-
Notifications
You must be signed in to change notification settings - Fork 1.4k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
detect: absent keyword to test absence of sticky buffer #11423
detect: absent keyword to test absence of sticky buffer #11423
Conversation
THashInitConfig may not allocate array and increase memuse. Such a failure leads to THashShutdown which should not decrease the memuse. Ticket: 7135
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #11423 +/- ##
========================================
Coverage 82.44% 82.45%
========================================
Files 938 938
Lines 248086 248230 +144
========================================
+ Hits 204534 204669 +135
- Misses 43552 43561 +9
Flags with carried forward coverage won't be shown. Click here to find out more. |
Draft to check CI with fixup commit |
Ticket: 2224 It takes an argument to match only if the buffer is absent, or it can still match if the buffer is present, but we test the absence of some content
2becf58
to
08038bd
Compare
Information: QA ran without warnings. Pipeline 21385 |
I think there's a new different failure w the fuzz job. Your PR seems to be doing well. |
Rebased in #11459 |
Link to redmine ticket:
https://redmine.openinfosecfoundation.org/issues/2224
Describe changes:
absent
keyword to match on absent bufferSV_BRANCH=OISF/suricata-verify#1957
#11375 with newer tests, some engine analysis, and ability to express "if there is no user agent, or if it exists and is XYZ, then match"