ftp: mark ftpbounce as supported by firewall #6318

Workflow file for this run

	name: builds

	on:
	push:
	paths-ignore:
	# Don't run this workflow if only files under doc/ have been
	# modified.
	- "doc/**"
	- "etc/schema.json"
	pull_request:
	paths-ignore:
	# Don't run this workflow if only files under doc/ have been
	# modified.
	- "doc/**"
	- "etc/schema.json"
	workflow_dispatch:
	inputs:
	SU_REPO:
	SU_BRANCH:
	SV_REPO:
	SV_BRANCH:

	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	permissions: read-all

	env:
	DEFAULT_CFLAGS: "-Wall -Wextra -Werror -Wno-unused-parameter -Wno-unused-function"

	# Apt sometimes likes to ask for user input, this will prevent that.
	DEBIAN_FRONTEND: "noninteractive"

	# A recent version of stable Rust that is known to pass build, test and other
	# verification steps in this workflow. This was added because using "stable"
	# could cause some steps to fail.
	RUST_VERSION_KNOWN: "1.95.0"

	jobs:

	prepare-deps:
	name: Prepare dependencies
	uses: ./.github/workflows/prepare-deps.yml

	prepare-cbindgen:
	name: Prepare cbindgen
	runs-on: ubuntu-latest
	steps:
	- name: Cache ~/.cargo
	uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
	with:
	path: ~/.cargo
	key: ${{ github.job }}-cargo
	- name: Installing Rust
	run: \|
	curl https://sh.rustup.rs -sSf \| sh -s -- -y
	echo "$HOME/.cargo/bin" >> $GITHUB_PATH
	rustup target add x86_64-unknown-linux-musl
	- name: Building static cbindgen for Linux
	run: \|
	cargo install --target x86_64-unknown-linux-musl --debug cbindgen
	cp $HOME/.cargo/bin/cbindgen .
	- name: Uploading prep archive
	uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
	with:
	name: cbindgen
	path: .

	almalinux-10:
	name: AlmaLinux 10 (schema, plugins)
	runs-on: ubuntu-latest
	container: almalinux:10
	needs: [prepare-deps, prepare-cbindgen]
	steps:
	# Cache Rust stuff.
	- name: Cache cargo registry
	uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
	with:
	path: ~/.cargo/registry
	key: cargo-registry

	- name: Determine number of CPUs
	run: echo CPUS=$(nproc --all) >> $GITHUB_ENV

	- name: Install system packages
	run: \|
	dnf -y install dnf-plugins-core epel-release
	dnf config-manager --set-enabled crb
	dnf -y install \
	autoconf \
	automake \
	cargo-vendor \
	cbindgen \
	clippy \
	diffutils \
	numactl-devel \
	dpdk-devel \
	file-devel \
	gcc \
	gcc-c++ \
	git \
	hwloc \
	hwloc-devel \
	jansson-devel \
	jq \
	libtool \
	libyaml-devel \
	libnfnetlink-devel \
	libnetfilter_queue-devel \
	libnet-devel \
	libcap-ng-devel \
	libevent-devel \
	libmaxminddb-devel \
	libpcap-devel \
	libtool \
	lz4-devel \
	make \
	pcre2-devel \
	pkgconfig \
	python3-devel \
	python3-sphinx \
	python3-yaml \
	rustfmt \
	rust-toolset \
	sudo \
	which \
	zlib-devel
	# These packages required to build the PDF.
	dnf -y install \
	texlive-latex \
	texlive-cmap \
	texlive-collection-latexrecommended \
	texlive-fncychap \
	texlive-titlesec \
	texlive-tabulary \
	texlive-framed \
	texlive-wrapfig \
	texlive-upquote \
	texlive-capt-of \
	texlive-needspace

	- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
	- run: git config --global --add safe.directory /__w/suricata/suricata
	- uses: ./.github/actions/install-cbindgen
	# Download and extract dependency archives created during prep
	# job.
	- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
	with:
	name: prep
	path: prep
	- run: tar xvf prep/suricata-update.tar.gz
	- run: tar xvf prep/suricata-verify.tar.gz
	- name: Configuring
	run: \|
	./autogen.sh
	CFLAGS="${DEFAULT_CFLAGS}" ./configure --enable-warnings
	- run: make -j ${{ env.CPUS }} distcheck
	env:
	DISTCHECK_CONFIGURE_FLAGS: "--enable-unittests --enable-debug --enable-geoip --enable-profiling --enable-profiling-locks --enable-dpdk"
	MAKEFLAGS: "-j ${{ env.CPUS }}"
	- run: test -e doc/userguide/suricata.1

	# Rebuild with debug-validation.
	- name: Configuring
	run: \|
	./autogen.sh
	CFLAGS="${DEFAULT_CFLAGS}" ./configure --enable-debug-validation --enable-qa-simulation
	make -j ${{ env.CPUS }}

	- name: Building Rust documentation
	run: make doc
	working-directory: rust
	- run: make install install-conf
	- run: suricatasc -h
	- run: suricata-update -V
	- run: suricata-update

	- name: Check if Suricata-Update example configuration files are installed
	run: \|
	test -e /usr/local/lib/suricata/python/suricata/update/configs/disable.conf
	test -e /usr/local/lib/suricata/python/suricata/update/configs/drop.conf
	test -e /usr/local/lib/suricata/python/suricata/update/configs/enable.conf
	test -e /usr/local/lib/suricata/python/suricata/update/configs/modify.conf
	test -e /usr/local/lib/suricata/python/suricata/update/configs/threshold.in
	test -e /usr/local/lib/suricata/python/suricata/update/configs/update.yaml

	- name: Test capture plugin
	working-directory: examples/plugins/ci-capture
	run: \|
	make
	../../../src/suricata -S /dev/null --plugin ./capture.so --capture-plugin=ci-capture --runmode=single -l . -c ../../../suricata.yaml
	cat eve.json \| jq -c 'select(.dns)'
	test $(cat eve.json \| jq -c 'select(.dns)' \| wc -l) = "1"

	- name: Test app-layer plugin
	working-directory: examples/plugins/altemplate
	run: \|
	cargo build
	../../../src/suricata -S altemplate.rules --plugin ./target/debug/libsuricata_altemplate.so --runmode=single -l . -c altemplate.yaml -k none -r ../../../rust/src/applayertemplate/template.pcap
	cat eve.json \| jq -c 'select(.altemplate)'
	test $(cat eve.json \| jq -c 'select(.altemplate)' \| wc -l) = "3"
	# we get 2 alerts and 1 altemplate events

	- name: Test library build in tree
	working-directory: examples/lib/simple
	run: make clean all

	- name: Test plugin build in tree
	working-directory: examples/plugins/c-json-filetype
	run: make clean all

	- name: Build example C custom logger plugin
	working-directory: examples/plugins/c-custom-loggers
	run: make clean all

	- name: Check and build Rust example plugin
	working-directory: examples/plugins/rust
	run: \|
	cargo fmt --check
	cargo clippy -- -D warnings
	cargo build

	- name: Install Suricata and library
	run: make install install-headers install-library

	- name: Test library build out of tree
	working-directory: examples/lib/simple
	run: PATH=/usr/local/bin:$PATH make -f Makefile.example clean all

	- name: Test custom lib example
	run: \|
	make
	./custom -- ../../../qa/docker/pcaps/tls.pcap
	test $(cat eve.json \|jq 'select(.stats) \| .stats.decoder.pkts') = 110
	working-directory: examples/lib/custom

	- name: Build live library example
	run: make
	working-directory: examples/lib/live

	- run: python3 scripts/eve-parity.py mapped-fields
	- run: python3 scripts/eve-parity.py unmapped-fields
	- run: python3 scripts/eve-parity.py unmapped-keywords

	- name: Cleaning source directory for standalone plugin test.
	run: make clean

	- name: Test plugin against installed headers
	working-directory: examples/plugins/c-json-filetype
	run: \|
	# First use sed to pretend we are a user following our
	# directions for building a standalone plugin.
	sed -i 's/^#LIBSURICATA_CONFIG/LIBSURICATA_CONFIG/' Makefile
	sed -i 's/^#CPPFLAGS/CPPFLAGS/' Makefile
	sed -i 's/^CPPFLAGS.*HAVE_CONFIG_H//' Makefile

	# And build.
	PATH=/usr/local/bin:$PATH make clean all

	- name: Check EVE schema ordering
	run: ./scripts/schema-sort.py --check ./etc/schema.json

	- name: Check EVE schema has all additionalProperties
	run: test $(cat etc/schema.json \| jq 'paths( objects \| (.type == "object" and (has("additionalProperties") \| not) )) \| join(".")' \| wc -l) = "0"

	almalinux-9:
	name: AlmaLinux 9 (schema, rust-checks)
	runs-on: ubuntu-latest
	container: almalinux:9
	needs: [prepare-deps, prepare-cbindgen]
	steps:
	# Cache Rust stuff.
	- name: Cache cargo registry
	uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
	with:
	path: ~/.cargo/registry
	key: cargo-registry

	- name: Determine number of CPUs
	run: echo CPUS=$(nproc --all) >> $GITHUB_ENV

	- name: Install system packages
	run: \|
	dnf -y install dnf-plugins-core epel-release
	dnf config-manager --set-enabled crb
	dnf -y install \
	autoconf \
	automake \
	cbindgen \
	clang-devel \
	diffutils \
	numactl-devel \
	dpdk-devel \
	file-devel \
	gcc \
	gcc-c++ \
	git \
	hwloc \
	hwloc-devel \
	jansson-devel \
	jq \
	libtool \
	libyaml-devel \
	libnfnetlink-devel \
	libnetfilter_queue-devel \
	libnet-devel \
	libcap-ng-devel \
	libevent-devel \
	libmaxminddb-devel \
	libpcap-devel \
	libtool \
	lz4-devel \
	make \
	pcre2-devel \
	pkgconfig \
	python3-devel \
	python3-sphinx \
	python3-yaml \
	sudo \
	which \
	zlib-devel
	# These packages required to build the PDF.
	dnf -y install \
	texlive-latex \
	texlive-cmap \
	texlive-collection-latexrecommended \
	texlive-fncychap \
	texlive-titlesec \
	texlive-tabulary \
	texlive-framed \
	texlive-wrapfig \
	texlive-upquote \
	texlive-capt-of \
	texlive-needspace

	- name: Install Rust
	run: curl https://sh.rustup.rs -sSf \| sh -s -- --default-toolchain $RUST_VERSION_KNOWN -y
	- run: echo "$HOME/.cargo/bin" >> $GITHUB_PATH
	- run: cargo install bindgen-cli --version 0.66.0

	- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
	- run: git config --global --add safe.directory /__w/suricata/suricata
	- uses: ./.github/actions/install-cbindgen
	# Download and extract dependency archives created during prep
	# job.
	- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
	with:
	name: prep
	path: prep
	- run: tar xvf prep/suricata-update.tar.gz
	- run: tar xvf prep/suricata-verify.tar.gz
	- name: Configuring
	run: \|
	./autogen.sh
	CFLAGS="${DEFAULT_CFLAGS}" ./configure --enable-warnings

	- name: Checking bindgen output
	working-directory: rust
	run: \|
	bindgen --version
	make check-bindgen-bindings
	diff=$(git diff sys)
	if [ "${diff}" ]; then
	echo "${diff}"
	echo "::error ::Bindgen bindings appear to be out of date"
	exit 1
	fi
	- run: cargo clippy --workspace --all-features --fix --allow-no-vcs
	working-directory: rust
	- run: \|
	diff=$(git diff)
	if [ "${diff}" ]; then
	echo "${diff}"
	echo "::error ::Clippy --fix made changes, please fix"
	exit 1
	fi
	- run: cargo clippy --workspace --all-features --all-targets -- -D warnings
	working-directory: rust
	# especially without debug feature
	- run: cargo clippy
	working-directory: rust
	- run: ./scripts/rustfmt.sh
	- name: Check if Cargo.lock.in is up to date
	run: \|
	cp rust/Cargo.lock rust/Cargo.lock.in
	diff=$(git diff rust/Cargo.lock.in)
	if [ "${diff}" ]; then
	echo "${diff}"
	echo "::error ::Cargo.lock.in needs to be updated"
	exit 1
	fi

	- run: make -j ${{ env.CPUS }} distcheck
	env:
	DISTCHECK_CONFIGURE_FLAGS: "--enable-unittests --enable-debug --enable-geoip --enable-profiling --enable-profiling-locks --enable-dpdk"
	MAKEFLAGS: "-j ${{ env.CPUS }}"
	- run: test -e doc/userguide/suricata.1
	- name: Building Rust documentation
	run: make doc
	working-directory: rust
	- run: make install install-conf
	- run: suricatasc -h
	- run: suricata-update -V
	- name: Check if Suricata-Update example configuration files are installed
	run: \|
	test -e /usr/local/lib/suricata/python/suricata/update/configs/disable.conf
	test -e /usr/local/lib/suricata/python/suricata/update/configs/drop.conf
	test -e /usr/local/lib/suricata/python/suricata/update/configs/enable.conf
	test -e /usr/local/lib/suricata/python/suricata/update/configs/modify.conf
	test -e /usr/local/lib/suricata/python/suricata/update/configs/threshold.in
	test -e /usr/local/lib/suricata/python/suricata/update/configs/update.yaml

	- name: Test capture plugin
	working-directory: examples/plugins/ci-capture
	run: \|
	make
	../../../src/suricata -S /dev/null --plugin ./capture.so --capture-plugin=ci-capture --runmode=single -l . -c ../../../suricata.yaml
	cat eve.json \| jq -c 'select(.dns)'
	test $(cat eve.json \| jq -c 'select(.dns)' \| wc -l) = "1"

	- name: Test app-layer plugin
	working-directory: examples/plugins/altemplate
	run: \|
	cargo build
	../../../src/suricata -S altemplate.rules --plugin ./target/debug/libsuricata_altemplate.so --runmode=single -l . -c altemplate.yaml -k none -r ../../../rust/src/applayertemplate/template.pcap
	cat eve.json \| jq -c 'select(.altemplate)'
	test $(cat eve.json \| jq -c 'select(.altemplate)' \| wc -l) = "3"
	# we get 2 alerts and 1 altemplate events

	- name: Test library build in tree
	working-directory: examples/lib/simple
	run: make clean all

	- name: Test plugin build in tree
	working-directory: examples/plugins/c-json-filetype
	run: make clean all

	- name: Build example C custom logger plugin
	working-directory: examples/plugins/c-custom-loggers
	run: make clean all

	- name: Install Suricata and library
	run: make install install-headers install-library

	- name: Test library build out of tree
	working-directory: examples/lib/simple
	run: PATH=/usr/local/bin:$PATH make -f Makefile.example clean all

	- name: Test custom lib example
	run: \|
	make
	./custom -- ../../../qa/docker/pcaps/tls.pcap
	test $(cat eve.json \|jq 'select(.stats) \| .stats.decoder.pkts') = 110
	working-directory: examples/lib/custom

