \
libpcap-devel \
lz4-devel \
make \
nss-devel \
pcre2-devel \
pkgconfig \
python36-PyYAML \
rust \
sudo \
which \
zlib-devel
- name: Download suricata.tar.gz
uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a
with:
name: dist
- run: tar zxvf suricata-*.tar.gz --strip-components=1
# This isn't really needed as we are building from a prepared
# package, but some package managers like RPM and Debian like to
# run this command even on prepared packages, so make sure it
# works.
- name: Test autoreconf
run: autoreconf -fv --install
- run: CFLAGS="${DEFAULT_CFLAGS}" ./configure
- run: make -j2
- run: make install
- run: make install-conf
- run: make distcheck
- run: make clean
- run: make -j2
- uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a
with:
name: prep
path: prep
- run: tar xf prep/suricata-verify.tar.gz
- run: python3 ./suricata-verify/run.py -q --debug-failed
- run: suricata-update -V
- run: suricatasc -h
fedora-38-sv-codecov:
name: Fedora 38 (Suricata Verify codecov)
runs-on: ubuntu-latest
container: fedora:38
needs: [prepare-deps]
steps:
# Cache Rust stuff.
- name: Cache cargo registry
uses: actions/[email protected]
with:
path: ~/.cargo
key: ${{ github.job }}-cargo
- name: Cache RPMs
uses: actions/[email protected]
with:
path: /var/cache/dnf
key: ${{ github.job }}-dnf
- run: echo "keepcache=1" >> /etc/dnf/dnf.conf
- run: |
dnf -y install \
autoconf \
automake \
cbindgen \
ccache \
clang \
curl \
diffutils \
file-devel \
gcc \
gcc-c++ \
git \
hiredis-devel \
jansson-devel \
jq \
lua-devel \
libasan \
libtool \
libyaml-devel \
libnfnetlink-devel \
libnetfilter_queue-devel \
libnet-devel \
libcap-ng-devel \
libevent-devel \
libmaxminddb-devel \
libpcap-devel \
libtool \
llvm-devel \
lz4-devel \
make \
nss-softokn-devel \
pcre2-devel \
pkgconfig \
python3-yaml \
sudo \
which \
zlib-devel
# packaged Rust version has no profiler support built in, so get from rustup
- name: Install Rust
run: curl https://sh.rustup.rs -sSf | sh -s -- --default-toolchain 1.63.0 -y
- run: echo "$HOME/.cargo/bin" >> $GITHUB_PATH
- uses: actions/[email protected]
- uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a
with:
name: prep
path: prep
- run: tar xf prep/libhtp.tar.gz
- run: tar xf prep/suricata-update.tar.gz
- run: ./autogen.sh
- run: ./configure --disable-shared
env:
CC: "clang"
RUSTFLAGS: "-C instrument-coverage"
CFLAGS: "-fprofile-instr-generate -fcoverage-mapping -O0"
- run: make -j2
env:
CC: "clang"
RUSTFLAGS: "-C instrument-coverage"
CFLAGS: "-fprofile-instr-generate -fcoverage-mapping -O0"
- name: Extracting suricata-verify
run: tar xf prep/suricata-verify.tar.gz
- name: Running suricata-verify
run: python3 ./suricata-verify/run.py -q --debug-failed
- run: llvm-profdata merge -o default.profdata $(find suricata-verify/tests/ -name '*.profraw')
- run: llvm-cov show ./src/suricata -instr-profile=default.profdata --show-instantiations --ignore-filename-regex="^/root/.*" > coverage.txt
- name: Upload coverage to Codecov
uses: codecov/codecov-action@d9f34f8cd5cb3b3eb79b3e4b5dae3a16df499a70
with:
fail_ci_if_error: false
flags: suricata-verify
# Fedora 38 build using Clang.
fedora-38-clang:
name: Fedora 38 (clang, debug, asan, wshadow, rust-strict, systemd)
runs-on: ubuntu-latest
container: fedora:38
needs: [prepare-deps]
steps:
# Cache Rust stuff.
- name: Cache cargo registry
uses: actions/[email protected]
with:
path: ~/.cargo
key: ${{ github.job }}-cargo
- name: Cache RPMs
uses: actions/[email protected]
with:
path: /var/cache/dnf
key: ${{ github.job }}-dnf
- run: echo "keepcache=1" >> /etc/dnf/dnf.conf
- run: |
dnf -y install \
autoconf \
automake \
cargo \
cbindgen \
ccache \
clang \
coccinelle \
diffutils \
file-devel \
gcc \
gcc-c++ \
git \
hiredis-devel \
jansson-devel \
jq \
lua-devel \
libasan \
libtool \
libyaml-devel \
libnfnetlink-devel \
libnetfilter_queue-devel \
libnet-devel \
libcap-ng-devel \
libevent-devel \
libmaxminddb-devel \
libpcap-devel \
libxdp-devel \
libbpf-devel \
libtool \
lz4-devel \
make \
nss-softokn-devel \
pcre2-devel \
pkgconfig \
python \
python3-yaml \
sudo \
systemd-devel \
which \
zlib-devel
- uses: actions/[email protected]
- uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a
with:
name: prep
path: prep
- run: tar xf prep/libhtp.tar.gz
- run: tar xf prep/suricata-update.tar.gz
- run: ./autogen.sh
- run: CC="clang" CFLAGS="$DEFAULT_CFLAGS -Wshadow" ./configure --disable-shared --enable-coccinelle
- name: Running unit tests and cocci checks
# Set the concurrency level for cocci.
run: CONCURRENCY_LEVEL=2 make check
- run: make distclean
- run: CC="clang" CFLAGS="$DEFAULT_CFLAGS -Wshadow -fsanitize=address -fno-omit-frame-pointer" ./configure --enable-debug --enable-unittests --disable-shared --enable-rust-strict --enable-hiredis --enable-nfqueue --enable-lua
env:
LDFLAGS: "-fsanitize=address"
ac_cv_func_realloc_0_nonnull: "yes"
ac_cv_func_malloc_0_nonnull: "yes"
- run: make -j2
- run: ASAN_OPTIONS="detect_leaks=0" ./src/suricata -u -l .
- name: Extracting suricata-verify
run: tar xf prep/suricata-verify.tar.gz
- name: Running suricata-verify
run: python3 ./suricata-verify/run.py -q --debug-failed
# Now install and make sure headers and libraries aren't
# installed until requested.
- run: make install
- run: test ! -e /usr/local/lib/libsuricata_c.a
- run: test ! -e /usr/local/include/suricata
- run: make install-headers
- run: test -e /usr/local/include/suricata/suricata.h
- run: make install-library
- run: test -e /usr/local/lib/libsuricata_c.a
- run: test -e /usr/local/lib/libsuricata_rust.a
- run: test -e /usr/local/bin/libsuricata-config
- run: test ! -e /usr/local/lib/libsuricata.so
- run: make install
- run: suricata-update -V
- run: suricatasc -h
# Check compilation against systemd
- run: ldd src/suricata | grep libsystemd &> /dev/null
# Fedora 38 build using GCC.
fedora-38-gcc:
name: Fedora 38 (gcc, debug, asan, wshadow, rust-strict)
runs-on: ubuntu-latest
container: fedora:38
needs: [prepare-deps]
steps:
