Conversation
so that future lua code can specify a direction
Since hooks, we do not need a specific SMTP buffer list id.
Ticket: 7605
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #13168 +/- ##
==========================================
- Coverage 83.08% 83.04% -0.04%
==========================================
Files 988 988
Lines 271850 271904 +54
==========================================
- Hits 225874 225811 -63
- Misses 45976 46093 +117
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
|
Information: QA ran without warnings. Pipeline 25997 |
|
Information: QA ran without warnings. Pipeline 25998 |
|
Some doc comments incomming, sorry |
jufajardini
left a comment
jufajardini
left a comment
There was a problem hiding this comment.
Two typos, one place where I feel the explanation isn't so clear, and a suggestion for post merge:
Once the SV test gets also merged, I think we could add a reference in the docs here to the test, as a place to find a working Lua script that uses ja3 functions
| end | ||
|
|
||
| ``ja3.enable_ja3()`` will not enable ja3 if they are explicitly | ||
| disabled, so you should add ``requires: feature ja3;`` to your rule. |
There was a problem hiding this comment.
nit: add reference to doc? https://docs.suricata.io/en/latest/rules/meta.html#requires
| For use in rule matching, the rule may **hook** into a TLS or QUIC | ||
| transaction state if you want to match on only one of these protocols. | ||
| Or you should use need ``ja3`` or ``ja3s`` in your init script:: |
There was a problem hiding this comment.
Could you clarify what hook means here? Are these rule hooks? If so, I suggest adding a reference to that. If something else, maybe we need rewording or a longer explanation? (or a pointer to where to find more info)
There was a problem hiding this comment.
Could you clarify what hook means here?
Not sure I can do it right, it comes from @jasonish doc about lua dns.
I am removing this as needs["ja3s"] = true looks more appropriate for ja3 lib
|
Staging incl this PR is already running, so will merge this and @jufajardini 's comments will have to be addressed in a follow up patch. |
|
Merged in #13179, thanks! |
5 participants
Link to ticket: https://redmine.openinfosecfoundation.org/issues/
https://redmine.openinfosecfoundation.org/issues/7605
Describe changes:
SV_BRANCH=OISF/suricata-verify#2482
#13158 with review taken into account