	- name: Cleaning source directory for standalone plugin test.
	run: make clean

	- name: Test plugin against installed headers
	working-directory: examples/plugins/c-json-filetype
	run: \|
	# First use sed to pretend we are a user following our
	# directions for building a standalone plugin.
	sed -i 's/^#LIBSURICATA_CONFIG/LIBSURICATA_CONFIG/' Makefile
	sed -i 's/^#CPPFLAGS/CPPFLAGS/' Makefile
	sed -i 's/^CPPFLAGS.*HAVE_CONFIG_H//' Makefile

	# And build.
	PATH=/usr/local/bin:$PATH make clean all

	- name: Check EVE schema ordering
	run: ./scripts/schema-sort.py --check ./etc/schema.json

	almalinux-9-templates:
	name: AlmaLinux 9 Test Templates
	runs-on: ubuntu-latest
	container: almalinux:9
	needs: [prepare-deps, prepare-cbindgen]
	steps:
	# Cache Rust stuff.
	- name: Cache cargo registry
	uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
	with:
	path: ~/.cargo/registry
	key: cargo-registry

	- name: Determine number of CPUs
	run: echo CPUS=$(nproc --all) >> $GITHUB_ENV

	- name: Install system packages
	run: \|
	dnf -y install dnf-plugins-core epel-release
	dnf config-manager --set-enabled crb
	dnf -y install \
	autoconf \
	automake \
	cbindgen \
	diffutils \
	numactl-devel \
	dpdk-devel \
	file-devel \
	gcc \
	gcc-c++ \
	git \
	hwloc \
	hwloc-devel \
	jansson-devel \
	jq \
	libtool \
	libyaml-devel \
	libnfnetlink-devel \
	libnetfilter_queue-devel \
	libnet-devel \
	libcap-ng-devel \
	libevent-devel \
	libmaxminddb-devel \
	libpcap-devel \
	libtool \
	lz4-devel \
	make \
	pcre2-devel \
	pkgconfig \
	python3-devel \
	python3-sphinx \
	python3-yaml \
	sudo \
	which \
	zlib-devel
	- run: curl https://sh.rustup.rs -sSf \| sh -s -- --default-toolchain 1.85.0 -y
	- run: echo "$HOME/.cargo/bin" >> $GITHUB_PATH
	- run: rustup component add rustfmt
	- run: rustup component add clippy

	- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
	- run: git config --global --add safe.directory /__w/suricata/suricata

	- uses: ./.github/actions/install-cbindgen

	# Download and extract dependency archives created during prep
	# job.
	- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
	with:
	name: prep
	path: prep
	- run: tar xvf prep/suricata-update.tar.gz
	- run: tar xvf prep/suricata-verify.tar.gz
	- name: Build
	run: \|
	./autogen.sh
	CFLAGS="${DEFAULT_CFLAGS}" ./configure
	make -j ${{ env.CPUS }}
	- run: ./scripts/setup-app-layer.py --parser --logger --detect FooBar payload
	- run: make -j ${{ env.CPUS }}
	- run: ./src/suricata --list-app-layer-protos \| grep foobar
	- run: ./src/suricata --list-app-layer-hooks \| grep "foobar:request_started"
	- name: Verify rustfmt
	run: rustfmt -v --check src/applayerfoobar/*.rs
	working-directory: rust
	- name: Verify clippy
	run: cargo clippy --all-features
	working-directory: rust

	rpms:
	name: Build RPMs
	runs-on: ubuntu-latest
	container: ${{ matrix.container }}
	needs: [ubuntu-22-04-dist]
	strategy:
	fail-fast: false
	matrix:
	container:
	- almalinux:9
	- fedora:44
	env:
	skip: false
	steps:
	- name: Cache cargo registry
	uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
	with:
	path: ~/.cargo/registry
	key: cargo-registry

	- name: Download Suricata distribution archive
	uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
	with:
	name: dist

	- name: Install packages
	if: ${{ env.skip != 'true' }}
	run: \|
	if test -e /etc/almalinux-release; then
	dnf -y install \
	epel-release \
	git \
	make \
	rpm-build \
	rpmdevtools \
	dnf-plugins-core
	dnf config-manager --set-enabled crb
	elif test -e /etc/fedora-release; then
	dnf -y install \
	awk \
	git \
	make \
	rpm-build \
	rpmdevtools
	else
	echo "ERROR: Unsupported distribution for RPM building"
	exit 1
	fi
	- if: ${{ env.skip != 'true' }}
	run: \|
	git clone https://github.com/jasonish/suricata-rpms
	cd suricata-rpms/devel
	make update-release update-sources
	dnf -y install $(rpmspec -q --buildrequires ./suricata.spec)
	mv ../../suricata-*.tar.gz .
	make srpm
	make local

	# We need a step for each RPM upload as we can't use the
	# container name directly in an artifact, as artifacts can't
	# have ':' in the name.
	- if: ${{ matrix.container == 'fedora:44' && env.skip != 'true' }}
	uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
	name: Uploading RPMs
	with:
	name: rpms-fedora-44
	path: suricata-rpms/devel/rpms
	- if: ${{ matrix.container == 'almalinux:9' && env.skip != 'true' }}
	uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
	name: Uploading RPMs
	with:
	name: rpms-epel-9
	path: suricata-rpms/devel/rpms

	almalinux-8:
	name: AlmaLinux 8
	runs-on: ubuntu-latest
	container: almalinux:8
	needs: [prepare-deps, prepare-cbindgen]
	steps:
	# Cache Rust stuff.
	- name: Cache cargo registry
	uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
	with:
	path: ~/.cargo/registry
	key: cargo-registry

	- name: Determine number of CPUs
	run: echo CPUS=$(nproc --all) >> $GITHUB_ENV

	- name: Install system packages
	run: \|
	yum -y install dnf-plugins-core
	yum config-manager --set-enabled powertools
	yum -y install \
	autoconf \
	automake \
	cargo-vendor \
	diffutils \
	numactl-devel \
	dpdk-devel \
	file-devel \
	gcc \
	gcc-c++ \
	git \
	hwloc \
	hwloc-devel \
	jansson-devel \
	jq \
	libtool \
	libyaml-devel \
	libnfnetlink-devel \
	libnetfilter_queue-devel \
	libnet-devel \
	libcap-ng-devel \
	libevent-devel \
	libmaxminddb-devel \
	libpcap-devel \
	libtool \
	lz4-devel \
	make \
	pcre2-devel \
	pkgconfig \
	python3-devel \
	python3-yaml \
	rust-toolset \
	sudo \
	which \
	zlib-devel

	- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
	- run: git config --global --add safe.directory /__w/suricata/suricata

	- uses: ./.github/actions/install-cbindgen

	# Prebuild check for duplicate SIDs
	- name: Check for duplicate SIDs
	run: \|
	dups=$(sed -n 's/^alert.sid:$[[:digit:]]$;./\1/p' ./rules/.rules\|sort\|uniq -d\|tr '\n' ' ')
	if [[ "${dups}" != "" ]]; then
	echo "::error::Duplicate SIDs found:${dups}"
	exit 1
	fi

	# Download and extract dependency archives created during prep
	# job.
	- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
	with:
	name: prep
	path: prep
	- run: tar xvf prep/suricata-update.tar.gz
	- run: tar xvf prep/suricata-verify.tar.gz
	- uses: ./.github/actions/install-cbindgen
	- name: Configuring
	run: \|
	./autogen.sh
	CFLAGS="${DEFAULT_CFLAGS}" ./configure
	- run: make -j ${{ env.CPUS }} check
	- run: make install
	- run: suricatasc -h
	- run: suricata-update -V

	centos-stream9:
	name: CentOS Stream 9
	runs-on: ubuntu-latest
	container: quay.io/centos/centos:stream9
	needs: [prepare-deps, ubuntu-22-04-dist]
	steps:
	# Cache Rust stuff.
	- name: Cache cargo registry
	uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
	with:
	path: ~/.cargo/registry
	key: cargo-registry

	- name: Determine number of CPUs
	run: echo CPUS=$(nproc --all) >> $GITHUB_ENV

	- name: Install system packages
	run: \|
	dnf -y install dnf-plugins-core epel-release
	dnf config-manager --set-enabled crb
	dnf -y install \
	autoconf \
	automake \
	cargo-vendor \
	diffutils \
	numactl-devel \
	dpdk-devel \
	file-devel \
	gcc \
	gcc-c++ \
	git \
	hwloc \
	hwloc-devel \
	jansson-devel \
	jq \
	libtool \
	libyaml-devel \
	libnfnetlink-devel \
	libnetfilter_queue-devel \
	libnet-devel \
	libcap-ng-devel \
	libevent-devel \
	libmaxminddb-devel \
	libpcap-devel \
	libtool \
	lz4-devel \
	make \
	pcre2-devel \
	pkgconfig \
	python3-devel \
	python3-sphinx \
	python3-yaml \
	rust-toolset \
	sudo \
	which \
	zlib-devel
	- name: Download suricata.tar.gz
	uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
	with:
	name: dist

	- name: Build and install nDPI
	run: \|
	curl -OL https://github.com/ntop/nDPI/archive/refs/tags/4.14.tar.gz
	tar xvf 4.14.tar.gz
	cd nDPI-4.14
	./autogen.sh
	./configure
	make -j ${{ env.CPUS }}

	- run: tar zxvf suricata-*.tar.gz --strip-components=1
	- name: ./configure
	run: CFLAGS="${DEFAULT_CFLAGS}" ./configure --enable-ndpi --with-ndpi=$(pwd)/nDPI-4.14 --enable-debug --enable-qa-simulation
	- run: make -j ${{ env.CPUS }}
	- run: make install
	- run: make install-conf
	- run: suricatasc -h
	- run: suricata-update -V
	- name: Check if Suricata-Update example configuration files are installed
	run: \|
	test -e /usr/local/lib/suricata/python/suricata/update/configs/disable.conf
	test -e /usr/local/lib/suricata/python/suricata/update/configs/drop.conf
	test -e /usr/local/lib/suricata/python/suricata/update/configs/enable.conf
	test -e /usr/local/lib/suricata/python/suricata/update/configs/modify.conf
	test -e /usr/local/lib/suricata/python/suricata/update/configs/threshold.in
	test -e /usr/local/lib/suricata/python/suricata/update/configs/update.yaml
	- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
	with:
	name: prep
	path: prep
	- name: Check if the nDPI plugin was installed
	run: test -e /usr/local/lib/suricata/ndpi.so
	- run: tar xf prep/suricata-verify.tar.gz
	- run: python3 ./suricata-verify/run.py -q --debug-failed
	- run: suricata-update -V
	- run: suricatasc -h
	# Test build after clean.
	- run: make clean
	- run: make -j ${{ env.CPUS }}

	fedora-44-sv-codecov:
	name: Fedora 44 (Suricata Verify codecov)
	runs-on: ubuntu-latest
	container: fedora:44
	needs: [prepare-deps, prepare-cbindgen]
	steps:

	# Cache Rust stuff.
	- name: Cache cargo registry
	uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
	with:
	path: ~/.cargo/registry
	key: cargo-registry

	- name: Determine number of CPUs
	run: echo CPUS=$(nproc --all) >> $GITHUB_ENV

	- run: \|
	dnf -y install \
	autoconf \
	automake \
	awk \
	cbindgen \
	ccache \
	clang \
	curl \
	diffutils \
	file-devel \
	gcc \
	gcc-c++ \
	git \
	gpg \
	hwloc \
	hwloc-devel \
	hiredis-devel \
	jansson-devel \
	jq \
	libasan \
	libtool \
	libyaml-devel \
	libnfnetlink-devel \
	libnetfilter_queue-devel \
	libnet-devel \
	libcap-ng-devel \
	libevent-devel \
	libmaxminddb-devel \
	libpcap-devel \
	libtool \
	llvm-devel \
	lz4-devel \
	make \
	pcre2-devel \
	pkgconfig \
	python3-yaml \
	sudo \
	which \
	zlib-devel
	- run: \|
	dnf clean all
	# packaged Rust version has no profiler support built in, so get from rustup
	- name: Install Rust
	run: curl https://sh.rustup.rs -sSf \| sh -s -- --default-toolchain 1.86.0 -y
	- run: echo "$HOME/.cargo/bin" >> $GITHUB_PATH
	- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
	- uses: ./.github/actions/install-cbindgen
	- run: git config --global --add safe.directory /__w/suricata/suricata
	- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
	with:
	name: prep
	path: prep
	- run: tar xf prep/suricata-update.tar.gz
	- run: ./autogen.sh
	- run: RUSTC_WRAPPER="$(pwd)/scripts/rustc.py" ./configure --enable-warnings --disable-shared --enable-qa-simulation
	env:
	CC: "clang"
	RUSTFLAGS: "-Cinstrument-coverage"
	CFLAGS: "-fprofile-instr-generate -fcoverage-mapping -O0"
	- run: RUSTC_WRAPPER="$(pwd)/scripts/rustc.py" make -j ${{ env.CPUS }}
	env:
	CC: "clang"
	RUSTFLAGS: "-Cinstrument-coverage"
	CFLAGS: "-fprofile-instr-generate -fcoverage-mapping -O0"
	- name: Extracting suricata-verify
	run: tar xf prep/suricata-verify.tar.gz
	- run: rm -r prep
	- name: Running suricata-verify
	run: python3 ./suricata-verify/run.py -q --debug-failed --aggressive-cleanup
	- run: llvm-profdata merge -o default.profdata $(find suricata-verify/tests/ -name '*.profraw')
	- run: llvm-cov export ./src/suricata -instr-profile=default.profdata -format=lcov --ignore-filename-regex="^/(root\|usr\|rustc\|github)/.*" --skip-branches > coverage.lcov
	- name: Upload coverage.lcov artifact
	uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
	with:
	name: coverage-lcov-${{ github.job }}
	path: coverage.lcov
	- name: Upload coverage to Codecov
	uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f
	with:
	fail_ci_if_error: false
	files: coverage.lcov
	flags: suricata-verify

	# Fedora build using Clang.
	fedora-44-clang:
	name: Fedora 44 (clang, debug, asan, wshadow, rust-strict, systemd)
	runs-on: ubuntu-latest
	container: fedora:44
	needs: [prepare-deps, prepare-cbindgen]
	steps:

	# Cache Rust stuff.
	- name: Cache cargo registry
	uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
	with:
	path: ~/.cargo/registry
	key: cargo-registry

