Skip to content

detect: factorize code for DetectSetupDirection #13123

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed

Conversation

catenacyber
Copy link
Contributor

Link to ticket: https://redmine.openinfosecfoundation.org/issues/
https://redmine.openinfosecfoundation.org/issues/7665

Describe changes:

  • detect: transactional rules allow filesize keyword

This means adding facility to allow non-sticky buffer keywords

  • Moving DetectSetupDirection call site to SigParseOptions instead of in each keyword and use a new flag SIGMATCH_SUPPORT_DIR
  • DetectSetupDirection now takes a pointer to a string, and may move the string forward to allow filesize: to_client, >100; so that DetectFilesizeSetup gets called with ">100"
  • SigMatchAppendSMToList now sets only_tc and only_ts as DetectBufferSetActiveList already does

(3 commits may be better but debugging, I ended up squashing everything)

Now making transactional rules support other direction-ambiguous keywords should be one-liner like adding SIGMATCH_SUPPORT_DIR to sigmatch_table[DETECT_KEYWORD].flags

SV_BRANCH=OISF/suricata-verify#2453

#13120 with cast like str = (char *)"to_client_toto"; in unit tests to fix compile without warnings

Ticket: 7665

Instead of each keyword calling DetectSetupDirection, use a
new flag SIGMATCH_SUPPORT_DIR so that DetectSetupDirection gets
called, before parsing the rest of the keyword.

Allows to support filesize keyword in transactional signatures
Copy link

codecov bot commented Apr 30, 2025

Codecov Report

Attention: Patch coverage is 87.27273% with 14 lines in your changes missing coverage. Please review.

Project coverage is 83.04%. Comparing base (22abad7) to head (bfe4678).
Report is 61 commits behind head on master.

Additional details and impacted files
@@           Coverage Diff           @@
##           master   #13123   +/-   ##
=======================================
  Coverage   83.04%   83.04%           
=======================================
  Files         987      987           
  Lines      271868   271938   +70     
=======================================
+ Hits       225764   225835   +71     
+ Misses      46104    46103    -1     
Flag Coverage Δ
fuzzcorpus 61.39% <37.31%> (-0.01%) ⬇️
livemode 18.96% <20.89%> (+<0.01%) ⬆️
pcap 44.78% <20.89%> (-0.02%) ⬇️
suricata-verify 64.75% <56.71%> (-0.02%) ⬇️
unittests 58.23% <82.72%> (+0.01%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@suricata-qa
Copy link

WARNING:

field baseline test %
SURI_TLPR1_stats_chk
.uptime 627 652 103.99%

Pipeline 25945

@victorjulien victorjulien added this to the 8.0 milestone May 7, 2025
@victorjulien
Copy link
Member

Merged in #13179, thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

Successfully merging this pull request may close these issues.

3 participants