-
Notifications
You must be signed in to change notification settings - Fork 1.5k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Flow bytes pkts syntax/v5 #12180
Flow bytes pkts syntax/v5 #12180
Conversation
Currently, the syntax includes direction as a part of the keyword which is against how usually keywords are done. By making direction as a mandatory argument, it is possible to make the syntax cleaner and the implementation more compact and easily extendable. Pros: - Registration table sees lesser entries - If the options have to be extended, it can be done trivially - In accordance w existing keyword implementations Note that this commit also retains the existing direction specific keywords.
For flow.bytes and flow.pkts keywords, allow matching in either direction. Feature 5646
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #12180 +/- ##
==========================================
+ Coverage 49.75% 49.97% +0.21%
==========================================
Files 912 912
Lines 257055 257169 +114
==========================================
+ Hits 127895 128516 +621
+ Misses 129160 128653 -507
Flags with carried forward coverage won't be shown. Click here to find out more. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Think this is looking pretty good. Some comments inline.
return -1; | ||
char copy[strlen(rawstr) + 1]; |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
this is a common pattern in our parser, but wonder if we should replace it by a heap allocation? SCStrdup
. @catenacyber input size is limited by max rule size, and perhaps other limits. Any thoughts?
Information: QA ran without warnings. Pipeline 23602 |
Previous PR: #11897
Redmine ticket: https://redmine.openinfosecfoundation.org/issues/5646
SV_BRANCH=OISF/suricata-verify#2145
Changes since v4:
flow.bytes:<dir>,<op><num>
andflow.pkts..
flow.bytes_toserver
and friends