	- name: Determine number of CPUs
	run: echo CPUS=$(nproc --all) >> $GITHUB_ENV

	- run: \|
	dnf -y install \
	autoconf \
	automake \
	awk \
	cargo \
	cbindgen \
	ccache \
	clang \
	diffutils \
	file-devel \
	gcc \
	gcc-c++ \
	git \
	hiredis-devel \
	hwloc \
	hwloc-devel \
	jansson-devel \
	jq \
	libasan \
	libtool \
	libyaml-devel \
	libnfnetlink-devel \
	libnetfilter_queue-devel \
	libnet-devel \
	libcap-ng-devel \
	libevent-devel \
	libmaxminddb-devel \
	libpcap-devel \
	libxdp-devel \
	libbpf-devel \
	libtool \
	lz4-devel \
	make \
	parallel \
	pcre2-devel \
	pkgconfig \
	python \
	python3-yaml \
	sudo \
	which \
	zlib-devel
	- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
	- uses: ./.github/actions/install-cbindgen
	- run: git config --global --add safe.directory /__w/suricata/suricata
	- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
	with:
	name: prep
	path: prep
	- run: tar xf prep/suricata-update.tar.gz
	- run: ./autogen.sh
	- run: CC="clang" CFLAGS="$DEFAULT_CFLAGS -Wshadow" ./configure --disable-shared
	- run: make check
	- run: make distclean
	- run: CC="clang" CFLAGS="$DEFAULT_CFLAGS -Wshadow -fsanitize=address -fno-omit-frame-pointer" ./configure --enable-warnings --enable-debug --enable-qa-simulation --enable-unittests --disable-shared --enable-rust-strict --enable-hiredis --enable-nfqueue
	env:
	LDFLAGS: "-fsanitize=address"
	ac_cv_func_realloc_0_nonnull: "yes"
	ac_cv_func_malloc_0_nonnull: "yes"
	- run: make -j ${{ env.CPUS }}
	- run: ./src/suricata -u -l .
	- name: Extracting suricata-verify
	run: tar xf prep/suricata-verify.tar.gz
	- name: Running suricata-verify
	run: python3 ./suricata-verify/run.py -q --debug-failed
	# Now install and make sure headers and libraries aren't
	# installed until requested.
	- run: make install
	- run: test ! -e /usr/local/lib/libsuricata_c.a
	- run: test ! -e /usr/local/include/suricata
	- run: make install-headers
	- run: test -e /usr/local/include/suricata/suricata.h
	- run: make install-library
	- run: test -e /usr/local/lib/libsuricata_c.a
	- run: test -e /usr/local/lib/libsuricata_rust.a
	- run: test -e /usr/local/bin/libsuricata-config
	- run: test ! -e /usr/local/lib/libsuricata.so
	- run: make install
	- run: suricata-update -V
	- run: suricatasc -h
	# Check compilation against systemd
	- run: src/suricata --build-info \| grep -E "Systemd support:\s+yes" &> /dev/null

	# Fedora build using GCC.
	fedora-44-gcc:
	name: Fedora 44 (gcc, debug, flto, asan, wshadow, rust-strict)
	runs-on: ubuntu-latest
	container: fedora:44
	needs: [prepare-deps, prepare-cbindgen]
	steps:

	# Cache Rust stuff.
	- name: Cache cargo registry
	uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
	with:
	path: ~/.cargo/registry
	key: cargo-registry

	- name: Determine number of CPUs
	run: echo CPUS=$(nproc --all) >> $GITHUB_ENV

	- run: \|
	dnf -y install \
	autoconf \
	automake \
	awk \
	cargo \
	cbindgen \
	ccache \
	diffutils \
	file-devel \
	gcc \
	gcc-c++ \
	git \
	hiredis-devel \
	hwloc \
	hwloc-devel \
	jansson-devel \
	jq \
	libasan \
	libtool \
	libyaml-devel \
	libnfnetlink-devel \
	libnetfilter_queue-devel \
	libnet-devel \
	libcap-ng-devel \
	libevent-devel \
	libmaxminddb-devel \
	libpcap-devel \
	libtool \
	lz4-devel \
	make \
	pcre2-devel \
	pkgconfig \
	python3-yaml \
	sudo \
	vectorscan-devel \
	which \
	zlib-devel
	- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
	- run: git config --global --add safe.directory /__w/suricata/suricata
	- uses: ./.github/actions/install-cbindgen
	- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
	with:
	name: prep
	path: prep
	- run: tar xf prep/suricata-update.tar.gz
	- run: ./autogen.sh
	- run: ./configure --enable-warnings --enable-debug --enable-qa-simulation --enable-unittests --disable-shared --enable-rust-strict --enable-hiredis --enable-nfqueue
	env:
	CFLAGS: "${{ env.DEFAULT_CFLAGS }} -Wshadow -fsanitize=address -fno-omit-frame-pointer -flto=auto -O2"
	LDFLAGS: "-fsanitize=address"
	ac_cv_func_realloc_0_nonnull: "yes"
	ac_cv_func_malloc_0_nonnull: "yes"
	- run: make -j ${{ env.CPUS }}
	- run: ./src/suricata -u -l .
	- name: Extracting suricata-verify
	run: tar xf prep/suricata-verify.tar.gz
	- name: Running suricata-verify
	run: python3 ./suricata-verify/run.py -q --debug-failed
	# Now install and make sure headers and libraries aren't
	# installed until requested.
	- run: make install
	- run: test ! -e /usr/local/lib/libsuricata_c.a
	- run: test ! -e /usr/local/include/suricata
	- run: make install-headers
	- run: test -e /usr/local/include/suricata/suricata.h
	- run: make install-library
	- run: test -e /usr/local/lib/libsuricata_c.a
	- run: test -e /usr/local/lib/libsuricata_rust.a
	- run: test -e /usr/local/bin/libsuricata-config
	- run: test ! -e /usr/local/lib/libsuricata.so
	- run: make install
	- run: suricata-update -V
	- run: suricatasc -h

	# This job builds and tests Suricata as a non-root user as some
	# issues only show up when not running as root, and by default all
	# jobs in GitHub actions are run as root inside the container.
	# Also ja3 and ja4 are disabled to run SV tests that require
	# the absence of these features
	fedora-non-root:
	name: Fedora 44 (non-root, debug, clang, asan, wshadow, rust-strict, no-ja)
	runs-on: ubuntu-latest
	container: fedora:44
	needs: [prepare-deps, prepare-cbindgen]
	steps:
	- name: Determine number of CPUs
	run: echo CPUS=$(nproc --all) >> $GITHUB_ENV

	- run: \|
	dnf -y install \
	autoconf \
	automake \
	awk \
	cargo \
	cbindgen \
	ccache \
	clang \
	diffutils \
	file-devel \
	gcc \
	gcc-c++ \
	git \
	hiredis-devel \
	hwloc \
	hwloc-devel \
	jansson-devel \
	jq \
	libasan \
	libtool \
	libyaml-devel \
	libnfnetlink-devel \
	libnetfilter_queue-devel \
	libnet-devel \
	libcap-ng-devel \
	libevent-devel \
	libmaxminddb-devel \
	libpcap-devel \
	libtool \
	lz4-devel \
	make \
	pcre2-devel \
	pkgconfig \
	python3-yaml \
	sudo \
	which \
	zlib-devel
	- run: adduser suricata
	- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
	- uses: ./.github/actions/install-cbindgen
	- run: git config --global --add safe.directory /__w/suricata/suricata
	- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
	with:
	name: prep
	path: prep
	- run: tar xf prep/suricata-update.tar.gz
	- run: tar xf prep/suricata-verify.tar.gz
	- run: mkdir /home/suricata/suricata
	- run: cp -a . /home/suricata/suricata
	- run: chown -R suricata:suricata /home/suricata

	- run: sudo -u suricata -s ./autogen.sh
	working-directory: /home/suricata/suricata

	- run: >-
	sudo -u suricata -s env PATH="/home/suricata/.cargo/bin:$PATH" ./configure --enable-warnings
	--enable-debug --enable-unittests --disable-shared --enable-rust-strict --enable-hiredis
	--enable-nfqueue --disable-ja3 --disable-ja4
	--enable-qa-simulation
	working-directory: /home/suricata/suricata
	env:
	ac_cv_func_realloc_0_nonnull: "yes"
	ac_cv_func_malloc_0_nonnull: "yes"
	LDFLAGS: "-fsanitize=address"
	CC: "clang"
	CFLAGS: "${{ env.DEFAULT_CFLAGS }} -Wshadow -fsanitize=address -fno-omit-frame-pointer"

	- run: sudo -u suricata -s env PATH="/home/suricata/.cargo/bin:$PATH" make -j ${{ env.CPUS }}
	working-directory: /home/suricata/suricata

	- run: sudo -u suricata -s make check
	working-directory: /home/suricata/suricata

	- run: src/suricata --build-info \| grep -E "JA3 support:\s+no" &> /dev/null
	working-directory: /home/suricata/suricata

	- run: src/suricata --build-info \| grep -E "JA4 support:\s+no" &> /dev/null
	working-directory: /home/suricata/suricata

	- run: sudo -u suricata -s python3 ./suricata-verify/run.py -q --debug-failed
	working-directory: /home/suricata/suricata

	- run: src/suricata -h \| grep '\-\-list\-app\-layer\-hooks' &> /dev/null
	working-directory: /home/suricata/suricata

	# Test that ./configure fails out if libjansson is not available.
	almalinux-9-no-jansson:
	name: AlmaLinux 9 (no jansson)
	runs-on: ubuntu-latest
	container: almalinux:9
	needs: [prepare-deps]
	steps:

	# Cache Rust stuff.
	- name: Cache cargo registry
	uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
	with:
	path: ~/.cargo/registry
	key: cargo-registry

	- name: Determine number of CPUs
	run: echo CPUS=$(nproc --all) >> $GITHUB_ENV

	- run: \|
	dnf -y install dnf-plugins-core epel-release
	dnf config-manager --set-enable crb
	dnf -y install \
	autoconf \
	automake \
	cargo \
	cbindgen \
	clang \
	diffutils \
	file-devel \
	gcc \
	gcc-c++ \
	git \
	hwloc \
	hwloc-devel \
	libasan \
	libtool \
	libyaml-devel \
	libnfnetlink-devel \
	libnetfilter_queue-devel \
	libnet-devel \
	libcap-ng-devel \
	libevent-devel \
	libmaxminddb-devel \
	libpcap-devel \
	libtool \
	lz4-devel \
	make \
	pcre2-devel \
	pkgconfig \
	python3-yaml \
	sudo \
	which \
	zlib-devel
	- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
	- run: git config --global --add safe.directory /__w/suricata/suricata
	- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
	with:
	name: prep
	path: prep
	- run: ./autogen.sh
	- run: \|
	if ./configure; then
	echo "error: configure should have failed"
	exit 1
	else
	exit 0
	fi

	almalinux-9-minimal-recommended-dependecies:
	name: AlmaLinux 9 (Minimal/Recommended Build)
	runs-on: ubuntu-latest
	container: almalinux:9
	needs: [ubuntu-22-04-dist]
	steps:
	# Cache Rust stuff.
	- name: Cache cargo registry
	uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
	with:
	path: ~/.cargo/registry
	key: cargo-registry

	- name: Determine number of CPUs
	run: echo CPUS=$(nproc --all) >> $GITHUB_ENV

	- name: Download suricata.tar.gz
	uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
	with:
	name: dist
	- run: tar xf suricata-*.tar.gz --strip-components=1

	- name: Update packages and install sudo
	run: dnf -y update && dnf install -y sudo

	- name: Install AlmaLinux 9 extra repositories
	run: \|
	dnf -y update
	dnf -y install dnf-plugins-core epel-release sudo
	dnf config-manager --set-enabled crb

	- name: Install minimal dependencies
	run: ./scripts/docs-almalinux9-minimal-build.sh

	- run: CFLAGS="${DEFAULT_CFLAGS}" ./configure
	- run: make -j ${{ env.CPUS }}
	- run: ./src/suricata --build-info # check if we can run Suricata

	ubuntu-24-04:
	name: Ubuntu 24.04 (cocci)
	runs-on: ubuntu-latest
	container: ubuntu:24.04
	needs: [prepare-deps]
	steps:
	- name: Cache ~/.cargo
	uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
	with:
	path: ~/.cargo/registry
	key: cargo-registry

	- name: Determine number of CPUs
	run: echo CPUS=$(nproc --all) >> $GITHUB_ENV

	- name: Install dependencies
	run: \|
	apt update
	apt -y install \
	autoconf \
	automake \
	build-essential \
	cargo \
	cbindgen \
	clang-14 \
	coccinelle \
	dpdk-dev \
	git \
	hwloc \
	libhwloc-dev \
	jq \
	libcap-ng-dev \
	libevent-dev \
	libevent-pthreads-2.1-7 \
	libhiredis-dev \
	libhyperscan-dev \
	libjansson-dev \
	libmagic-dev \
	libnet1-dev \
	libnetfilter-queue-dev \
	libnetfilter-queue1 \
	libnfnetlink-dev \
	libnfnetlink0 \
	libnuma-dev \
	libpcap-dev \
	libpcre2-dev \
	libpython3.12 \
	libtool \
	libyaml-dev \
	llvm-14-dev \
	make \
	parallel \
	python-is-python3 \
	python3-yaml \
	rustc \
	software-properties-common \
	zlib1g \
	zlib1g-dev
	- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
	- run: git config --global --add safe.directory /__w/suricata/suricata
	- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
	with:
	name: prep
	path: prep
	- run: tar xf prep/suricata-update.tar.gz
	- run: tar xf prep/suricata-verify.tar.gz
	- run: ./autogen.sh
	- run: ./configure --enable-unittests --enable-coccinelle
	- run: make -j ${{ env.CPUS }}
	- run: CONCURRENCY_LEVEL=${{ env.CPUS }} make check
	- run: python3 ./suricata-verify/run.py -q --debug-failed
	- run: make install
	- run: make install-headers
	- run: make install-library

	- run: TZ="UTC" ./src/suricata -u -U CreateFormattedTimeStringTest01
	- run: TZ="Brazil/East" ./src/suricata -u -U CreateFormattedTimeStringTest01
	- run: TZ="Saskatchewan/Regina" ./src/suricata -u -U CreateFormattedTimeStringTest01

	ubuntu-24-04-rust-vars:
	name: Ubuntu 24.04 (RUSTC+CARGO vars)
	runs-on: ubuntu-latest
	container: ubuntu:24.04
	needs: [prepare-deps]
	steps:
	- name: Cache ~/.cargo
	uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
	with:
	path: ~/.cargo/registry
	key: cargo-registry

	- name: Determine number of CPUs
	run: echo CPUS=$(nproc --all) >> $GITHUB_ENV

	- name: Install dependencies
	run: \|
	apt update
	apt -y install \
	autoconf \
	automake \
	build-essential \
	cargo-1.82 \
	cbindgen \
	clang-14 \
	dpdk-dev \
	git \
	hwloc \
	libhwloc-dev \
	jq \
	libcap-ng-dev \
	libevent-dev \
	libevent-pthreads-2.1-7 \
	libhiredis-dev \
	libhyperscan-dev \
	libjansson-dev \
	libmagic-dev \
	libnet1-dev \
	libnetfilter-queue-dev \
	libnetfilter-queue1 \
	libnfnetlink-dev \
	libnfnetlink0 \
	libnuma-dev \
	libpcap-dev \
	libpcre2-dev \
	libpython3.12 \
	libtool \
	libyaml-dev \
	llvm-14-dev \
	make \
	parallel \
	python-is-python3 \
	python3-yaml \
	rustc-1.82 \
	software-properties-common \
	zlib1g \
	zlib1g-dev
	- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
	- run: git config --global --add safe.directory /__w/suricata/suricata
	- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
	with:
	name: prep
	path: prep
	- run: tar xf prep/suricata-update.tar.gz
	- run: tar xf prep/suricata-verify.tar.gz
	- run: ./autogen.sh
	- run: CARGO=cargo-1.82 RUSTC=rustc-1.82 RUSTDOC=rustdoc-1.82 ./configure --enable-unittests
	- run: make -j ${{ env.CPUS }}
	- run: make check
	- run: python3 ./suricata-verify/run.py -q --debug-failed
	env:
	CARGO: cargo-1.82
	- run: make install
	- run: make install-headers
	- run: make install-library

	ubuntu-24-04-cov-ut:
	name: Ubuntu 24.04 (unittests coverage)
	runs-on: ubuntu-latest
	container: ubuntu:24.04
	needs: [prepare-deps, prepare-cbindgen]
	steps:
	- name: Cache ~/.cargo
	uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
	with:
	path: ~/.cargo/registry
	key: cargo-registry

