Skip to content

Conversation

@jlucovsky
Copy link
Contributor

Continuation of #14009

Use unique variable names for each flowvar as they come from a global
namespace. The chosen name is: sid:<signature_id>;buffer:<buffer-name>;instance:<instance#>

Describe changes:

  • Use a unique name for flowvar by appending the signature id to the name and the occurrence value. The occurrence values start from 1 and are significant if multiple entropy values are used in a single rule. They start from 1.

Entropy values will be logged into an array named entropy.

Each array element will look like this:

    {"sid":2,"buffer":"file_data","instance":1,"value":4.137370175000773}

Updates:

  • Add a config setting to control whether unique names are generated: logging.entropy.make-unique
  • Document new configuration setting and how output is affected.
  • Disambiguate entropy output by adding the instance number.
  • Changed variable name to sid:<signature_id>;buffer:<buffer-name>;instance:<instance#>
  • Represent multiple entropy values in an array.
  • Output log format changed
  • Removed jsonbuilder changes
  • Fixed ASAN issue
  • Updated JSON schema -- sorted keys properly
  • Removed atoi; replaced with SCStringParseU32RangeCheck
  • Fixed double-free issue (cocci detected)
  • Rebased (see detect/entropy: Unique flowvar names #14009)

Issue: 7814

Link to ticket: https://redmine.openinfosecfoundation.org/issues/7814

Provide values to any of the below to override the defaults.

  • To use a Suricata-Verify or Suricata-Update pull request,
    link to the pull request in the respective _BRANCH variable.
  • Leave unused overrides blank or remove.

SV_REPO=
SV_BRANCH=OISF/suricata-verify#2588
SU_REPO=
SU_BRANCH=

Issue: 7814

Support unique flow variable names for entropy-related values.

Since this is a breaking change from Suricata 8, unique names
are configurable (default value off) with this setting

        logging:
          entropy:
            make-unique: on

When `make-unique` is on, entropy-related flow variable names are
structured as:
     sid:<sid>;buffer:<buffer>;instance:<instance>

Instance is a small integer value corresponding to the number of
entropy values in the rule. The first entropy usage will create a flow
variable with an instance value of 1; the second will use 2, and so
on. This is necessary to disambiguate the flow variable names.

When `make-unique` is off (default = off), this format is used:
     <sticky_buffer>
Discuss the new configuration variable that provides unique
names for entropy values in logging output: logging.entropy.make-unique

Issue: 7814
@codecov
Copy link

codecov bot commented Nov 10, 2025

Codecov Report

❌ Patch coverage is 85.93750% with 9 lines in your changes missing coverage. Please review.
✅ Project coverage is 84.17%. Comparing base (6bd3605) to head (a0af50f).

Additional details and impacted files
@@           Coverage Diff           @@
##             main   #14309   +/-   ##
=======================================
  Coverage   84.17%   84.17%           
=======================================
  Files        1012     1012           
  Lines      261868   261924   +56     
=======================================
+ Hits       220421   220470   +49     
- Misses      41447    41454    +7     
Flag Coverage Δ
fuzzcorpus 63.30% <14.06%> (-0.02%) ⬇️
livemode 18.76% <0.00%> (-0.02%) ⬇️
pcap 44.63% <0.00%> (-0.02%) ⬇️
suricata-verify 64.95% <84.37%> (+0.03%) ⬆️
unittests 59.21% <0.00%> (-0.02%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@suricata-qa
Copy link

Information: QA ran without warnings.

Pipeline = 28430

@victorjulien
Copy link
Member

I feel like we need to address https://redmine.openinfosecfoundation.org/issues/4707 as well with this work, as we're now going to be exposing the messy internal buffer names more formally to the users.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

3 participants