Fix/12397 Prepare for prerealese for Suriconf 1.1.0-dev.2 v1

[KEIAHNY]

PR Type

Bug fix

---

Description

• Parse CPU ranges in max_cpu_usage_vec (e.g. 0-2)

• Apply 4x correction factor to defrag memcap

• Increase Suricata shutdown timeout to 300s

• Bump version to 1.1.0-dev.2, update docs

---

Diagram Walkthrough

flowchart LR
  A["cpu_affinity.rs"] -- "uses" --> B["yaml.rs public CPU parsers"]
  A -- "parses ranges in" --> C["max_cpu_usage_vec"]
  D["memory_usage.rs"] -- "applies 4x factor to" --> E["defrag memcap"]
  F["suricata.rs"] -- "extends" --> G["shutdown timeout 300s"]
  H["Cargo.toml / docs"] -- "bump version to" --> I["1.1.0-dev.2"]

Loading

File Walkthrough

	Relevant files
Bug fix	3 files cpu_affinity.rs Parse CPU ranges in max_cpu_usage_vec                                        +28/-4    memory_usage.rs Apply 4x correction factor to defrag memcap                            +1/-1      suricata.rs Increase Suricata shutdown timeout to 300s                              +1/-1
Enhancement	1 files yaml.rs Make CPU range parsing helpers public                                        +2/-2
Configuration changes	2 files Cargo.toml Bump version to 1.1.0-dev.2                                                            +1/-1      suriconf.yaml Bump version and use CPU range example                                      +2/-2
Documentation	2 files ISSUES.md Update known issues list                                                                  +3/-2      README.md Update version references to 1.1.0-dev.2                                  +6/-6

---

[github-actions]

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 2 🔵🔵⚪⚪⚪

🧪 No relevant tests

🔒 No security concerns identified

⚡ No major issues detected

[github-actions]

PR Code Suggestions ✨

Explore these optional code suggestions:

Category	Suggestion	Impact
General	Replace hardcoded magic multiplier with named constant *The hardcoded 4.0 multiplier silently alters the defrag memcap calculation with no explanation in the code. Extract it into a named constant (e.g., DEFRAG_MEMCAP_ADJUSTMENT) with a comment referencing the hotfix noted in ISSUES.md, so the rationale is discoverable and the value can be corrected in one place. src/memory_usage.rs [455] - hashsize*DEFRAG_TRACKER_HASHROW+(max_defrag_tracker_active+(self.get_ippair_host_defrag_stream_reassembly_prealloc(answers, &HashType::Defrag) as f64)*MULTIPLIER)*DEFRAG_TRACKER*4.0 + /// Hotfix multiplier for defrag memcap estimation; see ISSUES.md "Hotfix for defrag_memcap". + const DEFRAG_MEMCAP_ADJUSTMENT: f64 = 4.0; + hashsize*DEFRAG_TRACKER_HASHROW+(max_defrag_tracker_active+(self.get_ippair_host_defrag_stream_reassembly_prealloc(answers, &HashType::Defrag) as f64)*MULTIPLIER)*DEFRAG_TRACKER*DEFRAG_MEMCAP_ADJUSTMENT + Suggestion importance[1-10]: 4 __ Why: Extracting the unexplained *4.0 into a named constant with a reference to the ISSUES.md hotfix is a valid maintainability improvement for a change that silently alters the memcap calculation. However, it is purely stylistic and includes a doc comment, so the impact is moderate at best.	Low
	Reduce excessive process kill timeout Increasing the kill timeout from 30s to 300s means Suricata shutdown failures can now stall the whole workflow for 5 minutes. This looks like a leftover debugging value; a 10x increase is rarely justified for a process kill. Consider reverting to a more moderate timeout or making it configurable. src/suricata.rs [390-391] pub fn kill_suricata(child: &mut Child) { - let end_timeout = Duration::from_secs(300); + let end_timeout = Duration::from_secs(60); Suggestion importance[1-10]: 2 __ Why: The PR deliberately increases end_timeout from 30s to 300s, likely an intentional change for slow Suricata shutdowns. The suggestion speculates it is a leftover debugging value without evidence and proposes an arbitrary 60s alternative, offering only marginal improvement.	Low
	Add missing trailing newline to config The file still lacks a trailing newline, which produces noisy diffs and can trigger "no newline at end of file" warnings in editors and linters. Add a final newline after the max_cpu_usage_vec line to conform to standard text file conventions. suriconf.yaml [36-40] +variables: + interface: eth0 + capture_mode: af_packet # dpdk + max_memory_usage: 1 GiB + max_cpu_usage_vec: [0-2] # [0-6] - Suggestion importance[1-10]: 2 __ Why: The diff does not indicate that the file lacks a trailing newline, and the improved_code is effectively identical to existing_code, making the change unverifiable and trivially impactful.	Low

• Author self-review: I have reviewed the PR code suggestions, and addressed the relevant ones.

[KEIAHNY]

Closing - applying changes.