# Cache Rust stuff.
- name: Cache cargo registry
uses: actions/[email protected]
with:
path: ~/.cargo/registry
key: cargo-registry
- run: |
dnf -y install \
autoconf \
automake \
cargo \
cbindgen \
ccache \
diffutils \
file-devel \
gcc \
gcc-c++ \
git \
hiredis-devel \
jansson-devel \
jq \
lua-devel \
libasan \
libtool \
libyaml-devel \
libnfnetlink-devel \
libnetfilter_queue-devel \
libnet-devel \
libcap-ng-devel \
libevent-devel \
libmaxminddb-devel \
libpcap-devel \
libtool \
lz4-devel \
make \
nss-softokn-devel \
pcre2-devel \
pkgconfig \
python3-yaml \
sudo \
which \
zlib-devel
- uses: actions/[email protected]
- uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a
with:
name: prep
path: prep
- run: tar xf prep/libhtp.tar.gz
- run: tar xf prep/suricata-update.tar.gz
- run: ./autogen.sh
- run: ./configure --enable-debug --enable-unittests --disable-shared --enable-rust-strict --enable-hiredis --enable-nfqueue
env:
CFLAGS: "${{ env.DEFAULT_CFLAGS }} -Wshadow -fsanitize=address -fno-omit-frame-pointer"
LDFLAGS: "-fsanitize=address"
ac_cv_func_realloc_0_nonnull: "yes"
ac_cv_func_malloc_0_nonnull: "yes"
- run: make -j2
- run: ASAN_OPTIONS="detect_leaks=0" ./src/suricata -u -l .
- name: Extracting suricata-verify
run: tar xf prep/suricata-verify.tar.gz
- name: Running suricata-verify
run: python3 ./suricata-verify/run.py -q --debug-failed
# Now install and make sure headers and libraries aren't
# installed until requested.
- run: make install
- run: test ! -e /usr/local/lib/libsuricata_c.a
- run: test ! -e /usr/local/include/suricata
- run: make install-headers
- run: test -e /usr/local/include/suricata/suricata.h
- run: make install-library
- run: test -e /usr/local/lib/libsuricata_c.a
- run: test -e /usr/local/lib/libsuricata_rust.a
- run: test -e /usr/local/bin/libsuricata-config
- run: test ! -e /usr/local/lib/libsuricata.so
- run: make install
- run: suricata-update -V
- run: suricatasc -h
# Fedora 39 build using Clang.
fedora-39-clang:
name: Fedora 39 (clang, debug, asan, wshadow, rust-strict, systemd)
runs-on: ubuntu-latest
container: fedora:39
needs: [prepare-deps, prepare-cbindgen]
steps:
# Cache Rust stuff.
- name: Cache cargo registry
uses: actions/[email protected]
with:
path: ~/.cargo
key: ${{ github.job }}-cargo
- name: Cache RPMs
uses: actions/[email protected]
with:
path: /var/cache/dnf
key: ${{ github.job }}-dnf
- run: echo "keepcache=1" >> /etc/dnf/dnf.conf
- run: |
dnf -y install \
autoconf \
automake \
cargo \
cbindgen \
ccache \
clang \
diffutils \
file-devel \
gcc \
gcc-c++ \
git \
hiredis-devel \
jansson-devel \
jq \
lua-devel \
libasan \
libtool \
libyaml-devel \
libnfnetlink-devel \
libnetfilter_queue-devel \
libnet-devel \
libcap-ng-devel \
libevent-devel \
libmaxminddb-devel \
libpcap-devel \
libxdp-devel \
libbpf-devel \
libtool \
lz4-devel \
make \
nss-softokn-devel \
pcre2-devel \
pkgconfig \
python3-yaml \
sudo \
systemd-devel \
which \
zlib-devel
- uses: actions/[email protected]
- uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a
with:
name: prep
path: prep
- run: tar xf prep/libhtp.tar.gz
- run: tar xf prep/suricata-update.tar.gz
- run: ./autogen.sh
- run: CC="clang" CFLAGS="$DEFAULT_CFLAGS -Wshadow -fsanitize=address -fno-omit-frame-pointer" ./configure --enable-debug --enable-unittests --disable-shared --enable-rust-strict --enable-hiredis --enable-nfqueue --enable-lua
env:
LDFLAGS: "-fsanitize=address"
ac_cv_func_realloc_0_nonnull: "yes"
ac_cv_func_malloc_0_nonnull: "yes"
- run: make -j2
- run: ASAN_OPTIONS="detect_leaks=0" ./src/suricata -u -l .
- name: Extracting suricata-verify
run: tar xf prep/suricata-verify.tar.gz
- name: Running suricata-verify
run: python3 ./suricata-verify/run.py -q --debug-failed
# Now install and make sure headers and libraries aren't install
# until requested.
- run: make install
- run: test ! -e /usr/local/lib/libsuricata_c.a
- run: test ! -e /usr/local/include/suricata
- run: make install-headers
- run: test -e /usr/local/include/suricata/suricata.h
- run: make install-library
- run: test -e /usr/local/lib/libsuricata_c.a
- run: test -e /usr/local/lib/libsuricata_rust.a
- run: test -e /usr/local/bin/libsuricata-config
- run: test ! -e /usr/local/lib/libsuricata.so
- run: make install
- run: suricata-update -V
- run: suricatasc -h
# Check compilation against systemd
- run: ldd src/suricata | grep libsystemd &> /dev/null
# Fedora 39 build using GCC.
fedora-39-gcc:
name: Fedora 39 (gcc, debug, asan, wshadow, rust-strict)
runs-on: ubuntu-latest
container: fedora:39
needs: [prepare-deps, prepare-cbindgen]
steps:
# Cache Rust stuff.
- name: Cache cargo registry
uses: actions/[email protected]
with:
path: ~/.cargo/registry
key: cargo-registry
- run: |
dnf -y install \
autoconf \
automake \
cargo \
cbindgen \
ccache \
diffutils \
file-devel \
gcc \
gcc-c++ \
git \
hiredis-devel \
jansson-devel \
jq \
lua-devel \
libasan \
libtool \
libyaml-devel \
libnfnetlink-devel \
libnetfilter_queue-devel \
libnet-devel \
libcap-ng-devel \
libevent-devel \
libmaxminddb-devel \
libpcap-devel \
libtool \
lz4-devel \
make \
nss-softokn-devel \
pcre2-devel \
pkgconfig \
python3-yaml \
sudo \
which \
zlib-devel
- uses: actions/[email protected]
- uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a
with:
name: prep
path: prep
- run: tar xf prep/libhtp.tar.gz
- run: tar xf prep/suricata-update.tar.gz
- run: ./autogen.sh
- run: ./configure --enable-debug --enable-unittests --disable-shared --enable-rust-strict --enable-hiredis --enable-nfqueue
env:
CFLAGS: "${{ env.DEFAULT_CFLAGS }} -Wshadow -fsanitize=address -fno-omit-frame-pointer"
LDFLAGS: "-fsanitize=address"
ac_cv_func_realloc_0_nonnull: "yes"
ac_cv_func_malloc_0_nonnull: "yes"
- run: make -j2
- run: ASAN_OPTIONS="detect_leaks=0" ./src/suricata -u -l .
