1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
name: Rust
on:
push:
branches:
pull_request:
branches:
env:
CARGO_TERM_COLOR: always
jobs:
build:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Format check
run: cargo fmt --all -- --check
- name: Build
run: cargo build --all-features --verbose
- name: Clippy
run: cargo clippy --all-features --all-targets -- -D warnings
- name: Run tests
run: cargo test --all-features --verbose
- name: Doc build
run: cargo doc --all-features --no-deps
env:
RUSTDOCFLAGS: -D warnings
feature-matrix:
# Library-only build + clippy across a small matrix of partial-
# feature combinations so latent cfg-gate dead-code issues in
# `src/` fail at PR time, not when a user enables an unusual
# combo. Test code is intentionally not included: it assumes
# `--all-features` and is covered by the `build` job above.
runs-on: ubuntu-latest
strategy:
fail-fast: false
matrix:
features:
- "" # default features only
- "pcap" # offline source, no L7
- "dns" # gate for obs::trace_session_message
- "http,tls"
- "metrics,tracing"
- "icmp" # standalone ICMP parser
- "l7,pcap" # `l7` now includes icmp
- "serde" # 0.8: serde on core types
- "serde,l7,pcap" # 0.8: serde on L7 messages
- "chrono" # 0.12: chrono interop on Timestamp
- "emit-eve" # 0.12: Suricata EVE JSON writer
- "tls-fingerprints" # 0.12: collapses former ja3 + ja4 sub-features
- "ja4plus" # 0.16: FoxIO-licensed JA4S (opt-in, off by default)
- "ja4plus,http" # 0.18: JA4H FoxIO HTTP fingerprint (issue #10)
- "file-hash" # 0.12: streaming hash sinks + MIME magic
- "ndp" # 0.18: IPv6 Neighbor Discovery parser (issue #6)
- "dhcp" # 0.18: DHCP parser + Fingerbank fingerprint (issue #11)
- "lldp" # 0.18: LLDP L2 discovery parser (issue #23)
- "cdp" # 0.18: CDP Cisco Discovery Protocol parser (issue #25)
- "tcp_fingerprint" # 0.18: p0f-style passive TCP/IP fingerprint (issue #9)
- "ssh" # 0.18: SSH parser + HASSH fingerprint (issue #7)
- "ipfix" # 0.18: IPFIX IE vocabulary module (scoped piece of #16)
- "ntp" # 0.18: NTP parser + amplification detection (issue #14 sub-piece)
- "ssdp" # 0.18: SSDP parser + IoT asset discovery (issue #14 sub-piece)
- "tftp" # 0.18: TFTP parser + device-config-theft detection (issue #14 sub-piece)
- "asset" # 0.18: asset-inventory composition (issue #27)
- "asset,arp,ndp,dhcp,lldp,cdp,ssdp" # 0.18: asset adapters require parsers
- "mdns" # 0.18: mDNS module (issue #14 sub-piece)
- "asset,mdns" # 0.18: mDNS asset adapter
- "ml-features" # 0.18: CICFlowMeter ml-features subset (issue #15 sub-piece)
- "netbios-ns" # 0.18: NetBIOS-NS parser (issue #14 sub-piece)
- "asset,netbios-ns" # 0.18: NetBIOS-NS asset adapter
- "ftp" # 0.18: FTP control-channel parser (issue #14 sub-piece)
- "smtp" # 0.18: SMTP control-channel parser (issue #14 sub-piece)
- "wireguard" # 0.18: WireGuard handshake detection (issue #14 sub-piece)
- "modbus" # 0.18: Modbus/TCP parser (issue #14 sub-piece)
- "stun" # 0.18: STUN datagram parser (issue #14 sub-piece)
- "rdp" # 0.18: RDP X.224 negotiation parser (issue #14 sub-piece)
- "ipfix-export" # 0.18: IPFIX binary wire encoder (issue #28)
- "snmp" # 0.18: SNMP v1/v2c parser (issue #14 sub-piece)
- "radius" # 0.18: RADIUS parser (issue #14 sub-piece)
- "dnp3" # 0.18: DNP3 metadata-only parser (issue #29)
- "ml-features-nprint" # 0.18: nPrint per-packet ternary header-bit matrix (issue #30)
- "kerberos" # 0.18: Kerberos parser (issue #13)
- "ldap" # 0.18: LDAP parser (issue #13)
- "smb" # 0.18: SMB2/3 parser M1 (issue #12)
- "quic" # 0.18: QUIC Initial parser (issue #3)
steps:
- uses: actions/checkout@v4
- name: Build (--no-default-features --features "${{ matrix.features }}")
run: cargo build --no-default-features --features "${{ matrix.features }}"
- name: Clippy (--no-default-features --features "${{ matrix.features }}")
run: cargo clippy --no-default-features --features "${{ matrix.features }}" -- -D warnings