	- name: Determine number of CPUs
	run: echo CPUS=$(nproc --all) >> $GITHUB_ENV

	- name: Install dependencies
	run: \|
	apt update
	apt -y install \
	libpcre2-dev \
	build-essential \
	autoconf \
	automake \
	clang-19 \
	curl \
	git \
	hwloc \
	libhwloc-dev \
	jq \
	libtool \
	libpcap-dev \
	libnet1-dev \
	libyaml-0-2 \
	libyaml-dev \
	libcap-ng-dev \
	libcap-ng0 \
	libmagic-dev \
	libnetfilter-queue-dev \
	libnetfilter-queue1 \
	libnfnetlink-dev \
	libnfnetlink0 \
	libnuma-dev \
	libhiredis-dev \
	libhyperscan-dev \
	libjansson-dev \
	libevent-dev \
	libevent-pthreads-2.1-7 \
	llvm-19-dev \
	make \
	parallel \
	python3-yaml \
	software-properties-common \
	zlib1g \
	zlib1g-dev \
	exuberant-ctags \
	curl \
	dpdk-dev
	- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
	- run: git config --global --add safe.directory /__w/suricata/suricata
	- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
	with:
	name: prep
	path: prep
	# packaged Rust version is too old for coverage, so get from rustup. 1.85.1 matches
	# LLVM 19
	- name: Install Rust
	run: curl https://sh.rustup.rs -sSf \| sh -s -- --default-toolchain 1.85.1 -y
	- uses: ./.github/actions/install-cbindgen
	- run: ./autogen.sh
	- run: ./configure --enable-warnings --disable-shared --enable-unittests
	env:
	CC: "clang-19"
	CXX: "clang++-19"
	RUSTFLAGS: "-C instrument-coverage"
	CFLAGS: "-fprofile-instr-generate -fcoverage-mapping -O0"
	CXXFLAGS: "-fprofile-instr-generate -fcoverage-mapping -O0"
	- run: make -j ${{ env.CPUS }}
	env:
	CC: "clang-19"
	CXX: "clang++-19"
	RUSTFLAGS: "-C instrument-coverage"
	CFLAGS: "-fprofile-instr-generate -fcoverage-mapping -O0"
	CXXFLAGS: "-fprofile-instr-generate -fcoverage-mapping -O0"
	- run: ./src/suricata -h
	env:
	LLVM_PROFILE_FILE: "/tmp/help.profraw"
	- run: llvm-profdata-19 merge -o help.profdata /tmp/help.profraw
	- run: ./src/suricata -u -l /tmp/
	env:
	LLVM_PROFILE_FILE: "/tmp/ut.profraw"
	- run: llvm-profdata-19 merge -o ut.profdata /tmp/ut.profraw
	- run: ./src/suricata --list-runmodes -l /tmp
	env:
	LLVM_PROFILE_FILE: "/tmp/listrunmodes.profraw"
	- run: llvm-profdata-19 merge -o listrunmodes.profdata /tmp/listrunmodes.profraw
	- run: ./src/suricata --list-keywords -l /tmp
	env:
	LLVM_PROFILE_FILE: "/tmp/lk.profraw"
	- run: llvm-profdata-19 merge -o lk.profdata /tmp/lk.profraw
	- run: ./src/suricata --list-app-layer-protos -l /tmp
	env:
	LLVM_PROFILE_FILE: "/tmp/la.profraw"
	- run: llvm-profdata-19 merge -o la.profdata /tmp/la.profraw
	- run: ./src/suricata --list-app-layer-hooks -l /tmp
	env:
	LLVM_PROFILE_FILE: "/tmp/lah.profraw"
	- run: llvm-profdata-19 merge -o lah.profdata /tmp/lah.profraw
	- run: ./src/suricata --list-rule-protos -l /tmp
	env:
	LLVM_PROFILE_FILE: "/tmp/lrp.profraw"
	- run: llvm-profdata-19 merge -o lrp.profdata /tmp/lrp.profraw
	- run: ./src/suricata --dump-features -c suricata.yaml -l /tmp
	env:
	LLVM_PROFILE_FILE: "/tmp/dumpfeatures.profraw"
	- run: llvm-profdata-19 merge -o dumpfeatures.profdata /tmp/dumpfeatures.profraw
	- run: ./src/suricata --dump-config -c suricata.yaml -l /tmp
	env:
	LLVM_PROFILE_FILE: "/tmp/dumpconfig.profraw"
	- run: llvm-profdata-19 merge -o dumpconfig.profdata /tmp/dumpconfig.profraw
	- run: llvm-profdata-19 merge -o combined.profdata $(find /tmp/ -name '*.profraw')
	- run: llvm-cov-19 export ./src/suricata -instr-profile=combined.profdata -format=lcov --ignore-filename-regex="^/(root\|usr\|rustc\|github)/.*" --skip-branches > coverage.lcov
	- run: \|
	cd rust
	cargo test --no-run
	cd ..
	env:
	RUSTFLAGS: "-C instrument-coverage"
	CARGO_INCREMENTAL: 0
	- run: \|
	$(find rust/target/debug/deps/ -type f -regex 'rust/target/debug/deps/suricata\-[a-z0-9]+$')
	env:
	LLVM_PROFILE_FILE: "/tmp/ct.profraw"
	CARGO_INCREMENTAL: 0
	- run: llvm-profdata-19 merge -o ct.profdata /tmp/ct.profraw
	- run: llvm-cov-19 export $(find rust/target/debug/deps/ -type f -regex 'rust/target/debug/deps/suricata\-[a-z0-9]+$') -instr-profile=ct.profdata -format=lcov --ignore-filename-regex="^/(root\|usr\|rustc\|github)/.*" --skip-branches >> coverage.lcov
	- run: \|
	cargo build --manifest-path examples/plugins/rust/Cargo.toml
	rm -f /tmp/eve.json /tmp/rust-plugin-*.profraw
	./src/suricata -S /dev/null --plugin ./examples/plugins/rust/target/debug/libsuricata_rust_plugin.so --runmode=single -l /tmp -c suricata.yaml -k none -r qa/docker/pcaps/tls.pcap
	test "$(jq -c 'select(.foobar and .rust_wrapped)' /tmp/eve.json \| wc -l)" != "0"
	llvm-profdata-19 merge -o rust-plugin.profdata /tmp/rust-plugin-*.profraw
	llvm-cov-19 export ./examples/plugins/rust/target/debug/libsuricata_rust_plugin.so -instr-profile=rust-plugin.profdata -format=lcov --ignore-filename-regex="^/(root\|usr\|rustc\|github)/.*" --skip-branches >> coverage.lcov
	env:
	RUSTFLAGS: "-C instrument-coverage"
	CARGO_INCREMENTAL: 0
	LLVM_PROFILE_FILE: "/tmp/rust-plugin-%p-%m.profraw"
	- name: Upload coverage.lcov artifact
	uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
	with:
	name: coverage-lcov-${{ github.job }}
	path: coverage.lcov
	- name: Upload coverage to Codecov
	uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f
	with:
	fail_ci_if_error: false
	files: coverage.lcov
	flags: unittests

	ubuntu-24-04-cov-pcapunix:
	name: Ubuntu 24.04 (unix socket mode coverage)
	runs-on: ubuntu-latest
	container:
	image: ubuntu:24.04
	options: --privileged
	needs: [prepare-deps, prepare-cbindgen]
	steps:
	- name: Cache ~/.cargo
	uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
	with:
	path: ~/.cargo/registry
	key: cargo-registry

	- name: Determine number of CPUs
	run: echo CPUS=$(nproc --all) >> $GITHUB_ENV

	- name: Install dependencies
	run: \|
	apt update
	apt -y install \
	libpcre2-dev \
	build-essential \
	autoconf \
	automake \
	llvm-19-dev \
	clang-19 \
	git \
	hwloc \
	libhwloc-dev \
	jq \
	inetutils-ping \
	libc++-dev \
	libc++abi-dev \
	libtool \
	libpcap-dev \
	libnet1-dev \
	libyaml-0-2 \
	libyaml-dev \
	libcap-ng-dev \
	libcap-ng0 \
	libmagic-dev \
	libnetfilter-queue-dev \
	libnetfilter-queue1 \
	libnfnetlink-dev \
	libnfnetlink0 \
	libnuma-dev \
	libhiredis-dev \
	libjansson-dev \
	libevent-dev \
	libevent-pthreads-2.1-7 \
	make \
	parallel \
	python3-yaml \
	software-properties-common \
	sudo \
	zlib1g \
	zlib1g-dev \
	exuberant-ctags \
	unzip \
	curl \
	time \
	wget
	# specific version to match up to the llvm version in ubuntu below
	- name: Install Rust
	run: curl https://sh.rustup.rs -sSf \| sh -s -- --default-toolchain 1.85.1 -y
	- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
	- run: git config --global --add safe.directory /__w/suricata/suricata
	- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
	with:
	name: prep
	path: prep
	- run: tar xf prep/suricata-verify.tar.gz
	- uses: ./.github/actions/install-cbindgen
	- name: Fix kernel mmap rnd bits
	# Asan in llvm 14 provided in ubuntu 22.04 is incompatible with
	# high-entropy ASLR in much newer kernels that GitHub runners are
	# using leading to random crashes: https://github.com/actions/runner-images/issues/9491
	run: sudo sysctl vm.mmap_rnd_bits=28
	- run: ./autogen.sh
	- run: ./configure --with-gnu-ld --disable-shared --enable-gccprotect --localstatedir=/var --prefix=/usr --sysconfdir=/etc
	env:
	CC: "clang-19"
	CXX: "clang++-19"
	RUSTFLAGS: "-C instrument-coverage"
	CFLAGS: "-fprofile-instr-generate -fcoverage-mapping -O0 -g -fno-strict-aliasing"
	CXXFLAGS: "-fprofile-instr-generate -fcoverage-mapping -O0 -g -fno-strict-aliasing"
	ac_cv_func_malloc_0_nonnull: "yes"
	ac_cv_func_realloc_0_nonnull: "yes"
	- run: make -j ${{ env.CPUS }}
	env:
	CC: "clang-19"
	CXX: "clang++-19"
	RUSTFLAGS: "-C instrument-coverage"
	- run: \|
	./qa/unix.sh "suricata-verify/"
	env:
	LLVM_PROFILE_FILE: "/tmp/unix.profraw"
	- run: llvm-profdata-19 merge -o default.profdata $(find /tmp/ -name '*.profraw')
	- run: llvm-cov-19 export ./src/suricata -instr-profile=default.profdata -format=lcov --ignore-filename-regex="^/(root\|usr\|rustc\|github)/.*" --skip-branches > coverage.lcov
	- name: Upload coverage.lcov artifact
	uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
	with:
	name: coverage-lcov-${{ github.job }}
	path: coverage.lcov
	- name: Upload coverage to Codecov
	uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f
	with:
	fail_ci_if_error: false
	files: coverage.lcov
	flags: pcap

	ubuntu-24-04-cov-afpdpdk:
	name: Ubuntu 24.04 (afpacket and dpdk coverage)
	runs-on: ubuntu-latest
	container:
	image: ubuntu:24.04
	options: --privileged
	needs: [prepare-deps, prepare-cbindgen]
	steps:
	- name: Cache ~/.cargo
	uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
	with:
	path: ~/.cargo/registry
	key: cargo-registry
	- name: Determine number of CPUs
	run: echo CPUS=$(nproc --all) >> $GITHUB_ENV

	- name: Install dependencies
	run: \|
	apt update
	apt -y install \
	libpcre2-dev \
	build-essential \
	autoconf \
	automake \
	llvm-19-dev \
	clang-19 \
	git \
	hwloc \
	libhwloc-dev \
	jq \
	inetutils-ping \
	libc++-dev \
	libc++abi-dev \
	libtool \
	libpcap-dev \
	libnet1-dev \
	libyaml-0-2 \
	libyaml-dev \
	libcap-ng-dev \
	libcap-ng0 \
	libmagic-dev \
	libnetfilter-queue-dev \
	libnetfilter-queue1 \
	libnfnetlink-dev \
	libnfnetlink0 \
	libnuma-dev \
	libhiredis-dev \
	libjansson-dev \
	libevent-dev \
	libevent-pthreads-2.1-7 \
	make \
	parallel \
	python3-yaml \
	software-properties-common \
	sudo \
	zlib1g \
	zlib1g-dev \
	exuberant-ctags \
	unzip \
	curl \
	time \
	wget \
	dpdk-dev
	# specific version to match up to the llvm version in ubuntu below
	- name: Install Rust
	run: curl https://sh.rustup.rs -sSf \| sh -s -- --default-toolchain 1.85.1 -y
	- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
	- run: git config --global --add safe.directory /__w/suricata/suricata
	- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
	with:
	name: prep
	path: prep
	- uses: ./.github/actions/install-cbindgen
	- name: Fix kernel mmap rnd bits
	# Asan in llvm 14 provided in ubuntu 22.04 is incompatible with
	# high-entropy ASLR in much newer kernels that GitHub runners are
	# using leading to random crashes: https://github.com/actions/runner-images/issues/9491
	run: sudo sysctl vm.mmap_rnd_bits=28
	- run: ./autogen.sh
	- run: ./configure --with-gnu-ld --enable-dpdk --disable-shared --enable-gccprotect --localstatedir=/var --prefix=/usr --sysconfdir=/etc
	env:
	CC: "clang-19"
	CXX: "clang++-19"
	RUSTFLAGS: "-C instrument-coverage"
	CFLAGS: "-fprofile-instr-generate -fcoverage-mapping -O0 -g -fno-strict-aliasing"
	CXXFLAGS: "-fprofile-instr-generate -fcoverage-mapping -O0 -g -fno-strict-aliasing"
	ac_cv_func_malloc_0_nonnull: "yes"
	ac_cv_func_realloc_0_nonnull: "yes"
	- run: make -j ${{ env.CPUS }}
	env:
	CC: "clang-19"
	CXX: "clang++-19"
	RUSTFLAGS: "-C instrument-coverage"
	# IDS config
	- run: \|
	./qa/live/dpdk.sh "qa/live/dpdk/suricata-null-ids.yaml"
	env:
	LLVM_PROFILE_FILE: "/tmp/dpdk-ids.profraw"
	# IPS config
	- run: \|
	./qa/live/dpdk.sh "qa/live/dpdk/suricata-null-ips.yaml"
	env:
	LLVM_PROFILE_FILE: "/tmp/dpdk-ips.profraw"
	# DPDK configuration checks
	- run: ./qa/live/dpdk/dpdk-testsuite.sh
	env:
	LLVM_PROFILE_FILE: "/tmp/dpdk-testsuite-%p.profraw"
	# AF_PACKET tests
	- run: \|
	./qa/live/afp-ids.sh "2" "autofp"
	env:
	LLVM_PROFILE_FILE: "/tmp/afp2-ids-autofp.profraw"
	- run: \|
	./qa/live/afp-ids.sh "2" "workers"
	env:
	LLVM_PROFILE_FILE: "/tmp/afp2-ids-workers.profraw"
	- run: \|
	./qa/live/afp-ids.sh "3" "autofp"
	env:
	LLVM_PROFILE_FILE: "/tmp/afp3-ids-autofp.profraw"
	- run: \|
	./qa/live/afp-ids.sh "3" "workers"
	env:
	LLVM_PROFILE_FILE: "/tmp/afp3-ids-workers.profraw"
	# PCAP
	- run: \|
	./qa/live/pcap.sh "autofp"
	env:
	LLVM_PROFILE_FILE: "/tmp/pcap-autofp.profraw"
	- run: \|
	./qa/live/pcap.sh "single"
	env:
	LLVM_PROFILE_FILE: "/tmp/pcap-single.profraw"
	- run: \|
	./qa/live/multi-tenant.sh "autofp"
	env:
	LLVM_PROFILE_FILE: "/tmp/mt-autofp.profraw"
	- run: llvm-profdata-19 merge -o default.profdata $(find /tmp/ -name '*.profraw')
	- run: llvm-cov-19 export ./src/suricata -instr-profile=default.profdata -format=lcov --ignore-filename-regex="^/(root\|usr\|rustc\|github)/.*" --skip-branches > coverage.lcov
	- name: Upload coverage.lcov artifact
	uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
	with:
	name: coverage-lcov-${{ github.job }}
	path: coverage.lcov
	- name: Upload coverage to Codecov
	uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f
	with:
	fail_ci_if_error: false
	files: coverage.lcov
	flags: livemode

	ubuntu-24-04-pcap-unix:
	name: Ubuntu 24.04 (pcap unix socket ASAN)
	runs-on: ubuntu-latest
	container:
	image: ubuntu:24.04
	options: --privileged
	needs: [prepare-deps, prepare-cbindgen]
	steps:
	- name: Cache ~/.cargo
	uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
	with:
	path: ~/.cargo/registry
	key: cargo-registry
	- name: Determine number of CPUs
	run: echo CPUS=$(nproc --all) >> $GITHUB_ENV

