Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Detect generic uint 4112 v6 #7302

Closed
wants to merge 6 commits into from
Closed

Detect generic uint 4112 v6 #7302

wants to merge 6 commits into from

Conversation

catenacyber
Copy link
Contributor

Link to redmine ticket:
https://redmine.openinfosecfoundation.org/issues/4112

Describe changes:

  • Makes use of generic DetectUint structure for dsize and dcerpc, ttl, tcpmss, filesize (and template2)

Replaces #7170 with rebase to get better CI

Further work, but this PR can already be merged:

  • more keywords in C use specific versions, but they are more complex than just an integer
  • look for uses of set_uint in loggers to see if we can easily a new keywords
> git grep _LT src/*.h | grep DETEC
src/detect-ipproto.h:#define DETECT_IPPROTO_OP_LT     '<' /**< "less than" operator */
src/detect-iprep.h:#define DETECT_IPREP_OP_LT        0
src/detect-stream_size.h:#define DETECTSSIZE_LT 0
src/detect-tls-cert-validity.h:#define DETECT_TLS_VALIDITY_LT (1<<1) /* less than */
src/detect-urilen.h:#define DETECT_URILEN_LT   0   /**< "less than" operator */

@catenacyber
detect: rust generic functions for integers
45b82b9 
Ticket: 4112

Move it away from http2 to generic core crate.
And use it for DCERPC (and SMB)

And remove the C version.
Main change in API is the free function is not free itself, but
a rust wrapper around unbox.
@catenacyber
detect: use generic integer functions for dsize
1aacfe3 
Ticket: 4112
@catenacyber
detect: use generic integer functions for ttl
fab3e85 
Ticket: 4112
@catenacyber
detect: use generic integer functions for template2
c3e56da
@catenacyber
detect: use generic integer functions for tcp mss
94d19f3 
Ticket: 4112
@catenacyber
detect: use generic integer functions for filesize
20231e0 
Ticket: 4112
This was referenced Apr 25, 2022
Closed
Closed
@catenacyber
Copy link
Contributor Author

Needs OISF/suricata-verify#809 for CI to pass...

@catenacyber catenacyber mentioned this pull request Apr 25, 2022
Closed
@catenacyber
Copy link
Contributor Author

Replaced by #7305

zemeteri added a commit to zemeteri/suricata that referenced this pull request Oct 4, 2024
@zemeteri
conf: init parser after check with stat()
2cca563 
Commit changes are made to avoid possible memory leaks. If the parser
is initialized before configuration file checking, there was no deinit
call before function return. Do check config file existance and type
before YAML parser initialization, so we don't need to deinit parser
before exiting the function.

Bug: OISF#7302
zemeteri added a commit to zemeteri/suricata that referenced this pull request Oct 8, 2024
@zemeteri
conf: init parser after check with stat()
381334f 
Commit changes are made to avoid possible memory leaks. If the parser
is initialized before configuration file checking, there was no deinit
call before function return. Do check config file existance and type
before YAML parser initialization, so we don't need to deinit parser
before exiting the function.

Bug: OISF#7302
zemeteri added a commit to zemeteri/suricata that referenced this pull request Oct 10, 2024
@zemeteri
conf: init parser after check with stat()
e56667b 
Commit changes are made to avoid possible memory leaks. If the parser
is initialized before configuration file checking, there was no deinit
call before function return. Do check config file existance and type
before YAML parser initialization, so we don't need to deinit parser
before exiting the function.

Bug: OISF#7302
@zemeteri zemeteri mentioned this pull request Oct 10, 2024
Closed
victorjulien pushed a commit to victorjulien/suricata that referenced this pull request Oct 12, 2024
@zemeteri @victorjulien
conf: init parser after check with stat()
87e6e93 
Commit changes are made to avoid possible memory leaks. If the parser
is initialized before configuration file checking, there was no deinit
call before function return. Do check config file existance and type
before YAML parser initialization, so we don't need to deinit parser
before exiting the function.

Bug: OISF#7302
jufajardini pushed a commit to jufajardini/suricata that referenced this pull request Oct 21, 2024
@zemeteri @jufajardini
conf: init parser after check with stat()
931a2e5 
Commit changes are made to avoid possible memory leaks. If the parser
is initialized before configuration file checking, there was no deinit
call before function return. Do check config file existance and type
before YAML parser initialization, so we don't need to deinit parser
before exiting the function.

Bug: OISF#7302
(cherry picked from commit 87e6e93)
@jufajardini jufajardini mentioned this pull request Oct 21, 2024
Closed
victorjulien pushed a commit to victorjulien/suricata that referenced this pull request Oct 22, 2024
@zemeteri @victorjulien
conf: init parser after check with stat()
4f80cb5 
Commit changes are made to avoid possible memory leaks. If the parser
is initialized before configuration file checking, there was no deinit
call before function return. Do check config file existance and type
before YAML parser initialization, so we don't need to deinit parser
before exiting the function.

Bug: OISF#7302
(cherry picked from commit 87e6e93)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@victorjulien victorjulien Awaiting requested review from victorjulien victorjulien is a code owner

@jasonish jasonish Awaiting requested review from jasonish jasonish is a code owner

Assignees
No one assigned
Labels
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@catenacyber