detect/sip: add sticky buffers to match headers v2#10907
detect/sip: add sticky buffers to match headers v2#10907glongo wants to merge 11 commits intoOISF:masterfrom
Conversation
glongo
requested review from
jasonish,
jufajardini and
victorjulien
as code owners
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #10907 +/- ##
==========================================
+ Coverage 77.64% 82.84% +5.20%
==========================================
Files 922 930 +8
Lines 247806 247976 +170
==========================================
+ Hits 192400 205440 +13040
+ Misses 55406 42536 -12870
Flags with carried forward coverage won't be shown. Click here to find out more. |
| - Stats counters that are 0 can now be hidden from EVE logs. Default behavior | ||
| still logs those (see :ref:`EVE Output - Stats <eve-json-output-stats>` for configuration setting). | ||
| - The following sticky buffers for matching SIP headers have been implemented: | ||
| - sip.via |
There was a problem hiding this comment.
It looks like these miss in doc/userguide/rules/sip-keywords.rst ;-)
| pub version: String, | ||
| pub code: String, | ||
| pub reason: String, | ||
| pub headers: HashMap<String, String>, |
There was a problem hiding this comment.
What happens if I have multiple via headers ?
There was a problem hiding this comment.
The value is updated and the old one is returned.
catenacyber
left a comment
catenacyber
left a comment
There was a problem hiding this comment.
Thanks Giuseppe, will need at least a rebase, and doc update for these new keywords
|
Also for your info, you can take a look at #10966 |
|
Replaced with #11004 |
3 participants
Make sure these boxes are signed before submitting your Pull Request -- thank you.
https://docs.suricata.io/en/latest/devguide/contributing/contribution-process.html
https://suricata.io/about/contribution-agreement/ (note: this is only required once)
Link to redmine ticket:
https://redmine.openinfosecfoundation.org/issues/6374
Describe changes:
SV_BRANCH=OISF/suricata-verify#1787