	- name: Install dependencies
	run: \|
	apt update
	apt -y install \
	libpcre2-dev \
	build-essential \
	autoconf \
	automake \
	llvm-18-dev \
	cargo \
	cbindgen \
	clang-18 \
	git \
	hwloc \
	libhwloc-dev \
	jq \
	libc++-dev \
	libc++abi-dev \
	libtool \
	libpcap-dev \
	libnet1-dev \
	libyaml-0-2 \
	libyaml-dev \
	libcap-ng-dev \
	libcap-ng0 \
	libmagic-dev \
	libnetfilter-queue-dev \
	libnetfilter-queue1 \
	libnfnetlink-dev \
	libnfnetlink0 \
	libnuma-dev \
	libhiredis-dev \
	libjansson-dev \
	libevent-dev \
	libevent-pthreads-2.1-7 \
	make \
	parallel \
	python3-yaml \
	rustc \
	software-properties-common \
	sudo \
	zlib1g \
	zlib1g-dev \
	exuberant-ctags \
	unzip \
	curl \
	time \
	wget \
	dpdk-dev
	- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
	- run: git config --global --add safe.directory /__w/suricata/suricata
	- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
	with:
	name: prep
	path: prep
	- name: Extracting suricata-verify
	run: tar xf prep/suricata-verify.tar.gz
	- name: Fix kernel mmap rnd bits
	run: sudo sysctl vm.mmap_rnd_bits=28
	- run: ./autogen.sh
	- run: ./configure --enable-dpdk --disable-shared --enable-gccprotect --localstatedir=/var --prefix=/usr --sysconfdir=/etc
	env:
	CC: "clang-18"
	CFLAGS: "-g -fsanitize=address -fno-omit-frame-pointer"
	ac_cv_func_malloc_0_nonnull: "yes"
	ac_cv_func_realloc_0_nonnull: "yes"
	- run: make -j ${{ env.CPUS }}
	env:
	CC: "clang-18"
	- run: \|
	./qa/unix.sh "suricata-verify/"

	ubuntu-latest-namespace-ips:
	name: Ubuntu 24.04 (afpacket IPS tests in namespaces)
	runs-on: ubuntu-latest
	needs: [prepare-deps, prepare-cbindgen]
	container:
	image: ubuntu:24.04
	options: --privileged
	steps:
	- name: Cache ~/.cargo
	uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
	with:
	path: ~/.cargo/registry
	key: cargo-registry
	- name: Determine number of CPUs
	run: echo CPUS=$(nproc --all) >> $GITHUB_ENV

	- name: Install dependencies
	run: \|
	apt update
	apt -y install \
	libpcre2-dev \
	build-essential \
	autoconf \
	automake \
	llvm-19-dev \
	clang-19 \
	git \
	hping3 \
	hwloc \
	libhwloc-dev \
	jq \
	inetutils-ping \
	libc++-dev \
	libc++abi-dev \
	libtool \
	libpcap-dev \
	libnet1-dev \
	libyaml-0-2 \
	libyaml-dev \
	libcap-ng-dev \
	libcap-ng0 \
	libmagic-dev \
	libnetfilter-queue-dev \
	libnetfilter-queue1 \
	libnfnetlink-dev \
	libnfnetlink0 \
	libnuma-dev \
	libhiredis-dev \
	libjansson-dev \
	libevent-dev \
	libevent-pthreads-2.1-7 \
	make \
	parallel \
	python3-yaml \
	software-properties-common \
	sudo \
	zlib1g \
	zlib1g-dev \
	exuberant-ctags \
	unzip \
	curl \
	time \
	wget \
	caddy \
	ethtool \
	iproute2 \
	iptables \
	tshark
	- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
	- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
	with:
	name: prep
	path: prep
	# packaged Rust version is too old for coverage, so get from rustup. 1.85.1 matches
	# LLVM 19
	- name: Install Rust
	run: curl https://sh.rustup.rs -sSf \| sh -s -- --default-toolchain 1.85.1 -y
	- uses: ./.github/actions/install-cbindgen
	- run: ./autogen.sh
	- run: ./configure --disable-shared --localstatedir=/var --prefix=/usr --sysconfdir=/etc --enable-nfqueue
	env:
	CC: "clang-19"
	CXX: "clang++-19"
	RUSTFLAGS: "-C instrument-coverage"
	CFLAGS: "-fprofile-instr-generate -fcoverage-mapping -O0"
	CXXFLAGS: "-fprofile-instr-generate -fcoverage-mapping -O0"
	- run: make -j ${{ env.CPUS }}
	env:
	CC: "clang-19"
	CXX: "clang++-19"
	RUSTFLAGS: "-C instrument-coverage"
	CFLAGS: "-fprofile-instr-generate -fcoverage-mapping -O0"
	CXXFLAGS: "-fprofile-instr-generate -fcoverage-mapping -O0"

	- run: \|
	./qa/live/netns/afp-ips-netns-bridge.sh "2" "workers" "qa/live/netns/ips-netns.yaml"
	env:
	LLVM_PROFILE_FILE: "/tmp/afp-ips.profraw"
	- run: llvm-profdata-19 merge -o afp-ips.profdata /tmp/afp-ips.profraw

	- run: \|
	./qa/live/netns/afp-ips-netns-bridge.sh "2" "autofp" "qa/live/netns/ips-netns.yaml"
	env:
	LLVM_PROFILE_FILE: "/tmp/afp-ips-autofp.profraw"
	- run: llvm-profdata-19 merge -o afp-ips-autofp.profdata /tmp/afp-ips-autofp.profraw

	- run: \|
	./qa/live/netns/afp-ips-netns-bond-bridge.sh "2" "workers" "qa/live/netns/ips-netns-bond.yaml"
	env:
	LLVM_PROFILE_FILE: "/tmp/afp-ips-bond1.profraw"
	- run: llvm-profdata-19 merge -o afp-ips-bond1.profdata /tmp/afp-ips-bond1.profraw

	- run: \|
	./qa/live/netns/afp-ips-netns-bond-bridge2.sh "2" "workers" "qa/live/netns/ips-netns-bond2.yaml"
	env:
	LLVM_PROFILE_FILE: "/tmp/afp-ips-bond2.profraw"
	- run: llvm-profdata-19 merge -o afp-ips-bond2.profdata /tmp/afp-ips-bond2.profraw

	- run: \|
	./qa/live/netns/nfq-ips-netns-route.sh "autofp" "qa/live/netns/ips-netns.yaml"
	env:
	LLVM_PROFILE_FILE: "/tmp/nfq-ips.profraw"
	- run: llvm-profdata-19 merge -o nfq-ips.profdata /tmp/nfq-ips.profraw

	- run: \|
	./qa/live/netns/nfq-ips-netns-route.sh "workers" "qa/live/netns/ips-netns.yaml"
	env:
	LLVM_PROFILE_FILE: "/tmp/nfq-ips-workers.profraw"
	- run: llvm-profdata-19 merge -o nfq-ips-workers.profdata /tmp/nfq-ips-workers.profraw

	- run: \|
	./qa/live/netns/nfq-fw-netns-route.sh "autofp" "qa/live/netns/fw-netns.yaml"
	env:
	LLVM_PROFILE_FILE: "/tmp/nfq-fw-netns-route.profraw"
	- run: llvm-profdata-19 merge -o nfq-fw-netns-route.profdata /tmp/nfq-fw-netns-route.profraw

	- run: \|
	./qa/live/netns/afp-fw-netns-bridge.sh "2" "workers" "qa/live/netns/fw-netns.yaml"
	env:
	LLVM_PROFILE_FILE: "/tmp/afp-fw-netns-bridge.profraw"
	- run: llvm-profdata-19 merge -o afp-fw-netns-bridge.profdata /tmp/afp-fw-netns-bridge.profraw

	- run: llvm-profdata-19 merge -o combined.profdata afp-ips.profdata nfq-ips.profdata afp-ips-autofp.profdata nfq-ips-workers.profdata afp-ips-bond1.profdata afp-ips-bond2.profdata afp-fw-netns-bridge.profdata nfq-fw-netns-route.profdata
	- run: llvm-cov-19 export ./src/suricata -instr-profile=combined.profdata -format=lcov --ignore-filename-regex="^(/github/home/.cargo/.\|/usr/.\|/rustc/.*)" --skip-branches > coverage.lcov
	- name: Upload coverage.lcov artifact
	uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
	with:
	name: coverage-lcov-${{ github.job }}
	path: coverage.lcov
	- name: Upload coverage to Codecov
	uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f
	with:
	fail_ci_if_error: true
	files: coverage.lcov
	flags: netns
	verbose: true

	ubuntu-24-04-asan-afpdpdk:
	name: Ubuntu 24.04 (afpacket and dpdk live tests with ASAN)
	runs-on: ubuntu-latest
	container:
	image: ubuntu:24.04
	options: --privileged
	needs: [prepare-deps, prepare-cbindgen]
	steps:
	- name: Cache ~/.cargo
	uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
	with:
	path: ~/.cargo/registry
	key: cargo-registry
	- name: Determine number of CPUs
	run: echo CPUS=$(nproc --all) >> $GITHUB_ENV

	- name: Install dependencies
	run: \|
	apt update
	apt -y install \
	libpcre2-dev \
	build-essential \
	autoconf \
	automake \
	llvm-18-dev \
	cargo \
	cbindgen \
	clang-18 \
	git \
	hwloc \
	libhwloc-dev \
	jq \
	inetutils-ping \
	libc++-dev \
	libc++abi-dev \
	libtool \
	libpcap-dev \
	libnet1-dev \
	libyaml-0-2 \
	libyaml-dev \
	libcap-ng-dev \
	libcap-ng0 \
	libmagic-dev \
	libnetfilter-queue-dev \
	libnetfilter-queue1 \
	libnfnetlink-dev \
	libnfnetlink0 \
	libnuma-dev \
	libhiredis-dev \
	libjansson-dev \
	libevent-dev \
	libevent-pthreads-2.1-7 \
	make \
	parallel \
	python3-yaml \
	rustc \
	software-properties-common \
	sudo \
	zlib1g \
	zlib1g-dev \
	exuberant-ctags \
	unzip \
	curl \
	time \
	wget \
	dpdk-dev
	- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
	- run: git config --global --add safe.directory /__w/suricata/suricata
	- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
	with:
	name: prep
	path: prep
	- name: Fix kernel mmap rnd bits
	run: sudo sysctl vm.mmap_rnd_bits=28
	- run: ./autogen.sh
	- run: ./configure --enable-dpdk --disable-shared --enable-gccprotect --localstatedir=/var --prefix=/usr --sysconfdir=/etc
	env:
	CC: "clang-18"
	CFLAGS: "-g -fsanitize=address -fno-omit-frame-pointer"
	ac_cv_func_malloc_0_nonnull: "yes"
	ac_cv_func_realloc_0_nonnull: "yes"
	- run: make -j ${{ env.CPUS }}
	env:
	CC: "clang-18"
	# IDS config
	- run: \|
	./qa/live/dpdk.sh "qa/live/dpdk/suricata-null-ids.yaml"
	# IPS config
	- run: \|
	./qa/live/dpdk.sh "qa/live/dpdk/suricata-null-ips.yaml"
	# DPDK configuration checks
	- run: ./qa/live/dpdk/dpdk-testsuite.sh
	# AF_PACKET tests
	- run: \|
	./qa/live/afp-ids.sh "2" "autofp"
	- run: \|
	./qa/live/afp-ids.sh "2" "workers"
	- run: \|
	./qa/live/afp-ids.sh "3" "autofp"
	- run: \|
	./qa/live/afp-ids.sh "3" "workers"
	- run: \|
	./qa/live/pcap.sh "autofp"
	- run: \|
	./qa/live/pcap.sh "single"
	- run: \|
	./qa/live/multi-tenant.sh "autofp"

	ubuntu-24-04-cov-fuzz:
	name: Ubuntu 24.04 (fuzz corpus coverage)
	runs-on: ubuntu-latest
	container:
	image: ubuntu:24.04
	options: --privileged
	needs: [prepare-deps, prepare-cbindgen]
	steps:
	- name: Cache ~/.cargo
	uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
	with:
	path: ~/.cargo/registry
	key: cargo-registry
	- name: Determine number of CPUs
	run: echo CPUS=$(nproc --all) >> $GITHUB_ENV

