SCTP decoder and sticky buffers v2 by glongo · Pull Request #15226 · OISF/suricata

glongo · 2026-04-19T14:43:24Z

Link to ticket: https://redmine.openinfosecfoundation.org/issues/4251

Describe changes:

SCTP decoder extracts up to 16 chunk types
sctp.chunk_type matches on one for the chunks extracted
Replaced decoder-sctp.c#L166 with const SCTPHdr *sctph = PacketSetSCTP(p, pkt);
Replaced decoder-sctp.c#L145 with hlen = SCTP_HEADER_LEN + MIN(offset, len);
Replaced pkthdr with sctp in rules/sctp-events.rules
sctp.has_init matches only on INIT (INIT_ACK removed)

Previous PR: #15129

Extend the SCTP decoder to parse chunk headers after the 12-byte common header. Each chunk is validated for minimum header size and length consistency per RFC 4960 sec 3.2. Add SCTPChunkHdr and SCTPVars structs to track per-packet chunk metadata Add five new decoder events for protocol violations: - SCTP_CHUNK_TOO_SMALL: insufficient data for a chunk header - SCTP_CHUNK_LEN_INVALID: chunk length < 4 or exceeds packet - SCTP_INIT_CHUNK_NOT_ALONE: INIT/INIT_ACK bundled (RFC 4960 sec 6.10) - SCTP_INIT_WITH_NON_ZERO_VTAG: INIT with vtag != 0 (RFC 4960 sec 8.5.1) - SCTP_DATA_WITH_ZERO_VTAG: DATA chunk with vtag == 0 Ticket OISF#4251

Implement a sticky buffer to match the raw SCTP header (common header + chunks) Ticket OISF#4251

Add a U8 numeric keyword to match the first SCTP chunk type in a packet with prefilter support. Ticket OISF#4251

Add a U8 numeric keyword to match the number of SCTP chunks parsed in a packet with prefilter support. Ticket OISF#4251

Add a U32 numeric keyword to match the SCTP verification tag from the common header with prefilter support. Ticket OISF#4251

Add a boolean NOOPT keyword to match SCTP packets containing an INIT or INIT_ACK chunk. Ticket OISF#4251

Add a boolean NOOPT keyword to match SCTP packets containing a DATA chunk. Ticket OISF#4251

Add a boolean NOOPT keyword to match SCTP packets containing an ABORT chunk. Ticket OISF#4251

Log SCTP-specific fields in the EVE JSON "sctp" object for alert events. Ticket OISF#4251

Track the first DATA chunk's data offset and length during chunk iteration, then reassign p->payload to point at the user data. When no DATA chunk is present (INIT, SACK, HEARTBEAT, etc.), payload_len is set to 0 since there is no application data. Ticket OISF#4251

Add a sctp.data sticky buffer that allows content matching on the bytes inside the first SCTP DATA chunk. Ticket OISF#4251

Add documentation for all sctp keywords. Ticket OISF#4251

codecov · 2026-04-19T15:22:43Z

Codecov Report

❌ Patch coverage is 90.24691% with 79 lines in your changes missing coverage. Please review.
✅ Project coverage is 82.69%. Comparing base (214e47b) to head (6b23469).

Additional details and impacted files

@@           Coverage Diff            @@
##             main   #15226    +/-   ##
========================================
  Coverage   82.68%   82.69%            
========================================
  Files         993     1010    +17     
  Lines      271880   272682   +802     
========================================
+ Hits       224807   225493   +686     
- Misses      47073    47189   +116

Flag	Coverage Δ
fuzzcorpus	`60.98% <46.89%> (-0.03%)`	⬇️
livemode	`18.38% <20.98%> (+0.01%)`	⬆️
netns	`22.61% <20.98%> (-0.02%)`	⬇️
pcap	`45.25% <43.26%> (-0.05%)`	⬇️
suricata-verify	`66.29% <73.57%> (-0.04%)`	⬇️
unittests	`58.91% <80.49%> (+0.06%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

glongo · 2026-04-19T15:42:00Z

+sctp.chunk_type
+---------------
+
+Match on the type of the first SCTP chunk in the packet.


forgot to update this doc

glongo · 2026-04-19T15:43:55Z

clang-format is formatting the code weirdly:

diff --git a/src/tests/detect-sctp-chunk-type.c b/src/tests/detect-sctp-chunk-type.c
index 958c132f0..c921ac415 100644
--- a/src/tests/detect-sctp-chunk-type.c
+++ b/src/tests/detect-sctp-chunk-type.c
@@ -46,18 +46,56 @@ static int DetectSCTPChunkTypeParseTest01(void)
 static int DetectSCTPChunkTypeMatchNonFirstTest(void)
 {
     uint8_t raw_sctp[] = {
-        0x04, 0xd2, 0x00, 0x50, /* sport=1234, dport=80 */
-        0x00, 0x00, 0x00, 0x01, /* vtag=1 */
-        0x00, 0x00, 0x00, 0x00, /* checksum=0 */
+        0x04,
+        0xd2,
+        0x00,
+        0x50, /* sport=1234, dport=80 */
+        0x00,
+        0x00,
+        0x00,
+        0x01, /* vtag=1 */
+        0x00,
+        0x00,
+        0x00,
+        0x00, /* checksum=0 */
         /* DATA chunk: type=0x00, flags=0x03, len=20 */
-        0x00, 0x03, 0x00, 0x14, 0x00, 0x00, 0x00, 0x00, /* TSN=0 */
-        0x00, 0x01, 0x00, 0x00,                         /* stream_id=1, stream_seq=0 */
-        0x00, 0x00, 0x00, 0x00,                         /* PPID=0 */
-        0x41, 0x42, 0x43, 0x44,                         /* data="ABCD" */
+        0x00,
+        0x03,
+        0x00,
+        0x14,
+        0x00,
+        0x00,
+        0x00,
+        0x00, /* TSN=0 */

suricata-qa · 2026-04-19T17:05:03Z

Information: QA ran without warnings.

Pipeline = 30979

victorjulien · 2026-04-20T07:05:10Z

Array like this can be wrapped in clang-format off/on

victorjulien · 2026-04-20T08:55:01Z

+void DetectSCTPDataRegister(void)
+{
+    sigmatch_table[DETECT_SCTP_DATA].name = "sctp.data";
+    sigmatch_table[DETECT_SCTP_DATA].desc = "sticky buffer to match on the SCTP DATA chunk payload";


I think this should be sctp.chunk_data to clearly indicate it's not reassembled.

And it also should be a multibuffer so we can inspect each chunk that may be in the packet, not just the first.

jufajardini

Inline, a few things docs / schema related.

I tried to check whether the progress-tracking for buffer keywords work (8f82445) would be relevant here, but it doesn't seem so. (In any case, highlighting, in case I'm wrong and in the chance it's unknown)

jufajardini · 2026-04-22T14:48:33Z

+Match if the SCTP packet contains an INIT or INIT_ACK chunk. This is a
+boolean keyword that takes no arguments.


Is this piece also missing an update (based on previous PR's review comments)?

jufajardini · 2026-04-22T14:50:25Z

+            "properties": {
+                "chunk_cnt": {
+                    "type": "integer",
+                    "suricata": {


This is probably the best time to also add a description to these, isn't it? :P

jufajardini · 2026-04-22T14:51:36Z

+                        "init": {
+                            "type": "integer",
+                            "description": "Number of SCTP packets with INIT or INIT_ACK chunk"
+                        },


Has this been decoupled? (as per the counter below and https://github.com/OISF/suricata/pull/15129/changes#r3021634492)

jufajardini · 2026-04-22T14:54:05Z

@@ -0,0 +1,8 @@
+# SCTP decoder event rules.
+# SID's fall in the 2200000+ range. See http://doc.emergingthreats.net/bin/view/Main/SidAllocation


2200000+ seems too generic, looking at examples from some other app-proto event rules (ldap, pgsql, ftp...) and the 2200130.. 2200135 sids present here.

catenacyber

Looks like there are remarks to be taken care of like the clang-format off

catenacyber · 2026-04-24T11:51:32Z

+
+Syntax::
+
+ sctp.chunk_type:[op]<number>


Do these chunk-types have a stringer ?

catenacyber · 2026-04-24T11:52:19Z

+sctp.has_init
+-------------
+
+Match if the SCTP packet contains an INIT or INIT_ACK chunk. This is a


Why a dedicated keyword instead of sctp.chunk_type:INIT; ?

catenacyber · 2026-04-24T11:53:41Z


 alert ipv4 any any -> any any (msg:"SURICATA IPv4 unknown protocol"; decode-event:ipv4.unknown_protocol; threshold: type limit, track by_src, seconds 60, count 1;classtype:protocol-command-decode; sid:2200125;)
-# next sid is 2200130
+# next sid is 2200136


catenacyber · 2026-04-24T11:54:26Z

+                                               "(msg:\"test\"; sctp.chunk_cnt:>5; sid:2;)"));
+
+    FAIL_IF_NOT_NULL(DetectEngineAppendSig(de_ctx, "alert sctp any any -> any any "
+                                                   "(msg:\"test\"; sctp.chunk_cnt:bar; sid:3;)"));


Is it not better to do SV tests than unit tests ?

catenacyber · 2026-04-24T11:54:52Z

+/** \test match on a non-first chunk: bundled [DATA, SACK], match sctp.chunk_type:3 */
+static int DetectSCTPChunkTypeMatchNonFirstTest(void)
+{
+    uint8_t raw_sctp[] = {


