Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

next/661/70x/20241207/v1 #12244

Merged
merged 6 commits into from
Dec 9, 2024
Merged

next/661/70x/20241207/v1 #12244

merged 6 commits into from
Dec 9, 2024

Conversation

victorjulien
Copy link
Member

jasonish and others added 6 commits December 7, 2024 07:18
@jasonish @victorjulien
requires: treat unknown requires keywords as unmet requirements
eac4854 
For example, "requires: foo bar" is an unknown requirement, however
its not tracked, nor an error as it follows the syntax. Instead,
record these unknown keywords, and fail the requirements check if any
are present.

A future version of Suricata may have new requires keywords, for
example a check for keywords.

Ticket: OISF#7418
(cherry picked from commit 820a3e5)
@jasonish @victorjulien
requires: add option to ignore unknown requirements
ccc61f6 
The new behavior in 8, and backported is to treat unknown requirements
as unsatisfied requirements.

For 7.0.8, add a configuration option, "ignore-unknown-requirements"
to completely ignore unknown requirements, effectively treating them
as available.

Ticket: OISF#7434
@victorjulien
detect: fix decoder only events
a8f3580 
Add missing setup part of the decoder event sgh.

Bug: OISF#7414.
(cherry picked from commit b23fa51)
@victorjulien
eve/alert: enrich decoder event
96d1dd9 
Default decoder event alert was very sparse, not even logging packet
type and pcap_cnt. Expand support for this record type. It will be more
useful with the ethernet headers and packet field, but these are still
disabled by default.

Ticket: OISF#7433.
(cherry picked from commit 2fe2cf8)
@jufajardini @victorjulien
flowint: add isnotset support
cbc0aa5 
Similar keywords use `isnotset`, while `flowint` only accepted `notset`
Opted to change the code, not only the regex, to keep the underlying
code also following the same patterns.

Task OISF#7426

(cherry picked from commit 6e4a501)
@jufajardini @victorjulien
detect/flowing: apply clang format changes
9be2eca 
Related to
Task OISF#7426
@codecov Codecov
Copy link

codecov bot commented Dec 7, 2024 •
edited
Loading

Codecov Report

Attention: Patch coverage is 97.64706% with 2 lines in your changes missing coverage. Please review.

Project coverage is 83.19%. Comparing base (825eadf) to head (9be2eca).
Report is 6 commits behind head on main-7.0.x.

Additional details and impacted files 
@@              Coverage Diff               @@
##           main-7.0.x   #12244      +/-   ##
==============================================
+ Coverage       83.17%   83.19%   +0.01%     
==============================================
  Files             922      922              
  Lines          260858   260888      +30     
==============================================
+ Hits           216979   217048      +69     
+ Misses          43879    43840      -39
Flag Coverage Δ
fuzzcorpus 64.19% <90.69%> (+0.03%) ⬆️
suricata-verify 63.39% <95.34%> (-0.01%) ⬇️
unittests 62.37% <74.11%> (-0.01%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

@suricata-qa
Copy link

Information: QA ran without warnings.

Pipeline 23721

inashivb
inashivb approved these changes Dec 9, 2024
View reviewed changes
Copy link
Member

@inashivb inashivb left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 🚀

@victorjulien victorjulien merged commit 9be2eca into OISF:main-7.0.x Dec 9, 2024
45 checks passed
This was referenced Dec 9, 2024
Closed
Closed
Closed
@victorjulien victorjulien deleted the next/661/70x/20241207/v1 branch December 9, 2024 06:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@inashivb inashivb inashivb approved these changes

@jasonish jasonish Awaiting requested review from jasonish jasonish is a code owner

@jufajardini jufajardini Awaiting requested review from jufajardini jufajardini is a code owner

Assignees
No one assigned
Labels
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
5 participants
@victorjulien @suricata-qa @inashivb @jasonish @jufajardini