Suricata

Suricata is a network IDS, IPS and NSM engine developed by the OISF and the Suricata community. We're happily taking patches and other contributions. Please see our Contribution Process for how to get started. Suricata is a complex piece of software dealing with mostly untrusted input. Mishandling this input will have serious consequences: In other words, we think the stakes are pretty high, especially since in many common cases the IDS/IPS will be directly reachable by an attacker. 1. GitHub-CI based checks. This runs automatically when a pull request is made. 2. Review by devs from the team and community 3. QA runs from private QA setups. These are private due to the nature of the test traffic. The final QA runs takes a few hours minimally, and generally runs overnight. It currently runs: extensive build tests on different OS', compilers, optimization levels, configure features static code analysis using cppcheck, scan-build runtime code analysis using valgrind, AddressSanitizer, LeakSanitizer regression tests for past bugs output validation of logging unix socket testing pcap based fuzz testing using ASAN and LSAN traffic replay based IDS and IPS tests One step of the QA is currently run post-merge. We submit builds to the Coverity Scan program. Due to limitations of this (free) service, we can submit once a day max. Of course it can happen that after the merge the community will find issues. For both cases we request you to help address the issues as they may come up. A: That depends on a number of things, including the code quality. With new features it also depends on whether the team and/or the community think the feature is useful, how much it affects other code and features, the risk of performance regressions, etc.