suricata

# Suricata

[![Fuzzing Status](https://oss-fuzz-build-logs.storage.googleapis.com/badges/suricata.svg)](https://bugs.chromium.org/p/oss-fuzz/issues/list?sort=-opened&can=1&q=proj:suricata)
[![codecov](https://codecov.io/gh/OISF/suricata/branch/main/graph/badge.svg?token=QRyyn2BSo1)](https://codecov.io/gh/OISF/suricata)

## Introduction

[Suricata](https://suricata.io) is a network IDS, IPS and NSM engine
developed by the [OISF](https://oisf.net) and the Suricata community.

## Resources

- [Home Page](https://suricata.io)
- [Bug Tracker](https://redmine.openinfosecfoundation.org/projects/suricata)
- [User Guide](https://docs.suricata.io)
- [Dev Guide](https://docs.suricata.io/en/latest/devguide/index.html)
- [Installation Guide](https://docs.suricata.io/en/latest/install.html)
- [User Support Forum](https://forum.suricata.io)

## Contributing

We're happily taking patches and other contributions. Please see our
[Contribution
Process](https://docs.suricata.io/en/latest/devguide/contributing/contribution-process.html)
for how to get started.

Suricata is a complex piece of software dealing with mostly untrusted
input. Mishandling this input will have serious consequences:

* in IPS mode a crash may knock a network offline
* in passive mode a compromise of the IDS may lead to loss of critical
  and confidential data
* missed detection may lead to undetected compromise of the network

In other words, we think the stakes are pretty high, especially since
in many common cases the IDS/IPS will be directly reachable by an
attacker.

For this reason, we have developed a QA process that is quite
extensive. A consequence is that contributing to Suricata can be a
somewhat lengthy process.

On a high level, the steps are:

1. GitHub-CI based checks. This runs automatically when a pull request
   is made.
2. Review by devs from the team and community
3. QA runs from private QA setups. These are private due to the nature
   of the test traffic.

### Overview of Suricata's QA steps

OISF team members are able to submit builds to our private QA
setup. It will run a series of build tests and a regression suite to
confirm no existing features break.

The final QA runs takes a few hours minimally, and generally runs
overnight. It currently runs:

- extensive build tests on different OS', compilers, optimization
  levels, configure features
- static code analysis using cppcheck, scan-build
- runtime code analysis using valgrind, AddressSanitizer,
  LeakSanitizer
- regression tests for past bugs
- output validation of logging
- unix socket testing
- pcap based fuzz testing using ASAN and LSAN
- traffic replay based IDS and IPS tests

Next to these tests, based on the type of code change further tests
can be run manually:

- traffic replay testing (multi-gigabit)
- large pcap collection processing (multi-terabytes)
- fuzz testing (might take multiple days or even weeks)
- pcap based performance testing
- live performance testing
- various other manual tests based on ev