	- name: Install dependencies
	run: \|
	apt update
	apt -y install \
	libpcre2-dev \
	build-essential \
	autoconf \
	automake \
	llvm-19-dev \
	clang-19 \
	git \
	hwloc \
	libhwloc-dev \
	jq \
	libc++-dev \
	libc++abi-dev \
	libtool \
	libpcap-dev \
	libnet1-dev \
	libyaml-0-2 \
	libyaml-dev \
	libcap-ng-dev \
	libcap-ng0 \
	libmagic-dev \
	libnetfilter-queue-dev \
	libnetfilter-queue1 \
	libnfnetlink-dev \
	libnfnetlink0 \
	libnuma-dev \
	libhiredis-dev \
	libjansson-dev \
	libevent-dev \
	libevent-pthreads-2.1-7 \
	make \
	parallel \
	python3-yaml \
	software-properties-common \
	sudo \
	zlib1g \
	zlib1g-dev \
	exuberant-ctags \
	unzip \
	curl \
	time \
	wget \
	dpdk-dev
	# packaged Rust version is too old for coverage, so get from rustup
	- name: Install Rust
	run: curl https://sh.rustup.rs -sSf \| sh -s -- --default-toolchain 1.85.1 -y
	- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
	- run: git config --global --add safe.directory /__w/suricata/suricata
	- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
	with:
	name: prep
	path: prep
	- uses: ./.github/actions/install-cbindgen
	- name: Fix kernel mmap rnd bits
	# Asan in llvm 14 provided in ubuntu 22.04 is incompatible with
	# high-entropy ASLR in much newer kernels that GitHub runners are
	# using leading to random crashes: https://github.com/actions/runner-images/issues/9491
	run: sudo sysctl vm.mmap_rnd_bits=28
	- run: ./autogen.sh
	- run: ./configure --enable-warnings --with-gnu-ld --enable-fuzztargets --disable-shared --enable-gccprotect
	env:
	LIB_FUZZING_ENGINE: "fail_to_onefile_driver"
	CC: "clang-19"
	CXX: "clang++-19"
	RUSTFLAGS: "-C instrument-coverage"
	CFLAGS: "-fprofile-instr-generate -fcoverage-mapping -O0 -g -fno-strict-aliasing -fsanitize=address -fno-omit-frame-pointer -fPIC -Wno-unused-parameter -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION=1 -Wimplicit-int-float-conversion -Wimplicit-int-conversion -Werror"
	CXXFLAGS: "-fprofile-instr-generate -fcoverage-mapping -O0 -g -fno-strict-aliasing -fsanitize=address -fno-omit-frame-pointer -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION=1 -stdlib=libc++ -Wimplicit-int-float-conversion -Wimplicit-int-conversion"
	ac_cv_func_malloc_0_nonnull: "yes"
	ac_cv_func_realloc_0_nonnull: "yes"
	- run: make -j ${{ env.CPUS }}
	env:
	CC: "clang-19"
	CXX: "clang++-19"
	RUSTFLAGS: "-C instrument-coverage"
	SURICATA_LUA_SYS_CFLAGS: "-fsanitize=address"
	- run: ./qa/run-ossfuzz-corpus.sh
	- run: llvm-profdata-19 merge -o default.profdata $(find /tmp/ -name '*.profraw')
	- run: llvm-cov-19 export ./src/suricata -instr-profile=default.profdata -format=lcov --ignore-filename-regex="^/(root\|usr\|rustc\|github)/.*" --skip-branches > coverage.lcov
	- name: Upload coverage.lcov artifact
	uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
	with:
	name: coverage-lcov-${{ github.job }}
	path: coverage.lcov
	- name: Upload coverage to Codecov
	uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f
	with:
	fail_ci_if_error: false
	files: coverage.lcov
	flags: fuzzcorpus

	ubuntu-20-04-ndebug:
	name: Ubuntu 20.04 (-DNDEBUG)
	runs-on: ubuntu-latest
	container: ubuntu:20.04
	needs: [prepare-deps, prepare-cbindgen]
	steps:
	- name: Cache ~/.cargo
	uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
	with:
	path: ~/.cargo/registry
	key: cargo-registry

	- name: Determine number of CPUs
	run: echo CPUS=$(nproc --all) >> $GITHUB_ENV

	- name: Install dependencies
	run: \|
	apt update
	apt -y install \
	build-essential \
	autoconf \
	automake \
	cargo \
	git \
	hwloc \
	libhwloc-dev \
	jq \
	libtool \
	libpcap-dev \
	libnet1-dev \
	libyaml-0-2 \
	libyaml-dev \
	libcap-ng-dev \
	libcap-ng0 \
	libmagic-dev \
	libnetfilter-queue-dev \
	libnetfilter-queue1 \
	libnfnetlink-dev \
	libnfnetlink0 \
	libnuma-dev \
	libhiredis-dev \
	libjansson-dev \
	libevent-dev \
	libevent-pthreads-2.1-7 \
	libpython2.7 \
	libpcre2-dev \
	make \
	parallel \
	python3-yaml \
	rustc \
	software-properties-common \
	zlib1g \
	zlib1g-dev \
	exuberant-ctags \
	dpdk-dev
	- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
	- run: git config --global --add safe.directory /__w/suricata/suricata
	- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
	with:
	name: prep
	path: prep
	- run: tar xf prep/suricata-update.tar.gz
	- uses: ./.github/actions/install-cbindgen
	- run: ./autogen.sh
	- run: CFLAGS="$DEFAULT_CFLAGS -DNDEBUG" ./configure --enable-warnings --enable-unittests
	- run: make -j ${{ env.CPUS }}
	- run: make check
	- run: make dist
	- name: Extracting suricata-verify
	run: tar xf prep/suricata-verify.tar.gz
	- name: Running suricata-verify
	run: python3 ./suricata-verify/run.py -q --debug-failed
	# Now install and make sure headers and libraries aren't install
	# until requested.
	- run: make install
	- run: test ! -e /usr/local/lib/libsuricata_c.a
	- run: test ! -e /usr/local/include/suricata
	- run: make install-headers
	- run: test -e /usr/local/include/suricata/suricata.h
	- run: make install-library
	- run: test -e /usr/local/lib/libsuricata_c.a
	- run: test -e /usr/local/lib/libsuricata_rust.a
	- run: test -e /usr/local/bin/libsuricata-config
	- run: test -e /usr/local/lib/libsuricata.so
	- run: test -e /usr/local/lib/$(readlink /usr/local/lib/libsuricata.so)
	- run: suricata-update -V
	- run: suricatasc -h

	ubuntu-20-04-too-old-rust:
	name: Ubuntu 20.04 (unsupported rust)
	runs-on: ubuntu-latest
	container: ubuntu:20.04
	needs: ubuntu-22-04-dist
	steps:
	- name: Cache ~/.cargo
	uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
	with:
	path: ~/.cargo/registry
	key: cargo-registry
	- name: Determine number of CPUs
	run: echo CPUS=$(nproc --all) >> $GITHUB_ENV

	- name: Install dependencies
	run: \|
	apt update
	apt -y install \
	build-essential \
	curl \
	hwloc \
	libhwloc-dev \
	libtool \
	libpcap-dev \
	libnet1-dev \
	libyaml-0-2 \
	libyaml-dev \
	libcap-ng-dev \
	libcap-ng0 \
	libmagic-dev \
	libnetfilter-queue-dev \
	libnetfilter-queue1 \
	libnfnetlink-dev \
	libnfnetlink0 \
	libnuma-dev \
	libhiredis-dev \
	libjansson-dev \
	libevent-dev \
	libevent-pthreads-2.1-7 \
	libpython2.7 \
	libpcre2-dev \
	make \
	python3-yaml \
	software-properties-common \
	zlib1g \
	zlib1g-dev \
	dpdk-dev
	- run: curl https://sh.rustup.rs -sSf \| sh -s -- --default-toolchain 1.62.0 -y
	- run: echo "$HOME/.cargo/bin" >> $GITHUB_PATH
	- name: Download suricata.tar.gz
	uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
	with:
	name: dist
	- run: tar zxvf suricata-*.tar.gz --strip-components=1
	- run: \|
	if ./configure; then
	echo "error: configure should have failed"
	exit 1
	else
	exit 0
	fi

	ubuntu-22-04-debug-validation:
	name: Ubuntu 22.04 (Debug Validation)
	runs-on: ubuntu-22.04
	container:
	image: ubuntu:22.04
	options: --privileged
	needs: [prepare-deps, prepare-cbindgen]
	steps:

	# Cache Rust stuff.
	- name: Cache cargo registry
	uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
	with:
	path: ~/.cargo/registry
	key: cargo-registry

	- name: Determine number of CPUs
	run: echo CPUS=$(nproc --all) >> $GITHUB_ENV

	- name: Install dependencies
	run: \|
	apt update
	apt -y install \
	libpcre2-dev \
	build-essential \
	autoconf \
	automake \
	cargo \
	git \
	hwloc \
	libhwloc-dev \
	jq \
	libtool \
	libpcap-dev \
	libnet1-dev \
	libyaml-0-2 \
	libyaml-dev \
	libcap-ng-dev \
	libcap-ng0 \
	libmagic-dev \
	libnetfilter-queue-dev \
	libnetfilter-queue1 \
	libnfnetlink-dev \
	libnfnetlink0 \
	libhiredis-dev \
	libjansson-dev \
	libevent-dev \
	libevent-pthreads-2.1-7 \
	libpython2.7 \
	make \
	parallel \
	python3-yaml \
	rustc \
	software-properties-common \
	sudo \
	zlib1g \
	zlib1g-dev \
	exuberant-ctags
	- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
	- run: git config --global --add safe.directory /__w/suricata/suricata
	- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
	with:
	name: prep
	path: prep
	- uses: ./.github/actions/install-cbindgen
	- name: Fix kernel mmap rnd bits
	# Asan in llvm 14 provided in ubuntu 22.04 is incompatible with
	# high-entropy ASLR in much newer kernels that GitHub runners are
	# using leading to random crashes: https://github.com/actions/runner-images/issues/9491
	run: sudo sysctl vm.mmap_rnd_bits=28
	- run: ./autogen.sh
	- run: ./configure --enable-warnings --enable-debug-validation --enable-qa-simulation
	env:
	CFLAGS: "${{ env.DEFAULT_CFLAGS }} -Wshadow -fsanitize=address -fno-omit-frame-pointer"
	LDFLAGS: "-fsanitize=address"
	ac_cv_func_malloc_0_nonnull: "yes"
	ac_cv_func_realloc_0_nonnull: "yes"
	- run: make -j ${{ env.CPUS }}
	- run: make check
	- name: Extracting suricata-verify
	run: tar xf prep/suricata-verify.tar.gz
	- name: Running suricata-verify
	run: python3 ./suricata-verify/run.py -q --debug-failed

	# test build with afl and fuzztargets
	ubuntu-22-04-fuzz:
	name: Ubuntu 22.04 (Fuzz)
	runs-on: ubuntu-22.04
	container: ubuntu:22.04
	needs: [prepare-deps, prepare-cbindgen]
	steps:

	# Cache Rust stuff.
	- name: Cache cargo registry
	uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
	with:
	path: ~/.cargo/registry
	key: cargo-registry

	- name: Determine number of CPUs
	run: echo CPUS=$(nproc --all) >> $GITHUB_ENV

	- name: Install dependencies
	run: \|
	apt update
	apt -y install \
	afl \
	afl-clang \
	libpcre2-dev \
	build-essential \
	autoconf \
	automake \
	cargo \
	git \
	hwloc \
	libhwloc-dev \
	libtool \
	libpcap-dev \
	libnet1-dev \
	libyaml-0-2 \
	libyaml-dev \
	libcap-ng-dev \
	libcap-ng0 \
	libmagic-dev \
	libnetfilter-queue-dev \
	libnetfilter-queue1 \
	libnfnetlink-dev \
	libnfnetlink0 \
	libhiredis-dev \
	libjansson-dev \
	libpython2.7 \
	make \
	rustc \
	software-properties-common \
	zlib1g \
	zlib1g-dev
	- run: echo "$HOME/.cargo/bin" >> $GITHUB_PATH
	- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
	- run: git config --global --add safe.directory /__w/suricata/suricata
	- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
	with:
	name: prep
	path: prep
	- uses: ./.github/actions/install-cbindgen
	- run: ./autogen.sh
	- run: AFL_HARDEN=1 ac_cv_func_realloc_0_nonnull=yes ac_cv_func_malloc_0_nonnull=yes CFLAGS="-fsanitize=address -fno-omit-frame-pointer" CXXFLAGS=$CFLAGS CC=afl-clang-fast CXX=afl-clang-fast++ LDFLAGS="-fsanitize=address" ./configure --enable-warnings --enable-fuzztargets --disable-shared
	- run: AFL_HARDEN=1 make -j ${{ env.CPUS }}

	ubuntu-22-04-netmap-build:
	name: Ubuntu 22.04 (Netmap build)
	needs: [prepare-deps, prepare-cbindgen]
	runs-on: ubuntu-22.04
	steps:
	- name: Restore Cache Netmap
	uses: actions/cache/restore@v5
	id: netmap-cache
	with:
	path: netmap/
	key: netmap-git

	# Cache Rust stuff.
	- name: Cache cargo registry
	uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
	with:
	path: ~/.cargo/registry
	key: cargo-registry

	- name: Determine number of CPUs
	run: echo CPUS=$(nproc --all) >> $GITHUB_ENV

	- name: Install dependencies
	run: \|
	sudo apt update
	sudo apt -y install \
	libpcre2-dev \
	build-essential \
	autoconf \
	automake \
	cargo \
	git \
	hwloc \
	libhwloc-dev \
	jq \
	libtool \
	libpcap-dev \
	libnet1-dev \
	libyaml-0-2 \
	libyaml-dev \
	libcap-ng-dev \
	libcap-ng0 \
	libmagic-dev \
	libnetfilter-queue-dev \
	libnetfilter-queue1 \
	libnfnetlink-dev \
	libnfnetlink0 \
	libhiredis-dev \
	libjansson-dev \
	libevent-dev \
	libevent-pthreads-2.1-7 \
	libpython2.7 \
	make \
	parallel \
	python3-yaml \
	rustc \
	software-properties-common \
	zlib1g \
	zlib1g-dev \
	exuberant-ctags

	- name: Install Netmap dependencies
	run: \|
	sudo apt -y install \
	build-essential \
	git \
	linux-headers-$(uname -r)

	- name: Checkout Netmap repository
	if: steps.netmap-cache.outputs.cache-hit != 'true'
	run: git clone --depth 1 https://github.com/luigirizzo/netmap

	- name: Save Netmap Cache
	if: steps.netmap-cache.outputs.cache-hit != 'true'
	uses: actions/cache/save@v5
	with:
	path: netmap/
	key: netmap-git

	- name: Compile and install Netmap
	run: \|
	cd $GITHUB_WORKSPACE/netmap/LINUX
	./configure --no-drivers
	make -j ${{ env.CPUS }}
	sudo make install

	- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
	- run: git config --global --add safe.directory /__w/suricata/suricata
	- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
	with:
	name: prep
	path: prep
	- uses: ./.github/actions/install-cbindgen
	- run: ./autogen.sh
	- run: CFLAGS="${DEFAULT_CFLAGS}" ./configure --enable-warnings --enable-netmap --enable-debug
	- run: make -j ${{ env.CPUS }}
	- run: ./src/suricata --build-info \| grep -E "Netmap support:\s+yes"

	ubuntu-22-04-minimal-recommended-build:
	name: Ubuntu 22.04 (Minimal/Recommended Build)
	needs: [ubuntu-22-04-dist]
	runs-on: ubuntu-22.04
	container: ubuntu:22.04
	steps:
	# Cache Rust stuff.
	- name: Cache cargo registry
	uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
	with:
	path: ~/.cargo/registry
	key: cargo-registry

	- name: Determine number of CPUs
	run: echo CPUS=$(nproc --all) >> $GITHUB_ENV

	- name: Download suricata.tar.gz
	uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
	with:
	name: dist
	- run: tar xvf suricata-*.tar.gz --strip-components=1

