output/ipv6: Add per-output configuration option to shorten IPv6 IP addresses by jlucovsky · Pull Request #14819 · OISF/suricata

jlucovsky · 2026-02-15T18:21:48Z

Continuation of #14816

Display IPv6 addresses in long (default) or shortened form per RFC-5952, based on the per-output configuration setting. Each of these outputs will display shortened IPv6 addresses when the per-output config setting ipv6-addr-shorten is yes.

EVE output
Fast output
Alert-debug output
Alert syslog output

Here's an example of an IPv6 address with its shortened value::

fe80:0000:0000:0000:020c:29ff:faf2:ab42
fe80::20c:29ff:faf2:ab42

Link to ticket: https://redmine.openinfosecfoundation.org/issues/7399

Describe changes:

Document configuration settings affecting IPv6 address display
Default settings in suricata.yaml.in
Utility function that generates shortened IPv6 addresses per RFC-5952
EVE modifications to honor config setting
Alert-debug/fast/syslog modifications to honor config setting.

Updates:

Formatting fixup
s-v: added missing suricata.yaml config file for tests where shortened IPv6 addrs are expected.

Provide values to any of the below to override the defaults.

To use a Suricata-Verify or Suricata-Update pull request,
link to the pull request in the respective _BRANCH variable.
Leave unused overrides blank or remove.

SV_REPO=
SV_BRANCH=OISF/suricata-verify#2789
SU_REPO=
SU_BRANCH=

Issue: 7399 Utility function to shorten IPv6 addresses per RFC-5952

Issue: 7399 Add option for EVE and alert output to shorten IPv6 addresses. The default is to not shorten; set ipv6-addr-shorten to yes to display shortened IPv6 addresses in output.

Issue: 7399 Add a IPv6 print utility function that accepts a parameter indicating whether the address should be in long or short form.

Issue: 7399 Determine the EVE IPv6 address display and use that when generating external display representation.

Issue: 7399 Add shorten ipv6 setting to file context.

When configured, display the short form of the IPv6 address. Issue: 7399

Issue: 7399 Document the IPv6 display behavior and how to display IPv6 addresses in their shortened form (per RFC-5952).

suricata-qa · 2026-02-15T20:50:02Z

Information: QA ran without warnings.

Pipeline = 29600

catenacyber

Thanks for the work,

CI : ✅
Code : will leave some remarks
Commits segmentation : 🟠 I would have less commits like the first one introducing SCIPv6Shorten should be merged with the first one using it (same for commit output/ipv6: Add output IPv6 shorten option which just adds line in suricata.yaml.in without reading them)
Commit messages : nice
Git ID set : looks fine for me
CLA : you already contributed
Doc update : cool
Redmine ticket : ok
Rustfmt : ok
Tests : README welcome but look ok
Dependencies added: none

catenacyber · 2026-02-16T14:09:35Z

rust/src/utils/ip_addr.rs

+    let mut ipv6_str = String::with_capacity(39);
+    let _ = std::fmt::Write::write_fmt(&mut ipv6_str, format_args!("{}", ipv6));
+
+    // Sufficient room?


debug validation that this never happens ?

The unittests exercise this logic ... suggestions for how to make the tests immune to a debug-validation check?

but... "configure: error: debug_validation can't be enabled with enabled unittests!" isn't that so?

Also, maybe the unit tests should not exercise this if Suricata itself never reaches this code

catenacyber · 2026-02-16T14:10:16Z

rust/src/utils/ip_addr.rs

+
+    // Copy string + NULL termination
+    std::ptr::copy_nonoverlapping(ipv6_str.as_ptr(), out_buf as *mut u8, ipv6_str.len());
+    std::ptr::write((out_buf as *mut u8).add(ipv6_str.len()), 0u8);


Is there a simpler way to do this in rust @jasonish ?

Yes.. Perhaps use crate::ffi::strings::copy_to_c_char, see SCSha256HashBufferToHex for an example on copying a Rust string to a C output pointer.

Thanks; will adjust.

catenacyber · 2026-02-16T14:11:08Z

rust/src/utils/ip_addr.rs

+
+    struct ShortenResult {
+        string: String,
+        len: usize,


can we not use the string.len() ?

This is unittest code -- the callers of this function verify the expected len -- is string.len() preferred over comparison with len?

I would prefer string.len() over len to avoid adding a field, unless there is a reason to do otherwise

Will make the change and remove len member.

catenacyber · 2026-02-16T14:14:47Z

src/alert-syslog.c


    char srcip[46], dstip[46];
-    PrintInet(AF_INET6, (const void *)GET_IPV6_SRC_ADDR(p), srcip, sizeof(srcip));
-    PrintInet(AF_INET6, (const void *)GET_IPV6_DST_ADDR(p), dstip, sizeof(dstip));


Is it exepcted that there are remaining cases with
git grep PrintInet | grep AF_INET6 ?

