Skip to content

detect/byte_jump: Support bitmask value#14701

Closed
jlucovsky wants to merge 2 commits intoOISF:mainfrom
jlucovsky:6693/7
Closed

detect/byte_jump: Support bitmask value#14701
jlucovsky wants to merge 2 commits intoOISF:mainfrom
jlucovsky:6693/7

Conversation

@jlucovsky
Copy link
Contributor

Continuation of #14675

Add support for the bitmask value to byte_jump

Snort compatibility says:
- The bitmask value is applied to the extracted value
- The result of the bitmask operation is to be right-shifted by the
  number of trailing 0's in the bitmask value.

Link to ticket: https://redmine.openinfosecfoundation.org/issues/6693

Describe changes:

  • Clarify how the bitmask value is used in the documentation
  • Add parsing support for bitmask option
  • Apply bitmask value/shift count as jump value is calculated.

Updates:

  • Range check bitmask value: [1, MAX_UINT32]
  • Removed Cargo.lock.in
  • Fix ASAN issue discovered during fuzzing.
  • Rebase and added s-v test
  • s-v test update -- add test case for 0-value bitmask
  • Moved the application of the bitmask to match Snort. Bitmask value now applied before multiplier
  • Use pahole to eliminate gaps in DetectBytejumpData
  • Changed shift count to uint8_t since it holds values [0, 32]

Provide values to any of the below to override the defaults.

  • To use a Suricata-Verify or Suricata-Update pull request,
    link to the pull request in the respective _BRANCH variable.
  • Leave unused overrides blank or remove.

SV_REPO=
SV_BRANCH=OISF/suricata-verify#2880
SU_REPO=
SU_BRANCH=

Issue: 6693

Add bitmask support to byte_jump
- Parse
- Calculate shift count
- Apply to value before applying multiplier
- Order items in DetectBytejumpData to reduce holes.

Snort:
See https://github.com/chenkc/snort2.9/blob/master/snort-2.9.11.1/src/detection-plugins/sp_byte_jump.c#L780
Issue: 6693

Clarify how the bitmask value is used for byte_jump

Snort compatibility says:
- The bitmask value is applied to the extracted value before the
  multiplier is applied.
- The result of the bitmask operation is to be right shifted by the
  number of trailing 0's in the bitmask value.
@codecov
Copy link

codecov bot commented Jan 27, 2026

Codecov Report

❌ Patch coverage is 98.01980% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 82.10%. Comparing base (5d61f52) to head (685ae86).
⚠️ Report is 38 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main   #14701      +/-   ##
==========================================
- Coverage   82.13%   82.10%   -0.03%     
==========================================
  Files        1011     1011              
  Lines      262925   263012      +87     
==========================================
- Hits       215954   215950       -4     
- Misses      46971    47062      +91     
Flag Coverage Δ
fuzzcorpus 60.22% <48.78%> (-0.05%) ⬇️
livemode 18.70% <31.70%> (-0.06%) ⬇️
pcap 44.60% <48.78%> (-0.05%) ⬇️
suricata-verify 65.28% <95.12%> (-0.05%) ⬇️
unittests 59.28% <89.10%> (+<0.01%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@suricata-qa
Copy link

Information: QA ran without warnings.

Pipeline = 29294

@catenacyber
Copy link
Contributor

I leave this for others to review as this shift does not make any sense to me

@victorjulien victorjulien added this to the 9.0 milestone Feb 4, 2026
@victorjulien
Copy link
Member

Merged in #14750, thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

4 participants