	# Install packages required by the install script.
	- run: apt update -y && apt install -y sudo

	- name: Install minimal dependencies
	run: ./scripts/docs-ubuntu-debian-minimal-build.sh

	- run: CFLAGS="${DEFAULT_CFLAGS}" ./configure
	- run: make -j ${{ env.CPUS }}
	- run: ./src/suricata --build-info # check if we can run Suricata

	ubuntu-22-04-dpdk-build:
	name: Ubuntu 22.04 (DPDK Build)
	runs-on: ubuntu-22.04
	container: ubuntu:22.04
	needs: [ prepare-deps, prepare-cbindgen ]
	strategy:
	matrix:
	dpdk_version: [ 24.11.3, 23.11.5, 22.11.10, 21.11.9 ]
	steps:

	# Cache Rust stuff.
	- name: Cache cargo registry
	uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
	with:
	path: ~/.cargo/registry
	key: cargo-registry

	- name: Determine number of CPUs
	run: echo CPUS=$(nproc --all) >> $GITHUB_ENV

	- name: Install dependencies
	run: \|
	apt update
	apt -y install \
	libpcre2-dev \
	build-essential \
	autoconf \
	automake \
	cargo \
	git \
	hwloc \
	libhwloc-dev \
	jq \
	libtool \
	libpcap-dev \
	libnet1-dev \
	libyaml-0-2 \
	libyaml-dev \
	libcap-ng-dev \
	libcap-ng0 \
	libmagic-dev \
	libnetfilter-queue-dev \
	libnetfilter-queue1 \
	libnfnetlink-dev \
	libnfnetlink0 \
	libhiredis-dev \
	libjansson-dev \
	libevent-dev \
	libevent-pthreads-2.1-7 \
	libpython2.7 \
	make \
	parallel \
	python3-yaml \
	rustc \
	software-properties-common \
	zlib1g \
	zlib1g-dev \
	exuberant-ctags
	- name: Install DPDK dependencies
	run: \|
	apt update
	apt install -y \
	curl \
	build-essential \
	libnuma-dev \
	ninja-build \
	meson \
	python3-pip \
	python3-pyelftools \
	python3-setuptools \
	python3-wheel

	- name: Compile and install DPDK
	run: \|
	cd $HOME
	rm -rf dpdk_${{ matrix.dpdk_version }}
	find /usr/ -name 'librte_*.a' -delete
	mkdir -p dpdk_${{ matrix.dpdk_version }} && cd dpdk_${{ matrix.dpdk_version }}
	curl -fsLS https://fast.dpdk.org/rel/dpdk-${{ matrix.dpdk_version }}.tar.xz \| tar -xJ --strip-components=1
	rm -rf build/
	meson setup -Dtests=false --prefix=/usr/ build
	ninja -C build
	ninja -C build install
	ldconfig
	cd $HOME
	- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
	- run: git config --global --add safe.directory /__w/suricata/suricata
	- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
	with:
	name: prep
	path: prep
	- uses: ./.github/actions/install-cbindgen
	- run: ./autogen.sh
	- run: CFLAGS="${DEFAULT_CFLAGS}" ./configure --enable-warnings --enable-dpdk --enable-hwloc
	- run: make -j ${{ env.CPUS }}
	- run: make check
	# IDS config
	- run: \|
	./qa/live/dpdk.sh "qa/live/dpdk/suricata-null-ids.yaml"
	# IPS config
	- run: \|
	./qa/live/dpdk.sh "qa/live/dpdk/suricata-null-ips.yaml"
	# DPDK configuration checks
	- run: ./qa/live/dpdk/dpdk-testsuite.sh

	debian-12:
	name: Debian 12 (xdp)
	runs-on: ubuntu-latest
	container: debian:12
	needs: [prepare-deps]
	steps:
	# Cache Rust stuff.
	- name: Cache cargo registry
	uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
	with:
	path: ~/.cargo/registry
	key: cargo-registry

	- name: Determine number of CPUs
	run: echo CPUS=$(nproc --all) >> $GITHUB_ENV

	- run: apt update
	- run: \|
	apt -y install \
	autoconf \
	automake \
	build-essential \
	cmake \
	curl \
	dpdk-dev \
	git \
	hwloc \
	libhwloc-dev \
	jq \
	make \
	libpcre3 \
	libpcre3-dbg \
	libpcre3-dev \
	libpcre2-dev \
	libtool \
	libpcap-dev \
	libnet1-dev \
	libyaml-0-2 \
	libyaml-dev \
	libcap-ng-dev \
	libcap-ng0 \
	libmagic-dev \
	libmaxminddb-dev \
	libjansson-dev \
	libjansson4 \
	libnuma-dev \
	liblz4-dev \
	libssl-dev \
	liblzma-dev \
	pkg-config \
	python3 \
	python3-yaml \
	sphinx-doc \
	sphinx-common \
	texlive-latex-base \
	texlive-fonts-recommended \
	texlive-fonts-extra \
	texlive-latex-extra \
	zlib1g \
	zlib1g-dev \
	clang \
	libxdp-dev
	- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
	- run: git config --global --add safe.directory /__w/suricata/suricata
	- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
	with:
	name: prep
	path: prep
	- name: Install Rust
	run: curl https://sh.rustup.rs -sSf \| sh -s -- --default-toolchain $(grep rust-version rust/Cargo.toml.in\|sed 's/\"//g'\|awk '{print $3}') -y
	- run: echo "$HOME/.cargo/bin" >> $GITHUB_PATH
	- uses: ./.github/actions/install-cbindgen
	- run: tar xf prep/suricata-update.tar.gz
	- run: tar xf prep/suricata-verify.tar.gz
	- run: ./autogen.sh
	- run: CFLAGS="${DEFAULT_CFLAGS}" ./configure --enable-warnings --enable-unittests --enable-qa-simulation --enable-ebpf --enable-ebpf-build
	- run: make -j ${{ env.CPUS }}
	- run: make check
	# -j2 caused random failures during cargo vendor
	- run: make distcheck
	env:
	DISTCHECK_CONFIGURE_FLAGS: "--enable-unittests --enable-debug --enable-geoip --enable-profiling --enable-profiling-locks --enable-dpdk --enable-ebpf --enable-ebpf-build"
	- run: test -e doc/userguide/suricata.1
	- run: test -e doc/userguide/userguide.pdf
	- name: Building Rust documentation
	run: make doc
	working-directory: rust
	- name: Running suricata-verify
	run: python3 ./suricata-verify/run.py -q --debug-failed
	- run: make install
	- run: suricata-update -V
	- run: suricatasc -h

	debian-13:
	name: Debian 13 (xdp)
	runs-on: ubuntu-latest
	container: debian:13
	needs: [prepare-deps]
	steps:
	# Cache Rust stuff.
	- name: Cache cargo registry
	uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
	with:
	path: ~/.cargo/registry
	key: cargo-registry

	- name: Determine number of CPUs
	run: echo CPUS=$(nproc --all) >> $GITHUB_ENV

	- run: apt update
	- run: \|
	apt -y install \
	autoconf \
	automake \
	build-essential \
	cmake \
	cargo \
	dpdk-dev \
	git \
	hwloc \
	libhwloc-dev \
	jq \
	make \
	libpcre2-dev \
	libtool \
	libpcap-dev \
	libnet1-dev \
	libyaml-0-2 \
	libyaml-dev \
	libcap-ng-dev \
	libcap-ng0 \
	libmagic-dev \
	libmaxminddb-dev \
	libjansson-dev \
	libjansson4 \
	libnuma-dev \
	liblz4-dev \
	libssl-dev \
	liblzma-dev \
	libvectorscan-dev \
	pkg-config \
	python3 \
	python3-yaml \
	rustc \
	sphinx-doc \
	sphinx-common \
	texlive-latex-base \
	texlive-fonts-recommended \
	texlive-fonts-extra \
	texlive-latex-extra \
	zlib1g \
	zlib1g-dev \
	clang \
	libxdp-dev
	- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
	- run: git config --global --add safe.directory /__w/suricata/suricata
	- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
	with:
	name: prep
	path: prep
	- uses: ./.github/actions/install-cbindgen
	- run: tar xf prep/suricata-update.tar.gz
	- run: tar xf prep/suricata-verify.tar.gz
	- run: ./autogen.sh
	- run: CFLAGS="${DEFAULT_CFLAGS}" ./configure --enable-warnings --enable-unittests --enable-qa-simulation --enable-ebpf --enable-ebpf-build
	- run: make -j ${{ env.CPUS }}
	- run: make check
	# -j2 caused random failures during cargo vendor
	- run: make distcheck
	env:
	DISTCHECK_CONFIGURE_FLAGS: "--enable-unittests --enable-debug --enable-geoip --enable-profiling --enable-profiling-locks --enable-dpdk --enable-ebpf --enable-ebpf-build"
	- run: python3 scripts/check-dist-rules.py
	- run: test -e doc/userguide/suricata.1
	- run: test -e doc/userguide/userguide.pdf
	- name: Building Rust documentation
	run: make doc
	working-directory: rust
	- name: Running suricata-verify
	run: python3 ./suricata-verify/run.py -q --debug-failed
	- run: make install
	- run: suricata-update -V
	- run: suricatasc -h

	ubuntu-22-04-dist:
	name: Ubuntu 22.04 Dist Builder
	runs-on: ubuntu-latest
	container: ubuntu:22.04
	needs: [prepare-deps, prepare-cbindgen]
	steps:
	# Cache Rust stuff.
	- name: Cache cargo registry
	uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
	with:
	path: ~/.cargo/registry
	key: cargo-registry

	- name: Determine number of CPUs
	run: echo CPUS=$(nproc --all) >> $GITHUB_ENV

	- run: apt update
	- run: \|
	apt -y install \
	autoconf \
	automake \
	build-essential \
	cargo \
	cmake \
	curl \
	git \
	hwloc \
	libhwloc-dev \
	jq \
	make \
	libpcre3 \
	libpcre3-dbg \
	libpcre3-dev \
	libpcre2-dev \
	libtool \
	libpcap-dev \
	libnet1-dev \
	libyaml-0-2 \
	libyaml-dev \
	libcap-ng-dev \
	libcap-ng0 \
	libmagic-dev \
	libjansson-dev \
	libjansson4 \
	liblz4-dev \
	libssl-dev \
	liblzma-dev \
	pkg-config \
	python3 \
	python3-yaml \
	rustc \
	sphinx-doc \
	sphinx-common \
	texlive-latex-base \
	texlive-fonts-recommended \
	texlive-fonts-extra \
	texlive-latex-extra \
	zlib1g \
	zlib1g-dev
	- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
	- run: git config --global --add safe.directory /__w/suricata/suricata
	- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
	with:
	name: prep
	path: prep
	- run: tar xf prep/suricata-update.tar.gz
	- uses: ./.github/actions/install-cbindgen
	- run: ./autogen.sh
	- run: CFLAGS="${DEFAULT_CFLAGS}" ./configure
	- run: make dist
	- run: test -e doc/userguide/suricata.1
	- run: test -e doc/userguide/userguide.pdf
	- name: Preparing distribution
	run: \|
	mkdir dist
	mv suricata-*.tar.gz dist
	- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
	name: Uploading distribution
	with:
	name: dist
	path: dist

	debian-12-msrv:
	name: Debian 12 MSRV
	runs-on: ubuntu-latest
	container: debian:12
	needs: [prepare-deps, prepare-cbindgen]
	steps:
	# Cache Rust stuff.
	- name: Cache cargo registry
	uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
	with:
	path: ~/.cargo/registry
	key: cargo-registry

	- name: Determine number of CPUs
	run: echo CPUS=$(nproc --all) >> $GITHUB_ENV

	- run: apt update
	- run: \|
	apt -y install \
	autoconf \
	automake \
	build-essential \
	cmake \
	curl \
	dpdk-dev \
	git \
	hwloc \
	libhwloc-dev \
	jq \
	make \
	libpcre3 \
	libpcre3-dbg \
	libpcre3-dev \
	libpcre2-dev \
	libtool \
	libpcap-dev \
	libnet1-dev \
	libyaml-0-2 \
	libyaml-dev \
	libcap-ng-dev \
	libcap-ng0 \
	libmagic-dev \
	libmaxminddb-dev \
	libjansson-dev \
	libjansson4 \
	libnuma-dev \
	liblz4-dev \
	libssl-dev \
	liblzma-dev \
	pkg-config \
	python3 \
	python3-yaml \
	sphinx-doc \
	sphinx-common \
	texlive-latex-base \
	texlive-fonts-recommended \
	texlive-fonts-extra \
	texlive-latex-extra \
	zlib1g \
	zlib1g-dev
	- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
	- run: git config --global --add safe.directory /__w/suricata/suricata
	- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
	with:
	name: prep
	path: prep
	- name: Install Rust
	run: curl https://sh.rustup.rs -sSf \| sh -s -- --default-toolchain $(grep rust-version rust/Cargo.toml.in\|sed 's/\"//g'\|awk '{print $3}') -y
	- run: echo "$HOME/.cargo/bin" >> $GITHUB_PATH
	- uses: ./.github/actions/install-cbindgen
	- run: tar xf prep/suricata-update.tar.gz
	- run: tar xf prep/suricata-verify.tar.gz
	- run: ./autogen.sh
	- run: CFLAGS="${DEFAULT_CFLAGS}" ./configure --enable-warnings --enable-unittests --enable-debug --enable-qa-simulation --enable-geoip --enable-profiling --enable-profiling-locks --enable-dpdk
	- run: make -j ${{ env.CPUS }}
	- run: make check
	- name: Building Rust documentation
	run: make doc
	working-directory: rust
	- name: Running suricata-verify
	run: python3 ./suricata-verify/run.py -q --debug-failed
	- run: make install
	- run: suricata-update -V
	- run: suricatasc -h

	debian-11:
	name: Debian 11
	runs-on: ubuntu-latest
	container: debian:11
	needs: [prepare-deps, prepare-cbindgen]
	steps:
	# Cache Rust stuff.
	- name: Cache cargo registry
	uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
	with:
	path: ~/.cargo/registry
	key: cargo-registry