Yes -- with a caveat. All usages that result in log output should be covered by this change.
Not covered with this PR are:

log-httplog.c

log-tcp-data.c

log-tlsstore.c
Is coverage for those logs necessary?

Adding the "Decision Required" label to highlight this.

Is coverage for those logs necessary?

That was kind of my question seeing log-httplog.c

Http-log is scheduled for removal in 9.

I will add shortening for the tcp-data log and an s-v test.

jufajardini · 2026-02-17T15:36:14Z

doc/userguide/configuration/suricata-yaml.rst

      filename: alert-debug.log   #The name of the file in the default logging directory.
      append: yes/no              #If this option is set to yes, the last filled fast.log-file will not be
                                  # overwritten while restarting Suricata.
+      # Shorten IPv6 addresses per RFC5952 as they are added to the fast log. The default is no.


nit: not fast.log ? :P

good catch; will update.

jufajardini · 2026-02-17T15:42:54Z

src/util-print.c

+        if (SCIPv6Shorten(src, dst, size)) {
+            return dst;
+        }
+


very nitty, but: unneeded extra line?

will remove.

jufajardini · 2026-02-17T15:47:24Z

src/alert-syslog.c


    char srcip[46], dstip[46];
-    PrintInet(AF_INET6, (const void *)GET_IPV6_SRC_ADDR(p), srcip, sizeof(srcip));
-    PrintInet(AF_INET6, (const void *)GET_IPV6_DST_ADDR(p), dstip, sizeof(dstip));


Adding the "Decision Required" label to highlight this.

jufajardini · 2026-02-17T15:49:06Z

rust/src/utils/ip_addr.rs

+    let mut ipv6_str = String::with_capacity(39);
+    let _ = std::fmt::Write::write_fmt(&mut ipv6_str, format_args!("{}", ipv6));
+
+    // Sufficient room?


but... "configure: error: debug_validation can't be enabled with enabled unittests!" isn't that so?

jasonish · 2026-02-19T18:33:00Z

rust/src/utils/mod.rs


 pub mod base64;
 pub mod datalink;
+pub mod ip_addr;


This is a real picky style nit, but maybe rename to ipaddr?

makes sense; will do.

jlucovsky · 2026-02-21T15:15:21Z

Continued in #14867

jlucovsky added 7 commits February 15, 2026 08:40

output/ipv6: Utility function to shorten IPv6 addrs

9dfc5bd

Issue: 7399 Utility function to shorten IPv6 addresses per RFC-5952

output/ipv6: Add output IPv6 shorten option

d849ad1

Issue: 7399 Add option for EVE and alert output to shorten IPv6 addresses. The default is to not shorten; set ipv6-addr-shorten to yes to display shortened IPv6 addresses in output.

util/output: Add IPv6 print func with shorten param

56c0ebd

Issue: 7399 Add a IPv6 print utility function that accepts a parameter indicating whether the address should be in long or short form.

output/eve: EVE output to use IPv6 shorten cfg

f48e826

Issue: 7399 Determine the EVE IPv6 address display and use that when generating external display representation.

output/log: ipv6-shorten member to file context

401e547

Issue: 7399 Add shorten ipv6 setting to file context.

output/log: IPv6 addr display per cfg

ff8c5d3

When configured, display the short form of the IPv6 address. Issue: 7399

doc/output: Document the IPv6 display behavior

534a5a5

Issue: 7399 Document the IPv6 display behavior and how to display IPv6 addresses in their shortened form (per RFC-5952).

jlucovsky requested review from a team, jasonish, jufajardini and victorjulien as code owners February 15, 2026 18:21

jlucovsky mentioned this pull request Feb 15, 2026

output/ipv6: Add per-output configuration option to shorten IPv6 IP addresses #14816

Closed

catenacyber reviewed Feb 16, 2026

View reviewed changes

jufajardini added the decision-required Waiting on deliberation from the team label Feb 17, 2026

jufajardini reviewed Feb 17, 2026

View reviewed changes

jasonish reviewed Feb 19, 2026

View reviewed changes

jlucovsky mentioned this pull request Feb 21, 2026

output/ipv6: Add per-output configuration option to shorten IPv6 IP addresses #14867

Closed

jlucovsky closed this Feb 21, 2026

Conversation

jlucovsky commented Feb 15, 2026

Provide values to any of the below to override the defaults.

Uh oh!

suricata-qa commented Feb 15, 2026

Uh oh!

catenacyber left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jlucovsky commented Feb 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

5 participants