- name: Extracting suricata-verify
run: tar xf prep/suricata-verify.tar.gz
- name: Running suricata-verify
run: python3 ./suricata-verify/run.py -q --debug-failed
# Now install and make sure headers and libraries aren't install
# until requested.
- run: make install
- run: test ! -e /usr/local/lib/libsuricata_c.a
- run: test ! -e /usr/local/include/suricata
- run: make install-headers
- run: test -e /usr/local/include/suricata/suricata.h
- run: make install-library
- run: test -e /usr/local/lib/libsuricata_c.a
- run: test -e /usr/local/lib/libsuricata_rust.a
- run: test -e /usr/local/bin/libsuricata-config
- run: test ! -e /usr/local/lib/libsuricata.so
- run: make install
- run: suricata-update -V
- run: suricatasc -h
# This job builds and tests Suricata as a non-root user as some
# issues only show up when not running as root, and by default all
# jobs in GitHub actions are run as root inside the container.
fedora-39-non-root:
name: Fedora 39 (non-root, debug, clang, asan, wshadow, rust-strict, systemd)
runs-on: ubuntu-latest
container: fedora:39
needs: [prepare-deps]
steps:
- run: |
dnf -y install \
autoconf \
automake \
cargo \
cbindgen \
ccache \
clang \
diffutils \
file-devel \
gcc \
gcc-c++ \
git \
hiredis-devel \
jansson-devel \
jq \
lua-devel \
libasan \
libtool \
libyaml-devel \
libnfnetlink-devel \
libnetfilter_queue-devel \
libnet-devel \
libcap-ng-devel \
libevent-devel \
libmaxminddb-devel \
libpcap-devel \
libtool \
lz4-devel \
make \
nss-softokn-devel \
pcre2-devel \
pkgconfig \
python3-yaml \
sudo \
systemd-devel \
which \
zlib-devel
- run: adduser suricata
- uses: actions/[email protected]
- uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a
with:
name: prep
path: prep
- run: tar xf prep/libhtp.tar.gz
- run: tar xf prep/suricata-update.tar.gz
- run: tar xf prep/suricata-verify.tar.gz
- run: mkdir /home/suricata/suricata
- run: cp -a . /home/suricata/suricata
- run: chown -R suricata:suricata /home/suricata
- run: sudo -u suricata -s ./autogen.sh
working-directory: /home/suricata/suricata
- run: sudo -u suricata -s env PATH="/home/suricata/.cargo/bin:$PATH" ./configure --enable-debug --enable-unittests --disable-shared --enable-rust-strict --enable-hiredis --enable-nfqueue
working-directory: /home/suricata/suricata
env:
ac_cv_func_realloc_0_nonnull: "yes"
ac_cv_func_malloc_0_nonnull: "yes"
LDFLAGS: "-fsanitize=address"
CC: "clang"
CFLAGS: "${{ env.DEFAULT_CFLAGS }} -Wshadow -fsanitize=address -fno-omit-frame-pointer"
- run: sudo -u suricata -s env PATH="/home/suricata/.cargo/bin:$PATH" make -j2
working-directory: /home/suricata/suricata
- run: sudo -u suricata -s make check
working-directory: /home/suricata/suricata
- run: sudo -u suricata -s python3 ./suricata-verify/run.py -q --debug-failed
working-directory: /home/suricata/suricata
# Test that ./configure fails out of libjansson is not available.
almalinux-9-no-jansson:
name: AlmaLinux 9 (no jansson)
runs-on: ubuntu-latest
container: almalinux:9
needs: [prepare-deps]
steps:
# Cache Rust stuff.
- name: Cache cargo registry
uses: actions/[email protected]
with:
path: ~/.cargo
key: ${{ github.job }}-cargo
- name: Cache RPMs
uses: actions/[email protected]
with:
path: /var/cache/dnf
key: ${{ github.job }}-dnf
- run: echo "keepcache=1" >> /etc/dnf/dnf.conf
- run: |
dnf -y install dnf-plugins-core epel-release
dnf config-manager --set-enable crb
dnf -y install \
autoconf \
automake \
cargo \
cbindgen \
clang \
diffutils \
file-devel \
gcc \
gcc-c++ \
git \
lua-devel \
libasan \
libtool \
libyaml-devel \
libnfnetlink-devel \
libnetfilter_queue-devel \
libnet-devel \
libcap-ng-devel \
libevent-devel \
libmaxminddb-devel \
libpcap-devel \
libtool \
lz4-devel \
make \
nss-softokn-devel \
pcre2-devel \
pkgconfig \
python3-yaml \
sudo \
which \
zlib-devel
- uses: actions/[email protected]
- uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a
with:
name: prep
path: prep
- run: tar xf prep/libhtp.tar.gz
- run: ./autogen.sh
- run: |
if ./configure; then
echo "error: configure should have failed"
exit 1
else
exit 0
fi
ubuntu-22-04-cov-ut:
name: Ubuntu 22.04 (unittests coverage)
runs-on: ubuntu-latest
container: ubuntu:22.04
needs: [prepare-deps, prepare-cbindgen]
steps:
- name: Cache ~/.cargo
uses: actions/[email protected]
with:
path: ~/.cargo
key: ${{ github.job }}-cargo
- name: Install dependencies
run: |
apt update
apt -y install \
libpcre2-dev \
build-essential \
autoconf \
automake \
clang-14 \
curl \
git \
jq \
libtool \
libpcap-dev \
libnet1-dev \
libyaml-0-2 \
libyaml-dev \
libcap-ng-dev \
libcap-ng0 \
libmagic-dev \
libnetfilter-queue-dev \
libnetfilter-queue1 \
libnfnetlink-dev \
libnfnetlink0 \
libnuma-dev \
libhiredis-dev \
libhyperscan-dev \
liblua5.1-dev \
libjansson-dev \
libevent-dev \
libevent-pthreads-2.1-7 \
libjansson-dev \
libpython2.7 \
llvm-14-dev \
make \
parallel \
python3-yaml \
software-properties-common \
zlib1g \
zlib1g-dev \
exuberant-ctags \
curl \
dpdk-dev
# packaged Rust version is too old for coverage, so get from rustup
- name: Install Rust
run: curl https://sh.rustup.rs -sSf | sh -s -- --default-toolchain 1.63.0 -y
- uses: actions/[email protected]
- uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a
with:
name: prep
path: prep
- run: tar xf prep/libhtp.tar.gz
- name: Setup cbindgen
run: |
mkdir -p $HOME/.cargo/bin
cp prep/cbindgen $HOME/.cargo/bin
chmod 755 $HOME/.cargo/bin/cbindgen
echo "$HOME/.cargo/bin" >> $GITHUB_PATH
- run: ./autogen.sh
- run: ./configure --disable-shared --enable-unittests
env:
CC: "clang-14"
CXX: "clang++-14"
RUSTFLAGS: "-C instrument-coverage"
CFLAGS: "-fprofile-instr-generate -fcoverage-mapping -O0"
CXXFLAGS: "-fprofile-instr-generate -fcoverage-mapping -O0"
- run: make -j2
env:
CC: "clang-14"
CXX: "clang++-14"
RUSTFLAGS: "-C instrument-coverage"
CFLAGS: "-fprofile-instr-generate -fcoverage-mapping -O0"
CXXFLAGS: "-fprofile-instr-generate -fcoverage-mapping -O0"
- run: ./src/suricata -u -l /tmp/
env:
LLVM_PROFILE_FILE: "/tmp/ut.profraw"
- run: llvm-profdata-14 merge -o ut.profdata /tmp/ut.profraw
- run: llvm-cov-14 show ./src/suricata -instr-profile=ut.profdata --show-instantiations --ignore-filename-regex="^/root/.*" > coverage.txt
- run: |
cd rust
cargo test --no-run
cd ..
