Skip to content

Feature/flow community id/v18#3504

Closed
victorjulien wants to merge 15 commits intoOISF:masterfrom
victorjulien:feature/flow-community-id/v18
Closed

Feature/flow community id/v18#3504
victorjulien wants to merge 15 commits intoOISF:masterfrom
victorjulien:feature/flow-community-id/v18

Conversation

@victorjulien
Copy link
Member

If we missed the tree connect we can't know for sure if we're
reading from a (DCERPC) PIPE or not. In this case probe the data
to see if it looks like DCERPC.

If the detection succeeds, use a special 'suricata::dcerpc' service
in the TX.

Simplify handling of DCERPC records that cross records

Update logging for the response only TXs.
Remove 'experimental' label for Rust, and enable it by default if
rustc and cargo (and libjansson) are available.

Add rustc and cargo versions to the build-info.
Don't allocate an output buffer for each call. These buffers
would have the exact same size every time.
Add simple helper funcs for option-less loggers
Add support for community flow id, meant to give a records a
predictable flow id that can be used to match records to
output of other tools.

Takes a 'seed' that needs to be same across sensors and tools
to make the id less predictable.
@victorjulien victorjulien requested review from a team and jasonish as code owners October 10, 2018 08:44
@victorjulien
Copy link
Member Author

@regit fixed the ICMP issue

@victorjulien
Copy link
Member Author

Replaced by #3506

@victorjulien victorjulien deleted the feature/flow-community-id/v18 branch October 15, 2018 06:31
amirabell pushed a commit to amirabell/suricata that referenced this pull request Jun 16, 2020
This changeset fixes a bug on the computation of the buffer
lenght for raw http headers. The bug is due to a mismatch
on the data type of the length (uint8_t vs uint32_t) and it
was causing signature misses.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

1 participant