Skip to content

Detect generic uint 4112 v9#7461

Closed
catenacyber wants to merge 8 commits intoOISF:masterfrom
catenacyber:detect-generic-uint-4112-v9
Closed

Detect generic uint 4112 v9#7461
catenacyber wants to merge 8 commits intoOISF:masterfrom
catenacyber:detect-generic-uint-4112-v9

Conversation

@catenacyber
Copy link
Contributor

Link to redmine ticket:
https://redmine.openinfosecfoundation.org/issues/4112
https://redmine.openinfosecfoundation.org/issues/2697

Describe changes:

  • Makes use of generic DetectUint structure for dsize and dcerpc, ttl, tcpmss, filesize, streamsize (and template2)
  • Uses pre filter for streamsize on the way

Replaces #7357 with rebase and adding S-V PR for missing keywords

Further work, but this PR can already be merged:

  • more keywords in C use specific versions, but they are more complex than just an integer
  • look for uses of set_uint in loggers to see if we can easily a new keywords
> git grep _LT src/*.h | grep DETEC
src/detect-ipproto.h:#define DETECT_IPPROTO_OP_LT     '<' /**< "less than" operator */
src/detect-iprep.h:#define DETECT_IPREP_OP_LT        0
src/detect-tls-cert-validity.h:#define DETECT_TLS_VALIDITY_LT (1<<1) /* less than */
src/detect-urilen.h:#define DETECT_URILEN_LT   0   /**< "less than" operator */

suricata-verify-pr: 839

Move it away from http2 to generic core crate.
And use it for DCERPC (and SMB)

And remove the C version.
Main change in API is the free function is not free itself, but
a rust wrapper around unbox.

Ticket: OISF#4112
By the way, adds the prefilter feature

Ticket: OISF#2697
Ticket: OISF#4112
So as not to recompile every C file inclusing rust.h
@codecov
Copy link

codecov bot commented Jun 1, 2022

Codecov Report

Merging #7461 (2448be5) into master (43d28f2) will decrease coverage by 0.06%.
The diff coverage is 75.10%.

@@            Coverage Diff             @@
##           master    #7461      +/-   ##
==========================================
- Coverage   75.88%   75.81%   -0.07%     
==========================================
  Files         657      655       -2     
  Lines      189473   188471    -1002     
==========================================
- Hits       143775   142892     -883     
+ Misses      45698    45579     -119     
Flag Coverage Δ
fuzzcorpus 60.24% <60.69%> (-0.36%) ⬇️
suricata-verify 52.30% <44.63%> (+0.32%) ⬆️
unittests 60.89% <54.00%> (-0.01%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

@suricata-qa
Copy link

ERROR:

ERROR: QA failed on tlpw1_files_sha256.

ERROR: QA failed on tlpr1_alerts_cmp.

Pipeline 7634

@victorjulien victorjulien mentioned this pull request Jun 2, 2022
@victorjulien
Copy link
Member

Merged in #7467, thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

3 participants