env:
RUSTFLAGS: "-C instrument-coverage"
CARGO_INCREMENTAL: 0
- run: |
$(find rust/target/debug/deps/ -type f -regex 'rust/target/debug/deps/suricata\-[a-z0-9]+$')
env:
LLVM_PROFILE_FILE: "/tmp/ct.profraw"
CARGO_INCREMENTAL: 0
- run: llvm-profdata-14 merge -o ct.profdata /tmp/ct.profraw
- run: llvm-cov-14 show $(find rust/target/debug/deps/ -type f -regex 'rust/target/debug/deps/suricata\-[a-z0-9]+$') -instr-profile=ct.profdata --show-instantiations --ignore-filename-regex="^/root/.*" >> coverage.txt
- run: |
cd libhtp
make test
cd ..
env:
LLVM_PROFILE_FILE: "/tmp/htp-test.profraw"
- run: llvm-profdata-14 merge -o htp-test.profdata /tmp/htp-test.profraw
- run: llvm-cov-14 show libhtp/test/test_all -instr-profile=htp-test.profdata --show-instantiations --ignore-filename-regex="^/root/.*" >> coverage.txt
- name: Upload coverage to Codecov
uses: codecov/codecov-action@d9f34f8cd5cb3b3eb79b3e4b5dae3a16df499a70
with:
fail_ci_if_error: false
flags: unittests
ubuntu-22-04-cov-fuzz:
name: Ubuntu 22.04 (fuzz corpus coverage)
runs-on: ubuntu-latest
container: ubuntu:22.04
needs: [prepare-deps, prepare-cbindgen]
steps:
- name: Cache ~/.cargo
uses: actions/[email protected]
with:
path: ~/.cargo
key: ${{ github.job }}-cargo
- name: Install dependencies
run: |
apt update
apt -y install \
libpcre2-dev \
build-essential \
autoconf \
automake \
llvm-14-dev \
clang-14 \
git \
jq \
libc++-dev \
libc++abi-dev \
libtool \
libpcap-dev \
libnet1-dev \
libyaml-0-2 \
libyaml-dev \
libcap-ng-dev \
libcap-ng0 \
libmagic-dev \
libnetfilter-queue-dev \
libnetfilter-queue1 \
libnfnetlink-dev \
libnfnetlink0 \
libnuma-dev \
libhiredis-dev \
liblua5.1-dev \
libjansson-dev \
libevent-dev \
libevent-pthreads-2.1-7 \
libjansson-dev \
libpython2.7 \
make \
parallel \
python3-yaml \
software-properties-common \
zlib1g \
zlib1g-dev \
exuberant-ctags \
unzip \
curl \
time \
wget \
dpdk-dev
# packaged Rust version is too old for coverage, so get from rustup
- name: Install Rust
run: curl https://sh.rustup.rs -sSf | sh -s -- --default-toolchain 1.63.0 -y
- uses: actions/[email protected]
- uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a
with:
name: prep
path: prep
- run: tar xf prep/libhtp.tar.gz
- name: Setup cbindgen
run: |
mkdir -p $HOME/.cargo/bin
cp prep/cbindgen $HOME/.cargo/bin
chmod 755 $HOME/.cargo/bin/cbindgen
echo "$HOME/.cargo/bin" >> $GITHUB_PATH
- run: ./autogen.sh
- run: ./configure --with-gnu-ld --enable-fuzztargets --disable-shared --enable-gccprotect
env:
LIB_FUZZING_ENGINE: "fail_to_onefile_driver"
CC: "clang-14"
CXX: "clang++-14"
RUSTFLAGS: "-C instrument-coverage"
CFLAGS: "-fprofile-instr-generate -fcoverage-mapping -O0 -g -fno-strict-aliasing -fsanitize=address -fno-omit-frame-pointer -fPIC -Wno-unused-parameter -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION=1 -Wimplicit-int-float-conversion -Wimplicit-int-conversion -Werror"
CXXFLAGS: "-fprofile-instr-generate -fcoverage-mapping -O0 -g -fno-strict-aliasing -fsanitize=address -fno-omit-frame-pointer -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION=1 -stdlib=libc++ -Wimplicit-int-float-conversion -Wimplicit-int-conversion"
ac_cv_func_malloc_0_nonnull: "yes"
ac_cv_func_realloc_0_nonnull: "yes"
- run: make -j2
env:
CC: "clang-14"
CXX: "clang++-14"
RUSTFLAGS: "-C instrument-coverage"
- run: ./qa/run-ossfuzz-corpus.sh
- run: llvm-profdata-14 merge -o default.profdata $(find /tmp/ -name '*.profraw')
- run: llvm-cov-14 show ./src/suricata -instr-profile=default.profdata --show-instantiations --ignore-filename-regex="^/root/.*" > coverage.txt
- name: Upload coverage to Codecov
uses: codecov/codecov-action@d9f34f8cd5cb3b3eb79b3e4b5dae3a16df499a70
with:
fail_ci_if_error: false
flags: fuzzcorpus
ubuntu-20-04-ndebug:
name: Ubuntu 20.04 (-DNDEBUG)
runs-on: ubuntu-latest
container: ubuntu:20.04
needs: [prepare-deps, prepare-cbindgen]
steps:
- name: Cache ~/.cargo
uses: actions/[email protected]
with:
path: ~/.cargo
key: ${{ github.job }}-cargo
- name: Install dependencies
run: |
apt update
apt -y install \
build-essential \
autoconf \
automake \
cargo \
git \
jq \
libtool \
libpcap-dev \
libnet1-dev \
libyaml-0-2 \
libyaml-dev \
libcap-ng-dev \
libcap-ng0 \
libmagic-dev \
libnetfilter-queue-dev \
libnetfilter-queue1 \
libnfnetlink-dev \
libnfnetlink0 \
libnuma-dev \
libhiredis-dev \
libjansson-dev \
libevent-dev \
libevent-pthreads-2.1-7 \
libjansson-dev \
libpython2.7 \
libpcre2-dev \
make \
parallel \
python3-yaml \
rustc \
software-properties-common \
zlib1g \
zlib1g-dev \
exuberant-ctags \
dpdk-dev
- uses: actions/[email protected]
- uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a
with:
