Backports/708/v1 #12263
Backports/708/v1 #12263
Conversation
Ticket: 7199 Uses a config parameter detect.guess-applayer-tx to enable this behavior (off by default) This feature is requested for use cases with signatures not using app-layer keywords but still targetting application layer transactions, such as pass/drop rule combination, or lua usage. This overrides the previous behavior of checking if the signature has a content match, by checking if there is only one live transaction, in addition to the config parameter being set. (cherry picked from commit f2c3776)
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main-7.0.x #12263 +/- ##
==============================================
- Coverage 83.19% 83.19% -0.01%
==============================================
Files 922 922
Lines 260888 260898 +10
==============================================
- Hits 217048 217043 -5
- Misses 43840 43855 +15
Flags with carried forward coverage won't be shown. Click here to find out more. |
|
And more important, SV testing does not include bug-7199 |
|
I think that second commit needs more of a description in it as its not consistent with whats being backported. |
|
w/o it we break tests, this indicates a regression. The commit fixes the regression. |
The `guess-applayer-tx` work also removed the stream match condition for adding app-layer metadata to alerts. This is a behavior change that is not desired at this point, so this commit reverts that part of the changes. We keep the exising logging of app-layer metadata if the match was in the stream.
victorjulien
force-pushed
the
backports/708/v1
branch
from
05ff25a to
f5322d2
Compare
|
It appears this change of behaviour is not address in the upgrade guide, should it be something for the upgrade guide in master? |
Is that about the live transactions? If yes, #12266 adds that, but Victor want the docs for post-merge of the staging branch |
I think he meant post merge of #12259 and before release |
|
replaced by #12267 |
Need the stream addition to make SV pass (task-7018-* tests)
SV_BRANCH=OISF/suricata-verify#2178