Skip to content

Detect generic uint 4112 v8#7357

Closed
catenacyber wants to merge 8 commits intoOISF:masterfrom
catenacyber:detect-generic-uint-4112-v8
Closed

Detect generic uint 4112 v8#7357
catenacyber wants to merge 8 commits intoOISF:masterfrom
catenacyber:detect-generic-uint-4112-v8

Conversation

@catenacyber
Copy link
Contributor

@catenacyber catenacyber commented May 2, 2022

Link to redmine ticket:
https://redmine.openinfosecfoundation.org/issues/4112
https://redmine.openinfosecfoundation.org/issues/2697

Describe changes:

  • Makes use of generic DetectUint structure for dsize and dcerpc, ttl, tcpmss, filesize, streamsize (and template2)
  • Uses pre filter for streamsize on the way

Replaces #7305 with rebase and commit rewording

Further work, but this PR can already be merged:

  • more keywords in C use specific versions, but they are more complex than just an integer
  • look for uses of set_uint in loggers to see if we can easily a new keywords
> git grep _LT src/*.h | grep DETEC
src/detect-ipproto.h:#define DETECT_IPPROTO_OP_LT     '<' /**< "less than" operator */
src/detect-iprep.h:#define DETECT_IPREP_OP_LT        0
src/detect-tls-cert-validity.h:#define DETECT_TLS_VALIDITY_LT (1<<1) /* less than */
src/detect-urilen.h:#define DETECT_URILEN_LT   0   /**< "less than" operator */

suricata-verify-pr: 809

catenacyber added 8 commits May 2, 2022 14:16
@catenacyber
detect: rust generic functions for integers
8080dc4 
Move it away from http2 to generic core crate.
And use it for DCERPC (and SMB)

And remove the C version.
Main change in API is the free function is not free itself, but
a rust wrapper around unbox.

Ticket: OISF#4112
@catenacyber
detect: use generic integer functions for dsize
566a124 
Ticket: OISF#4112
@catenacyber
detect: use generic integer functions for ttl
c6826f8 
Ticket: OISF#4112
@catenacyber
detect: use generic integer functions for template2
4f5aeb3
@catenacyber
detect: use generic integer functions for tcp mss
3df3440 
Ticket: OISF#4112
@catenacyber
detect: use generic integer functions for filesize
204bbee 
Ticket: OISF#4112
@catenacyber
detect: use generic integer functions for streamsize
dacdd7f 
By the way, adds the prefilter feature

Ticket: OISF#2697
Ticket: OISF#4112
@catenacyber
rust: cbindgen first verifies existing bindings
791c624 
So as not to recompile every C file inclusing rust.h
@catenacyber catenacyber requested review from a team, jasonish and victorjulien as code owners May 2, 2022 13:08
@catenacyber catenacyber mentioned this pull request May 2, 2022
Closed
@suricata-qa
Copy link

suricata-qa commented May 8, 2022

ERROR:

ERROR: QA failed on tlpw1_files_sha256.

field test baseline %
tlpr1_stats_chk
.app_layer.error.ftp-data.parser 0 395 0.0%

Pipeline 7355

@victorjulien victorjulien self-assigned this May 17, 2022
@victorjulien victorjulien mentioned this pull request Jun 1, 2022
Merged
@victorjulien
Copy link
Member

victorjulien commented Jun 1, 2022

Can we have SV tests for each of the keywords, at least for those we don't have any tests for?

@catenacyber
Copy link
Contributor Author

catenacyber commented Jun 1, 2022

So :

  • dsize : S-V tests exist cf git grep dsize | grep test.rules
  • ttl: S-V tests exist
  • template2 : irrelevant I think
  • tcp.mss: S-V tests exist
  • dcerpc : S-V tests exist
  • filesize: TODO
  • streamsize: TODO

Does that look good to you ?

@catenacyber catenacyber mentioned this pull request Jun 1, 2022
Closed
@catenacyber
Copy link
Contributor Author

catenacyber commented Jun 1, 2022

Replaced by #7461

@catenacyber catenacyber closed this Jun 1, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@victorjulien victorjulien Awaiting requested review from victorjulien

@jasonish jasonish Awaiting requested review from jasonish

Assignees

@victorjulien victorjulien

Labels

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@catenacyber @suricata-qa @victorjulien