Skip to content

output/ipv6: Add per-output configuration option to compress IPv6 IP addresses#14916

Closed
jlucovsky wants to merge 5 commits intoOISF:mainfrom
jlucovsky:7399/6
Closed

output/ipv6: Add per-output configuration option to compress IPv6 IP addresses#14916
jlucovsky wants to merge 5 commits intoOISF:mainfrom
jlucovsky:7399/6

Conversation

@jlucovsky
Copy link
Contributor

Continuation of #14871

Display IPv6 addresses in expanded (default) or compressed form per RFC-5952, based on the per-output configuration setting. Each of these outputs will display compressed IPv6 addresses when the per-output config setting ipv6-compress is yes.

  • EVE output
  • Fast output
  • Alert-debug output
  • Alert syslog output
  • tcp-data log output

Here's an example of an IPv6 address with its compressed value::

fe80:0000:0000:0000:020c:29ff:faf2:ab42
fe80::20c:29ff:faf2:ab42

Link to ticket: https://redmine.openinfosecfoundation.org/issues/7399

Describe changes:

  • Document configuration settings affecting IPv6 address display
  • Default settings in suricata.yaml.in
  • Utility function that generates compressed IPv6 addresses per RFC-5952
  • EVE modifications to honor config setting
  • Alert-debug/fast/syslog modifications to honor config setting.

Updates:

Provide values to any of the below to override the defaults.

  • To use a Suricata-Verify or Suricata-Update pull request,
    link to the pull request in the respective _BRANCH variable.
  • Leave unused overrides blank or remove.

SV_REPO=
SV_BRANCH=OISF/suricata-verify#2789
SU_REPO=
SU_BRANCH=

Issue: 7399

Utility function to shorten IPv6 addresses per RFC-5952
Issue: 7399

Determine the EVE IPv6 address display and use that when generating
external display representation.
Issue: 7399

Add shorten ipv6 setting to file context.
When configured, display the short form of the IPv6 address.

Issue: 7399
Issue: 7399

Document the IPv6 display behavior and how to display IPv6 addresses in
their shortened form (per RFC-5952).
@jlucovsky
Copy link
Contributor Author

Continued in #14917

@jlucovsky jlucovsky closed this Feb 28, 2026
@codecov
Copy link

codecov bot commented Feb 28, 2026

Codecov Report

❌ Patch coverage is 92.95775% with 15 lines in your changes missing coverage. Please review.
✅ Project coverage is 81.95%. Comparing base (90823fa) to head (d18a4d5).

Additional details and impacted files
@@            Coverage Diff             @@
##             main   #14916      +/-   ##
==========================================
- Coverage   81.97%   81.95%   -0.02%     
==========================================
  Files         986      987       +1     
  Lines      271174   271312     +138     
  Branches    31005    31011       +6     
==========================================
+ Hits       222287   222366      +79     
- Misses      46745    46796      +51     
- Partials     2142     2150       +8     
Flag Coverage Δ
fuzzcorpus 61.03% <52.83%> (-0.02%) ⬇️
livemode 18.33% <16.03%> (-0.06%) ⬇️
netns 18.37% <24.52%> (-0.05%) ⬇️
pcap 45.16% <41.50%> (-0.11%) ⬇️
suricata-verify 58.53% <83.01%> (-0.05%) ⬇️
unittests 58.85% <64.78%> (+0.02%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@coveralls
Copy link

Pull Request Test Coverage Report for Build 22522913668

Details

  • 203 of 216 (93.98%) changed or added relevant lines in 15 files are covered.
  • 48 unchanged lines in 16 files lost coverage.
  • Overall coverage increased (+0.02%) to 73.705%

Changes Missing Coverage Covered Lines Changed/Added Lines %
src/output-json-alert.c 3 4 75.0%
src/alert-debuglog.c 0 4 0.0%
src/alert-syslog.c 0 4 0.0%
src/log-tcp-data.c 4 8 50.0%
Files with Coverage Reduction New Missed Lines %
src/alert-debuglog.c 1 48.89%
src/detect-http-client-body.c 1 84.3%
src/detect-iprep.c 1 90.59%
src/log-tcp-data.c 1 51.69%
src/util-mpm.c 1 82.52%
src/app-layer.c 2 93.06%
src/detect-engine-threshold.c 2 80.61%
src/source-pcap-file-directory-helper.c 2 52.85%
src/tm-threads.c 2 69.54%
src/detect-engine-frame.c 3 84.92%
Totals Coverage Status
Change from base Build 22512875201: 0.02%
Covered Lines: 265573
Relevant Lines: 334933

💛 - Coveralls

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

2 participants