1 of 23

Framealicious fun:

Tackling Frame Challenges and Boosting Code Coverage for New Suricata Devs

With Support from:

2 of 23

About the speaker:

  • Haleema Khan: Software engineer, based in Islamabad Pakistan
  • 2.5+ years of experience in the Integrations domain.
  • MuleSoft Developer and Mentor.
  • Love reading books, travelling and cooking in my free time
  • Eager about the InfoSec and systems research domain

2

3 of 23

  • Getting started with Open Source Contributions in 2022 summer.
  • Choosing OISF and learning Rust.
  • Writing code for past few months vs professional experience as an Integrations engineer.
  • Advocating consistent effort and believing in the power of hard work.

​

My Outreachy Journey

3

4 of 23

Suricata: An IDS, IPS & Much more!

4

5 of 23

Adding frame support to Suricata

​

Expose app-layer Protocol Data Units (PDUs) to the detection engine

Frame is a generic term that can represent any unit of network data we are interested in, which could be comprised of one or several records of other, lower level protocols. Frames work as “stream annotations”, allowing Suricata to tell the detection engine what type of record exists at a specific offset in the stream.

Improves data processing time and makes rule writing easy for the detection engine by tagging the input stream.

5

6 of 23

Frame support in Action

  • Identify which frames make sense for a protocol given the packet structure.
  • Observe naming conventions for known structures in packets, such as PDU, Header and Data
  • Frames in action
    • Define frame enum types
    • Register frames at specific places in the parsing functions
    • Add callbacks
    • Use frame API to facilitate the process or build on it to register the frames.

6

7 of 23

  • RFB stands for remote frame buffer and it is the underlying protocol when a remote desktop connection is established.
  • Registering Pdu(Protocol Data Unit) Frames for RFB.

Frame Support in RFB Protocol

7

8 of 23

Frame Support in RFB Protocol

8

9 of 23

MQTT stands for MQ Telemetry and it is standard messaging protocol for the Internet of Things (IoT).

Registering Pdu, Header and Data Frames for MQTT.

​

​

Frame support in MQTT protocol

​

9

10 of 23

Frame support in MQTT protocol

​

10

11 of 23

  • ​

Frame support: A brief comparison

​

​

11

12 of 23

Testing in Suricata

​

Improve code coverage and ensure code quality

  • Unit tests: for independently checking specific functions or portions of code. Languages: C and Rust
  • Suricata-Verify: those are used to check more complex behavior, like the log output or the alert counts for a given input, where that input is usually comprised of several packets;

​

12

13 of 23

Unit Tests

13

14 of 23

  • ​

Suricata Verify Tests

​

​

14

15 of 23

Demo: Running S-V tests locally

15

16 of 23

Improving coverage of Suricata codebase

​

  • Understanding Codecov coverage reports.
  • Which files need more coverage?
  • Making sense of rule keywords in the code that

need coverage.

  • Writing Suricata-verify tests for rule keywords

16

17 of 23

Improving coverage of Suricata codebase

​

  • Configuring Suricata to generate coverage reports locally:
    • CFLAGS="-O0 -ggdb -fno-omit-frame-pointer -fprofile-instr-generate -fcoverage-mapping" CC="clang" RUSTFLAGS="-C instrument-coverage" ./configure --disable-shared --enable-debug --enable-unittests
    • CFLAGS="-O0 -fprofile-instr-generate -fcoverage-mapping" CC="clang" RUSTFLAGS="-C instrument-coverage" make -j2
    • python ../suricata-verify/run.py tls
    • llvm-profdata merge -o default.profdata $(find ../suricata-verify-path/tests/ -name '*.profraw')
    • llvm-cov show -output-dir=report -format=html -instr-profile=default.profdata -compilation-dir=src -object=src/suricata

17

18 of 23

Improving coverage of Suricata codebase

​

  • ​

18

19 of 23

  • ​

Demo: Generating code coverage locally

​

​

19

20 of 23

Learning Outcomes

​

  • Technical Skills: Programming in C and Rust , Writing Unittest and S-V tests
  • Familiarity with OSS contributions
  • Making quality PRs.
  • Networking and making meaningful connections.
  • Starting a blog: hsadiablogs.wordpress.com

​

20

21 of 23

Suricata Community - Resources

​

  • Website : https://suricata.io/
  • Checkout the Suricata Discourse at https://forum.suricata.io/
  • Tracking bugs, feature request and support requests is done on the Redmine platform redmine.openinfosecfoundation.org
  • Suricata has a Discord server – join @ Suricata.
  • Training options are now available: training

​

​

21

22 of 23

References

​

​

​

22

23 of 23

Thanks!

Any Questions?

Website

hsadiablogs.wordpress.com

E-mail

hsadia538@gmail.com

LinkedIn

In/haleem-khan

23