name: prep
path: prep
- run: tar xf prep/libhtp.tar.gz
- run: tar xf prep/suricata-update.tar.gz
- name: Setup cbindgen
run: |
mkdir -p $HOME/.cargo/bin
cp prep/cbindgen $HOME/.cargo/bin
chmod 755 $HOME/.cargo/bin/cbindgen
echo "$HOME/.cargo/bin" >> $GITHUB_PATH
- run: ./autogen.sh
- run: CFLAGS="$DEFAULT_CFLAGS -DNDEBUG" ./configure --enable-unittests
- run: make -j2
- run: make check
- run: make dist
- name: Extracting suricata-verify
run: tar xf prep/suricata-verify.tar.gz
- name: Running suricata-verify
run: python3 ./suricata-verify/run.py -q --debug-failed
# Now install and make sure headers and libraries aren't install
# until requested.
- run: make install
- run: test ! -e /usr/local/lib/libsuricata_c.a
- run: test ! -e /usr/local/include/suricata
- run: make install-headers
- run: test -e /usr/local/include/suricata/suricata.h
- run: make install-library
- run: test -e /usr/local/lib/libsuricata_c.a
- run: test -e /usr/local/lib/libsuricata_rust.a
- run: test -e /usr/local/bin/libsuricata-config
- run: test -e /usr/local/lib/libsuricata.so
- run: test -e /usr/local/lib/$(readlink /usr/local/lib/libsuricata.so)
- run: suricata-update -V
- run: suricatasc -h
ubuntu-20-04-too-old-rust:
name: Ubuntu 20.04 (unsupported rust)
runs-on: ubuntu-latest
container: ubuntu:20.04
needs: debian-12-dist
steps:
- name: Cache ~/.cargo
uses: actions/[email protected]
with:
path: ~/.cargo
key: ${{ github.job }}-cargo
- name: Install dependencies
run: |
apt update
apt -y install \
build-essential \
curl \
libtool \
libpcap-dev \
libnet1-dev \
libyaml-0-2 \
libyaml-dev \
libcap-ng-dev \
libcap-ng0 \
libmagic-dev \
libnetfilter-queue-dev \
libnetfilter-queue1 \
libnfnetlink-dev \
libnfnetlink0 \
libnuma-dev \
libhiredis-dev \
libjansson-dev \
libevent-dev \
libevent-pthreads-2.1-7 \
libjansson-dev \
libpython2.7 \
libpcre2-dev \
make \
python3-yaml \
software-properties-common \
zlib1g \
zlib1g-dev \
dpdk-dev
- run: curl https://sh.rustup.rs -sSf | sh -s -- --default-toolchain 1.62.0 -y
- run: echo "$HOME/.cargo/bin" >> $GITHUB_PATH
- name: Download suricata.tar.gz
uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a
with:
name: dist
- run: tar zxvf suricata-*.tar.gz --strip-components=1
- run: |
if ./configure; then
echo "error: configure should have failed"
exit 1
else
exit 0
fi
ubuntu-22-04-debug-validation:
name: Ubuntu 22.04 (Debug Validation)
runs-on: ubuntu-22.04
container: ubuntu:22.04
needs: [prepare-deps, prepare-cbindgen]
steps:
# Cache Rust stuff.
- name: Cache cargo registry
uses: actions/[email protected]
with:
path: ~/.cargo
key: ${{ github.job }}-cargo
- name: Install dependencies
run: |
apt update
apt -y install \
libpcre2-dev \
build-essential \
autoconf \
automake \
cargo \
git \
jq \
libtool \
libpcap-dev \
libnet1-dev \
libyaml-0-2 \
libyaml-dev \
libcap-ng-dev \
libcap-ng0 \
libmagic-dev \
libnetfilter-queue-dev \
libnetfilter-queue1 \
libnfnetlink-dev \
libnfnetlink0 \
libhiredis-dev \
libjansson-dev \
libevent-dev \
libevent-pthreads-2.1-7 \
libjansson-dev \
libpython2.7 \
make \
parallel \
python3-yaml \
rustc \
software-properties-common \
zlib1g \
zlib1g-dev \
exuberant-ctags
- uses: actions/[email protected]
- uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a
with:
name: prep
path: prep
- run: tar xf prep/libhtp.tar.gz
- name: Setup cbindgen
run: |
mkdir -p $HOME/.cargo/bin
cp prep/cbindgen $HOME/.cargo/bin
chmod 755 $HOME/.cargo/bin/cbindgen
echo "$HOME/.cargo/bin" >> $GITHUB_PATH
- run: ./autogen.sh
- run: ./configure --enable-debug-validation
env:
CFLAGS: "${{ env.DEFAULT_CFLAGS }} -Wshadow -fsanitize=address -fno-omit-frame-pointer"
LDFLAGS: "-fsanitize=address"
ac_cv_func_malloc_0_nonnull: "yes"
ac_cv_func_realloc_0_nonnull: "yes"
- run: make -j2
- run: make check
- name: Extracting suricata-verify
run: tar xf prep/suricata-verify.tar.gz
- name: Running suricata-verify
run: python3 ./suricata-verify/run.py -q --debug-failed
# test build with afl and fuzztargets
ubuntu-22-04-fuzz:
name: Ubuntu 22.04 (Fuzz)
runs-on: ubuntu-22.04
container: ubuntu:22.04
needs: [prepare-deps, prepare-cbindgen]
steps:
# Cache Rust stuff.
- name: Cache cargo registry
uses: actions/[email protected]
with:
path: ~/.cargo
key: ${{ github.job }}-cargo
- name: Install dependencies
run: |
apt update
apt -y install \
afl \
afl-clang \
libpcre2-dev \
build-essential \
autoconf \
automake \
cargo \
git \
libtool \
libpcap-dev \
libnet1-dev \
libyaml-0-2 \
libyaml-dev \
libcap-ng-dev \
libcap-ng0 \
libmagic-dev \
libnetfilter-queue-dev \
libnetfilter-queue1 \
libnfnetlink-dev \
libnfnetlink0 \
libhiredis-dev \
libjansson-dev \
libjansson-dev \
libpython2.7 \
make \
rustc \
software-properties-common \
zlib1g \
zlib1g-dev
- run: echo "$HOME/.cargo/bin" >> $GITHUB_PATH
- uses: actions/[email protected]
- uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a
with:
name: prep
path: prep
- run: tar xf prep/libhtp.tar.gz
- name: Setup cbindgen
run: |
mkdir -p $HOME/.cargo/bin
cp prep/cbindgen $HOME/.cargo/bin
chmod 755 $HOME/.cargo/bin/cbindgen
echo "$HOME/.cargo/bin" >> $GITHUB_PATH
- run: ./autogen.sh
- run: AFL_HARDEN=1 ac_cv_func_realloc_0_nonnull=yes ac_cv_func_malloc_0_nonnull=yes CFLAGS="-fsanitize=address -fno-omit-frame-pointer" CXXFLAGS=$CFLAGS CC=afl-clang-fast CXX=afl-clang-fast++ LDFLAGS="-fsanitize=address" ./configure --enable-fuzztargets --disable-shared
- run: AFL_HARDEN=1 make -j2
ubuntu-22-04-netmap-build:
name: Ubuntu 22.04 (Netmap build)
needs: [prepare-deps, prepare-cbindgen]
runs-on: ubuntu-22.04
steps:
# Cache Rust stuff.
- name: Cache cargo registry
uses: actions/[email protected]
with:
path: ~/.cargo/registry
key: cargo-registry
- name: Install dependencies
run: |
sudo apt update
sudo apt -y install \
libpcre2-dev \
build-essential \
autoconf \
automake \
cargo \
git \
jq \
libtool \
libpcap-dev \
libnet1-dev \
libyaml-0-2 \
libyaml-dev \
libcap-ng-dev \
libcap-ng0 \
libmagic-dev \
libnetfilter-queue-dev \
libnetfilter-queue1 \
libnfnetlink-dev \
libnfnetlink0 \
libhiredis-dev \
libjansson-dev \
libevent-dev \
libevent-pthreads-2.1-7 \
libjansson-dev \
libpython2.7 \
make \
parallel \
python3-yaml \
rustc \
software-properties-common \
zlib1g \
zlib1g-dev \
exuberant-ctags
- name: Install Netmap dependencies
run: |
sudo apt -y install \
build-essential \
git \
linux-headers-$(uname -r)
- name: Checkout Netmap repository
uses: actions/[email protected]
with:
repository: luigirizzo/netmap
# gets cloned to $GITHUB_WORKSPACE/netmap/
path: netmap/
- name: Compile and install Netmap
run: |
cd $GITHUB_WORKSPACE/netmap/LINUX
./configure --no-drivers
make -j2
sudo make install
- uses: actions/[email protected]
- uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a
with:
name: prep
path: prep
- run: tar xf prep/libhtp.tar.gz
- name: Setup cbindgen
run: |
mkdir -p $HOME/.cargo/bin
cp prep/cbindgen $HOME/.cargo/bin
chmod 755 $HOME/.cargo/bin/cbindgen
echo "$HOME/.cargo/bin" >> $GITHUB_PATH
- run: ./autogen.sh
- run: CFLAGS="${DEFAULT_CFLAGS}" ./configure --enable-netmap
- run: make -j2
- run: ./src/suricata --build-info | grep -E "Netmap support:\s+yes"
ubuntu-22-04-dpdk-build:
name: Ubuntu 22.04 (DPDK Build)
runs-on: ubuntu-22.04
container: ubuntu:22.04
needs: [ prepare-deps, prepare-cbindgen ]
strategy:
matrix:
dpdk_version: [ 22.11.3, 21.11.5, 20.11.9, 19.11.14 ]
steps:
# Cache Rust stuff.
- name: Cache cargo registry
uses: actions/[email protected]
with:
path: ~/.cargo/registry
key: cargo-registry
- name: Install dependencies
run: |
apt update
apt -y install \
libpcre2-dev \
build-essential \
autoconf \
automake \
cargo \
git \
jq \
libtool \
libpcap-dev \
libnet1-dev \
libyaml-0-2 \
libyaml-dev \
libcap-ng-dev \
libcap-ng0 \
libmagic-dev \
libnetfilter-queue-dev \
libnetfilter-queue1 \
libnfnetlink-dev \
libnfnetlink0 \
libhiredis-dev \
libjansson-dev \
libevent-dev \
libevent-pthreads-2.1-7 \
libjansson-dev \
libpython2.7 \
make \
parallel \
python3-yaml \
rustc \
software-properties-common \
zlib1g \
zlib1g-dev \
exuberant-ctags
- name: Install DPDK dependencies
run: |
apt update
apt install -y \
curl \
build-essential \
libnuma-dev \
ninja-build \
meson \
python3-pip \
python3-pyelftools \
python3-setuptools \
python3-wheel
- name: Compile and install DPDK
run: |
cd $HOME
rm -rf dpdk_${{ matrix.dpdk_version }}
find /usr/ -name 'librte_*.a' -delete
mkdir -p dpdk_${{ matrix.dpdk_version }} && cd dpdk_${{ matrix.dpdk_version }}
curl -fsLS https://fast.dpdk.org/rel/dpdk-${{ matrix.dpdk_version }}.tar.xz | tar -xJ --strip-components=1
rm -rf build/
meson setup -Dtests=false --prefix=/usr/ build
ninja -C build
ninja -C build install
ldconfig
cd $HOME
- uses: actions/[email protected]
- uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a
with:
name: prep
path: prep
- run: tar xf prep/libhtp.tar.gz
- name: Setup cbindgen
run: |
mkdir -p $HOME/.cargo/bin
cp prep/cbindgen $HOME/.cargo/bin
chmod 755 $HOME/.cargo/bin/cbindgen
echo "$HOME/.cargo/bin" >> $GITHUB_PATH
- run: ./autogen.sh
- run: CFLAGS="${DEFAULT_CFLAGS}" ./configure --enable-dpdk
- run: make -j2
- run: make check
debian-12:
name: Debian 12
runs-on: ubuntu-latest
container: debian:12
needs: [prepare-deps]
steps:
# Cache Rust stuff.
- name: Cache cargo registry
uses: actions/[email protected]
with:
path: ~/.cargo
key: ${{ github.job }}-cargo
- run: apt update
- run: |
apt -y install \
autoconf \
automake \
build-essential \
cargo \
cbindgen \
cmake \
curl \
dpdk-dev \
git \
jq \
make \
libpcre3 \
libpcre3-dbg \
libpcre3-dev \
libpcre2-dev \
libtool \
libpcap-dev \
libnet1-dev \
libyaml-0-2 \
libyaml-dev \
libcap-ng-dev \
libcap-ng0 \
libmagic-dev \
libmaxminddb-dev \
libjansson-dev \
libjansson4 \
liblua5.1-dev \
libnspr4-dev \
libnuma-dev \
liblz4-dev \
libssl-dev \
liblzma-dev \
pkg-config \
python3 \
python3-yaml \
rustc \
sphinx-doc \
sphinx-common \
texlive-latex-base \
texlive-fonts-recommended \
texlive-fonts-extra \
texlive-latex-extra \
zlib1g \
zlib1g-dev
- uses: actions/[email protected]
- uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a
with:
name: prep
path: prep
- run: tar xf prep/libhtp.tar.gz
- run: tar xf prep/suricata-update.tar.gz
- run: tar xf prep/suricata-verify.tar.gz
- run: ./autogen.sh
- run: CFLAGS="${DEFAULT_CFLAGS}" ./configure --enable-unittests
- run: make -j2
- run: make check
# -j2 caused random failures during cargo vendor
- run: make distcheck
env:
DISTCHECK_CONFIGURE_FLAGS: "--enable-unittests --enable-debug --enable-lua --enable-geoip --enable-profiling --enable-profiling-locks --enable-dpdk"
- run: test -e doc/userguide/suricata.1
- run: test -e doc/userguide/userguide.pdf
- name: Building Rust documentation
run: make doc
working-directory: rust
- name: Running suricata-verify
run: python3 ./suricata-verify/run.py -q --debug-failed
- run: make install
- run: suricata-update -V
- run: suricatasc -h
debian-12-dist:
name: Debian 12 Dist Builder
runs-on: ubuntu-latest
container: debian:12
needs: [prepare-deps]
steps:
# Cache Rust stuff.
- name: Cache cargo registry
uses: actions/[email protected]
with:
path: ~/.cargo
key: ${{ github.job }}-cargo
- run: apt update
- run: |
apt -y install \
autoconf \
automake \
build-essential \
cargo \
cbindgen \
cmake \
curl \
git \
jq \
make \
libpcre3 \
libpcre3-dbg \
libpcre3-dev \
libpcre2-dev \
libtool \
libpcap-dev \
libnet1-dev \
libyaml-0-2 \
libyaml-dev \
libcap-ng-dev \
libcap-ng0 \
libmagic-dev \
libjansson-dev \
libjansson4 \
libnspr4-dev \
liblz4-dev \
libssl-dev \
liblzma-dev \
pkg-config \
python3 \
python3-yaml \
rustc \
sphinx-doc \
sphinx-common \
texlive-latex-base \
texlive-fonts-recommended \
texlive-fonts-extra \
texlive-latex-extra \
zlib1g \
zlib1g-dev
- uses: actions/[email protected]
- uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a
with:
name: prep
path: prep
- run: tar xf prep/libhtp.tar.gz
- run: tar xf prep/suricata-update.tar.gz
- run: ./autogen.sh
- run: CFLAGS="${DEFAULT_CFLAGS}" ./configure
- run: make dist
- run: test -e doc/userguide/suricata.1
- run: test -e doc/userguide/userguide.pdf
- name: Preparing distribution
run: |
mkdir dist
mv suricata-*.tar.gz dist
- uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce
name: Uploading distribution
with:
name: dist
path: dist
debian-12-msrv:
name: Debian 12 MSRV
runs-on: ubuntu-latest
container: debian:12
needs: [prepare-deps, prepare-cbindgen]
steps:
# Cache Rust stuff.
- name: Cache cargo registry
uses: actions/[email protected]
with:
path: ~/.cargo
key: ${{ github.job }}-cargo
- run: apt update
- run: |
apt -y install \
autoconf \
automake \
build-essential \
cmake \
curl \
dpdk-dev \
git \
jq \
make \
libpcre3 \
libpcre3-dbg \
libpcre3-dev \
libpcre2-dev \
libtool \
libpcap-dev \
libnet1-dev \
libyaml-0-2 \
libyaml-dev \
libcap-ng-dev \
libcap-ng0 \
libmagic-dev \
libmaxminddb-dev \
libjansson-dev \
libjansson4 \
liblua5.1-dev \
libnspr4-dev \
libnuma-dev \
liblz4-dev \
libssl-dev \
liblzma-dev \
pkg-config \
python3 \
python3-yaml \
sphinx-doc \
sphinx-common \
texlive-latex-base \
texlive-fonts-recommended \
texlive-fonts-extra \
texlive-latex-extra \
zlib1g \
zlib1g-dev
- name: Install Rust
run: curl https://sh.rustup.rs -sSf | sh -s -- --default-toolchain ${RUST_VERSION_MIN} -y
- run: echo "$HOME/.cargo/bin" >> $GITHUB_PATH
- uses: actions/[email protected]
- uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a
with:
name: prep
path: prep
- name: Setup cbindgen
run: |
mkdir -p $HOME/.cargo/bin
cp prep/cbindgen $HOME/.cargo/bin
chmod 755 $HOME/.cargo/bin/cbindgen
- run: tar xf prep/libhtp.tar.gz
- run: tar xf prep/suricata-update.tar.gz
- run: tar xf prep/suricata-verify.tar.gz
- run: ./autogen.sh
- run: CFLAGS="${DEFAULT_CFLAGS}" ./configure --enable-unittests --enable-debug --enable-lua --enable-geoip --enable-profiling --enable-profiling-locks --enable-dpdk
- run: make -j2
- run: make check
- name: Building Rust documentation
run: make doc
working-directory: rust
- name: Running suricata-verify
run: python3 ./suricata-verify/run.py -q --debug-failed
- run: make install
- run: suricata-update -V
- run: suricatasc -h
debian-11:
name: Debian 11 (xdp)
runs-on: ubuntu-latest
container: debian:11
needs: [prepare-deps, prepare-cbindgen]
steps:
# Cache Rust stuff.
- name: Cache cargo registry
uses: actions/[email protected]
with:
path: ~/.cargo
key: ${{ github.job }}-cargo
- run: |
echo "deb http://deb.debian.org/debian bullseye-backports main" >> /etc/apt/sources.list
apt update
apt -y install \
automake \
autoconf \
build-essential \
ccache \
curl \
git \
gosu \
jq \
libpcre2-dev \
libpcap-dev \
libnet1-dev \
libyaml-0-2 \
libyaml-dev \
libcap-ng-dev \
libcap-ng0 \
libmagic-dev \
libjansson-dev \
libgeoip-dev \
liblua5.1-dev \
libhiredis-dev \
libevent-dev \
libtool \
m4 \
make \
python3-yaml \
pkg-config \
sudo \
zlib1g \
zlib1g-dev \
clang \
libbpf-dev \
libelf-dev \
libxdp-dev
- name: Install Rust
run: curl https://sh.rustup.rs -sSf | sh -s -- --default-toolchain $RUST_VERSION_KNOWN -y
- run: echo "$HOME/.cargo/bin" >> $GITHUB_PATH
- uses: actions/[email protected]
- uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a
with:
name: prep
path: prep
- run: tar xf prep/libhtp.tar.gz
- run: tar xf prep/suricata-update.tar.gz
- name: Setup cbindgen
run: |
mkdir -p $HOME/.cargo/bin
cp prep/cbindgen $HOME/.cargo/bin
chmod 755 $HOME/.cargo/bin/cbindgen
- run: ./autogen.sh
- run: CFLAGS="${DEFAULT_CFLAGS}" ./configure --enable-unittests --enable-fuzztargets --enable-ebpf --enable-ebpf-build
- run: make -j2
- run: make check
- run: tar xf prep/suricata-verify.tar.gz
- name: Running suricata-verify
run: python3 ./suricata-verify/run.py -q --debug-failed
- run: make install
- run: suricata-update -V
- run: suricatasc -h
debian-10:
name: Debian 10
runs-on: ubuntu-latest
container: debian:10
needs: [prepare-deps, prepare-cbindgen]
steps:
# Cache Rust stuff.
- name: Cache cargo registry
uses: actions/[email protected]
with:
path: ~/.cargo
key: ${{ github.job }}-cargo
- run: |
apt update
apt -y install \
automake \
autoconf \
build-essential \
ccache \
curl \
git \
gosu \
jq \
libpcre2-dev \
libpcap-dev \
libnet1-dev \
libyaml-0-2 \
libyaml-dev \
libcap-ng-dev \
libcap-ng0 \
libmagic-dev \
libjansson-dev \
libgeoip-dev \
liblua5.1-dev \
libhiredis-dev \
libevent-dev \
libtool \
m4 \
make \
python3-yaml \
pkg-config \
sudo \
zlib1g \
zlib1g-dev \
clang \
libelf-dev
- name: Install Rust
run: curl https://sh.rustup.rs -sSf | sh -s -- --default-toolchain $RUST_VERSION_KNOWN -y
- run: echo "$HOME/.cargo/bin" >> $GITHUB_PATH
- uses: actions/[email protected]
- uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a
with:
name: prep
path: prep
- run: tar xf prep/libhtp.tar.gz
- run: tar xf prep/suricata-update.tar.gz
- name: Setup cbindgen
run: |
mkdir -p $HOME/.cargo/bin
cp prep/cbindgen $HOME/.cargo/bin
chmod 755 $HOME/.cargo/bin/cbindgen
- run: ./autogen.sh
- run: CFLAGS="${DEFAULT_CFLAGS}" ./configure --enable-unittests --enable-fuzztargets
- run: make -j2
- run: make check
- run: tar xf prep/suricata-verify.tar.gz
- name: Running suricata-verify
run: python3 ./suricata-verify/run.py -q --debug-failed
- run: make install
- run: suricata-update -V
- run: suricatasc -h
macos-latest:
name: MacOS Latest
runs-on: macos-latest
needs: [prepare-deps]
steps:
# Cache Rust stuff.
- name: Cache cargo registry
uses: actions/[email protected]
with:
path: ~/.cargo
key: ${{ github.job }}-cargo
- run: |
brew install \
autoconf \
automake \
curl \
hiredis \
jansson \
jq \
libmagic \
libnet \
libtool \
libyaml \
lua \
pkg-config \
python \
rust \
xz
- name: Install cbindgen
run: cargo install --debug --version 0.24.3 cbindgen
- run: echo "$HOME/.cargo/bin" >> $GITHUB_PATH
- run: pip3 install PyYAML
- uses: actions/[email protected]
- name: Downloading prep archive
uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a
with:
name: prep
path: prep
- run: tar xvf prep/libhtp.tar.gz
- run: tar xvf prep/suricata-update.tar.gz
- run: ./autogen.sh
- run: CFLAGS="${DEFAULT_CFLAGS}" ./configure --enable-unittests
- run: make -j2
# somehow it gets included by some C++ stdlib header (case unsensitive)
- run: rm libhtp/VERSION && make check
- run: tar xf prep/suricata-verify.tar.gz
- name: Running suricata-verify
run: python3 ./suricata-verify/run.py -q --debug-failed
- run: make install
- run: suricata-update -V
- run: suricatasc -h
windows-msys2-mingw64-npcap:
name: Windows MSYS2 MINGW64 (NPcap)
runs-on: windows-latest
needs: [prepare-deps]
defaults:
run:
shell: msys2 {0}
steps:
- name: Cache ~/.cargo
uses: actions/[email protected]
with:
path: ~/.cargo
key: ${{ github.job }}-cargo
- uses: actions/[email protected]
- uses: msys2/setup-msys2@v2
with:
msystem: MINGW64
update: true
install: git mingw-w64-x86_64-toolchain automake1.16 automake-wrapper autoconf libtool libyaml-devel pcre2-devel jansson-devel make mingw-w64-x86_64-libyaml mingw-w64-x86_64-pcre2 mingw-w64-x86_64-rust mingw-w64-x86_64-jansson unzip p7zip python-setuptools mingw-w64-x86_64-python-yaml mingw-w64-x86_64-jq mingw-w64-x86_64-libxml2
# hack: install our own cbindgen system wide as we can't get the
# preinstalled one to be picked up by configure
- name: cbindgen
run: cargo install --root /usr --force --debug --version 0.24.3 cbindgen
- uses: actions/[email protected]
- uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a
with:
name: prep
path: prep
- run: tar xf prep/libhtp.tar.gz
- run: tar xf prep/suricata-update.tar.gz
- name: Npcap DLL
run: |
curl -sL -O https://nmap.org/npcap/dist/npcap-1.00.exe
7z -y x -o/npcap-bin npcap-1.00.exe
# hack: place dlls in cwd
cp /npcap-bin/*.dll .
- name: Npcap SDK
run: |
curl -sL -O https://nmap.org/npcap/dist/npcap-sdk-1.06.zip
unzip npcap-sdk-1.06.zip -d /npcap
cp /npcap/Lib/x64/* /usr/lib/
- run: tar xf prep/suricata-verify.tar.gz
- name: Build
run: |
./autogen.sh
CFLAGS="-ggdb -Werror" ./configure --enable-unittests --enable-gccprotect --disable-gccmarch-native --disable-shared --with-libpcap-includes=/npcap/Include --with-libpcap-libraries=/npcap/Lib/x64
make -j3
- name: Run
run: |
./src/suricata --build-info
./src/suricata -u -l /tmp/
# need cwd in path due to npcap dlls (see above)
PATH="$PATH:$(pwd)" python3 ./suricata-verify/run.py -q --debug-failed
- run: make install
- run: suricata-update -V
windows-msys2-mingw64-libpcap:
name: Windows MSYS2 MINGW64 (libpcap)
runs-on: windows-latest
needs: [prepare-deps]
defaults:
run:
shell: msys2 {0}
steps:
- name: Cache ~/.cargo
uses: actions/[email protected]
with:
path: ~/.cargo
key: ${{ github.job }}-cargo
- uses: actions/[email protected]
- uses: msys2/setup-msys2@v2
with:
msystem: MINGW64
update: true
install: git mingw-w64-x86_64-toolchain automake1.16 automake-wrapper autoconf libtool libyaml-devel pcre2-devel jansson-devel make mingw-w64-x86_64-libyaml mingw-w64-x86_64-pcre2 mingw-w64-x86_64-rust mingw-w64-x86_64-jansson unzip p7zip python-setuptools mingw-w64-x86_64-python-yaml mingw-w64-x86_64-jq mingw-w64-x86_64-libxml2 libpcap-devel mingw-w64-x86_64-libpcap
# hack: install our own cbindgen system wide as we can't get the
# preinstalled one to be picked up by configure
- name: cbindgen
run: cargo install --root /usr --force --debug --version 0.24.3 cbindgen
- uses: actions/[email protected]
- uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a
with:
name: prep
path: prep
- run: tar xf prep/libhtp.tar.gz
- run: tar xf prep/suricata-update.tar.gz
- run: tar xf prep/suricata-verify.tar.gz
- name: Build
run: |
./autogen.sh
CFLAGS="-ggdb -Werror" ./configure --enable-unittests --enable-gccprotect --disable-gccmarch-native --disable-shared --with-libpcap-includes=/npcap/Include --with-libpcap-libraries=/npcap/Lib/x64
make -j3
- name: Run
run: |
./src/suricata --build-info
./src/suricata -u -l /tmp/
python3 ./suricata-verify/run.py -q --debug-failed
- run: make install
- run: suricata-update -V
windows-msys2-mingw64-windivert:
name: Windows MSYS2 MINGW64 (WinDivert)
runs-on: windows-latest
needs: [prepare-deps]
defaults:
run:
shell: msys2 {0}
steps:
- name: Cache ~/.cargo
uses: actions/[email protected]
with:
path: ~/.cargo
key: ${{ github.job }}-cargo
- uses: actions/[email protected]
- uses: msys2/setup-msys2@v2
with:
msystem: MINGW64
update: true
install: git mingw-w64-x86_64-toolchain automake1.16 automake-wrapper autoconf libtool libyaml-devel pcre2-devel jansson-devel make mingw-w64-x86_64-libyaml mingw-w64-x86_64-pcre2 mingw-w64-x86_64-rust mingw-w64-x86_64-jansson unzip p7zip python-setuptools mingw-w64-x86_64-python-yaml mingw-w64-x86_64-jq mingw-w64-x86_64-libxml2 libpcap-devel mingw-w64-x86_64-libpcap
# hack: install our own cbindgen system wide as we can't get the
# preinstalled one to be picked up by configure
- name: cbindgen
run: cargo install --root /usr --force --debug --version 0.24.3 cbindgen
- uses: actions/[email protected]
- uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a
with:
name: prep
path: prep
- run: tar xf prep/libhtp.tar.gz
- name: WinDivert
run: |
curl -sL -O https://github.com/basil00/Divert/releases/download/v1.4.3/WinDivert-1.4.3-A.zip
unzip WinDivert-1.4.3-A.zip -d /windivert
cp /windivert/WinDivert-1.4.3-A/x86_64/* /usr/lib/
# hack: place dlls in cwd
cp /windivert/WinDivert-1.4.3-A/x86_64/*.dll .
- name: Build
run: |
./autogen.sh
CFLAGS="-ggdb -Werror" ./configure --enable-gccprotect --disable-gccmarch-native --disable-shared --enable-windivert --with-windivert-include=/windivert/WinDivert-1.4.3-A/include --with-windivert-libraries=/windivert/WinDivert-1.4.3-A/x86_64
make -j3
- name: Run
run: |
# need cwd in path due to dlls (see above)
PATH="$PATH:$(pwd)" ./src/suricata --build-info
- run: make install