Skip to content

Detect integers 6644 v12#10234

Closed
catenacyber wants to merge 5 commits intoOISF:masterfrom
catenacyber:detect-integers-6644-v12
Closed

Detect integers 6644 v12#10234
catenacyber wants to merge 5 commits intoOISF:masterfrom
catenacyber:detect-integers-6644-v12

Conversation

@catenacyber
Copy link
Contributor

Link to redmine ticket:
https://redmine.openinfosecfoundation.org/issues/6644 and all subtickets
https://redmine.openinfosecfoundation.org/issues/6645
https://redmine.openinfosecfoundation.org/issues/6646
https://redmine.openinfosecfoundation.org/issues/6647
https://redmine.openinfosecfoundation.org/issues/6648
https://redmine.openinfosecfoundation.org/issues/6628

Describe changes:

  • detect/integers: support hexadecimal notation for parsing
  • detect/integers: add mode for negated range
  • detect/integers: rust derive for enumerations
  • detect/integers: keywords now accept bitmasks
  • doc: detect/integers

#10222 with typo fixed in doc

catenacyber and others added 5 commits January 22, 2024 20:28
So that we can write enip.revision: 0x203

Ticket: 6645
Ticket: 6647

Allows keywords using integers to use strings in signature
parsing based on a rust enumeration with a derive.
Ticket: 6648

Like &0x40=0x40 to test for a specific bit set
Ticket: 6628

Document the generic detection capabilities for integer keywords.
and make every integer keyword pointing to this section.
@suricata-qa
Copy link

Information:

ERROR: QA failed on SURI_TLPW1_files_sha256.

field baseline test %
SURI_TLPR1_stats_chk
.app_layer.error.http.parser 1108 724 65.34%

Pipeline 17729

@catenacyber
Copy link
Contributor Author

Why is CI using libhtp 0.5.45 and not 0.5.x ?

@jasonish
Copy link
Member

Why is CI using libhtp 0.5.45 and not 0.5.x ?

CI uses scripts/bundle.sh which uses requirements.txt for repeatable builds in and out of CI. requirements.txt hasn't been updated since the 7.0.0 release it looks like.


DHCP lease time (integer).

dhcp.leasetime uses an :ref:`unsigned 64-bits integer <rules-integer-keywords>`.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

64-bits or 64-bit?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Without an s if I believe

16-bit integers are those that are 16 bits (2 octets) wide.

Fixing that


/// Enum trait that will be implemented on enums that
/// derive StringEnum.
pub trait Enum<T> {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would EnumString be a better name?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

indeed

@catenacyber
Copy link
Contributor Author

Replaced by #10241

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

3 participants