Skip to content

Comments

Detect dynamic register keywords 4683 v4#11036

Closed
catenacyber wants to merge 10 commits intoOISF:masterfrom
catenacyber:detect-dynamic-register-keywords-4683-v4
Closed

Detect dynamic register keywords 4683 v4#11036
catenacyber wants to merge 10 commits intoOISF:masterfrom
catenacyber:detect-dynamic-register-keywords-4683-v4

Conversation

@catenacyber
Copy link
Contributor

Link to redmine ticket:
https://redmine.openinfosecfoundation.org/issues/4683

Describe changes:

  • build: fix fuzz dependencies, and dpdk
  • detect: helper to have pure rust keywords
  • make keywords registration dynamic
  • detect/snmp: move keywords to rust
  • snmp.pdu_type use a generic uint32 for detection, allowing >2 and such
  • detect/dhcp: move keywords to rust
  • detect/websocket: move keywords to rust

Continuation of #9871 after merge of #10819

After the merge of loggers, pure rust plugins will need pure rust keywords.
The plan is to do this for all rust app-layers, now only done for 3 protocols, which has both integers and buffers as keywords.

#11035 which should be green CI, plus DHCP and websocket

This is done on top of #11033 commits to get green CI

As this triggers rustc 1.78
unsafe precondition(s) violated: slice::from_raw_parts requires
the pointer to be aligned and non-null,
and the total size of the slice not to exceed `isize::MAX`
If the flow begins with a gap, do not try run probing parsers
to recognize app-layer on it, as they have no data.
So that there is no need to remove the final binary, to recompile
it if there has been changes in the code.
detect: make number of keywords dynamic

Ticket: 4683
Ticket: 4863

On the way, convert unit test DetectSNMPCommunityTest to a SV test.

And also, make snmp.pdu_type use a generic uint32 for detection,
allowing operators, instead of just equality.
@suricata-qa
Copy link

Information: QA ran without warnings.

Pipeline 20534

@catenacyber
Copy link
Contributor Author

Rebased in #11068

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

2 participants