This looks even more like it should be a SV test

catenacyber · 2026-04-24T11:56:09Z

+#define SCTP_DATA_CHUNK_HDR_LEN 16
+
+/* SCTP chunk types (RFC 4960 sec 3.2) */
+#define SCTP_CHUNK_TYPE_DATA              0x00


Looks like we have a stringer :-)

Did you think about trying rust here ?

catenacyber · 2026-04-24T11:57:07Z

-    sigmatch_table[transform_id].Transform = (void (*)(DetectEngineThreadCtx * det_ctx,
-            InspectionBuffer * buffer, const void *options)) kw->Transform;
+    sigmatch_table[transform_id].Transform = (void (*)(DetectEngineThreadCtx *det_ctx,
+            InspectionBuffer *buffer, const void *options))kw->Transform;


You have a too recent clang-format ;-)

catenacyber · 2026-04-24T11:58:18Z

+
+    const DetectU8Data *data = (const DetectU8Data *)ctx;
+    const uint8_t cnt = MIN(p->l4.vars.sctp.chunk_cnt, SCTP_MAX_TRACKED_CHUNKS);
+    for (uint8_t i = 0; i < cnt; i++) {


Looks like you could try to implement SIGMATCH_INFO_MULTI_UINT ;-)

catenacyber · 2026-04-24T11:58:56Z

+
+static int DetectSCTPChunkTypeSetup(DetectEngineCtx *de_ctx, Signature *s, const char *str)
+{
+    if (!(DetectProtoContainsProto(s->proto, IPPROTO_SCTP)))


Could I not write alert ip any any -> any any (sctp.chunk_type: 1;) ?

glongo added 13 commits April 19, 2026 15:59

detect/sctp: add sctp.hdr sticky buffer

3f45efd

Implement a sticky buffer to match the raw SCTP header (common header + chunks) Ticket OISF#4251

detect/sctp: add sctp.chunk_type keyword

7746409

Add a U8 numeric keyword to match the first SCTP chunk type in a packet with prefilter support. Ticket OISF#4251

detect/sctp: add sctp.chunk_cnt detection keyword

e9b38b1

Add a U8 numeric keyword to match the number of SCTP chunks parsed in a packet with prefilter support. Ticket OISF#4251

detect/sctp: add sctp.vtag keyword

6efc9b9

Add a U32 numeric keyword to match the SCTP verification tag from the common header with prefilter support. Ticket OISF#4251

detect/sctp: add sctp.has_init keyword

3c9ac9b

Add a boolean NOOPT keyword to match SCTP packets containing an INIT or INIT_ACK chunk. Ticket OISF#4251

detect/sctp: add sctp.has_data keyword

b411b27

Add a boolean NOOPT keyword to match SCTP packets containing a DATA chunk. Ticket OISF#4251

detect/sctp: add sctp.has_abort keyword

1f0be7a

Add a boolean NOOPT keyword to match SCTP packets containing an ABORT chunk. Ticket OISF#4251

output/json: add sctp metadata to alerts

a0a7bc3

Log SCTP-specific fields in the EVE JSON "sctp" object for alert events. Ticket OISF#4251

detect/sctp: add sctp.data sticky buffer

aa72e23

Add a sctp.data sticky buffer that allows content matching on the bytes inside the first SCTP DATA chunk. Ticket OISF#4251

doc/sctp: add sctp keywords

1d2b890

Add documentation for all sctp keywords. Ticket OISF#4251

detect-engine/helper: clang-format

6b23469

glongo requested review from a team, jufajardini and victorjulien as code owners April 19, 2026 14:43

This was referenced Apr 19, 2026

tests: add test for sctp keywords OISF/suricata-verify#2999

Open

SCTP decoder and sticky buffers v1 #15129

Closed

glongo commented Apr 19, 2026

View reviewed changes

victorjulien reviewed Apr 20, 2026

View reviewed changes

jufajardini reviewed Apr 22, 2026

View reviewed changes

catenacyber requested changes Apr 24, 2026

View reviewed changes

catenacyber reviewed Apr 24, 2026

View reviewed changes

catenacyber added the needs rebase Needs rebase to main label Apr 27, 2026

		Match if the SCTP packet contains an INIT or INIT_ACK chunk. This is a
		boolean keyword that takes no arguments.

		@@ -0,0 +1,8 @@
		# SCTP decoder event rules.
		# SID's fall in the 2200000+ range. See http://doc.emergingthreats.net/bin/view/Main/SidAllocation


		Syntax::

		sctp.chunk_type:[op]<number>

Conversation

glongo commented Apr 19, 2026

Uh oh!

codecov Bot commented Apr 19, 2026

Codecov Report

Uh oh!

Choose a reason for hiding this comment

Uh oh!

glongo commented Apr 19, 2026

Uh oh!

suricata-qa commented Apr 19, 2026

Uh oh!

victorjulien commented Apr 20, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jufajardini left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

catenacyber left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

5 participants