	- name: Determine number of CPUs
	run: echo CPUS=$(nproc --all) >> $GITHUB_ENV

	- run: \|
	apt update
	apt -y install \
	automake \
	autoconf \
	build-essential \
	ccache \
	curl \
	git \
	hwloc \
	libhwloc-dev \
	jq \
	libpcre2-dev \
	libpcap-dev \
	libnet1-dev \
	libyaml-0-2 \
	libyaml-dev \
	libcap-ng-dev \
	libcap-ng0 \
	libmagic-dev \
	libjansson-dev \
	libgeoip-dev \
	libhiredis-dev \
	libevent-dev \
	libtool \
	m4 \
	make \
	python3-yaml \
	pkg-config \
	sudo \
	zlib1g \
	zlib1g-dev \
	clang \
	libbpf-dev \
	libelf-dev
	- name: Install Rust
	run: curl https://sh.rustup.rs -sSf \| sh -s -- --default-toolchain $RUST_VERSION_KNOWN -y
	- run: echo "$HOME/.cargo/bin" >> $GITHUB_PATH
	- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
	- run: git config --global --add safe.directory /__w/suricata/suricata
	- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
	with:
	name: prep
	path: prep
	- run: tar xf prep/suricata-update.tar.gz
	- uses: ./.github/actions/install-cbindgen
	- run: ./autogen.sh
	- run: CFLAGS="${DEFAULT_CFLAGS}" ./configure --enable-warnings --enable-unittests --enable-fuzztargets
	- run: make -j ${{ env.CPUS }}
	- run: make check
	- run: tar xf prep/suricata-verify.tar.gz
	- name: Running suricata-verify
	run: python3 ./suricata-verify/run.py -q --debug-failed
	- run: make install
	- run: suricata-update -V
	- run: suricatasc -h

	macos-latest:
	name: MacOS Latest
	runs-on: macos-latest
	needs: [prepare-deps]
	steps:
	# Cache Rust stuff.
	- name: Cache cargo registry
	uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
	with:
	path: ~/.cargo/registry
	key: cargo-registry
	- run: \|
	brew install \
	autoconf \
	automake \
	cbindgen \
	curl \
	hiredis \
	hwloc \
	jansson \
	jq \
	libnet \
	libtool \
	libyaml \
	pcre2 \
	pkg-config \
	python \
	rust \
	xz
	- run: echo "$HOME/.cargo/bin" >> $GITHUB_PATH
	- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
	- run: git config --global --add safe.directory /__w/suricata/suricata
	- name: Downloading prep archive
	uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
	with:
	name: prep
	path: prep
	- run: tar xvf prep/suricata-update.tar.gz
	- name: Create Python virtual environment
	run: python3 -m venv ./testenv
	- name: Install PyYAML
	run: \|
	. ./testenv/bin/activate
	pip install pyyaml
	- run: ./autogen.sh
	- run: CPATH="$HOMEBREW_PREFIX/include:$CPATH" LIBRARY_PATH="$HOMEBREW_PREFIX/lib:$LIBRARY_PATH" PATH="/opt/homebrew/opt/libtool/libexec/gnubin:$PATH" CFLAGS="${DEFAULT_CFLAGS}" ./configure --enable-warnings --enable-unittests --prefix="$HOME/.local/"
	- run: CPATH="$HOMEBREW_PREFIX/include:$CPATH" LIBRARY_PATH="$HOMEBREW_PREFIX/lib:$LIBRARY_PATH" PATH="/opt/homebrew/opt/libtool/libexec/gnubin:$PATH" make -j2
	- run: CPATH="$HOMEBREW_PREFIX/include:$CPATH" LIBRARY_PATH="$HOMEBREW_PREFIX/lib:$LIBRARY_PATH" PATH="/opt/homebrew/opt/libtool/libexec/gnubin:$PATH" make check
	- run: tar xf prep/suricata-verify.tar.gz
	- name: Running suricata-verify
	run: \|
	. ./testenv/bin/activate
	python3 ./suricata-verify/run.py -q --debug-failed
	- run: CPATH="$HOMEBREW_PREFIX/include:$CPATH" LIBRARY_PATH="$HOMEBREW_PREFIX/lib:$LIBRARY_PATH" PATH="/opt/homebrew/opt/libtool/libexec/gnubin:$PATH" CFLAGS="${DEFAULT_CFLAGS}" make install
	- name: Check Suricata-Update
	run: \|
	. ./testenv/bin/activate
	which suricata-update
	python3 $(which suricata-update) -V
	- run: suricatasc -h

	freebsd-15-0:
	name: FreeBSD 15.0
	runs-on: ubuntu-latest
	needs: [prepare-deps]
	steps:
	- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
	- name: Downloading prep archive
	uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
	with:
	name: prep
	path: prep
	- uses: vmactions/freebsd-vm@a6de9343ef5747433d9c25784c90e84998b9d69a
	with:
	release: "15.0"
	arch: x86_64
	usesh: true
	sync: rsync
	copyback: false
	envs: "DEFAULT_CFLAGS"
	prepare: \|
	pkg install -y \
	autoconf \
	automake \
	gmake \
	jq \
	rust-cbindgen \
	jansson \
	libpcap \
	libtool \
	libyaml \
	pcre2 \
	pkgconf \
	python3 \
	py311-pyyaml \
	rust
	run: \|
	tar xf prep/suricata-verify.tar.gz
	./autogen.sh
	CFLAGS="${DEFAULT_CFLAGS}" ./configure --enable-warnings --enable-unittests
	gmake -j$(sysctl -n hw.ncpu)
	./src/suricata -u -l /tmp/
	python3 ./suricata-verify/run.py -q --debug-failed

	windows-msys2-mingw64-npcap:
	name: Windows MSYS2 MINGW64 (NPcap)
	runs-on: windows-latest
	needs: [prepare-deps]
	defaults:
	run:
	shell: msys2 {0}
	steps:
	- name: Cache ~/.cargo
	uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
	with:
	path: ~/.cargo/registry
	key: cargo-registry
	- name: Cache npcap
	uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
	with:
	path: /npcap-bin
	key: npcap-bin-100
	- uses: msys2/setup-msys2@v2
	with:
	msystem: MINGW64
	update: true
	install: git mingw-w64-x86_64-toolchain automake1.16 automake-wrapper autoconf libtool libyaml-devel pcre2-devel jansson-devel make mingw-w64-x86_64-libyaml mingw-w64-x86_64-pcre2 mingw-w64-x86_64-rust mingw-w64-x86_64-jansson unzip p7zip python-setuptools mingw-w64-x86_64-python-yaml mingw-w64-x86_64-jq mingw-w64-x86_64-libxml2
	# hack: install our own cbindgen system wide as we can't get the
	# preinstalled one to be picked up by configure
	- name: cbindgen
	run: cargo install --root /usr --force --debug --version 0.24.3 cbindgen
	- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
	- run: git config --global --add safe.directory /__w/suricata/suricata
	- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
	with:
	name: prep
	path: prep
	- run: tar xf prep/suricata-update.tar.gz
	- name: Npcap DLL
	run: \|
	if ! test -e /npcap-bin; then
	curl -sL -O https://nmap.org/npcap/dist/npcap-1.00.exe
	7z -y x -o/npcap-bin npcap-1.00.exe
	fi
	- name: Place NPcap dll's in curent directory
	run: cp /npcap-bin/*.dll .
	- name: Npcap SDK
	run: \|
	curl -sL -O https://nmap.org/npcap/dist/npcap-sdk-1.06.zip
	unzip npcap-sdk-1.06.zip -d /npcap
	cp /npcap/Lib/x64/* /usr/lib/
	- run: tar xf prep/suricata-verify.tar.gz
	- name: Build
	run: \|
	./autogen.sh
	CFLAGS="-ggdb -Werror" ./configure --enable-warnings --enable-unittests --enable-gccprotect --disable-gccmarch-native --disable-shared --with-libpcap-includes=/npcap/Include --with-libpcap-libraries=/npcap/Lib/x64
	make -j3
	- name: Run
	run: \|
	./src/suricata --build-info
	./src/suricata -u -l .
	# need cwd in path due to npcap dlls (see above)
	PATH="$PATH:$(pwd)" python3 ./suricata-verify/run.py -q --debug-failed
	- run: make install
	- run: suricata-update -V

	windows-msys2-mingw64-libpcap:
	name: Windows MSYS2 MINGW64 (libpcap)
	runs-on: windows-latest
	needs: [prepare-deps, ubuntu-22-04-dist]
	defaults:
	run:
	shell: msys2 {0}
	steps:
	- name: Cache ~/.cargo
	uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
	with:
	path: ~/.cargo/registry
	key: cargo-registry
	- uses: msys2/setup-msys2@v2
	with:
	msystem: MINGW64
	update: true
	install: git mingw-w64-x86_64-toolchain automake1.16 automake-wrapper autoconf libtool libyaml-devel pcre2-devel jansson-devel make mingw-w64-x86_64-libyaml mingw-w64-x86_64-pcre2 mingw-w64-x86_64-rust mingw-w64-x86_64-jansson unzip p7zip python-setuptools mingw-w64-x86_64-python-yaml mingw-w64-x86_64-jq mingw-w64-x86_64-libxml2 libpcap-devel mingw-w64-x86_64-libpcap
	# hack: install our own cbindgen system wide as we can't get the
	# preinstalled one to be picked up by configure
	- name: cbindgen
	run: cargo install --root /usr --force --debug --version 0.24.3 cbindgen
	- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
	- run: git config --global --add safe.directory /__w/suricata/suricata
	- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
	with:
	name: prep
	path: prep
	- name: Download suricata.tar.gz
	uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
	with:
	name: dist
	- run: tar xvf suricata-*.tar.gz --strip-components=1
	- run: tar xf prep/suricata-verify.tar.gz
	- name: Build
	run: \|
	./autogen.sh
	CFLAGS="-ggdb -Werror" ./configure --enable-warnings --enable-unittests --enable-gccprotect --disable-gccmarch-native --disable-shared --with-libpcap-includes=/npcap/Include --with-libpcap-libraries=/npcap/Lib/x64
	make -j3
	- name: Run
	run: \|
	./src/suricata --build-info
	./src/suricata -u -l .
	python3 ./suricata-verify/run.py -q --debug-failed
	- run: make install
	- run: suricata-update -V

	windows-msys2-ucrt64-libpcap:
	name: Windows MSYS2 UCRT64 (libpcap)
	runs-on: windows-latest
	needs: [prepare-deps, ubuntu-22-04-dist]
	defaults:
	run:
	shell: msys2 {0}
	steps:
	- name: Cache ~/.cargo
	uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
	with:
	path: ~/.cargo/registry
	key: cargo-registry
	- uses: msys2/setup-msys2@v2
	with:
	msystem: ucrt64
	update: true
	install: \|
	autoconf
	automake
	git
	make
	mingw-w64-ucrt-x86_64-cbindgen
	mingw-w64-ucrt-x86_64-jansson
	mingw-w64-ucrt-x86_64-jq
	mingw-w64-ucrt-x86_64-libpcap
	mingw-w64-ucrt-x86_64-libtool
	mingw-w64-ucrt-x86_64-libyaml
	mingw-w64-ucrt-x86_64-pcre2
	mingw-w64-ucrt-x86_64-python-yaml
	mingw-w64-ucrt-x86_64-rust
	mingw-w64-ucrt-x86_64-toolchain
	unzip
	- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
	- run: git config --global --add safe.directory /__w/suricata/suricata
	- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
	with:
	name: prep
	path: prep
	- name: Download suricata.tar.gz
	uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
	with:
	name: dist
	- run: tar xvf suricata-*.tar.gz --strip-components=1
	- run: tar xf prep/suricata-verify.tar.gz
	- name: Build
	run: \|
	./autogen.sh
	CFLAGS="-ggdb -Werror" ./configure --enable-warnings --enable-unittests --enable-gccprotect --disable-gccmarch-native --disable-shared
	make -j3
	- name: Run
	run: \|
	./src/suricata --build-info
	./src/suricata -u -l .
	python3 ./suricata-verify/run.py -q --debug-failed
	- run: make install
	- run: suricata-update -V

	windows-msys2-mingw64-windivert:
	name: Windows MSYS2 MINGW64 (WinDivert)
	runs-on: windows-latest
	needs: [prepare-deps]
	defaults:
	run:
	shell: msys2 {0}
	steps:
	- name: Cache ~/.cargo
	uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
	with:
	path: ~/.cargo/registry
	key: cargo-registry
	- uses: msys2/setup-msys2@v2
	with:
	msystem: MINGW64
	update: true
	install: git mingw-w64-x86_64-toolchain automake1.16 automake-wrapper autoconf libtool libyaml-devel pcre2-devel jansson-devel make mingw-w64-x86_64-libyaml mingw-w64-x86_64-pcre2 mingw-w64-x86_64-rust mingw-w64-x86_64-jansson unzip p7zip python-setuptools mingw-w64-x86_64-python-yaml mingw-w64-x86_64-jq mingw-w64-x86_64-libxml2 libpcap-devel mingw-w64-x86_64-libpcap
	# hack: install our own cbindgen system wide as we can't get the
	# preinstalled one to be picked up by configure
	- name: cbindgen
	run: cargo install --root /usr --force --debug --version 0.24.3 cbindgen
	- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
	- run: git config --global --add safe.directory /__w/suricata/suricata
	- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
	with:
	name: prep
	path: prep
	- name: WinDivert
	run: \|
	curl -sL -O https://github.com/basil00/Divert/releases/download/v2.2.2/WinDivert-2.2.2-A.zip
	unzip WinDivert-2.2.2-A.zip -d /windivert
	cp /windivert/WinDivert-2.2.2-A/x64/* /usr/lib/
	# hack: place dlls in cwd
	cp /windivert/WinDivert-2.2.2-A/x64/*.dll .
	- name: Build
	run: \|
	./autogen.sh
	CFLAGS="-ggdb -Werror" ./configure --enable-warnings --enable-gccprotect --disable-gccmarch-native --disable-shared --enable-windivert --with-windivert-include=/windivert/WinDivert-2.2.2-A/include --with-windivert-libraries=/windivert/WinDivert-2.2.2-A/x64
	make -j3
	- name: Run
	run: \|
	# need cwd in path due to dlls (see above)
	PATH="$PATH:$(pwd)" ./src/suricata --build-info
	- run: make install

	pf-ring:
	name: PF_RING
	runs-on: ubuntu-latest
	container: almalinux:9
	needs: [prepare-deps, ubuntu-22-04-dist]
	steps:
	# Cache Rust stuff.
	- name: Cache cargo registry
	uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
	with:
	path: ~/.cargo/registry
	key: cargo-registry

	- name: Determine number of CPUs
	run: echo CPUS=$(nproc --all) >> $GITHUB_ENV

	- name: Install system packages
	run: \|
	dnf -y install dnf-plugins-core epel-release
	dnf config-manager --set-enabled crb
	dnf -y install \
	autoconf \
	automake \
	diffutils \
	numactl-devel \
	dpdk-devel \
	file-devel \
	gcc \
	gcc-c++ \
	git \
	hwloc \
	hwloc-devel \
	jansson-devel \
	libtool \
	libyaml-devel \
	libnfnetlink-devel \
	libnetfilter_queue-devel \
	libnet-devel \
	libcap-ng-devel \
	libevent-devel \
	libmaxminddb-devel \
	libpcap-devel \
	libtool \
	lz4-devel \
	make \
	pcre2-devel \
	pkgconfig \
	python3-devel \
	python3-sphinx \
	python3-yaml \
	rust-toolset \
	sudo \
	which \
	zlib-devel

	- name: Install PF_RING
	run: \|
	curl https://packages.ntop.org/centos-stable/ntop.repo > /etc/yum.repos.d/ntop.repo
	dnf install -y pfring

	- name: Download suricata.tar.gz
	uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
	with:
	name: dist
	- run: tar xf suricata-*.tar.gz --strip-components=1
	- run: ./configure --enable-pfring --enable-debug --enable-qa-simulation
	- run: make -j ${CPUS}
	- run: make install
	- run: test -e /usr/local/lib/suricata/pfring.so

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ftp: mark ftpbounce as supported by firewall #6318

Workflow file

ftp: mark ftpbounce as supported by firewall #6318

Uh oh!

Workflow file for this run