Flow bytes pkts syntax/v7 #12206
Flow bytes pkts syntax/v7 #12206
Conversation
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #12206 +/- ##
========================================
Coverage 83.17% 83.17%
========================================
Files 912 912
Lines 257111 257242 +131
========================================
+ Hits 213856 213968 +112
- Misses 43255 43274 +19
Flags with carried forward coverage won't be shown. Click here to find out more. |
Currently, the syntax includes direction as a part of the keyword which is against how usually keywords are done. By making direction as a mandatory argument, it is possible to make the syntax cleaner and the implementation more compact and easily extendable. Pros: - Registration table sees lesser entries - If the options have to be extended, it can be done trivially - In accordance w existing keyword implementations Note that this commit also retains the existing direction specific keywords.
For flow.bytes and flow.pkts keywords, allow matching in either direction. Feature 5646
inashivb
force-pushed
the
flow-bytes-pkts-syntax/v7
branch
from
0e3cb2b to
5320e79
Compare
|
Information: QA ran without warnings. Pipeline 23663 |
|
|
||
| Signature example:: | ||
|
|
||
| alert ip any any -> any any (msg:"Flow has 20 packets"; flow.pkts_toserver:20; sid:1;) | ||
|
|
||
| flow.bytes_toclient |
There was a problem hiding this comment.
I guess doc should not be removed if the keyword still exist
You can just have a quick mention of it saying it has the same behavior as flow.bytes: toclient,
There was a problem hiding this comment.
ok. My idea of removing the doc for old syntax was to increase adaptation of the new syntax only. Old syntax is for backwards compatibility so the existing rulesets using it do not break and that's it. Lmk wdyt?
There was a problem hiding this comment.
@jufajardini thoughts ?
I see base64_decode doc has a sentence : We recommend using the base64 transform instead
Previous PR: #12199
Redmine ticket: https://redmine.openinfosecfoundation.org/issues/5646
SV_BRANCH=OISF/suricata-verify#2145
Changes since v6: